General upper bound for conferencing keys in arbitrary quantum networks

Secure quantum conferencing refers to a protocol where a number of trusted users generate exactly the same secret key to conﬁdentially broadcast private messages. By a modiﬁcation of the techniques ﬁrst introduced in [Pirandola, arXiv:1601.00966], we derive a single-letter upper bound for the maximal rates of secure conferencing in a quantum network with arbitrary topology, where the users are allowed to perform the most powerful local operations assisted by two-way classical communications, and the quantum systems are routed according to the most eﬃcient multipath ﬂooding strategies. More precisely, our analysis allows us to bound the ultimate rates that are achievable by single-message multiple-multicast protocols, where N senders distribute N independent secret keys, and each key is to be shared with an ensemble of M receivers.


I. INTRODUCTION
Quantum information science [1][2][3][4][5] is currently being developed at an unprecedented pace, with the field of quantum key distribution (QKD) [6][7][8] already extended to quantum-secured networks [9] and even satellite communications [10,11].Long-term plans to develop a fully-purpose quantum network, or 'quantum internet', are also contemplated from both a theoretical and experimental point of view [12][13][14].Building quantum networks not only has the advantage of creating connectivity among many users, but also gives the possibility to overcome the intrinsic fundamental limitation imposed by the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [15], according to which the maximum number of quantum bits, entanglement bits (ebits) or private/secret bits, that can be transmitted or generated at the two ends of a lossy communication channel is limited to − log 2 (1 − η) bits per channel use, where η is the channel's transmissivity.This limit can be approached by point-to-point continuous variable protocols based on the reverse coherent information [16,17] and can be beaten by using suitably relayassisted QKD protocols, such as the recently-introduced twin-field QKD [18] (see also related experimental realizations [19,20]), or by resorting to entanglement distillation repeaters based on quantum memories [21][22][23].
Using techniques from classical network theory [24][25][26][27][28] and tools more recently developed in quantum information theory [15,[29][30][31][32][33][34], Ref. [35,36] established tight bounds (and capacities) for the repeater-assisted quantum communications over repeater chains and, more general, network scenarios.These results were first developed for the unicast case of a single sender and a single receiver in multi-hop quantum networks, and then extended [35,37] to multiend configurations involving multiple senders and receivers, such as multiple unicasts, multicasts, and multiple multicasts [26].All these scenarios were considered in the setting of multiple independent messages, so that each sender-receiver pair was assigned a different key with respect to any other pair.
In this work, we extend the methodology of Refs.[35][36][37] to the case of single-message multicasts, i.e., a scenario where one or more senders aim to share exactly the same secret key with an ensemble of receivers in a multihop quantum network.When the sender is only one, this becomes a protocol of secure quantum conferencing in an arbitrary network topology.Using tools of network simulation and stretching [35], we can write a general upper bound to the sum of all the key rates that the senders can optimally achieve in distributing their secret keys to the destination set of the receivers.This bound has a single-letter form in terms of the relative entropy of enetanglement (REE) and includes a minimization over suitable cuts of the network.
It is important to stress that this result not only applies to arbitrary network topologies but also arbitrary dimensions of the Hilbert space, finite or infinite.In other words, we consider quantum networks connected by discrete-variable quantum channels, but also bosonic channels.Following the methods in Refs.[15,31,32,[35][36][37], we can in fact introduce asymptotic notions of channel and network simulation that allows us to rigorously prove results in the infinite-energy limit.
The paper is organized as follows.In Sec.II we provide preliminary notions for understanding the basic theory behind the next derivation.In Sec.III we show our results for the distribution of conferencing keys in a quantum network, extending the notion of single-message multiple-multicast network to the quantum setting.Finally, Sec.IV is for conclusions.

II. PRELIMINARIES A. Channel simulation
Given a quantum channel E, we can simulate it by means of local operations (LOs) and classical communication (CC), briefly called LOCCs, applied to the input state ρ and a resource state σ.In other words, we may write E(ρ) = T (ρ ⊗ σ).In general, this simulation can be asymptotic, so that E(ρ) = lim µ T µ (ρ ⊗ σ µ ), for a sequence of LOCCs T µ and resource states σ µ .Then, a channel is called teleportation-covariant if it is covariant with respect to the correction unitaries U k of teleportation [38], i.e., finite-dimensional Pauli operators [39] or bosonic displacements [40,41], depending on the dimension of the Hilbert space.Channel E is teleportationcovariant if, for any U k , we have Weyl-covariant (or just Pauli covariant if the dimension is finite).In discrete variables, for a tele-covariant E, we may write the simulation where T tele is teleportation and σ E := I ⊗ E(Φ) is the Choi matrix of the channel (here Φ denotes a finitedimensional maximally-entangled state).In continuous variables, we write E(ρ) = lim µ T µ tele (ρ⊗σ µ E ), where T µ tele is the Braunstein-Kimble teleportation protocol based on a two-mode squeezed vacuum (TMSV) state Φ µ with variance parameter µ, and σ µ E := I ⊗ E(Φ µ ) is a sequence of quasi-Choi matrices.

C. Quantum networks: formalism and simulation
A quantum network N can be represented as an undirected finite graph [24] N = (P, E), where P represent the set of points (or nodes), while E is the set of undirected edges.We assume that every point P has a quantum register p, i.e., an ensemble of quantum systems that are used for quantum communication and local quantum information processing.Between two points x and y, there is an edge (x, y) if there is a corresponding quantum channel E xy .In general, we assume that the channel is bidirectional, meaning that it can be used in forward direction x → y or backward y → x.For two labeled points p i and p j , we may also adopt the simpler notation E ij := E pipj .Given two points a and b, a cut C : a|b with respect to these points is a bipartition (A, B) of P such that a ∈ A and b ∈ B. Given a cut, its cut-set C is defined by C = {(x, y) ∈ E : x ∈ A, y ∈ B}, i.e., represents the ensemble of edges across the bipartition.In general, a cut can be defined between multiple points, i.e., we may consider C : {a i }|{b j } for i = 1, . . ., N and j = 1, . . ., M .This means that the bipartition is such that a i ∈ A and b j ∈ B for any i and j.
Given a network N , we may consider its simulation [35,36].This means that, for any edge (x, y), the quantum channel E

III. MULTICASTS OF CONFERENCING KEYS
We consider the model of single-message multiplemulticast network in the quantum setting.Here we have N senders {a i } N i=1 = {a 1 , . . ., a i , . . ., a N } and M receivers {b j } M j=1 = {b 1 , . . ., b j , . . ., b M }.Each sender a i aims at generating the same conferencing secret key K i with all the M receivers.Different senders distribute different keys to the ensemble of receivers, so that we have a total of N keys.In general we assume that each point of the network can perform arbitrary LOs on their registers, assisted by two-way CCs with all the other points of the network.These adaptive LOCCs can be performed before and after each use of each channel in the network.We also assume that the global distribution of the N keys is performed assuming a multi-path flooding [45] protocol P where each channel of the network is actively exploited by the parties for each use of the network (see Refs. [35][36][37] for more details on these general protocols).
More precisely the aim of the i-th sender is to share copies of a multipartite private state φ ai{bj } with the destination set of the M receivers.This state is a direct generalization of a GHZ state (|0 ⊗(M+1) + |1 ⊗(M+1) )/ √ 2 to include an additional shield system [46], and generates one private bit shared between the sender and all the receivers.After n uses of the network, the N senders and M receivers will share a global output state ρ n {ai}{b j } which is ε-close to the target state where nR ε,n i is the number of copies distributed by the i-th sender.taking the limit of large n, small ε, and optimizing over all protocols P, one defines the capacity region for the achievable key rates {R i }.We can then prove our main result.

Theorem 1 (Single-message multiple multicasts)
Let us consider a quantum network N = (P, E) with resource representation σ(N ) = {σ xy } (x,y)∈E , which may be a Choi-representation for a teleportation-covariant N .Consider the most general multiple-multicast protocol where the i-th of N senders {a i } distributes an independent key to a destination set of M receivers {b j } at the rate R i .Then, we have the following outer bound for the capacity region where E m R (C) is the multi-edge flow of REE through cut C, defined by which is implicitly extended to asymptotic simulations.
Proof.Consider an arbitrary cut of the type C : {a i }|{b j }.With respect to this bipartition, we may write the distillable key K D of the target state and write where we use (i) the fact that the distillable key of a state is upper bounded by its REE [46], and (ii) the continuity of the REE with respect to the states ρ − φ ≤ ε, where ρ := ρ n {ai}{b j } is the output state and φ is the target state.In Eq. ( 4), the error term δ(ε, d) depends on the ε-closeness and the dimension d of the target private state φ.More in detail, this error term can be expressed as and the dimension of the private state grows at most exponentially in n, i.e., d ≤ 2 αnn , where α n tends to a finite constant.This is proven in Refs.[47,48] for discrete-variable systems and Ref. [15] for both discrete-and continuous-variable systems (see also Ref. [31]).Therefore, we may write δ(ε, d)/n ≤ 4εα n + 2H 2 (ε)/n.By taking the limit for large n and small ε (weak converse limit), the right hand side goes to zero and we can neglect δ(ε, d)/n.Therefore, by taking the weak converse limit in Eq. ( 4), we find lim The next ingredient is the simulation of the network.Given a simulation S(N ) = {S xy } (x,y)∈E with resource representation σ(N ) = {σ xy } (x,y)∈E (where we implicitly include asymptotic states) we may 'stretch' any adaptive protocol implemented over the network using the tools of Refs.[35,36] and write the output state in the block form where Λ is a trace-preserving LOCC.By adopting an arbitrary cut of the type C : {a i }|{b j }, we can reduce this decomposition into the following where ΛC is now local with respect to the bipartition introduced by the cut C.This decomposition is implicitly assumed to be asymptotic in the presence of asymptotic resource states, in which case it becomes of the following type for sequences of LOCCs Λµ C and resource states σ µ xy .By replacing Eq. ( 7) in Eq. ( 5), we may exploit the monotonicity of the REE under trace preserving LOCCs and write Then, if we minimize over all possible cuts of the type C : {a i }|{b j }, we may write the following bound for the asymptotic rates which concludes the proof.Some considerations are in order.First of all, let us note that, for a distillable network, i.e., a network connected by distillable channels [15], such as pure-loss channels, quantum-limited amplifiers, dephasing and erasure channels, we have a simplification of the bound.A distillable channel E is a particular teleportation-covariant channel whose secret-key capacity K is equal to the REE of its Choi matrix, i.e., K(E) = E R (σ E ).Therefore, for a distillable network with channels E xy , for any cut C, we may write where K m (C) is the multi-edge secret-key capacity of the cut C [35,36].Then, consider the case of a single sender (N = 1), that we denote by a.This is the most basic scenario for quantum conferencing in a multi-hop quantum network.We can see that the bound in Eq. ( 2) simplifies to where R is the maximum achievable rate.While this bound is generally large, there are network configurations where it is sufficiently tight.For instance, consider the case where the sender wants to generate a conferencing key with the destination set but it is limited to connect to an intermediate router node r via a quantum channel E ar .Then, it is immediate to see that the conferencing key must satisfy R ≤ E R (σ ar ), where σ ar is the resource state associated with the simulation of E ar .If the channel is distillable, we then have R ≤ K(E ar ).For instance, if it is a pure-loss channel with transmissivity η, we find R ≤ − log 2 (1 − η), i.e., the rate of the conferencing key cannot beat the PLOB bound [15].

IV. CONCLUSIONS
In this work, we have studied the ultimate conferencing key rates that are achievable in a multi-hop quantum communication network.We have considered the general scenario of single-message multiple-multicast protocols, where N senders communicate with a destination set of M receivers, and each of the sender aims at generating the same secret key with the entire destination set.This general case can also be seen as a protocol for the simultaneous generation of N conferencing keys shared by the M receivers.For N = 1, this reduces to the basic configuration considered in the literature [49,50].
Our results are heavily based on the tools and notions established in Refs.[35][36][37] for quantum networks, and Ref. [15] for point-to-point communications.In particular, we exploit the simulation and stretching techniques developed in these previous works to reduce the most general (adaptive) protocols into a block form, so that we can derive a single-letter upper bound for the capacity region in terms of the REE.Furthermore, our results do not depend on the dimension of the Hilbert space, in the sense that they apply to quantum conferencing schemes in quantum networks connected by DV or CV quantum channels.
xy can be replaced by a simulation S xy = (T xy , σ xy ) where an LOCC T xy is applied to a resource state σ xy , so that E xy (ρ) = T xy (ρ ⊗ σ xy ) for any input state.More generally, this may be an asymptotic simulation E xy (ρ) = lim µ T µ xy (ρ ⊗ σ µ xy ) with sequences of LOCCs T µ xy and resource states σ µ xy .Therefore, we may define the LOCC simulation of the entire network S(N ) = {S xy } (x,y)∈E and a corresponding resource representation σ(N ) = {σ xy } (x,y)∈E , where σ xy may be asymptotic, i.e., defined by σ xy = lim µ σ µ xy .In particular, for a network with teleportation-covariant channels, we may use teleportation LOCCs and the Choi representation σ(N ) = {σ Exy } (x,y)∈E .