Quantum repeaters in space

Long-distance entanglement is a very precious resource, but its distribution is very difficult due to the exponential losses of light in optical fibres. A possible solution consists in the use of quantum repeaters, based on entanglement swapping (ES) or quantum error correction. Alternatively, satellite-based free-space optical links can be exploited, achieving better loss-distance scaling. We propose to combine these two ingredients, quantum repeaters and satellite-based links, into a scheme that allows to achieve entanglement distribution over global distances with a small number of intermediate untrusted nodes. The entanglement sources, placed on satellites, send quantum states encoded in photons towards orbiting quantum repeater stations, where ES is performed. The performance of this repeater chain is assessed in terms of the secret key rate achievable by the BBM92 cryptographic protocol. We perform a comparison with other repeater chain architectures and show that our scheme, even though more technically demanding, is superior in many situations of interest. Finally, we analyse strengths and weaknesses of the proposed scheme and discuss exemplary orbital configurations. The integration of satellite-based links with ground repeater networks can be envisaged to represent the backbone of the future quantum internet.

. Pictorial representation of the scheme proposed in this paper for long-distance entanglement distribution, based on orbiting QR stations.

Figure 2.
Schematic comparison between the satellite-based scheme OO (green arrows), the standard fibre-based implementation (GG, in black) and the scheme studied in [22] (OG, in red). Here S represent entanglement sources and R QR stations. The incoming photons are heralded by QND measurement devices and the quantum information is loaded into QMs. Finally, the quantum states are read and a BSM is performed, as part of the ES protocol.
We focus in the following on a specific application of entanglement distribution, namely quantum key distribution (QKD). The secret key rate turns out to be a good measure of the effectiveness of the QR link [29]. We compare the performance of the newly-proposed scheme with two other QR configurations based on ES. The nomenclature used in the remainder of the paper is the following, also schematically represented in figure 2: scheme orbiting sources orbiting repeaters (OO) is our proposal, scheme ground sources ground repeaters (GG) is the fibre-based one and scheme orbiting sources ground repeaters (OG) is the solution proposed in [22] (and expanded in [26]), where the QR stations are on the ground. We show that the configuration proposed and analysed here might represent a useful building block for the future global quantum network, once the additional technical requirements are met. A full satellite constellation study will be necessary, however, in order to fully grasp the potential of this scheme for real-life applications.
In section 1.1 we quantitatively estimate the performance of the different schemes in terms of achievable secret key rate and compare them. Afterwards, in section 1.2, we discuss pros and cons of the proposed satellite-based scheme and then analyse exemplary orbital configurations in section 1.3. The results are briefly summarized and discussed in the conclusion, section 2. Additional details on the simulations can be found in appendix A, regarding the error model and the contribution of environmental photons, the analysis of the orbits, the estimation of the satellite link transmittance and the values of the parameters used.

Secret key rate and comparison
The QR architecture is designed as follows [30]. The total link of length L between the two communicating parties A and B is divided into 2 n elementary links of length l 0 = L/2 n . Quantum repeaters are placed at the connections between adjacent elementary links, while entanglement sources are in their central points (figure 2). The latter produce bipartite entangled states (in the following we will consider qubit pairs), encoded in some degree of freedom of a pair of photons, that are then injected in the adjacent elementary links. The quantum repeaters consist of three main devices. First of all quantum non-demolition (QND) measurement devices herald the arrival of a photon from the elementary link. The quantum state encoded in the heralded photons is then loaded and stored in QMs. When both memories are full, a joint Bell state measurement (BSM) is performed and the result broadcast. This ES procedure allows to connect two adjacent entangled pairs and, repeated in a recursive and hierarchical way, to gradually extend the entanglement (see [29] for details). In consecutive nesting levels, the distance between the subsystems composing the entangled pairs will be doubled, with n the maximal nesting level. After n successful steps the entanglement is shared between the end points of the chain, the parties A and B.
In the case of scheme OO, the elementary links consist of double inter-satellite links and hybrid inter-satellite/down-link at the end points. In scheme GG, instead, they consist of optical fibres, whose transmittance η f (l) = 10 −αl/10 decreases exponentially with the length l, where the attenuation parameter is α = 0.17 dB km −1 at 1550 nm. Scheme OG on the other hand comprises double down-links from the satellites towards two adjacent receiving stations on the ground (as in figure 2). We discuss the losses introduced by such satellite links in appendix A.2. After an entangled pair is successfully shared between the parties A and B, it can be used for any quantum information protocol, in particular QKD. In this cryptographic primitive the two parties are connected by an insecure quantum link, the repeater chain, and by an authenticated classical channel. An eavesdropper can tamper on the classical channel and freely interact with the states sent over the quantum channel. The parties have to devise a protocol that either creates a private key or aborts. A generic protocol usually comprises the exchange of quantum states with successive measurements in random bases, base sifting, parameter estimation, error correction and privacy amplification. In the following we apply the well known asymmetric BB84 protocol (see [31] for the first proposal and [32] for the efficient asymmetric version) in the entanglement-based form, also referred to as BBM92 [33]. In this protocol the quantum states are measured in the bases defined by the eigenstates of the X and Z Pauli operators on qubits. For the security analysis [29] we assume that the whole QR chain is untrusted, so, not only the quantum channels, but also the sources on the satellites and the repeater stations can be in the eavesdropper's hands. Our analysis of the repeater chain is not linked to any specific implementation regarding the encoding of the quantum information in the single photons. The choice of the encoding also depends on the chosen quantum memory architecture and material. For the satellite-based schemes polarization encoding is feasible [16][17][18][19] and promising, so we base the error model on this assumption. Furthermore, we fix the wavelength of the photons to λ = 580 nm, as discussed in appendix A.2. The secret key rate depends on both the repeater rate and the quality of the final shared entangled state. It is estimated in the limit of an infinitely long key, based on the considerations in [29], by: In the expression above, R rep represents the entanglement distribution rate of the repeater chain, P click the double detection probability, R sift the sifting ratio (assumed equal to one in our asymmetric and asymptotic protocol) and r BBM92 ∞ the BBM92 secret fraction: In equation (2), the quantity 1/T 0 represents the intrinsic repetition rate of the repeater architecture. We assume here that the memories used are highly multi-mode [34,36] (see [22,27] for additional discussions) so that we can avoid to wait acknowledgement from the adjacent stations that the photons have been received, before proceeding with the protocol or emptying the memory. This allows us to fix T 0 = 1/R s , with R s the repetition rate of the source. The memories must have a sufficiently large number of modes to be able to store the signals that are received before the acknowledgement arrives. This number can be estimated [22] as N m = γR s η max P QND P W L c , where η max is the maximum single-photon transmittance during the overpass, P QND is the efficiency of the QND measurement, P W is the writing efficiency of the quantum memory, L c is the waiting time if all the local operations are instantaneous and γ is a constant close to one [35]. N m amounts to few thousand modes for the distances analysed in this section, which is a demanding but plausible condition [36]. The memory bandwidth of the chosen QM platform limits the maximum repetition rate, that we fix to 20 MHz for the following simulations [22,37]. P 0 is the transmittance of the elementary links for the entangled pair, which depends on the scheme under study. We identify with P 0 the average of the link transmittance over one fly-by of the satellite for schemes OG (double downlink) and OO (double inter-satellite link or inter-satellite + downlink). P R is the reading efficiency of the quantum memory. P ES is the success probability of the single ES process (we refer to appendix A.1 and [29] for details). The term 2/3 is connected with the average amount of time that one has to wait until entangled pairs in adjacent segments of the repeater chain are successfully generated. It arises due to a commonly employed approximation valid for small P 0 , which is always valid in the cases under study (we refer to [38] for further details and the exact solution). In equation (3), η d is the efficiency of the detectors used for the final measurement of the photons. The secret fraction r BBM92 ∞ depends, through the binary entropy h(p) = −p log 2 (p) − (1 − p)log 2 (1 − p), upon the error rates in the X and Z bases, e X and e Z . In our simulations they are estimated tracking the evolution of the state of the entangled pairs throughout the ES process, starting from noisy elementary pairs. In a practical experiment these error rates are the result of the parameter estimation stage, in which the parties make public a small subset of their measurement results and compare them. In our analysis we neglect decoherence in the QMs, even though such long distances would require coherence times of the order of tens of ms. We refer to the appendix A.1 for additional discussion.
In the following we assume two-qubit systems and we consider, without loss of generality, an entangled state ρ AB diagonal in the Bell basis with p φ + + p φ − + p ψ + + p ψ − = 1 and the Bell states |φ± = (|11 ± |00 )/ √ 2 and |ψ ± = (|10 ± |01 )/ √ 2. It is possible to apply appropriate local twirling operations that transform an arbitrary two-qubit quantum state in a Bell diagonal state, without compromising the security of the protocol [39]. This structure of the state simplifies the analysis because it can be shown that starting from two Bell-diagonal pairs, the resulting state after ES between two sub-systems is still Bell diagonal and the new coefficients p φ + , p φ − , p ψ + , p ψ − can be readily computed [29]. Then, the error rates along the X and Z directions can be simply written as The Bell-diagonal state received by the adjacent repeater stations is assumed to be, without loss of generality, a depolarized state of fidelity F with respect to |φ + The fidelity F accounts for the initial fidelity of the entanglement sources on the satellites and for the noise model that describes the channel. A depolarized state is a natural choice as it corresponds to a common and generic noise that well suits the problem under study and, moreover, any two-qubit mixed quantum state can be reduced to this form using some (previously mentioned) local twirling operations [40].
In the presence of environmental photons entering the receiver, the probability that the detection was due to a signal photon from the adjacent satellite can be estimated as where N s represents the number of signal photons per time window that we expect to observe (proportional to the transmittance of the channel) and N n is the expected number of environmental photons in the same time window. Now, with the assumption that environmental photons are unpolarized and uncorrelated to the signal photons, the final state the repeater stations receive is modelled as a mixture of the initial state sent by the sources ρ 0 with the completely mixed state where I is the 4 × 4 identity matrix and P s1 and P s2 refer to the receiving telescopes of the adjacent repeater stations.
Introducing the definition of the initial state ρ 0 = ρ dep (F 0 ) with the initial fidelity F 0 and writing the completely mixed state in the Bell basis we obtain, after comparison with equation (6), In appendix A.1 we show how to estimate the probabilities P s1 and P s2 in the different cases and which are the most important sources of environmental photons. The fibre-based implementation is substantially immune to this problem and we neglected further sources of error like basis misalignment, so the state that the repeater stations received is actually ρ 0 . We point out that no entanglement distillation [41] is performed in the protocol analysed here. If high quality gates for the implementation of entanglement distillation are available, this operation may allow to get higher key rates and reduce the threshold on the initial fidelity of the pairs and the noise filtering. Now we discuss the results of the comparison between scheme OO and the other configurations. The parameters employed for the simulations are given in table 1 of the appendix section. In particular, for schemes OO and OG, we assume the diameter of the main optical elements to be 50 cm for the emitters (source satellites) and 1 m for the receivers (repeater satellites and ground stations). The transmittance of the free-space links is estimated assuming an imperfect Gaussian beam and a simple model for the atmospheric extinction (more details in appendix A.2). Regarding detector and quantum memory efficiencies, we assumed rather conservative values, that either have already been achieved separately in different implementations or are expected to be reached in the near future [22]. We also assume that all the satellites are in Earth's shadow and the ground stations are at local night (details about the orbital configurations to achieve this condition are examined in section 1.3). We consider full Moon condition for the estimation of the environmental light (appendix A.1 for details). An important aspect to point out is that in these simulations we consider the satellites passing exactly over the ground stations. In practice most passes will not be close to zenith and a more detailed analysis is necessary. The newly proposed scheme OO will, generally, be more resilient than scheme OG to this problem, since in the latter every link in the chain will be affected, depending on the relative position of satellites and ground stations.
In figure 3 we show the secret key rate, see equation (1), as a function of the total distance between the parties for several interesting configurations of schemes OO, GG and OG, in the range [1000, 18 000] km.
For this range of distances, maximal ES nesting level n = 2, 3 are optimal, because for the chosen values of the parameters n 4 gives vanishing key rate. We fix the altitude of the orbits at h = 500 km in schemes OO and OG. For the latter, at the cost of introducing additional losses, choosing higher orbits has two positive effects: it allows to cover longer distances avoiding the detrimental effect of grazing angle incidence in the atmosphere and makes the fly-by duration longer (see appendix A.2 for details). In scheme OO, instead, going to higher altitudes does not have substantial net positive effects.
The use of orbiting QR stations clearly gives an important boost to the secret key rate, enlarging at the same time the maximum reachable distance, see figure 3. Avoiding the effect of the atmosphere allows to truly take advantage of the quadratic scaling of the losses with the distance that characterizes free-space optical channels in vacuum. The proposed scheme OO outperforms schemes GG and OG at every distance beyond ∼ 1000 km, by orders of magnitude. In this case, n = 2 is enough to achieve non-zero key rate at the longest distance studied. In figure 4 we focus instead on shorter distances, in which scheme OO performs again very well. For the satellite implementations n = 0, 1 are optimal in this case. With n = 0 schemes OO and OG are identical, as there is just a double down-link to the receiving stations of A and B on the ground [19]. In this case, since there are no QMs that limit the usable repetition rate, we fix R s = 1 GHz. This is the source of the advantage at L < 2000 km with respect to the other implementations. With n = 1, scheme OO beats OG by a factor ∼10 in this range of distances. These key rates have been derived from the average transmittance during an overpass (P 0 ). The error rate is also computed from P 0 . We checked numerically for some cases the result obtained computing the instantaneous error rate and then averaging it over the pass. The relative difference between the two results is less than 1%.
It is important to notice that, while for the ground implementation the link is available all day long, the satellite fly-by duration lasts several minutes at most (see appendix A.2 for details). Details about the computation of the fly-by duration can be found in the appendix and the results are shown in figure 5. It is evident how, for scheme OG, the fly-by duration goes to 0 when the distance between the ground stations becomes too large, as will be discussed in section 1.2. This is not true for scheme OO, where it only depends on the altitude and it is independent of the distance L for n 1.
We study the expected number of secure key bits exchanged in a day in figures 6 and 7. The key rate of figures 3 and 4 has been multiplied by the fly-by duration, considering a single over-pass per day, for schemes OO and OG. In the case of scheme GG we assumed continuous 24 h-operation. This comparison, as expected, advantages the ground implementation a bit more, but distances beyond 3000 km are still completely impracticable in scheme GG. The advantage of scheme OO over OG gets even bigger, especially at longer distances, since the fly-by duration is longer for scheme OO.
As discussed later in section 1.3, the satellites give coverage to many regions on Earth at every orbit, allowing to operate links between different pairs of users in a single orbit (and there are several orbits in one day). More passes over the same location are also possible, depending on the geography and the orbital configuration. The results shown in figures 6 and 7, that assume one pass per day, are therefore underestimating the actual key exchange per day in many cases, especially at short distances. In other cases, however, one usable pass per day might not be guaranteed, especially when the distance between the parties becomes so large that they are simultaneously at night only for short periods of time. So, we overestimate the average key per day in figure 6 for long distances. The deployment of a more complex constellation based on this setup will ease the problem.
Finite size effects can be very significant for satellite-based QKD due to limited satellite overpass duration, leading to small blocks and large statistical uncertainties. If we set a threshold to 30% of the asymptotic value as a satisfactory efficiency, we need a block length of at least ∼10 5 [42]. We then assume the use of ∼10 6 coincident counts at the end nodes to have ample margin for the bits lost during sifting and parameter estimation. This requirement can be met in a single fly-by for distances up to approximately L ∼ 6000 km by scheme OO. This means that for longer distances more overpasses need to be combined and processed together to avoid the loss of precious secure bits. Even more overpasses need to be combined to achieve the requirement with scheme OG. For scheme GG several days of collection time will be necessary already for distances L > 2000 km.  We point out that unlike schemes GG and OG, in scheme OO we find links with different transmittance along the repeater chain, in particular double inter-satellite links and twice an inter-satellite + down-link. The bottleneck given by the link with the lowest transmittance determines the overall entanglement distribution rate. For this reason, some parameters need to be fixed in a smart way. For short distances, the inter-satellite links have high transmittance, so the bottle neck is given by the down-links. In this case, increasing the size of the optics on the repeater satellites is not helpful. For longer distances, instead, the inter-satellite links become longer and lossier, so enlarging the correspondent optics allows to improve the bottleneck.  figure 6 apply, but in this case we focus on short-to-medium distances.

Pros and cons of orbiting QR stations
We showed in the previous section how scheme OO of figure 1 reaches the highest key rate in many situations of interest. In this section we will list several additional advantages of this configuration over the other two and discuss some of the technical advancements necessary for its deployment.
First of all, it takes full advantage of inter-satellite-links, which allow to completely avoid the degrading effect of the atmosphere. Even if for down-links the additional diffraction and beam deflections introduced by the atmosphere are generally small [21,23,24], the inevitable losses due to absorption and backscattering in the air amount to 5-10 dB. In scheme OG, in order for all the links to be active at the same time, good weather conditions must hold in all the intermediate repeater stations. This problem is almost completely solved by scheme OO, for which only the geographical sites of the two parties need to have clear sky conditions. If the channel is divided in 2 n elementary links, clear sky conditions must hold in all the 2 n + 1 sites on the ground (A, B and the intermediate repeater stations) for scheme OG. Let us assume that the probability of clear sky in all the locations is p cs (uniform and independent). In USA, for example, the sunniest city has p cs 0.7 [43], so we assume this value as worst-case scenario for scheme OO when compared with OG. In this case, for n = 3, scheme OO gives an additional advantage over scheme OG equal to p −(2 n +1−2) cs 12. The assumption of no correlation in the spatial distribution of cloud coverage is clearly incorrect over short distances. However, the correlation factor generally decreases exponentially with the distance [44] and becomes small (∼0.2) at around 500 km, making our brief analysis reasonable for L > 4000 km. When one is interested in intercontinental communication, in many cases scheme OG becomes practically unusable, since it would require optical ground stations in the middle of the ocean. The fact that, in scheme OO, all the components apart from the parties' stations are orbiting gives it the advantage. If we analyse figure 1, we see that in scheme OO the satellites need to communicate with a single ground station at a time, unlike scheme OG. For this reason, the fly-by time, that corresponds to the maximum time over which exchange of quantum information is possible, is much longer in scheme OO and independent of the distance between the parties (see figure 5 in section 1.1 for details). Finally, while in scheme OO the system is able to link only one pair of parties at a time, the chain of satellites can cover the entire world, depending on the choice of the orbit. In this way, a small number of satellites can potentially establish world-wide entanglement distribution, as discussed more thoroughly in section 1.3.
The implementation of a full-fledged QR on a satellite introduces several additional technical challenges with respect to the other schemes. QM technology is still under development and an architecture ensuring high efficiency, long coherence times and multi-mode functionality is still to be found. However, some of the main necessary technologies have been already individually developed and in some cases tested in the space environment. Needless to say, the implementation of all of them on a single platform will prove difficult and expensive. The low temperature usually needed for the operation of a quantum memory has already been achieved in different experiments. Sub-nK temperatures are expected to be achieved in a trapped atom experiment onboard the international space station [45,46]. The same experiment also tests the ability to reach ultra high vacuum, stable operation of lasers and microwave-radio sources and sizeable artificial magnetic fields. Dilution refrigerators have been implemented already in micro-gravity conditions [47] but solutions with long life-time are still in development [48,49]. With temperatures around 50 mK they would meet the requirements of, for example, QMs based on silicon vacancy centres in diamond [37,50]. The first stages of the refrigerator, at ∼1 K, can also be shared with superconducting nanowire single-photon detectors (SNSPDs).
It should be noted that even without considering the quantum devices, the satellites required will be expensive and technically challenging to develop. The choice of 1 m diameter telescopes on the repeater satellites, made to have a fair comparison with the OG scheme in terms of parameters, is beyond standard for satellite optical communication. Consider, however, that only the two final satellites of the chain need to independently steer the two telescopes considerably. In scheme OO the middle satellites (including all the repeater satellites) have to point at the adjacent ones, which occupy always the same relative position, requiring very limited steering, that simplifies the design of the satellites. Using smaller receiver telescopes (e.g. 50 cm diameter) the comparison between the satellite-based schemes will not change and the configuration proposed here will still outperform the fibre-based implementation for a wide range of distances. A more detailed analysis is necessary to assess the cost and the engineering feasibility of satellites with such large independently steerable telescopes. The pointing precision necessary for coupling into single-mode fibre at the receiver is also unprecedented on such platforms.
Optical inter-satellite links, like the ones used in scheme OO, have already been experimentally realized, e.g. during the SILEX mission of the European Space Agency [51][52][53]. In that experiment, 25 cm aperture telescopes allowed optical communication between satellites in LEO and geosynchronous equatorial orbit. However, the size of the optical elements, the independent steerability and the pointing precision required by scheme OO will introduce challenges that require further investigation.
In scheme OG the QR components on the ground could easily be updated over time with newer technology, which is clearly unfeasible in scheme OO. However, we point out that the life-time of LEO satellites is quite short, few tens of years at most, making it necessary to update the hardware in any case.

Analysis of possible orbital configurations
In this section we qualitatively analyse several types of orbits that may be useful for long-distance entanglement distribution and exemplify the potential of the satellite-based scheme we proposed before. Many recent works analysed the optimal satellite constellations for quantum communication with different protocols [25,26]. We will focus, instead, on simple configurations of few satellites, to highlight the different possibilities, that can then be used for larger setups.
The three different orbital configurations that we are going to analyse are represented schematically in figure 8.
The first example consists in Sun and Earth synchronous orbits, almost polar low Earth orbits that are engineered to pass over a given location always at the same time of the day. These orbits have already been extensively used for all kinds of satellites, from basic research to Earth imaging and proposals for quantum satellite constellations [54]. In order to achieve Earth and Sun synchronism, specific altitude and orbit inclination choices and a propulsion orbit station-keeping system are mandatory. Using such orbital configuration, if we assume that the satellites move one after the other in the already mentioned string of pearls configuration, scheme OO allows to connect parties on the ground in the north-south direction (in green in figure 8). One can, on the other hand, imagine to put satellites on equidistant Sun and Earth synchronous orbits, forming an arc, as shown in red in figure 8. This configuration is very convenient since it allows east-west links with the considerable advantages of Sun and Earth synchronous orbits. In this way we can ensure that the entire satellite chain passes over the target pairs of parties consistently. In order to achieve communication in the east-west direction with the string of pearls configuration one can also use circular orbits with suitable inclination with respect to the equatorial plane (yellow trajectory in figure 8), the most promising ones being between 0 • and 50 • . Such orbits can link locations in the temperate, subtropical and equatorial regions which have roughly the same latitude. If the orbital plane is not actively rotated, the satellite chain will be in a different position at night depending on the time of the year. More satellite chains could be deployed on rotated orbital planes to achieve year-round coverage. This problem does not arise if the orbits are right above the equator. In this case, every pair of users will have several usable fly-bys every night, year-round.
One might be interested in establishing links between different pairs of parties with a single satellite chain. In this case, the number of elementary links 2 n , their length and the orbital configuration need to be optimized depending on the set of locations.

Discussion
In this paper we presented a scheme based on the integration between satellite-based optical links and quantum repeaters to achieve long-distance entanglement distribution and untrusted-node QKD. Several LEO satellites, carrying quantum sources and quantum repeaters, are linked together by means of inter-satellite optical channels. The end-points of the chain are instead linked to two parties on the ground by downlinks. We carefully analyse the repeater rate of the chain and the fidelity of the final shared states, taking into account the effect of different sources of noise. In the end, we compute the asymptotic secret key rate achievable using the BBM92 cryptographic protocol. The parameters used in the simulations have been fixed to reasonably conservative values, that should be achievable in the mid-term future. The asymptotic key rate is compared with the rate achievable by an equivalent fibre-based implementation and a different satellite-based configuration [22], showing that the proposed scheme significantly outperforms the other approaches for a wide range of distances. These results potentially make it a promising candidate building block for a global quantum network, but additional studies are required to examine the feasibility, cost and actual performance in concrete implementations. Our analysis highlights how for this conservative choice of memory parameters and fidelity the satellite-based configurations with maximal nesting level n = 2 look more promising than n = 3 for mid-term implementation. For better memories and sources the additional round of ES would be less costly and the reduced losses in the elementary pairs would allow for higher rates. QM architectures with satisfactory performance in all the fields (efficiency, coherence times, multi-mode capability) are still in the development stage and won't be available for use in the field for many years. However, once such technology will be consolidated, the implementation into satellites seems, in principle, feasible, since many of the technical requirements have been already accomplished in-orbit, as discussed in section 1.2. The design of such platforms, though, will still be very challenging.
The study of quantum-memory-assisted satellite communication has flourished recently [25][26][27]55]. In reference [25] the authors focus on a near-future solution based on a constellation of quantum satellites that operate as trusted nodes. The ability to share entanglement and perform untrusted-node QKD differentiate our findings from theirs. Reference [26] offers a very detailed study of the protocol in [22] in case of a full satellite constellation based on polar orbits, including the optimization of the orbital parameters for a set of major cities around the world. In [27] the authors consider an architecture similar to the one studied here, they analyse pros and cons of different quantum memory platforms and also examine the potential of satellite-based memory-assisted measurement device independent QKD. However, they do not discuss the optimal maximal nesting level n for ES, depending on the target distance. Also, the problem of finding useful orbital configurations for the satellite chain is not addressed. In [55] the authors focus on one-and two-satellite configurations and analyse the robustness of teleportation protocols, but do not discuss practical implementations. A complete review of the recent developments in space quantum communication can be found in [28].
In summary, the global quantum channels analysed in this work, built through the integration of satellite-based links and repeater nodes, can be envisaged to represent a candidate building block for the future quantum internet [56][57][58][59][60].
Another source of errors is represented by dark counts in the detectors used for the BSM. We assume here the standard linear optics setup for polarization-entanglement, in which the photons read from the memories are let interfere on a beam splitter. The light coming out of the two output ports is then analysed using two polarizing beam splitters and four single photon detectors. The different click patterns allow to distinguish two out of the four possible Bell states in input. In this case the success probability of the ES procedure P ES , used in equation (2) of the main text, can be expressed as [29] where p dark is the detector dark count probability and η d their efficiency.
In the main text we considered the imperfections of the QMs limited to non-unity writing and reading efficiencies. Decoherence in the memories should be addressed too, especially because very long distances beyond 10 000 km correspond to long communication times of tens of ms. As discussed in [22], such long coherence times should be achievable by transferring the optical memory excitations to the ground spin states, for example in systems based on Eu-doped yttrium orthosilicate. Electronic spin states can be transferred to long-lived nuclear spin states in silicon-vacancy centres in diamond. In our simulation, such a modification would correspond to a lower value of the writing efficiency P W and would act in the same way on the different implementations, not changing the comparison between them.

A.2. Modelling the orbits and the transmittance of the satellite links
In this section we will give some details about the orbit model and how the transmittance of the satellite-based optical links has been computed. We assume circular orbits at altitude h above the ground and that, for simplicity, they lie in the equatorial plane. The ground stations are likewise put along the equator. The results of the paper can be extended to repeater chains in different sites of the globe by using suitable orbits (e.g. Sun and Earth synchronous LEO). The law of motion of the satellites and the relative position with respect to the ground stations have then been computed using simple geometrical considerations and the law of gravitational force, without any relativistic correction. In scheme OG, we define the fly-by as the period of time during which the satellite is in line-of-sight contact with both the adjacent ground stations. To be in contact, we suppose that it must be at an elevation angle, in the local coordinate frame of the ground stations, greater than a threshold that we set to 15 • [16]. The duration of the fly-by depends on the altitude of the satellite (that also fixes the angular speed), on the orbital direction (the same or opposite to the rotation of the Earth) and on the distance between the ground stations, fixed by the total distance L and n.
The effect is shown in figure 5 of the main text, where one can see how the fly-by duration for scheme OG goes to 0 when the distance between the ground stations becomes too large. This is not true for scheme OO, where it only depends on the altitude and it is independent of the distance L for n 1.
Numerical studies suggest that a full optimization that would include trimming the edges of the pass, analogously to [63], would only change the final key by a few percent and for simplicity it is omitted here.
In the remainder of this section we will outline the methodology used to estimate the instantaneous value of the transmittance of the free-space links. The beam effects introduced by the atmosphere [21,23,24], like additional beam wandering and broadening, are neglected in this work, as their effect is small compared to the strong geometrical losses due to the intrinsic diffraction. Same holds for losses related to pointing inaccuracy. We assume that the transmitter on the satellite generates a collimated imperfect Gaussian beam with initial beam waist W 0 and quality factor M 2 [64]. The value of the parameter M 2 has been fixed to match the far-field divergence of the imperfect Gaussian beam to the one observed for the mission Micius [16][17][18][19]. If we suppose that smaller values of M 2 can be achieved (better correction of optical aberrations) the value of the transmittance of the free-space links can easily go up of a factor {5-10}.
The atmosphere introduces losses due to absorption and back-scattering that depend on the elevation angle θ of the source and the frequency of the light. We fix the wavelength λ = 580 nm, the operating wavelength of Eu-doped yttrium orthosilicate memories [36], also a good compromise considering atmospheric extinction and diffraction.
The beam waist of a collimated imperfect Gaussian beam will broaden during the propagation in vacuum, following the relation [65] W(z) = W 0 1 + (zM 2 /z R ) 2 .
In the far field limit z z R /M 2 , with z R = πW 2 0 /λ the Rayleigh parameter of the beam with wavelength λ, equation (13) is linear in the distance z. Now we compute the integral of the Gaussian intensity distribution at the receiver, with beam waist W(z =z), inside a circular region with radius R, obtaining η diffr (z) = 1 − exp −2 R W 2 (z) . (14) This corresponds with the transmittance of the imperfect Gaussian beam through the receiving aperture of radius R, when the beam is perfectly aligned and centred. This formula can be directly employed for the inter-satellite links of scheme OO, while we multiply it by the factor χ ext (θ) = exp[−β sec(θ)] to take into account atmospheric extinction. β depends on the site and the atmospheric condition (see [21] for details). The instantaneous value of the transmittance of the double link from the source to the adjacent repeater stations is then averaged over the fly-by and this quantity is used in equation (2) of the main text, labelled as P 0 . Scheme OO contains two types of links, double inter-satellite links and twice an inter-satellite + down-link. For every configuration we compare the transmittance of the two types of links and used as P 0 the smaller one, that represents the bottleneck in the chain.
In table 1 we report the values of the most important parameters used in the simulations of section 1. Table 1. Parameters used in all the simulations in section 1. The parameters have been chosen to represent a reasonable prediction of what can be achieved in the near future. SNSPDs with low dark count rates and efficiencies exceeding 90% have already been realized at different wavelengths [66,67]. The quantum memory and heralding parameters have been already used in other theoretical studies [22,29] and the recent developments in the field make them reasonable [68]. The size of the optical elements imply a significant improvement over previous experiments [16][17][18][19], but qualitatively similar results in the comparison between the schemes is obtained with smaller optics. The parameters regarding the environmental light filtering should be reasonably easy to achieve and even improve [61,69].