Quantum Network Architectures
A quantum network architecture specifies how separated quantum nodes turn unreliable physical interactions into services that applications can request, identify, coordinate, consume, and verify. The physical carriers may be photons, transported matter, microwave excitations, or combinations of them. The requested service may be a measured correlation, a stored Bell pair, a multipartite state, a remote operation, a secret key, or a synchronized quantum-enhanced estimate. Architecture begins where a successful laboratory interaction must become a dependable shared resource.
The central architectural fact is that an entangled pair is neither a packet nor a permanent wire. It is a fragile, stateful resource tied to two endpoint memories, a preparation history, a reference frame, a quality estimate, and a deadline. Its unknown quantum payload cannot be read as a routing header, copied into a queue, or retransmitted after an unknown payload has been destroyed. Classical messages must therefore identify and coordinate the quantum resource from outside it.
The aim is to connect three questions: what state an application needs, which physical operations can create it, and how classical control keeps track of it before it expires. Protocol layers help organize these responsibilities, but they are design choices rather than a unique law of quantum mechanics.
Required background. Quantum communication describes channel tasks, swapping connects pairs, and repeaters explains stochastic link preparation and memory waiting. Memory hardware supplies the storage channels.
Quantum resources an application can request
Section titled “Quantum resources an application can request”A request for a shared state must specify endpoints, target or known frame, quality requirement, timing and whether the qubits must remain available. Ten pairs delivered one at a time and ten pairs held simultaneously can impose very different memory demands. A cryptographic application must additionally specify which devices and intermediate nodes are trusted.
The service type determines when control returns to the application and what the network may do internally.
| Service | Delivered object | Endpoint action |
|---|---|---|
| Measure directly | correlated classical outcomes | choose or receive measurement settings |
| Create and keep | identified stored qubits | preserve them until use |
| Remote preparation | state at one endpoint | track a known correction |
| Logical entanglement | encoded pair | maintain code and decoder state |
| Multipartite resource | GHZ or graph state | coordinate all participants |
A request for “one Bell pair” remains incomplete unless it states whether the pair may be measured immediately, must remain available for a later application trigger, or is only a precursor to a logical pair. The resources and latency distributions can differ by orders of magnitude.
Classical retransmission also needs a careful quantum translation. A network may retry resource generation before the application supplies an unknown state. Once that state has been consumed in a teleportation or remote-gate attempt, the network cannot recover it by replaying a lost quantum packet. Recovery must instead follow the protocol’s declared semantics: preserve the input until a herald, use an encoded fault-tolerant operation, abort the transaction, or repeat at the application level when the input is reproducible.
Four Graphs, Not One
Section titled “Four Graphs, Not One”One drawing of nodes and lines hides several independently changing structures. At minimum, distinguish four graphs.
- The physical quantum graph records available fibers, free-space channels, local couplers, sources, detectors, memories, and transducers.
- The classical-control graph records channels for heralds, requests, timing, corrections, authentication, and telemetry.
- The entanglement graph records the usable shared states that exist at time .
- The trust and policy graph records permitted operators, policy, credential, disclosure, and fault-containment boundaries.
These graphs need not have the same edges. Two nodes can exchange classical messages without a direct quantum channel. A physical quantum edge can exist while no entangled pair is currently stored. Entanglement swapping can create an overlay edge between nodes that have never exchanged a photon directly. Conversely, policy can forbid a technically available path from crossing an administrative boundary.
A stored pair needs identifiers for both endpoint memory slots, the known correction frame, its age and a justified quality estimate. The classical identifier does not contain the quantum state; it tells the controller which physical systems share it. A classical header can accompany quantum carriers in another mode or channel, but reading the unknown encoded payload is not a way to discover its route.
At the overlay level, swapping at is a stateful graph rewrite,
conditioned on a valid outcome and frame update. The two input records become consumed; the new record inherits a preparation history and a new quality and expiry estimate. The Entanglement Swapping article derives the state identity. Architecturally, the important point is preventing double use: applications must not receive an input pair after a swap has consumed it. The physical measurement is irreversible; a failed classical database update cannot restore those qubits.
A Provisional Architecture Stack
Section titled “A Provisional Architecture Stack”There is no universally adopted quantum-network stack equivalent to the mature Internet protocol suite. Research stacks and standards-oriented documents make different layer boundaries because hardware capabilities and application requirements are still evolving. The following decomposition is an enduring reasoning tool, not a claim that every system must expose five named layers.
The physical path and current shared states are different graphs. Before the swap, holds one qubit from each pair. A Bell measurement consumes both of those qubits; after its outcome is recorded, the surviving endpoint qubits form an – pair up to a known correction. The two old pairs are no longer available. Fibers need not change when entanglement connectivity changes.
Physical and interface layer
Section titled “Physical and interface layer”This layer performs physical attempts: emission, frequency and temporal modes, channel access, interference, detection, heralding signals, local gates, and hardware calibration. Its output is not merely “a click.” The resulting signal must identify the event actually certified, including false-herald probability, mode identity, timing, and device state. Transduction belongs at an interface boundary when carriers or encodings differ.
Link layer
Section titled “Link layer”The link layer turns repeated physical attempts into a robust service between neighbors. Dahlberg et al. (2019) developed link-layer requests containing a remote node, number of pairs, minimum fidelity, timeout, and delivery semantics such as create-and-keep, measure-directly, or remote state preparation. It assigns pair identifiers consistently at both ends, manages finite memory, and reports success or failure to higher layers. This is the nearest quantum analogue of turning a fallible physical medium into a usable local service, but it still delivers stateful resources rather than packets.
Network or entanglement layer
Section titled “Network or entanglement layer”This layer selects paths or subgraphs, reserves resources, coordinates link generation, schedules swaps or graph-state measurements, and returns an end-to-end state with provenance and frame information. Routing cannot be separated cleanly from resource creation: the chosen route changes memory waiting, contention, fidelity, and success probability.
Transport or session layer
Section titled “Transport or session layer”Some proposals add a layer that coordinates a longer-lived application session, admission control, reliability semantics, congestion response, ordered delivery of resource records, or a stream of entangled states. The name “transport” must not imply transparent retransmission of unknown quantum payloads. In small networks these functions may remain in the application or network layer.
Application and runtime layer
Section titled “Application and runtime layer”The application requests quantum resources and combines them with local operations and classical computation. A runtime maps high-level programs onto node instructions, waits for network events, handles measurement outcomes, and enforces the application’s causal order. NetQASM (Dahlberg et al., 2022) illustrates this boundary between a hybrid program and node instructions. A portable instruction interface still requires hardware-specific implementations and capability checks.
The layer interfaces should state semantics, not just message formats. A successful return must say what exists, where it exists, how it is identified, what quality has been established or estimated, how long it remains valid, and which corrections or frames remain outstanding.
Classical control while quantum states wait
Section titled “Classical control while quantum states wait”Classical messages carry heralds, pair identifiers, Bell outcomes, requests and authentication information. Controllers choose routes and reserve memories; device configuration and calibration set the conditions under which those choices remain valid. These functions can share physical equipment without having the same timing or trust requirements.
A known Pauli correction can often be tracked in software instead of applied immediately, but the consuming operation must interpret it correctly. Some Clifford operations can proceed with an unresolved frame and update it later; a dependent non-Clifford measurement may need the classical information first. “Every message must arrive before any quantum operation” is therefore too strong, while ignoring all feed-forward delay is equally incorrect.
Clock uncertainty matters when checking pair age and operation deadlines. A timestamp needs a clock domain and a bound on its error relative to the controller’s clock. Time spent waiting for an acknowledgement also occupies memory, even when the stored state was prepared earlier.
Topology Families
Section titled “Topology Families”Topology should be chosen for the service and failure model, not for visual symmetry. Several families recur.
| Family | Architectural strength | Characteristic bottleneck or risk |
|---|---|---|
| Point-to-point link | Minimal control and calibration surface | No alternate path; loss grows with distance |
| Switched star or hub | Efficient sharing of expensive sources or detectors | Hub contention and correlated failure |
| Repeater chain | Extends distance with local elementary links | Synchronization, memory aging, and serial cut capacity |
| Mesh | Alternate routes and concurrent demands | Routing state, resource fragmentation, and control overhead |
| Photonic graph-state fabric | Measurement can reshape connectivity | Large source, switching, loss, and feed-forward demands |
| Satellite–ground hybrid | Bypasses long terrestrial attenuation segments | Weather, pointing, daylight background, contact windows, trusted-node choices |
Point-to-point and switched networks
Section titled “Point-to-point and switched networks”A direct link is appropriate when two endpoints dominate the workload or when the experiment is characterizing one interface. A passive optical switch can connect different endpoint pairs over time without becoming a quantum repeater. It changes the physical path but does not, by itself, store adjacent entangled links and join them by entanglement swapping. Similarly, a trusted QKD relay can extend a classical key-management service while learning or handling key material; it is not an untrusted end-to-end entanglement path.
Chains and meshes
Section titled “Chains and meshes”A chain minimizes path choice but exposes the slowest cut: every end-to-end resource needs all required segments and intermediate operations. A mesh can route around failures and exploit parallel paths, yet alternative routes compete for memories, photons, detector time, and swaps. The entanglement overlay can be much denser or sparser than the physical mesh at a particular instant.
Multipartite and graph-state fabrics
Section titled “Multipartite and graph-state fabrics”Not every network should first create independent Bell pairs. A source may distribute a multipartite state, or nodes may fuse photonic graph fragments whose measurement pattern realizes routing and computation. The description must then identify a hyperedge or graph-state resource, not force it into pairwise edges that discard useful correlations.
Free-space and satellite links
Section titled “Free-space and satellite links”Free-space links add moving geometry, atmospheric loss, turbulence, pointing, background light, and intermittent contact. A satellite may be a trusted source or relay, an entangled-pair source with photons sent to two ground stations, or part of a future memory-assisted architecture. These roles have different security claims. Orbit and contact-window scheduling also couple network planning to time more strongly than in a fixed terrestrial graph.
Routing Is Resource Creation
Section titled “Routing Is Resource Creation”Classical routing usually chooses where an already formed packet should go. Entanglement routing chooses where probabilistic resources should be created and how they should be combined before they decohere. Path selection, scheduling and memory allocation are therefore coupled. Pant et al. (2019) study how routing policies exploit probabilistically generated entanglement.
For a simple path whose elementary attempts and swaps are treated as independent simultaneous events, a crude success surrogate is
where is link success and is swap success at an internal node. Then gives an additive link weight. This model can rank paths only under its assumptions. It is generally not an end-to-end rate because memories preserve early successes, attempts have unequal durations, cutoffs discard old pairs, operations contend for hardware, and fidelity changes with age and swapping.
Attempt duration, available modes, memory age, local swap success, current queues and the required output fidelity all influence a route. Two paths with the same loss can have different useful rates because one has a slow heralding loop or a heavily shared detector.
For example, with perfect memories and instantaneous deterministic swaps, two links attempted every millisecond complete in about cycles. Three links attempted every five milliseconds complete in about cycles. Their one-shot scores are and , but their repeated-completion rates are about and pairs per second. Exercise 4 derives this reversal using the exact waiting formula on the repeater page. It does not include extra swap or signaling delays.
Concurrent demands also compete. A total-throughput objective may give one application all capacity; max-min fairness protects the smallest rate. Priority or deadline objectives can choose differently. Any allocation must enforce the capacities of shared memories, detectors and local processors, not only the fibers.
Routing information has a cost. A global controller with exact instantaneous pair inventory would require frequent classical updates and could act on stale data before the messages arrive. Local policies react quickly but may miss globally better allocations. Hierarchical routing can advertise aggregated capabilities across domains while keeping pair-level scheduling local. The right choice depends on network size, coherence time, trust, and traffic predictability.
Entanglement Inventory and Sessions
Section titled “Entanglement Inventory and Sessions”A controller distinguishes pairs being generated, ready, reserved, consumed, expired or failed. It must prevent two requests from using the same qubits. Request, attempt, pair and operation identifiers connect messages to the right physical systems. A delayed swap command must not act on a new pair that happens to reuse an old memory address; the command must also identify the pair’s generation.
The controller should reserve valid inputs before issuing a destructive operation and mark them unavailable when that operation is committed. If an acknowledgement is lost, it must resolve whether the operation occurred instead of blindly executing the same destructive command again.
Reservation and expiration
Section titled “Reservation and expiration”One useful design gives reservations an expiration time. If a resource born at has a maximum accepted age , its local expiration time is
The scheduler must include control latency and clock uncertainty before starting an operation expected to finish at . A conservative condition is
Expiration is an application-quality decision, not necessarily the instant at which a memory state becomes physically meaningless. Different requests can assign different useful lifetimes to the same hardware.
Reactive and proactive generation
Section titled “Reactive and proactive generation”Reactive generation begins after a request arrives. It avoids storing unused pairs but exposes the application to the full stochastic setup delay. Proactive generation maintains an inventory based on forecast demand. It can reduce latency but consumes modes, memory lifetime, and energy, and may discard unused resources. Hybrid policies reserve a fraction of capacity for standing inventory while leaving room for urgent or unusual requests.
A session binds a sequence of resources to an application context. It may carry endpoint identities, authorization, reference frames, deadlines, rollback semantics, and a causal history. Sessions are especially useful when an application needs a stream of pairs, several correlated pairs at once, or conditional operations across nodes. They do not make the underlying quantum state durable; they make responsibility and failure semantics explicit.
Heterogeneity and Internetworking
Section titled “Heterogeneity and Internetworking”Different nodes may use different carriers, wavelengths, encodings, gates and storage times. Compatibility can be direct or supplied by a converter, but every conversion changes the accepted modes, loss and possibly noise. An efficient internal converter may still accept only a small fraction of the source spectrum.
Across network regions, the protocol must specify which party tracks corrections, estimates quality and performs any purification or decoding. Permissions and trust may change at the same boundary, even when the fiber is continuous.
A large domain may hide internal details and advertise a virtual link or service between gateways. This recursive abstraction can reduce control traffic and protect operational information, but its contract must expose enough to make end-to-end guarantees meaningful. A domain that advertises only an average pair rate conceals latency tails, correlated outages, fidelity variation, and trust assumptions.
Names also need levels. A human or application identity is not a physical memory address; a node name is not necessarily an interface; and a stable service endpoint may move among hardware modules. Separating application, node, interface, and transient-resource identifiers prevents routing and security policy from being tied accidentally to replaceable hardware.
Applications consume different resources
Section titled “Applications consume different resources”QKD can use prepare-and-measure links without long-lived memories; trusted key relays do not demonstrate arbitrary entanglement routing. Distributed computing may need synchronized bursts of high-quality pairs before a dependent gate can run. Distributed sensing may instead require simultaneous probes and stable relative phase references. A high long-term average pair rate can fail all of these workloads if the timing or state is unsuitable.
Blind delegation additionally constrains what a remote server may learn. A network interface supplies resources; the application’s proof determines whether those resources support its privacy or verification guarantee.
Trust, Security, and Failure Domains
Section titled “Trust, Security, and Failure Domains”Quantum communication does not make the surrounding network automatically secure. Security claims belong to an end-to-end protocol with explicit device, adversary, authentication, leakage, and availability assumptions.
At least the following surfaces require analysis:
- Classical authentication. An attacker who can forge heralds, route updates, corrections, or key post-processing messages can defeat the protocol without violating quantum mechanics.
- False resource records. Detector artifacts, stale identifiers, or a compromised node can claim that a pair exists when the endpoint state does not satisfy the service contract.
- Control-plane denial. Memory reservations, expensive link attempts, and route computation can be exhausted by requests that never consume their resources.
- Metadata leakage. Endpoint identities, timing, volume, route choice, and success patterns can reveal sensitive activity even when quantum payloads remain private.
- Implementation side channels. Sources, detectors, transducers, and control electronics may leak or accept modes outside an abstract proof.
- Trusted intermediaries. A trusted relay, measurement node, repeater, and administrative controller have different access to keys, states, outcomes, and metadata.
- Correlated failure. Shared clocks, software, power, fiber conduits, cryogenic systems, or control authorities can invalidate independence assumptions across apparently disjoint routes.
End-to-end entanglement can remove the need to trust an intermediate node with the ideal endpoint state, but only if the endpoints validate the protocol’s assumptions and authenticate the classical transcript. It does not eliminate availability attacks or metadata exposure. Device-independent security can reduce device-trust assumptions under demanding loophole, entropy, and finite-data conditions; it does not make network operations or endpoint software irrelevant.
Trust should therefore be represented as path metadata and policy, not as a single “secure” bit. A request may allow nodes operated by a specified set of domains, forbid key exposure to relays, require disjoint control authorities, or require tests performed at the endpoints.
Delivered rate, quality and deadlines
Section titled “Delivered rate, quality and deadlines”A network benchmark should begin at the application boundary and expose every denominator. For accepted outputs over observation time , define a service goodput
Here the quality condition refers to a justified bound for the relevant conditional output ensemble or protocol, not a nondestructive measurement of each unknown pair’s fidelity. Network verification explains how tests support such bounds. This rate is not interchangeable with source repetition rate, detector clicks, link heralds, raw swaps, sifted detections, or postselected tomographic events. If a result is quoted per optical mode, channel use, memory, wavelength, or spatial path, that denominator must also be named.
A rate should be accompanied by its workload, fidelity requirement, latency distribution and physical resource use. Changing a timeout can increase conditional fidelity and lower delivered rate. Changing offered load can create queues and memory aging. For repeated independent cycles, the long-run rate is total usable output divided by total elapsed time, not an average of individual inverse latencies.
For concurrent flows with delivered rates , Jain’s index
is one descriptive fairness measure when the total rate is nonzero. It does not encode priorities or deadlines, so it should accompany rather than replace the declared policy.
RFC 9340 (Kozlowski et al., 2023) develops architectural principles and RFC 9583 (Wang et al., 2024) discusses application scenarios. Both are Informational documents, not Internet Standards Track specifications. Proposed layers help express assumptions and interfaces; an implementation must still demonstrate compatible operation under its actual workload. Network case studies examine concrete experiments.
Exercises
Section titled “Exercises”1: Overlay graph rewrite
Section titled “1: Overlay graph rewrite”At time , a node holds pair records and . Both have been reserved for request . A Bell measurement succeeds at with outcome . Describe the required inventory transaction. Why is it unsafe merely to add to the database?
Solution
The transaction verifies that both input records still exist, refer to the expected memory slots, are unexpired, and are reserved for . It marks both inputs consumed, creates a new record tied to the endpoint slots, records the swap outcome or corresponding Pauli-frame update, recomputes the quality and expiration estimate, and retains the preparation history linking the output to both inputs and the operation at . It then reports success atomically to the next protocol stage.
Merely adding leaves the input records apparently available. A second request could allocate qubits that the Bell measurement already destroyed. It also loses the correction, causal history, and failure semantics needed to interpret the endpoint state.
2: Four graphs
Section titled “2: Four graphs”Alice and Bob have authenticated Internet connectivity. Each has an optical fiber to a university hub, but policy forbids Alice’s project from using Bob’s laboratory equipment. Yesterday the hub generated an Alice–Bob pair; it has since expired. State whether the corresponding edge is present in each of , , , and .
Solution
The physical quantum paths through the hub remain in . Alice and Bob’s authenticated classical reachability gives a path in . The expired pair contributes no current edge to . The administrative graph records a policy boundary that forbids the requested use, so there is no authorized Alice–Bob service path in even though physical and classical paths exist. The expired pair is no longer available for a new operation.
3: A complete link request
Section titled “3: A complete link request”An application asks, “Give node ten Bell pairs with node .” Add at least five fields needed to make the request operational, and explain one choice that changes the resource cost substantially.
Solution
Possible fields include the target Bell state or accepted frame convention, minimum fidelity, whether pairs are measured immediately or kept in memory, deadline, sustained-rate or burst requirement, maximum inter-pair skew, priority, endpoint memory constraints, confidence requirement for the quality estimate, and trust policy.
Create-and-keep delivery can cost much more than measure-directly delivery. It requires usable endpoint memories, assigns exact slots, waits for application consumption, and risks decoherence while the ten-pair batch is assembled. Measure-directly service can release each memory immediately after the chosen measurement.
4: Route scores are not rates
Section titled “4: Route scores are not rates”Two candidate paths have one-shot component probabilities
and instantaneous deterministic swaps. Suppose attempts every millisecond and every five milliseconds, with unlimited perfect memories and no extra control delay. Compare simultaneous one-shot scores with repeated pair-completion rates.
Solution
The scores are and . For independently prepared links, the exact mean cycle count is
Thus takes milliseconds, giving . For ,
or about milliseconds and . The slower clock reverses the one-shot ranking. Memory aging, gate errors and contention would require further analysis; this example isolates the missing time denominator.
5: Shared bottleneck and fairness
Section titled “5: Shared bottleneck and fairness”Two flows share a link that can supply at most accepted elementary pairs per second. Each end-to-end pair consumes one pair from that link, and all other resources are unconstrained. Compare the maximum total-throughput allocations with the max-min fair allocation. Compute Jain’s index for and .
Solution
Every nonnegative allocation satisfying has feasible total rate. A pure total-throughput objective is indifferent among all allocations on the boundary, including . Max-min fairness gives .
For ,
For ,
The index describes equality, not whether one flow legitimately had higher priority or a tighter deadline.
6: Memory lease decision
Section titled “6: Memory lease decision”A pair expires at . At , a controller considers a swap that will finish after . Control and clock uncertainty together contribute . Should the operation start under the conservative lease rule? What changes if the application’s accepted age is extended by ?
Solution
The conservative completion bound is
which exceeds the expiration time, so the scheduler should not start the operation under this contract. Extending the accepted age by moves expiration to , and the bound then satisfies the lease. That extension must come from a justified quality model or a different application threshold, not from the scheduler silently changing the contract.
7: Trust paths
Section titled “7: Trust paths”Compare two services: (a) a key transported through trusted classical relays, and (b) entanglement-based QKD over untrusted repeater nodes with authenticated endpoint classical communication. Which intermediate compromise is relevant to confidentiality, and which threats remain in both cases?
Solution
In the trusted-relay design, an intermediate that handles reconstructed key material can compromise end-to-end key confidentiality. In the ideal entanglement-based design, intermediate repeaters need not learn the endpoint key merely by performing the prescribed swapping operations; endpoint tests and the security proof bound adversarial influence under their assumptions.
Both designs still require authenticated classical communication and secure endpoint implementations. Both remain exposed to denial of service, traffic analysis, operational metadata leakage, compromised control software, common infrastructure failures, and implementation side channels outside the abstract model.
8: Equal mean latency, unequal deadline success
Section titled “8: Equal mean latency, unequal deadline success”One service delivers every pair after ms. Another takes ms with probability and ms with probability . Assume independent repeated requests, one pair per completed request and no early timeout. Compare mean latency, raw long-run pair rate and rate meeting a ms deadline.
Solution
Both have mean latency ms because . Each therefore delivers pairs per second in the renewal limit. All outputs of the first meet the deadline; only of the second do, giving useful rates and per second. Averaging the second service’s individual inverse latencies would instead give about , which is not its sequential throughput. Aborting slow requests at the deadline changes the cycle distribution and would be a different scheduling policy.
References
Section titled “References”- A. Dahlberg et al., “A Link Layer Protocol for Quantum Networks,” Proceedings of ACM SIGCOMM 2019, 159–173 (2019), doi:10.1145/3341302.3342070.
- A. Dahlberg et al., “NetQASM—a low-level instruction set architecture for hybrid quantum–classical programs in a quantum internet,” Quantum Science and Technology 7, 035023 (2022), doi:10.1088/2058-9565/ac753f.
- W. Kozlowski et al., “Architectural Principles for a Quantum Internet,” RFC 9340, IRTF Quantum Internet Research Group (2023), doi:10.17487/RFC9340.
- M. Pant et al., “Routing entanglement in the quantum internet,” npj Quantum Information 5, 25 (2019), doi:10.1038/s41534-019-0139-x.
- C. Wang, A. Rahman, R. Li, M. Aelmans, and K. Chakraborty, “Application Scenarios for the Quantum Internet,” RFC 9583, IRTF Quantum Internet Research Group (2024), doi:10.17487/RFC9583.