Herein we demonstrate that the four unitary operations I, U, C, and UC cannot be discriminated unambiguously with a single use if U and C are constructed by our method. Before giving the proof, we first introduce an important theorem on quantum operation discrimination.

Theorem 1^[58] Under the condition that the device can be accessed only once, the minimum error probability to discriminate two unitary operations U₁ and U₂ is

where stands for the distance between the origin of the complex plane and the polygon whose vertices are the eigenvalues of the unitary operator (see also Fig.  1), and U^† is the adjoint matrix of U.

Fig.  1.

	Figure Option ViewDownloadNew Window
	Fig.  1. Definition of the function r(U) = r, where λ 1, λ 2, λ 3, and λ 4 are eigenvalues of the matrix U, and r is the distance between the origin of the complex plane o and the polygon λ 1λ 2λ 3λ 4. Obviously, r = 0 indicates that o is in/on the polygon λ 1λ 2λ 3λ 4.

Corollary 1 Under the condition that the device can be accessed only once, two unitary operations U₁ and U₂ can be discriminated unambiguously if and only if

As defined in the presented method, . It can be easily found that r(I^† C) = r(U^† UC) = r(C), and r(U^† C) = r(U^{− 1}C) = r(C^{− 1}) = r(C^† ). According to Theorem 1 and Corollary 1, under the condition that the device can be accessed only once, the two operations U and C (I and C, U and UC) constructed by our method cannot be discriminated unambiguously if and only if neither r(C^† ) and r(C) equal to zero. Now we demonstrate that r(C^† ) > 0 and r(C) > 0. Since U is a unitary operator, all the eigenvalues of U are points on the unit circle in the complex plane. Namely, all the eigenvalues of U can be written in the form of e^{i(θ + 2kπ )}, here e^{i(θ + 2kπ )} = e^iθ , θ ∈ [0, 2π ), k ∈ Z. Therefore, all the eigenvalues of the operator should be in the form of e^{i(β + kπ )}, here β = θ /2 ∈ [0, π ), k ∈ Z. It is obvious that U has more than one square root. Take the Pauli operation σ ₀ as a simple example, since σ ₀ can be written as either e^{i· 0}| 0⟩ ⟨ 0| + e^{i· 0}| 1⟩ ⟨ 1| or e^{i· 0}| 0⟩ ⟨ 0| + e^{i· 2π} | 1⟩ ⟨ 1| , both e^{i· 0}| 0⟩ ⟨ 0| + e^{i· 0}| 1⟩ ⟨ 1| and e^{i· 0}| 0⟩ ⟨ 0| + e^{i· π} | 1⟩ ⟨ 1| are the square roots of . Here | 0⟩ and | 1⟩ represent the horizontal and the vertical polarizations of photons, respectively.

As shown above, all the eigenvalues of the operator should be in the form of e^{i(β + kπ )}, k ∈ Z. In our method, we choose the square root (of U) whose eigenvalues are all in the form of e^iβ (which means that the corresponding parameter k is even) as the controlling operation C. As β ∈ [0, π ), all the eigenvalues of C are points on the upper half of the unit circle (except for − 1) in the complex plane and therefore r(C) > 0. In addition, since all the eigenvalues of C are points on the upper half of the unit circle (except for − 1), it is evident that all the eigenvalues of C^† are points on the bottom half of the unit circle (except for ¹), which means r(C^† ) > 0. That is to say, the two operations U and C (I and C, U and UC) constructed by our method cannot be discriminated unambiguously under the condition that the device can be accessed only once.

Till now, we have proved that the four unitary operations I, U, C, and UC constructed by our method cannot be discriminated unambiguously under the condition that the device can be accessed only once. Utilizing this method, we can construct the required unitary operations for designing a secure MQCP-CD with different kinds of quantum states.

If someone wants to design an MQCP-CD using a certain kind of quantum state in his favor, one of the most important things he should do first is to find the corresponding encoding operation U and controlling operation C which satisfy the security requirement of the MQCP-CD. Obviously, the method we just proposed can be used to construct such unitary operations. For example, if he wants to design an MQCP-CD with single photons, a natural choice for one of the two bases could be {| 0⟩ , | 1⟩ }. By employing our method, the other basis could be chosen as {| + ⟩ , | − ⟩ }, where and , and the corresponding encoding operation U_s and controlling operation C_s can be constructed as

It can be easily verified that {| 0⟩ , | 1⟩ } and {| + ⟩ , | − ⟩ } form two mutually unbiased bases. The effect of the operations U_s and C_s on the four states can be illustrated as

Utilizing the two bases and two operations (U_s and C_s) given above, one can design different kinds of MQCP-CDs (QSS, QPC, etc.) with single photons. Evidently, there are still some other choices for the two operations if other single particles are chosen to be the quantum information carriers. To date, in order to improve the qubit efficiency or reduce the hardware requirement, some MQCP-CDs ^{[34– 41]} have been proposed with single photons. Unfortunately, all of those protocols need to store the quantum qubits, which is still a difficult task in reality. To make use of the collective detection under the current techniques, we present a more feasible MQKD protocol without employing a quantum storage machine in the next section. More importantly, we also enhance the proposed protocol to be immune to the errors over different collective-noise channels based on the above method.

If two users in the network, say Alice and Bob, want to share a random key, they can execute the MQKD protocol as described below (see also Fig.  3).

Fig.  3.

	Figure Option ViewDownloadNew Window
	Fig.  3. The subsystem of the presented QKD network with single particles.

1) Alice generates two random binary strings of length 4n, which are denoted as A and A′ , respectively. Similarly, Bob generates two random binary strings of length 4n, which are denoted as B and B′ , respectively. After that, Alice informs the center that she wants to establish a random key with Bob.

2) The center receives Alice’ s request, prepares a sequence of 4n single particles which are all in the state | 0⟩ (denoted as sequence S), and sends it to Alice.

3) Once receiving S, Alice performs the unitary operations U^A_i and on the i-th particle in S for 1 ≤ i ≤ 4n. Here, A_i and are respectively the i-th bit in strings A and A′ , U¹ = U_s, C¹ = C_s, and U⁰ = C⁰ = I_s is the identity density operator on the two-dimensional Hilbert space, i.e., I_s = | 0⟩ ⟨ 0| + | 1⟩ ⟨ 1| . After that, she sends the new sequence (denoted as S₁) to Bob.

4) Upon receiving the sequence S₁, Bob performs operations U^B_i and on the i-th particle in S₁ for 1 ≤ i ≤ 4n. Then he sends the new sequence (denoted as S₂) back to the center.

5) Once receiving S₂, the center makes a measurement on each of the particles randomly in σ _z-basis or σ _y-basis, and then publishes the measurement outcome of each of the particles in S₂, where σ _z-basis = {| 0⟩ , | 1⟩ } and σ _y-basis = {| + ⟩ , | − ⟩ }. According to the i-th measurement outcome announced by the center, Alice and Bob could learn which of the two bases was used to measure the i-th particle in S₂. Concretely, if the measurement outcome is | 0⟩ or | 1⟩ (| + ⟩ or | − ⟩ ), the σ _z-basis (σ _y-basis) was used.

6) After the center announced the measurement outcomes of all the particles in S₂, Alice and Bob publish A′ and B′ , respectively, where indicates whether Alice (Bob) has performed C_s on the i-th particle in the travelling sequence. Based on the announced information, Alice and Bob are able to determine which of the particles in S₂ were measured in correct bases. Here measuring the i-th particle in the correct basis represents that the i-th measurement outcome is | 0⟩ or | 1⟩ (| + ⟩ or | − ⟩ ) under the condition that is 0 or 2 (1). According to the probabilistic theory, half of the particles in S₂ (i.e., 2n particles in S₂) have been measured by the center with correct measuring bases. For the positions of the measurement outcomes obtained from incorrect measuring bases, Alice and Bob discard the corresponding bits in A, B, A′ , and B′ , where the new strings are denoted as Ā , , Ā ′ , and , respectively. Then Alice and Bob can deduce a 2n-bit string C with the measurement outcomes obtained with the correct measuring bases. Concretely, if the measurement outcome is | 0⟩ or | + ⟩ (| 1⟩ or | − ⟩ ), the corresponding bit of C is 0 (1). The relationship among the values of Ā _j, , , and C_j when no error occurs is shown in Table  4, where 1 ≤ j ≤ 2n and ⊕ denotes the additional module 2.

7) To check eavesdropping, Bob randomly chooses n positions in string C and requires Alice to tell him the corresponding bits in Ā . According to the information announced by Alice and Table  1, Bob checks whether the corresponding bits in C are in accordance with the theoretical values. If the error rate is higher than acceptable, they abort the results; otherwise, Bob can trust the transmission and deduce the rest n bits of Ā with the corresponding bits of C and . At last, Alice and Bob utilize error correction and privacy amplification^{[59, 60]} to establish a secure session key.

Table 1.

Table 1.

Table 1. The relationship among the values of Ā j, , , and Cj when no errors occur. Ā j Cj Ā j 0 or 1 Ā j 2

Table 1. The relationship among the values of Ā j, , , and Cj when no errors occur.

In this protocol, with the help of the center, any two of the involved users can establish a random key with only unitary operations. Although the qubit efficiency of our protocol is half of that of the protocols in Refs.  [34]– [36], our protocol does not need to store quantum qubits. Hence, our protocol is more feasible with the current techniques. Besides, users should set up a filter and a beam splitter to prevent a Trojan horse attack and an invisible-photon attack.^{[61, 62]}

Herein we introduce three fault-tolerant versions of the proposed MQKD protocol based on the method in Section 2 and the idea of DFS, which can be immune to the collective-dephasing noise, the collective-rotation noise, and all kinds of unitary collective noise, respectively.

Let us assume that Eve is an attacker who wants to eavesdrop the users’ secret key without being noticed in the eavesdropping detection. Eve could intercept the traveling particles sent to the receiver and replace them with the ones prepared by herself, ^[55] or she can entangle the travelling particles with additional states and try to extract information from these states.^[64] Since the secret strings of the users are encoded on the travelling particles via the operations performed, the action to eavesdrop on the users’ secret strings is equivalent to discriminating between the operations that they have performed. For instance, if Eve wants to obtain the value of A_i (1 ≤ i ≤ 4n), she should know which one of the operations I_s, U_s, C_s, and U_sC_s Alice has performed on the corresponding particle. In other words, Eve should be capable of discriminating between the four unitary operations. Actually, the quantum operation discrimination has been well studied. In addition to Theorem 1 and Corollary 2, here we introduce another theorem.

Theorem 3^[65] The quantum operations γ ₁, … , γ _n can be unambiguously discriminated by a single operation if and only if for any i = 1, 2, … , n, supp(γ _i) ⊈ supp(S_i), where supp(γ ) denotes the support of quantum operation γ and S_i = {γ _j : j ≠ i}.

In the proposed protocol with single particles, the unitary operations performed by both users (Alice and Bob) can be viewed as a whole with four unitary operations, i.e. I_s, U_s, C_s, and U_sC_s. Here, I_s is the identity density operator on the two-dimensional Hilbert space and the operations U_s and C_s are respectively the encoding operation and controlling operation defined in Eq.  (4). It can be easily found that these operations satisfy , which indicates that supp{C_s} ⊆ supp{I_s, U_s, U_sC_s}. Therefore, these four operations cannot be unambiguously discriminated by a single operation (i.e., with only one opportunity) according to Theorem 3. Moreover, we can also obtain the same conclusion according to Theorem 1. For example, the eigenvalues of the operator are 1 and − i, therefore, and the minimum error probability to discriminate U_s and C_s is

In the same way, we obtain the minimum error probability P_e(I_s, C_s) = P_e(I_s, U_sC_s) = P_e(U_s, U_sC_s) ≈ 0.15, which means that these operations cannot be discriminated unambiguously under the condition that the device can be accessed only once.

In the proposed protocol, the users’ secret strings are encoded in the operations they performed on the states. If Eve wants to obtain a bit of a user’ s secret string without leaving a trace in the eavesdropping detection, she should have the ability of unambiguously finding out which of I_s, U_s, C_s, and U_sC_s has been performed on the corresponding particle with only one opportunity. However, as we analyzed above, the four operations cannot be unambiguously discriminated under this condition. Consequently, well-known attacks, such as the intercept-resend attack, the measurement-resend attack, the entanglement-measure attack, and the dense-coding attack, from an outside eavesdropper will inevitably be found in the eavesdropping detection.

Furthermore, as for the two special attacks of two-way communication, i.e., the Trojan horse attack and the invisible-photon attack, the users and the center can make use of the methods in Refs.  [61] and [62] to protect the proposed protocols. Hence, we omit a redundant description here.

It is known that an attack from a dishonest participant is more powerful than those from the outside eavesdroppers. On one hand, he knows parts of the legal information. On the other hand, he could tell lies in the executing procedure of the protocol to avoid being detected. Therefore, attacks from dishonest participants should be paid more attention. Such situations should also be considered in our protocol. First, in the case that the center has been corrupted by others, he may try to eavesdrop the random key shared between the users. Second, in some special situations, the center may be out of service and a person who has the ability of generating and measuring the quantum states may want to eavesdrop the key. That is, the one who is able to substitute the center may be dishonest. Now, we show that, if the users use the proposed protocol, a dishonest center cannot obtain the random key without leaving a trace in the eavesdropping detection,

Compared with the outside eavesdroppers, a dishonest center has the following two superiorities. First, he could replace the particles in S with whatever kind of states he wants. Second, he could modify the measurement outcomes which are announced in step 5. Nevertheless, he is still unable to obtain the key shared between the users without being noticed in the eavesdropping detection of our protocol. According to the analysis given above, no matter what kind of states the dishonest center has prepared in step 2, he is unable to unambiguously discriminate between the four unitary operations performed by the users under the condition that the device can be accessed only once. In other words, these four unitary operations cannot be precisely discriminated when they are performed on a single qubit or one qubit of any entangled state. That is to say, if the center utilizes a strategy to discriminate between these four operations, he will obtain an incorrect outcome with a non-negligible probability. In our protocol, the users will announce the controlling string A′ and B′ only after the center publishes the measurement outcomes of all the particles in S₂. Also the bits utilized to check eavesdropping are randomly chosen by the users after the measurement outcomes are published. Since the dishonest center cannot precisely discriminate between the four unitary operations utilized in our protocol with only one opportunity, no matter what attack strategy he employs, once he obtains part of the useful information about the secret string, he will inevitably introduce errors into the eavesdropping detection and hence be noticed by the users.

Till now, we have analyzed the security of the MQKD protocol in Subsection 3.1 to show that it is secure against attacks from both the outside eavesdroppers and the dishonest center. For the fault-tolerant MQKD protocols against collective-dephasing noise, collective-rotation noise, and all kinds of unitary collective noise, we can show that they can be immune to all the present attacks in just the same way, since the operations in {I^{⊗ 2}, U_dp, C_dp, U_dpC_dp}/{I^{⊗ 2}, U_r, C_r, U_rC_r}/{I^{⊗ 4}, Ū , , } cannot be discriminated unambiguously (under the condition that the device can be accessed only once) according to the theorems given above.

To combat the errors introduced by the collective-noise channel, Zhang has proposed a well-known fault-tolerant multiparty quantum secret sharing (MQSS) protocol.^[28] It is easy to find that this MQSS protocol can also be used for MQKD. However, there are clear differences between this protocol and our protocol. First, by utilizing our protocol, two arbitrary users could establish a secret key with the help of the center, and then they could utilize this key for secure communication between each other. In this circumstance, the center is unable to obtain any useful information of the shared key. While by employing Zhang’ s protocol, a boss could establish a joint key with his agents. Only when all the agents collaborate can they deduce the joint key and then utilize this key for secure communication with the boss. Second, as there exists a serving center in our protocol, if two of the involved users want to establish a secret key, they only need to be capable of performing certain unitary operations. Nevertheless, in Zhang’ s protocol, if the boss wants to establish a joint key with his agents, the boss should be able to generate quantum states, and the agents should be capable of performing a certain unitary operation and measuring the quantum states. In addition, to establish a secret key, the quantum state sequence should be transmitted three times in our protocol, while the sequence in Zhang’ s protocol only needs to be transmitted twice.

In fact, with some minor modifications, the protocol proposed in Section 3 can also be used for secret sharing of a random key. Concretely, if we want this protocol to be used for QSS, the following modifications are needed. Firstly, in step 5, after the center finishes measuring all the received particles, he notifies the fact to Alice and Bob. Different to the original protocol, he no longer publishes the measurement outcomes. Secondly, in step 6, once receiving the center’ s notification, Alice and Bob publish Ā ′ and . With this information, the center judges which of the received particles have been measured in correct measuring bases. Then he informs Alice and Bob of the positions of the particles which have been measured incorrectly. With the positions, Alice and Bob discard the corresponding bits in A, B, A′ , and B′ , and obtain new strings which are denoted as Ā , , Ā ′ , and , respectively. Then the center deduces a 2n-bit string C according to the corresponding 2n measurement outcomes obtained from correct measuring bases. The relationship among the bit values of Ā _j, , , and C_j is shown in Table  1, where 1 ≤ j ≤ 2n. Thirdly, in step 7, the center randomly chooses n positions out of string C and requires Alice and Bob to tell him the corresponding bits in Ā and , respectively. According to the received information and Table  1, the center checks whether there exists eavesdropping in the executing procedure of the protocol. If no eavesdropping exists, the center has successfully established a joint key with Alice and Bob. That is to say, only when Alice and Bob collaborate can they first establish a joint key with the center and then extract the secret messages from the center’ s encrypted messages later transmitted via a public channel.

So far, we have shown that the protocol proposed in Section 3 can be used for three-party QSS with some minor modifications. Nevertheless, QSS has different security requirements from QKD. On one hand, the boss (i.e., the message sender) of a QSS protocol is honest. On the other hand, the agents (i.e., sharers) of a QSS protocol may be dishonest. That is to say, some dishonest agents may cooperate to attack the protocol and try to obtain the key without the help of other agents. According to the security analysis given in Section 4, it is not hard to find that the three-party QSS we just mentioned is secure. However, when the number of agents is more than two, many more threatening attacking strategies for QSS, such as the entanglement swapping attack, ^[39] should be considered. That is to say, to extend the above three-party protocol to an n-party one, some extra strategies should be employed for resisting these attacks. As the related strategies have been discussed somewhere else, ^[40] we do not focus on this issue here.

We introduce a method for constructing encoding operations and controlling operations, which are required in the MQCP-CD. Then by employing single particles and collective detection, we present an MQKD protocol on a star network without storing qubits, which can resist attacks from both outside eavesdroppers and a dishonest center. Based on the proposed method and the idea of DFS, we also introduce three fault-tolerant versions of the proposed protocol against collective-dephasing noise, collective-rotation noise, and all kinds of unitary collective noise.

Obviously, the presented method is useful as it can be used to construct the unitary operations required in the MQCP-CD with different kinds of quantum states. Compared with the existing MQCP-CDs, ^{[34– 41]} the protocols proposed in this paper have the following advantages. First, the proposed protocols are more feasible since they do not need to employ a quantum storage machine. Second, the proposed protocols can not only utilize the collective detection, but also be immune to the collective noise.