Consider a generalization of the familiar Bell states for qudits which were introduced in Refs.  [21] and [22]. These d² maximally entangled Bell states form an orthonormal basis for the two-qudit space. The generalized d-level two-qudit Bell state has the form

where , m, n ∈ {0, 1, … , d − 1}, and [ ] means the modulo-d operation. When d = 2, these states can be reduced to the Bell states, which are usually denoted as and . Analogous to the Pauli operators for qubits, the generalized Pauli operators for the d-level quantum states are defined as

When d = 2, these local unitary operators U(0, 0), U(0, 1), U(1, 0), and U(1, 1) reduce to the four Pauli operators I, σ _X, σ _Z, and iσ _Y, respectively. Based on the idea of superdense coding, the information can be encoded by applying the encoding unitary operation U(m, n) to one particle of a generalized Bell state.

Suppose that the first particle of a d-level Bell state belongs to Alice and the second to Bob. Only by performing the local unitary operation shown in Eq.  (2) on her particle, Alice can transform the given d-level Bell state into another one.^[23] The relationship between the initial and the final d-level Bell states is described as

In the proposed protocol, the two parties of the communication will establish a covert channel inside a given QSDC channel to send secret messages. Here the given QSDC channel employs the dense coding method to encode information. In this subsection, we propose a covert layer to encode secret messages for the covert channel. The tensor product of two generalized Bell states that are encoded to carry the information in the given QSDC channel is taken as the output of the entanglement swapping for the covert layer. Encoding the output of the entanglement swapping between two generalized Bell states into a 4-bit secret message is shown as follows.

Suppose that | ϕ (u₁, u₂)⟩ ₁₂ and | ϕ (v₁, v₂)⟩ ₃₄ are shared by two distant parties, Alice and Bob. Here, Alice has particles 1, 4 and Bob has particles 2, 3. Let us review the entanglement swapping of two generalized Bell states^{[24– 26]}

where the initial states of particles 1, 2 and 3, 4 are | ϕ (u₁, u₂)⟩ and | ϕ (v₁, v₂)⟩ , respectively. Then after performing the generalized Bell measurement on the pair of particles 1 and 4, the input states collapse into one of the states | ϕ ([u₁ + k], [v₂ + l])⟩ ₁₄| ϕ ([v₁ − k], [u₂ − l]⟩ ₃₂, (k, l = 0, 1, … , d − 1) with equal probability 1/d².

If the result of the entanglement swapping between two states | ϕ (u₁, u₂)⟩ ₁₂ and | ϕ (v₁, v₂)⟩ ₃₄ is | ϕ (u₃, u₄)⟩ ₁₄ and | ϕ (v₃, v₄)⟩ ₃₂,

according to Eqs.  (4) and (5), we can find

Based on the property of the modulo-d addition, [u₃ + v₃], [u₄ + v₄] ∈ {0, 1, … , d − 1}. To embed the secret message under the cover of normally transferred information, we establish a covert layer between the secure message and the output results of the entanglement swapping of any two generalized Bell states, as follows:

where a₁, a₂ are two constants and a₁, a₂ ∈ {0, 1, … , d − 1}. In fact, s divides the output results of the entanglement swapping of any two generalized Bell states into d² classes. On the basis of Eq.  (4), there are d² possible output results of the entanglement swapping between any two generalized Bell states, i.e., each class of the output result of any two generalized Bell states has d² different elements. In addition, both u₃ and u₄ will go through the entire integer from 0 to d − 1 based on Eq.  (4). For example, when d = 3, the possible output results of | ϕ (0, 0)⟩ ₁₂| ϕ (0, 0)⟩ ₃₄ are

They are all encoded to a₁a₂ according to Eq.  (7). To improve the embedding capacity, the d² different elements in each class can be further encoded into d² different secret message substrings as follows:

where a_i is constant and a_i ∈ {0, 1, … , d − 1} (i = 1, 2, 3, 4). By this means, the covert layer for embedding secret messages based on the entanglement swapping of any two generalized Bell states can be obtained. For instance, the nine different results in the above example (Eq.  (12)) can be respectively encoded to 1111, 1112, 1110, 1121, 1122, 1120, 1101, 1102, and 1100 when d = 3 and a_i = 1 (i = 1, 2, 3, 4). It is worth noting that the covert layer is more general than that used in Refs.  [14] and [18] even d = 2, because the four constants a_i (i = 1, 2, 3, 4) are adopted in this layer. Compared with the layer used in Refs.  [14] and [18], this covert layer has a lower computational complexity, since the complicated computation of entanglement swapping is no longer needed.

Suppose that | ϕ (u₃, u₄)⟩ and | ϕ (v₃, v₄)⟩ are used to encode the information m₁m₂m₃m₄ in the given QSDC channel and the initial states of the QSDC channel are | ϕ (r, t)⟩ , according to Eq.  (3) and the superdense encoding rule, we can obtain

Based on Eqs.  (9) and (10), the relationship between the generalized Pauli transformations U(m₁, m₂), U(m₃, m₄) and the secret messages s₁s₂s₃s₄ can be obtained as

Equation  (9) or (11) is the covert layer for secret message encoding.

The capacity, or embedding payload, indicates the maximum quantity of secret messages that can be transmitted in each round of covert communication. In this protocol, the d-level Bell state instead of the 2-level Bell state is used, each generalized Bell state can be employed to encode a 2log₂d bits (2 dits) secret message by the covert layer, so the capacity is largely extended. Note that the quantum or classical cost is taken into account in some quantum communication protocols.^{[29, 30]} However, the evaluation index, capacity does not take the quantum cost into account. So the index cannot show the efficiency of the covert communication. To describes how many secret messages can be embedded by consuming a one-bit quantum state in a quantum information hiding scheme, reference  [19] introduced a new evaluation index, which is called the embedding efficiency,

where C is the embedding payload of each round of covert communication, N and d indicate that there are Nd-level quantum states consumed in a round of covert communication excluding the quantum states used for eavesdropping check, and D refers to the dimension of the quantum state. If the evaluation index illustrated in Eq.  (14) is employed to compute the transmission efficiency (E_T) of a QSDC scheme, then we can obtain E_T = 1 for a QSDC protocol based on superdense coding, for example, the transmission efficiencies of the QSDC schemes in Refs. [4]– [6] are 1.

According to Section 3, a covert channel can be built up within the given QSDC channel without consuming any auxiliary quantum state. By transferring two particles and that carry 4log₂d bits of information over the QSDC channel, Alice can send a 4log₂d-bit secret message through the covert channel. Bob can decode the information by performing generalized Bell basis measurements on the two pairs of particles and . At the same time, he can recover the embedded secret message based on the covert layer. In fact, the role that particles and play is information transmission over the QSDC channel, all the participants only need to perform classical computation in the covert channel. Since there are no auxiliary particles consumed except those in the QSDC process, the embedding payload of the proposed protocol is at least 2N log₂d bits for each round of covert communication by consuming N generalized Bell states which are used for the QSDC process. As a result, the capacity of the covert channel is the same as that of the given QSDC scheme in Ref.  [6], which achieves a higher resource capacity. To further enhance the embedding capacity, each of the middle 2-dit information substrings can be used again to encode secret messages. For example, given the contiguous carrier sequences 01, 02, 11, and 10 for d = 3, we can use 0102, 0211, and 1110 to respectively embed secret messages 1112, 2110, and 0222, in which the middle two carrier substrings 02 and 11 are used twice. In this way, a 4(N − 1) log₂d-bit secret message can be sent in a round of covert communication by transmitting 2N log₂d bits of information over the QSDC channel, i.e., C = 4(N − 1) log₂d. Because an auxiliary quantum state is consumed for each entanglement swapping of two quantum states in the two protocols in Refs.  [14] and [15], the above secret message embedding method cannot be adopted in them.

According to Step 3, each of the position information, m, corresponds a 4log₂d-bit secret message, we can draw the following conclusion.

Theorem 1 The maximum embedding efficiency of the proposed QCC protocol does not exceed 2.

Proof Assume that the position information and the embedded secret messages are transmitted using the same round of QSDC and d^{2(n − 1)} < N ≤ d²ⁿ, where N and d are the same as those used in Eq.  (14) and n is a positive integer. The total position information that can be sent in a round of QSDC does not exceed N. Because each pair of the generalized Bell states can carry a 4log₂d-bit secret message, we can obtain

By Eq.  (14), the upper bound of the embedding efficiency is

If the position information is transmitted by two or more rounds of QSDC so as to send more position information, and one of these rounds is used to transmit the embedded secret message, then C can be larger, but E_E is not changed according to Eq.  (14).

Since each of the hidden positions is different from the others and the source capacity of the QSDC channel is limited, the total position information which is sent by the QSDC is ⌊ N/n⌋ , thus

By Eq.  (14), we have

where ⌊ x⌋ rounds the element of x to the nearest integer less than or equal to x. Obviously, equation  (18) satisfies Theorem 1. Following this, we give Theorem 2.

Theorem 2 The maximum E_E of the proposed QCC protocol based on QSDC is , where d^{2(n − 1)} < N ≤ d²ⁿ, N and d indicate that there are Nd-level quantum states consumed in a round of covert communication excluding the particles used for eavesdropping check, and n is a positive integer.

Obviously, E_E may achieve the maximum possible value 2, which is almost twice that of the QSDC' s transmission efficiency when N ≤ d² (i.e., n = 1). Moreover, the larger n is, the smaller E_E can be achieved. According to Eq.  (18), E_E = 1 when n = 2 and N is an even number, which is the same as the E_T of the QSDC protocol.^[16] As we know, a QSDC scheme which combines the superdense encoding method achieves a high efficiency. So we advise N = d⁴ (d is an even number) or N = d⁴ − 1 (d is an odd number) to achieve a high efficiency for the proposed scheme.

To show that our protocol can achieve the maximum embedding efficiency, two simple examples are given below. Note that we count from the 0th (00 or 0000) hidden position in the two examples.

(i) Suppose that d = 3, n = 1, N = 9, and Alice sends the information sequences 01, 12, 10, 02, 21, 00, 11, 20, and 12 to Bob over the QSDC channel, each of the nine information sequences denotes a hidden position. According to the secret message encoding method, the 1st (01), 5th (12), 3rd (10), 2nd (02), 7th (21), 0th (00), 4th (11), 6th (20), and 5th (12) information sequences 1210, 0011, 0221, 1002, 2012, 0112, 2100, 1120, and 0011 can be respectively employed to encode the secret messages sequences 0020, 2211, 0110, 2021, 1001, 2112, 0202, 1222, and 2211. We can obtain the capacity C = 36log₂ 3 bits and the embedding efficiency E_E = 2. Thus, the maximum embedding efficiency in Eq.  (18) can be achieved when n = 1.

(ii) When n = 2, d = 3, and N = 12, the decimal form of 22 is 8 < 3², so Alice should use a 4-dit information sequence to describe a position information. Suppose that Alice sends the 12 information sequences 00, 10, 00, 20, 01, 01, 00, 22, 00, 12, 00, and 01 to Bob over the QSDC channel, each of the substrings 0010, 0020, 0101, 0022, 0012, and 0001 denotes a position information. Alice can use the 3rd (0010), 6th (0020), 10th (0101), 8th (0022), 5th (0012), and 1st (0001) information substrings 2001, 0022, 0001, 0012, 0100, and 1000 to respectively hide the secret messages sequences 0201, 0011, 1211, 2011, 1212, and 2121. So the capacity and the embedding efficiency are C = 24log₂ 3 bits and E_E = 1 = 2/n, respectively. Thus, the maximum embedding efficiency in Eq.  (18) can be achieved when n > 1.

Since most of the previous quantum information hiding protocols can embed 1 bit (qbit) in each round of covert communication, their embedding efficiency is smaller than 1. The comparison of capacity and embedding efficiency for five quantum information hiding protocols^{[12– 15, 18]} and our protocol is shown in Table  1. Obviously, the proposed scheme achieves a high embedding efficiency. The two protocols proposed by Qu et al.^{[14, 15]} have the same embedding efficiency, and our maximum embedding efficiency is three times of that of Qu’ s.

Table 1.

Table 1.

Table 1. Comparison of capacity and embedding efficiency for some protocols. Protocol Mogos[12] Liao[13] Qu10[14] Qu11[15] Fatahi[18] Our protocol Maximum capacity/bits 1 1 4N/3 8N/3 N 4Nlog2d Maximum embedding efficiency 1/3 1/2N 2/3 2/3 1/2 2

Table 1. Comparison of capacity and embedding efficiency for some protocols.

An information hiding scheme is accomplished through embedding a message in another innocuous looking object so as to keep the existence of the hidden data secret. The invisibility is the primary and foremost requirement of an information hiding algorithm because the strength of the information hiding scheme depends on its ability of not being (or hardly being) detected. According to the quantum uncertainty theorem and the no-cloning theorem, the imperceptibility of a quantum information hiding scheme has some natural advantages compared with a classical one. In fact, the protocol including the above Steps 1– 5(i) excluding Steps 1(iii) and 3(ii) is just a QSDC protocol. The imperceptibility of the proposed QCC scheme mainly lies in the invisibility of the covert channel.

If the eavesdropper, Eve, attempts to detect the covert channel between Alice and Bob, she can either observe the abnormity caused by the covert communication directly or observe the abnormity of particles from Alice to Bob by performing measurements on the intercepted particles. For the former, it is completely impossible to find out the abnormity, since the proposed QCC protocol that does not consume any auxiliary quantum state seems the same as a QSDC scheme. That is to say, there is no abnormity between the proposed protocol and the QSDC protocol, so Eve has no chance to discover the covert channel. For the latter, Eve can adopt the intercept– resend attack or the auxiliary particle attack. No matter what kind of attack she adopts, it is inevitable to introduce errors that would be detected by Alice and Bob. As a result, Eve fails to find the abnormity of particles from Alice to Bob by the intercept– resend attack or the auxiliary particle attack. Even if she can successfully escape the eavesdropping check via the auxiliary particle attack, Eve can only obtain the measurement result of in sequence T on condition that she chooses the correct measurement basis. Since it is impossible to speculate the whole generalized Bell state | ϕ (m, n)⟩ only by without knowing , Eve does not know the information carried by in QSDC. Due to the difficulty of getting the hidden position information m, that is guaranteed by the security of the QSDC protocol, Eve is incapable of getting the right position information of the hiding data from the QSDC channel. Consequently, the imperceptibility of the proposed protocol can be guaranteed.

The security of an information hiding protocol means that the protocol can prevent the secret messages from being attacked or eavesdropped by most of the possible quantum attacks. The QSDC protocol used in this paper seems the same as that in Ref.  [5] except the eavesdropping check. From the point view of cryptography, these two QSDC schemes which can be regarded as the same have the same security. Because of the excellent imperceptibility of the proposed protocol, the existence of the covert channel established within the given QSDC channel is imperceptible, while the existence of the QSDC channel is perceptible. From this point of view, the proposed QCC scheme is at least as secure as the QSDC.^[5] Even if some information of the given QSDC channel is revealed, the eavesdropper cannot read out the secret messages without knowing the secret key a_i.

Due to the remarkable effects of the eavesdropping check technique with decoy photon, which are shown in many quantum communication protocols, ^{[27, 28]} any eavesdropper hidden in the quantum channel will be detected, and the proposed protocol can resist all serious attacks brought forward in recent years including the man-in-the-middle attack, the intercept– resend attack, and the auxiliary particle attack. By two rounds of eavesdropping check, the eavesdropper Eve can neither pretend to be Alice nor pretend to be Bob. As a result, Eve can obtain neither the carrier sequence nor the embedded sequence, thus all the classical steganalysis methods shown in Ref.  [31] are ineffective. Moreover, since a high-level QSDC protocol provides better security than that obtained with 2-level Bell states, ^[5] the security of this protocol based on the d-level Bell states is higher than that in Ref.  [14] and [18] which is based on the 2-level Bell states. Therefore, the proposed protocol has a high security.

As illustrated in Ref.  [5], the QSDC scheme can be used in a noisy channel with the help of quantum privacy amplification by quantum purification and quantum error correction, so the proposed QCC protocol can also be used in a noisy channel in the same way.

To strengthen the performance of the proposed QCC protocol, two possible variations are presented in this section.

Based on the entanglement swapping of d-level Bell states, a covert layer between the output results of the entanglement swapping of any two d-level Bell states and the secret message is established. Under the control of the covert layer, a covert channel can be built up within the QSDC channel to transfer secret messages without consuming any auxiliary quantum state or extra communication resource except the QSDC. Compared with the quantum covert channel protocols in Refs.  [14]– [17], this quantum covert channel protocol has three remarkable features. Firstly, this protocol has a low computation complexity. Because high-level Bell states, high-level unitary transformations, and the entanglement swapping between two high-level Bell states all have general term formulas, the complex computation of entanglement swapping is no longer needed. Secondly, this protocol has a high embedding efficiency because it consumes no auxiliary quantum state. Thirdly, this protocol has a large capacity since the high-level quantum states instead of the 2-level quantum states are employed. Furthermore, the performance analysis shows that the proposed protocol has a good imperceptibility and a high security.

The proposed QCC scheme is aimed to perform covert communication with high security. It can be used to covertly transfer secret documents for the government and the military. From a practical point of view, we can transfer any 8 bits (1 byte) secret message, which is an ASCII code and widely used in classical information coding, using 4-level Bell states. Similarly, a decimal (octal or hexadecimal) encoded secret message can quickly be sent using 10-level (8-level or 16-level) Bell states. As mentioned in Refs.  [14] and [15], the QCC protocol can be employed to achieve another two purposes: identity authentication and distributed transmission of both common information and secret messages which have different security requirements.