CN108449176B - Single photon-based annular semi-quantum secret sharing method requiring classical communicator to have measurement capability - Google Patents

Abstract

The invention provides a single-photon-based annular semi-quantum secret sharing method requiring classical communicators to have measurement capability, which realizes secret sharing between one quantum communicator and two classical communicators, and any one classical communicator cannot independently obtain shared secrets. Compared with the existing semi-quantum secret sharing method, the method has the advantages that: (1) single photons are used as quantum carriers instead of product states or entangled states; (2) the particles are transported in a ring-shaped manner. The method of the invention can resist measurement-retransmission attack, interception-retransmission attack and entanglement-measurement attack. In addition, the method of the present invention has good practical feasibility at present.

Description

Single photon-based annular semi-quantum secret sharing method requiring classical communicator to have measurement capability

Technical Field

The present invention relates to the field of quantum cryptography. The invention designs a single-photon-based semi-quantum secret sharing method requiring classical communicators to have measurement capability, which realizes secret sharing between one quantum communicator and two classical communicators, and any one classical communicator can not obtain shared secret independently.

Background

Quantum cryptography provides a means of transmitting security information through the fundamental law of quantum mechanics, using the properties of quantum mechanics rather than the computational complexity of mathematical problems to achieve unconditional security. Quantum Key Distribution (QKD) is one of the core problems in Quantum cryptography. The first QKD method, the BB84 method, was proposed in 1984 by Bennett and Brassard [1 ]. After this, many other QKD methods [2-7] have been proposed. Quantum information processing has evolved to handle other cryptographic tasks such as Quantum Secret Sharing (QSS) [8-16], Quantum authentication [17-19], and Quantum Secure Direct Communication (QSDC) [20-23], among others. In 1999, Hillery et al [8] proposed the first QSS method using the three-particle entangled Greenberg-Horne-Zeilinger (GHZ) state. Guo and Guo [11] proposed a novel QSS method based on product states in 2003. In 2005, Deng et al [12] proposed an efficient QSS method based on the Einstein-Podolsky-Rosen (EPR) pair. In 2006, Deng et al [13] proposed a single photon based ring QSS method. Multi-party QSS methods [14-15] based on single photons have also been proposed. The basic concept of QSS is that a publisher distributes her secret to multiple participants using quantum mechanical techniques, and the secret can only be recovered when there are enough participants to collaborate. A secure QSS method should be able to resist attacks from external eavesdroppers and internal malicious participants.

In 2007, Boyer et al [24-25] presented for the first time the novel concept of Semi-quantum key distribution (SQKD). In this approach, Alice has full quantum capability, while Bob's capability is limited to performing the following operations in the quantum channel only; (a) sending or returning qubits without interference; (b) measuring the quantum bit by using a fixed calculation basis { |0>, |1> }; (c) preparing (new) qubits at a fixed computational basis { |0>, |1> }; (d) the qubits are reordered (by different delay lines). According to the definition of the document [24-25], the calculation basis { |0>, |1> } can be considered as a classical basis and replaced by a classical notation {0,1} because it only involves qubits |0> and |1> and not any quantum superposition states. It makes sense to implement quantum cryptography methods using as few quantum resources as possible. Therefore, researchers have shown great enthusiasm for half-quantum cryptography, and have attempted to apply the half-quantum concept to different quantum cryptography tasks such as QKD, QSDC, and QSS. Therefore, many half-quantum cryptography methods, such as SQKD methods [26-38], half-quantum secure direct communication (sqscd) methods [39-41], half-quantum secret sharing (SQSS) methods [42-49], have also been devised.

In 2010, Li et al [42] proposed two novel SQSS approaches that utilize the GHZ-like state. Wang et al [43] proposed an SQSS method in 2012 that utilizes a two-particle entangled state. In 2013, Li et al [44] proposed an SQSS method using the product state of two particles; lin et al [45] indicate that the two methods [42] of Li et al are insecure against interception replay attacks and Trojan horse attacks, respectively, by dishonest correspondents and suggest corresponding improvements; yang and Hwang [46] indicate that the non-synchronization of measurement operations between classical communicators may improve the efficiency of generating shared keys. Xie et al [47] proposed a new SQSS method based on GHZ-like states in 2015, where Quantum Alice could share a specific bit string with classical Bob and classical Charlie, instead of a random bit string. In 2016, Yin and Fu [48] demonstrated that Xie et al's method [47] was insecure when a dishonest correspondent took an intercept-replay attack, and an improved method was proposed. In summary, all previous SQSS methods [42-28] have three common features: (1) adopting a product state or an entangled state as a quantum carrier; (2) particles prepared by the quantum method propagate in a tree-like manner, as shown in fig. 1; (3) the classical party is required to have measurement capabilities.

Based on the analysis, the method of the invention uses single photons as quantum carriers to transmit particles in a ring-shaped manner as shown in fig. 2, so that secret sharing between one quantum communicator and two classical communicators is realized, and any classical communicator cannot independently obtain the shared secret. Compared with the prior semi-quantum secret sharing method, the method of the invention has the following distinct characteristics: (1) adopting single photon rather than product state or entangled state as quantum carrier; (2) the quantum-side prepared particles are transported in a ring-shaped manner.

Reference to the literature

[1]Bennett,C.H.,Brassard,G.:Quantum cryptography:public keydistribution and coin tossing.In:Proceedings of the IEEE InternationalConference on Computers,Systems and Signal Processing,Bangalore.pp.175–179(1984)

[2]Ekert,A.K.:Quantum cryptography based on Bell’stheorem.Phys.Rev.Lett.67(6),661-663(1991)

[3]Bennett,C.H.:Quantum cryptography using any two nonorthogonalstates.Phys.Rev.Lett.68(21),3121-3124(1992)

[4]Cabello,A.:Quantum key distribution in the Holevolimit.Phys.Rev.Lett.85(26),5635(2000)

[5]Hwang,W.Y.:Quantum key distribution with high loss:toward globalsecure communication.Phys.Rev.Lett.91(5),057901(2003)

[6]Li,X.H.,Deng,F.G.,Zhou,H.Y.:Efficient quantum key distributionover a collective noise channel.Phys.Rev.A 78(2),022321(2008)

[7]Zhang,C.M.,Song,X.T.,Treeviriyanupab,P.,et al.:Delayed errorverification in quantum key distribution.Chin.Sci.Bull.59(23),2825-2828(2014)

[8]Hillery,M.,Buzek,V.,Berthiaume,A.:Quantum secretsharing.Phys.Rev.A 59(3),1829-1834(1999)

[9]Karlsson,A.,Koashi,M.,Imoto,N.:Quantum entanglement for secretsharing and secret splitting.Phys.Rev.A 59(1),162-168(1999)

[10]Cleve,R.,Gottesman,D.,Lo,H.K.:How to share a quantumsecret.Phys.Rev.Lett.83(3),648-651(1999)

[11]Guo,G.P.,Guo,G.C.:Quantum secret sharing withoutentanglement.Phys.Lett.A 310(4),247-251(2003)

[12]Deng,F.G.,Long,G.L.,Zhou,H.Y.:An efficient quantum secret sharingscheme with Einstein-Podolsky-Rosen pairs.Phys.Lett.A 340(1-4),43-50(2005)

[13]Deng,F.G.,Zhou,H.Y.,Long,G.L.:Circular quantum secretsharing.J.Phys.A Gen.Phys.39(45):14089-14099(2006)

[14]Xiao,L.,Long,G.L.,Deng,F.G.,et al.:Efficient multiparty quantumsecret sharing schemes.Phys.Rev.A 69(5),052307(2004)

[15]Wang,T.Y.,Wen,Q.Y.,Chen,X.B.,et al.:An efficient and securemultiparty quantum secret sharing scheme based on singlephotons.Opt.Commun.281(24),6130-6134(2008)

[16]Hao,L.,Wang,C.,Long,G.L.:Quantum secret sharing protocol withfour state Grover algorithm and its proof-of-principle experimentaldemonstration.Opt.Commun.284(14),3639-3642(2011)

[17]

M.,Haderka,O.,Hendrych,M.,et al.:Quantum identificationsystem.Phys.Rev.A 60(1),149-156(1999)

[18]Curty,M.,Santos,D.J.:Quantum authentication of classicalmessages.Phys.Rev.A.64(6),062309(2001)

[19]Zhang,X.L.:One-way quantum identity authentication based onpublic key.Chin.Sci.Bull.54(12),2018-2021(2009)

[20]Long,G.L.,Liu,X.S.:Theoretically efficient high-capacity quantumkey distribution scheme.Phys.Rev.A 65(3),032302(2002)

[21]Deng,F.G.,Long,G.L.,Liu,X.S.:Two-step quantum directcommunication protocol using the Einstein–Podolsky–Rosen pairblock.Phys.Rev.A 68(4),042317(2003)

[22]Wang,J.,Zhang,Q.,Tang,C.J.:Quantum secure direct communicationbased on order rearrangement of single photons.Phys.Lett.A 358(4),256-258(2006)

[23]Tan,X.Q.,Zhang,X.Q.:Controlled quantum secure directcommunication by entanglement distillation or generalized measurement.QuantumInf.Process.15(5),2137-2154(2016)

[24]Boyer,M.,Kenigsberg,D.,Mor,T.:Quantum key distribution withclassical Bob.Phys.Rev.Lett.99(14),140501(2007)

[25]Boyer,M.,Gelles,R.,Kenigsberg,D.,et al.:Semiquantum keydistribution.Phys.Rev.A 79(3),032341(2009)

[26]Lu,H.,Cai,Q.Y.:Quantum key distribution with classicalAlice.Int.J.Quantum Inf.6(6),1195-1202(2008)

[27]Zhang,X.Z.,Gong,W.G.,Tan,Y.G.,et al.:Quantum key distributionseries network protocol with M-classical Bobs.Chin.Phys.B 18(6),2143-2148(2009)

[28]Tan,Y.G.,Lu,H.,Cai,Q.Y.:Comment on“Quantum key distribution withclassical Bob”.Phys.Rev.Lett.102(9),098901(2009)

[29]Zou,X.F.,Qiu,D.W.,Li,L.Z.,et al.:Semiquantum-key distributionusing less than four quantum states.Phys.Rev.A 79(5),052312(2009)

[30]Boyer,M.,Mor,T.:Comment on“Semiquantum-key distribution usingless than four quantum states”.Phys.Rev.A 83(4),046301(2011)

[31]Wang,J.,Zhang,S.,Zhang,Q.,et al.:Semiquantum key distributionusing entangled states.Chin.Phys.Lett.28(10),100301(2011)

[32]Miyadera,T.:Relation between information and disturbance inquantum key distribution protocol with classical Alice.Int.J.Quantum Inf.9(6),1427-1435(2011)

[33]Krawec,W.O.:Restricted attacks on semi-quantum key distributionprotocols.Quantum Inf.Process.13(11),2417-2436(2014)

[34]Yang,Y.G.,Sun,S.J.,Zhao,Q.Q.:Trojan-horse attacks on quantum keydistribution with classical Bob.Quantum Inf.Process.14(2),681-686(2015)

[35]Yu,K.F.,Yang,C.W.,Liao,C.H.,et al.:Authenticated semi-quantum keydistribution protocol using Bell states.Quantum Inf.Process.13(6),1457-1465(2014)

[36]Krawec,W.O.:Mediated semiquantum key distribution.Phys.Rev.A 91(3),032323(2015)

[37]Zou,X.F.,Qiu,D.W.,Zhang,S.Y.:Semiquantum key distribution withoutinvoking the classical party’s measurement capability.Quantum Inf.Process.14(8),2981-2996(2015)

[38]Li,Q.,Chan,W.H.,Zhang,S.Y.:Semiquantum key distribution withsecure delegated quantum computation.Sci.Rep.6,19898(2016)

[39]Zou,X.F.,Qiu,D.W.:Three-step semiquantum secure directcommunication protocol.Sci.China Phys.Mech.Astron.57(9),1696-1702(2014)

[40]Luo,Y.P.,Hwang,T.:Authenticated semi-quantum direct communicationprotocols using Bell states.Quantum Inf.Process.15(2),947-958(2016)

[41]Zhang,M.H.,Li,H.F.,Xia,Z.Q.,et al.:Semiquantum secure directcommunication using EPR pairs.Quantum Inf.Process.16(5),117(2017)

[42]Li,Q.,Chan,W.H.,Long,D.Y.:Semiquantum secret sharing usingentangled states.Phys.Rev.A 82(2),022303(2010)

[43]Wang,J.,Zhang,S.,Zhang,Q.,et al.:Semiquantum secret sharing usingtwo-particle entangled state.Int.J.Quantum Inf.10(5),1250050(2012)

[44]Li,L.Z.,Qiu,D.W.,Mateus,P.:Quantum secret sharing with classicalBobs.J.Phys.AMath.Theor.46(4),045304(2013)

[45]Lin,J.,Yang,C.W.,Tsai,C.W.,et al.:Intercept-resend attacks onsemi-quantum secret sharing and the improvements.Int.J.Theor.Phys.52(1),156-162(2013)

[46]Yang,C.W.,Hwang,T.:Efficient key construction on semi-quantumsecret sharing protocols.Int.J.Quant.Inform.11(5),1350052(2013)

[47]Xie,C.,Li,L.Z.,Qiu,D.W.:A novel semi-quantum secret sharingscheme of specific bits.Int.J.Theor.Phys.54(10),3819-3824(2015)

[48]Yin,A.,Fu,F.:Eavesdropping on semi-quantum secret sharing schemeof specific bits.Int.J.Theor.Phys.55(9),4027-4035(2016)

[49]Gao,G.,Wang,Y.,Wang,D.:Multiparty semiquantum secret sharingbased on rearranging orders of qubits.Mod.Phys.Lett.B 30(10),1650130(2016)

[50]Cai,Q.Y.:Eavesdropping on the two-way quantum communicationprotocols with invisible photons.Phys.Lett.A,351(1-2):23-25(2006)

[51]Gisin,N.,Ribordy,G.,Tittel,W.,Zbinden,H.:Quantumcryptography.Rev.Mod.Phys.74(1):145-195(2002)

[52]Deng,F.G.,Zhou,P.,Li,X.H.,Li,C.Y.,Zhou,H.Y.:Robustness of two-wayquantum communication protocols against Trojan horse attack.2005,http://arxiv.org/pdf/quant-ph/0508168.pdf

[53]Li,X.H.,Deng,F.G.,Zhou,H.Y.:Improving the security of securedirect communication based on the secret transmitting order ofparticles.Phys.Rev.A,74:054302(2006)

Disclosure of Invention

The invention designs a single-photon-based semi-quantum secret sharing method requiring classical communicators to have measurement capability, which realizes secret sharing between one quantum communicator and two classical communicators, and any one classical communicator can not obtain shared secret independently.

A single photon-based semi-quantum secret sharing method requiring classical communicators to have measurement capability comprises the following eight processes:

s1) the quantum communicator Alice prepares N + M single photons, wherein each single photon is randomly in one of four quantum states { |0>, |1>, | + >, and | - >, M and N are positive integers, and M is larger than N, and then sends the positive integers and the positive integers to the classical communicator Bob;

s2) Bob receives all the particles from Alice, makes two choices for them: (1) randomly selecting N particles for MEASURE; (2) REFLECT was performed on the remaining M particles. Finally, Bob sends all N + M particles in his hand to the classical correspondent Charlie;

s3) Charlie receives all the particles of Bob, and makes two choices: (1) randomly selecting N particles for MEASURE; (2) REFLECT was performed on the remaining M particles. Finally, Charlie sends all N + M particles on her hand to Alice. Here, MEASURE refers to measuring a particle with a Z-basis and preparing a new particle having the same quantum state as the measured particle, and reflex refers to sending the particle to the next receiver without interference. The Z base is { |0>, |1> };

s4) after Alice confirms that all particles of Charlie are received, Bob and Charlie respectively publish the positions of the particles for which they select MEASURE and REFLECT;

s5) Alice performs different operations on the received particles according to Bob and Charlie' S selection, as shown in table 1. Cases (c) and (d) are only used for detecting eavesdropping, and cases (c) and (d) the particles remaining after removing the particles used for eavesdropping detection in step S7 can be used for sharing the secret;

s6) Alice calculates error rates for cases (r) and (r) in table 1, respectively. In particular, in case (r), all measurements by Alice, Bob and Charlie on the respective particles should be identical if there is no eavesdropping. Alice has Bob and Charlie publish their measurements separately. Alice then calculates the error rate by comparing the measurements of their three people. If the error rate exceeds the threshold, the communication will be terminated.

In case # c, Alice's measurement will be the same as the state of the corresponding particle she prepared, if there is no eavesdropping. Alice calculates the error rate by comparing her measurements with the states of the corresponding particles she prepared. If the error rate exceeds a threshold, the communication will be terminated;

TABLE 1 operations performed by Alice in each case

ACTION 1: Alice measures particles using the Z-basis

Alice 2 measures the particles using the preparation basis itself at step S1, the preparation basis

There are two kinds { |0>, |1> } and { | + >, | - > }

S7) Alice calculates the error rates of cases (II) and (III) in Table 1, respectively. Specifically, in case 2, if there is no eavesdropping, Alice's measurement will be the same as Bob's measurement on the corresponding particle. Alice randomly selects half of the particles in case 2 and publishes their location to Bob. Bob then publishes his measurements on the corresponding particles to Alice. Alice then calculates the error rate by comparing her measurements with Bob's measurements. If the error rate exceeds the threshold, the communication will be terminated.

In case c, the measurement of Alice would be the same as Charlie on the corresponding particle if there is no eavesdropping. Alice randomly selects half of the particles in case c and announces their positions to Charlie. Charlie then publishes her measurements on the corresponding particles to Alice. Alice then calculates the error rate by comparing her measurements with Charlie's measurements. If the error rate exceeds a threshold, the communication will be terminated;

s8) after eavesdropping detection, Alice, Bob and Charlie establish a secret sharing relationship, i.e.

Wherein K_BIs a bit string consisting of the measurement results of Bob in case ② for the remaining particles after removing the particle used for eavesdropping detection at step S7, K_CIs used for stealing by removing step S7 from Charlie pair in case ③Bit string, K, formed by the measurement of the remaining particles after listening to the detected particles_AIs a string of bits that Alice is to share,

alice may derive K by performing ACTION 1 on the corresponding particle in cases ② and ③_BAnd K_C. Only when Bob and Charlie collaborate can they recover Alice's secret.

Drawings

FIG. 1 illustrates a particle transport mode employed by the tree SQSS method; FIG. 2 is a particle transport mode employed by the ring SQSS method; FIG. 3 is a model of an entanglement-measurement attack by Eve on the method of the present invention.

Detailed Description

The technical solution of the present invention is further described below with reference to the specific steps of the present invention.

1. SQSS method

Assume that there are three correspondents, Alice, Bob, and Charlie. Alice has quantum capabilities, while Bob and Charlie only have classical capabilities. The task that Bob and Charlie share Alice secret is realized by taking single photons as quantum carriers and adopting a ring particle transmission mode. In the method of the present invention, the measurement result of |0> (|1>) represents the classic bit 0 (1). The classical communicant has two operations: (1) measuring the particle with the Z-base and preparing a new particle (called MEASURE) having the same quantum state as the measured particle; (2) the particle is sent to the next recipient without interference (called REFLECT). Here, the Z base is { |0>, |1> }.

S1) the quantum communicator Alice prepares N + M single photons, wherein each single photon is randomly in one of four quantum states { |0>, |1>, | + >, and | - >, M and N are positive integers, and M is larger than N, and then sends the positive integers and the positive integers to the classical communicator Bob;

s2) Bob receives all the particles from Alice, makes two choices for them: (1) randomly selecting N particles for MEASURE; (2) REFLECT was performed on the remaining M particles. Finally, Bob sends all N + M particles in his hand to the classical correspondent Charlie;

s3) Charlie receives all the particles of Bob, and makes two choices: (1) randomly selecting N particles for MEASURE; (2) REFLECT was performed on the remaining M particles. Finally, Charlie sends all N + M particles on her hand to Alice;

s4) after Alice confirms that all particles of Charlie are received, Bob and Charlie respectively publish the positions of the particles for which they select MEASURE and REFLECT;

s5) Alice performs different operations on the received particles according to Bob and Charlie' S selection, as shown in table 1. Cases (c) and (d) are only used for detecting eavesdropping, and cases (c) and (d) the particles remaining after removing the particles used for eavesdropping detection in step S7 can be used for sharing the secret;

s6) Alice calculates error rates for cases (r) and (r) in table 1, respectively. In particular, in case (r), all measurements by Alice, Bob and Charlie on the respective particles should be identical if there is no eavesdropping. Alice has Bob and Charlie publish their measurements separately. Alice then calculates the error rate by comparing the measurements of their three people. If the error rate exceeds the threshold, the communication will be terminated.

In case # c, Alice's measurement will be the same as the state of the corresponding particle she prepared, if there is no eavesdropping. Alice calculates the error rate by comparing her measurements with the states of the corresponding particles she prepared. If the error rate exceeds a threshold, the communication will be terminated;

s7) Alice calculates the error rates of cases (II) and (III) in Table 1, respectively. Specifically, in case 2, if there is no eavesdropping, Alice's measurement will be the same as Bob's measurement on the corresponding particle. Alice randomly selects half of the particles in case 2 and publishes their location to Bob. Bob then publishes his measurements on the corresponding particles to Alice. Alice then calculates the error rate by comparing her measurements with Bob's measurements. If the error rate exceeds the threshold, the communication will be terminated.

In case c, the measurement of Alice would be the same as Charlie on the corresponding particle if there is no eavesdropping. Alice randomly selects half of the particles in case c and announces their positions to Charlie. Charlie then publishes her measurements on the corresponding particles to Alice. Alice then calculates the error rate by comparing her measurements with Charlie's measurements. If the error rate exceeds a threshold, the communication will be terminated;

s8) after eavesdropping detection, Alice, Bob and Charlie establish a secret sharing relationship, i.e.

Wherein K_BIs a bit string consisting of the measurement results of Bob in case ② for the remaining particles after removing the particle used for eavesdropping detection at step S7, K_CIs a bit string consisting of the measurement of the remaining particles from case ③ by Charlie, K, after removing the particles for eavesdropping detection from step S7_AIs a string of bits that Alice is to share,

alice may derive K by performing ACTION 1 on the corresponding particle in cases ② and ③_BAnd K_C. Only when Bob and Charlie collaborate can they recover Alice's secret.

1. Security analysis

Generally, in the QSS method, the capability of an internal communicator is stronger than that of an external eavesdropper. Document [9] states that for QSS, eavesdropping behavior by an eavesdropper (whether an insider or an external eavesdropper) will be discovered if security detection can detect eavesdropping attacks by the insider. Therefore, only the security of the SQSS method of the present invention to dishonest intercom is addressed here. In the SQSS method of the present invention, the roles of Bob and Charlie are different, and either of them may be dishonest. Thus, the security of the SQSS method of the present invention will be demonstrated for dishonest Bob and dishonest Charlie, respectively.

2.1 measurement-retransmission attack

Assume that Bob is a dishonest communicant. To obtain Alice's shared secret, Bob needs to get the bit string generated by Charlie in case 3. To achieve this, Bob may attempt a measurement-replay attack. Bob can take two measurements-a retransmission attack.

1) Bob measures all the particles from Alice and sends the measured particles to Charlie in step S2. In step S4, Bob pretends that he selected the location of the N particles of MEASURE and the location of the M particles of REFLECT. After Charlie publishes in step S4 that she selected the particle location of MEASURE and selected the particle location of REFLECT, Bob can easily get the bit string generated by Charlie in case 3. However, the attack by Bob is easily detected when the security check is performed on situation (r), because the measurement basis of Bob is not necessarily the same as the preparation basis of Alice, when both Bob and Charlie choose to perform REFLECT on particles from Alice. For example, assume that Alice sends particle | + > (| - >) to Bob at step S1, and Bob measures | + > (| - >) using the Z-base at step S2. Without loss of generality, assume Bob's measurement of | + > (| - >) collapses to |0 >. If both Bob and Charlie select REFLECT on this particle, Alice will perform Action 2 on |0 >. That is, Alice will measure |0> with the X base ({ | + >, | - >). Eventually, Alice will get either | + > or | - > with a 50% probability. On the other hand, assume that Alice sends particle |0> (|1>) to Bob at step S1. Bob measures particle |0> (|1>) with the Z base in step S2, and will not change the state of the particle. If both Bob and Charlie select REFLECT on this particle, Alice will perform Action 2 operations on this particle. That is, Alice will measure particle |0> (|1>) with the Z-base to get the correct particle state. In summary, Bob uses this measurement-the replay attack will be found with a probability of 25% in the eavesdropping detection of situation # r.

2) Bob normally executes step S2. When Charlie sends all the particles to Alice in step S3, Bob intercepts the particles and measures them using the Z basis, and then sends the measured particles to Alice. In step S4, Bob declares that he selects the particle position of MEASURE and selects the particle position of REFLECT according to his operation in step S2. After Charlie publishes in step S4 that she selected the position of the particles for MEASURE and the position of the particles for REFLECT, Bob can easily get the bit string generated by Charlie in case 3. However, this measurement-replay attack by Bob is also detected with a probability of 25% in the eavesdropping detection of situation iv. This is because when both Bob and Charlie choose to REFLECT particles from Alice, Bob's measured basis is not necessarily the same as Alice's prepared basis.

Assume that Charlie is a dishonest communicant. To obtain Alice's shared secret, Charlie needs to get the bit string Bob generates in case 2. To achieve this, Charlie may launch a measurement-retransmission attack. Charlie may in this case employ two measurements-a retransmission attack.

1) When Alice sends all the particles to Bob in step S1, Charlie intercepts the particles and measures them using the Z basis, and then sends the measured particles to Bob. In step S3, Charlie sends all the particles sent by Bob directly to Alice REFLECT. In step S4, Charlie pretends that she selected the location of the N particles of MEASURE and the location of the M particles of REFLECT. After Bob publishes in step S4 the location of the particle he selected MEASURE and the location of the particle selected REFLECT, Charlie can easily get the bit string that Bob produced in case 2. However, Charlie's such measurement-retransmission attack will be detected with a probability of 25% in the eavesdropping detection of situation iv. This is because the measurement basis of Charlie is not necessarily the same as the preparation basis of Alice when both Bob and Charlie choose to REFLECT particles from Alice.

2) In step S3, Charlie measures all particles from Bob with the Z-basis, and then sends the measured particles to Alice. In step S4, Charlie pretends that she selected the location of the N particles of MEASURE and the location of the M particles of REFLECT. After Bob publishes in step S4 the location of the particle he selected MEASURE and the location of the particle selected REFLECT, Charlie may get the bit string that Bob produced in case 2. However, Charlie's such measurement-retransmission attack will be detected with a probability of 25% in the eavesdropping detection of situation iv. This is because the measurement basis for Charlie is not necessarily the same as the preparation basis for Alice when Bob and Charlie both choose to REFLECT the particles.

2.2 interception-retransmission attacks

Assume that Bob is a dishonest communicant. To obtain Alice's shared key, Bob needs to get the bit string generated by Charlie in case 3. To achieve this, Bob may attempt to perform an intercept-retransmit attack as follows. He performs step S2 as usual for Alice' S particles. He then prepares N + M false single photons, where he chooses N single photons at the position of MEASURE to be in the same state as his measurement. After that, he intercepts the particle that Charlie sent to Alice and leaves it in his hand. Finally, he sends out his own prepared false single photons to Alice. In step S4, after Charlie announces that she selected the position of the particles of MEASURE and selected the position of REFLECT, Bob MEASUREs the corresponding particles from Charlie in his hand to obtain the bit string that Charlie produced in case 3. However, this attack by Bob is easily detected when eavesdropping is detected in either of cases (c) and (c), because the dummy particles produced by Bob are not necessarily identical to those produced by Alice.

Assume that Charlie is a dishonest communicant. To obtain Alice's shared key, Charlie needs to get the bit string Bob generated in case 2. To achieve this, Charlie may attempt to launch an intercept-retransmit attack as follows. She first prepares N + M false single photons. She then intercepts the particle sent by Alice to Bob and retains it in her hand. Finally, she sends her own prepared fake particles to Bob. Bob regards the false particle of Charlie as a normal particle, and performs step S2 as usual. Then, for Charlie, she has two attack scenarios to choose from.

1) Charlie performs step S3 with the particle sent by Bob. Charlie can then easily get the bit string that Bob generated in case 2, since he prepared fake particles by himself, after Bob publishes in step S4 the positions of the particles that he selected MEASURE and REFLECT. However, the Charlie attack is easily detected by any of the four security checks in step S6 and step S7 because the false particles of Charlie are not necessarily the same as those made by Alice.

2) Charlie performs step S3 with the intercepted Alice' S particles, rather than the particles that Bob sent to her, Bob publishes in step S4 the location of the particles that he selected MEASURE and REFLECT, and Charlie MEASUREs the corresponding particles of Bob in her hand to get the bit string that Bob generated in case ②_B。

2.3 entanglement-measurement attack

The entanglement-measurement attack from an external eavesdropper Eve consists of two parts: operating U with unitary_EAttacking particles sent by Alice to Bob and operating U with unitary_FAttack on particles returned from Charlie to Alice, where U_EAnd U_FShare one free state>A common detection volume of the characterization. As in the documents [24-25]]As noted, the shared probing state allows Eve dependent U_EThe information obtained imposes an attack on the returned particle (if Eve does not exploit this fact, the shared probe state can simply be thought of as a composite system consisting of two independent probe states). Eve makes U_FDependent on the application U_EAny attack on the latter measurement may be by a U with a control gate_EAnd U_FTo be implemented. FIG. 3 depicts the entanglement-measurement attack undertaken by Eve during the execution of the method of the present invention.

Theorem 1. assume that Eve performs on particles from Alice to Bob and particles from Charlie back to Alice (U)_E,U_F) And (5) attacking. For this attack, in order not to cause errors in step S6 and step S7, the final state of Eve 'S additional probe state should be independent of Bob and Charlie' S measurements. Thus, Eve does not get any information about Alice's shared secret。

Prior to Eve attack, the global state of the composite system composed of particles A and E is | S>_A|>Wherein | S>_AIs prepared by Alice and the state of the crystal is randomly in { |0>,|1>,|+>,|->One of four states. Executing U at Eve_EAfter operation, the global state changes to

Therein without₀₀>、|₀₁>、|₁₀>And has a₁₁>Is a non-normalized state of the probe state to which Eve is appended. It should be noted that it is preferable to provide,

when Bob receives Alice's particle, he may choose MEASURE or reflex. Charlie may also choose MEASURE or REFLECT when she receives Bob's particles. After that, Eve performs U on the particles that Charlie returns to Alice_FAnd (5) operating.

(i) First, consider the case where Bob and Charlie both select MEASURE. After Bob and Charlie operations are completed, the state of particles A and E will change

Note that in this case, Bob and Charlie both have measurements of particle A in their hands, Eve, U in order not to be discovered when eavesdropping was detected at situation ①_FThe operation should satisfy the following relationship:

U_F(|x>_A|_sx>)＝|x>_A|F_sx>， (3)

where x ∈ {0,1}, s ∈ {0,1, +, - }. equation (3) means that after operation of Bob and Charlie, U is equal to U_FThe state of particle a cannot be changed, otherwise Eve would be found with a non-zero probability in the security check of situation ①.

(ii) Next, consider the case where Bob selects MEASURE and Charlie selects REFLECT. After Bob and Charlie operations are completed, the states of particles a and E can be represented by formula (2) as well. It is noted that in this case only Bob possesses the measurement of particle a.

Suppose Bob's measurement is |0>. Eve returns Charlie to Alice's particle operation U_F. The state of the particles A and E will change due to formula (3)

On the other hand, assume that Bob's measurement result is |1>. Eve returns Charlie to Alice's particle operation U_F. The state of the particles A and E will change due to formula (3)

Therefore, according to equations (4) and (5), Eve is not found in the security detection of case (c), regardless of the measurement result of Bob.

(iii) Third, consider the case where Bob selects REFLECT and Charlie selects MEASURE. After Bob and Charlie operations are completed, the states of particles a and E can be represented by formula (2) as well. It is noted that in this case only Charlie possesses the measurement of particle a.

Suppose that the measurement result of Charlie is |0>. Particle action U on Charlie returned to Alice at Eve_FThen, the state of the particles a and E will also be changed to the formula (4) due to the formula (3).

On the other hand, assume that the measurement result of Charlie is |1>. Particle action U on Charlie returned to Alice at Eve_FThen, the state of the particles a and E will also be changed to the formula (5) due to the formula (3).

Therefore, according to equations (4) and (5), no matter what Charlie's measurement result is, Eve is not found in the security detection of situation (c).

(iv) Fourth, consider the case where Bob and Charlie both select REFLECT. After Bob and Charlie operations are completed, the states of particles a and E can be represented by formula (1). Note that neither Bob nor Charlie possess the measurement of particle a in their respective hands.

Particle action U on Charlie returned to Alice at Eve_FThen, the state of the particles A and E will also change due to the formula (3)

To avoid finding it in case of security check in case iv, we should establish the following relationship:

|F₀₁>＝|F₁₀>＝0，(7)

|F₊₀>＝|F₊₁>， (8)

|F_-0>＝-|F_-1>。 (9)

(v) fifthly, according to the formula (3), U can be obtained_F(|1>_A|₀₁>)＝|1>_A|F₀₁>And U_F(|0>_A|₁₀>)＝|0>_A|F₁₀>. Thus, it can be obtained from the formula (7)

|₀₁>＝|₁₀>＝0。 (10)

Further, substituting the formula (10) into

Can obtain

(vi) According to the formula (3), U can be obtained_F(|0>_A|₊₀>)＝|0>_A|F₊₀>And U_F(|0>_A|₀₀>)＝|0>_A|F₀₀>. By recombining formula (11), can be obtained

On the other hand, according to the formula (3), U can be obtained_F(|1>_A|₊₁>)＝|1>_A|F₊₁>And U_F(|1>_A|₁₁>)＝|1>_A|F₁₁>. By recombining formula (12), can be obtained

(vii) According to the formula (3), U can be obtained_F(|0>_A|_-0>)＝|0>_A|F_-0>And U_F(|0>_A|₀₀>)＝|0>_A|F₀₀>. By recombining formula (11), can be obtained

On the other hand, according to the formula (3), U can be obtained_F(|1>_A|_-1>)＝|1>_A|F_-1>And U_F(|1>_A|₁₁>)＝|1>_A|F₁₁>. By recombining formula (12), can be obtained

(viii) By summing up the formulae (8-9) and (13-16), there can be obtained

Ignoring the global factor, according to equations (7) and (17), the following can be concluded: if Eve ' S attack does not introduce interference in steps S6 and S7, the final state of Eve ' S probe state should be independent of Bob and Charlie ' S measurements. Thus, Eve does not get any information about Alice's shared secret.

In addition, if dishonest bob (charlie) initiates the entanglement-measurement attack shown in fig. 3, the following lemma is easily obtained in a manner similar to theorem 1.

Theorem 1, assume dishonest Bob (Charlie) proceeds on particles sent by Alice to Bob and returned from Charlie to Alice (U)_E,U_F) And (5) attacking. In order not to introduce errors in steps S6 and S7, the final state of the probe state of bob (charlie) should be independent of the measurement results of charlie (bob). Therefore, bob (charlie) does not get any information about Alice's shared secret.

Examples

1. SQSS method application example

Assume in case ② that Bob measures four particles and obtains the measurement { |0>,|1>,|0>,|1>Bob uses this measurement as its own secret K_BAt the same time, assume that Charlie also measures four particles in case ③ and obtains the measurement { |1>,|1>,|0>,|1>Charlie uses this measurement as its own secret K_C. Alice can measure the corresponding single photons using appropriate measurement bases according to the information published by Bob and Charlie. After eavesdropping detection, Alice may get K_BAnd K_CAnd Alice's secret is

Only when Bob and Charlie cooperate, can they recover Alice's secret.

2. Discussion of the related Art

In the method of the present invention, the quantum-side prepared particles are transported in a ring-shaped manner. Therefore, it is necessary to consider trojan attacks from eavesdroppers, including eavesdropping attacks of invisible photons [50] and delayed photons [51-52 ]. To prevent eavesdropping attacks of invisible photons, the receiver may insert a filter in front of his device to filter out the photon signals with illegal wavelengths prior to processing [52-53 ]. To overcome the delayed Photon Trojan attack, the receiver may use a Photon Number Splitter (PNS) to split each quantum signal of the sample into two parts and then measure the post-PNS signal with an appropriate measurement basis [52-53 ]. This attack is found if the multiphoton ratio is unreasonably high.

In addition, the method of the present invention requires the preparation, measurement and storage of single photons. Accordingly, it requires the use of quantum techniques for the preparation, measurement and storage of single photons. Fortunately, these quantum technologies are all currently achievable. Thus, the method of the invention has good performability.

2. Summary of the invention

The invention provides a single-photon-based annular semi-quantum secret sharing method requiring classical communicators to have measurement capability, which realizes secret sharing between one quantum communicator and two classical communicators, and any one classical communicator cannot independently obtain shared secrets. Compared with the existing semi-quantum secret sharing method, the method has the advantages that: (1) single photons are used as quantum carriers instead of product states or entangled states; (2) the particles are transported in a ring-shaped manner. The method of the invention can resist measurement-retransmission attack, interception-retransmission attack and entanglement-measurement attack. In addition, the method of the present invention has good practical feasibility at present.

Claims (1)

1. A ring-shaped semi-quantum secret sharing method based on single photon and requiring classical communicators to have measuring capability realizes secret sharing between one quantum communicator and two classical communicators, and any one classical communicator can not obtain shared secret independently; single photons are used as quantum carriers instead of product states or entangled states; transporting the particles in a ring-like manner; requiring classic correspondents to have measurement capabilities; the method comprises the following eight processes:

s1) the quantum communicator Alice prepares N + M single photons, wherein each single photon is randomly in one of four quantum states { |0>, |1>, | + >, and | - >, M and N are positive integers, and M is larger than N, and then sends the positive integers and the positive integers to the classical communicator Bob;

s2) Bob receives all the particles from Alice, makes two choices for them: (1) randomly selecting N particles for MEASURE; (2) REFLECT the remaining M particles; finally, Bob sends all N + M particles in his hand to the classical correspondent Charlie;

s3) Charlie receives all the particles of Bob, and makes two choices: (1) randomly selecting N particles for MEASURE; (2) REFLECT the remaining M particles; finally, Charlie sends all N + M particles on her hand to Alice; here, MEASURE means to MEASURE particles with Z-basis and prepare a new particle with the same quantum state as the measured particle, REFLECT means to send the particle to the next receiver without interference; the Z base is { |0>, |1> };

s4) after Alice confirms that all particles of Charlie are received, Bob and Charlie respectively publish the positions of the particles for which they select MEASURE and REFLECT;

s5) according to the selection of Bob and Charlie, Alice performs different operations on the received particles, as shown in table 1; cases (c) and (d) are only used for detecting eavesdropping, and cases (c) and (d) the particles remaining after removing the particles used for eavesdropping detection in step S7 can be used for sharing the secret;

s6) Alice calculates error rates of the situations (r) and (r) in the table 1 respectively; specifically, in case (r), all measurements by Alice, Bob and Charlie on the corresponding particles should be identical if there is no eavesdropping; alice lets Bob and Charlie publish their measurement results, respectively; then Alice calculates the error rate by comparing the measurements of their three people; if the error rate exceeds a threshold, the communication will be terminated;

in case (iv), if there is no eavesdropping, Alice's measurement will be the same as the state of the corresponding particle she prepared; alice calculates an error rate by comparing her measurement results with the states of the corresponding particles she prepared; if the error rate exceeds a threshold, the communication will be terminated;

TABLE 1 operations performed by Alice in each case

ACTION 1: Alice measures particles using the Z-basis

Alice measures the particles using the preparation basis of the measurement result obtained in step S1, and the preparation basis has two kinds { |0>, |1> } and { | + >, | - > }

S7) Alice calculates the error rates of the situations II and III in the table 1 respectively; specifically, in case 2, if there is no eavesdropping, Alice's measurement will be the same as Bob's measurement on the corresponding particle; alice randomly selects half of the particles in case II and publishes their positions to Bob; thereafter, Bob publishes his measurements on the corresponding particles to Alice; alice then calculates the error rate by comparing her measurements with Bob's measurements; if the error rate exceeds a threshold, the communication will be terminated;

in case c, if there is no eavesdropping, Alice's measurement will be the same as Charlie's measurement on the corresponding particle; randomly selecting half of the particles in the case III by Alice, and announcing the positions of the particles to Charlie; charlie then publishes her measurements on the corresponding particles to Alice; alice then calculates the error rate by comparing her measurements with Charlie's measurements; if the error rate exceeds a threshold, the communication will be terminated;

s8) after eavesdropping detection, Alice, Bob and Charlie establish a secret sharing relationship, i.e.

Wherein K_BIs a bit string consisting of the measurement results of Bob in case ② for the remaining particles after removing the particle used for eavesdropping detection at step S7, K_CIs a bit string consisting of the measurement of the remaining particles from case ③ by Charlie, K, after removing the particles for eavesdropping detection from step S7_AIs a string of bits that Alice is to share,

is a bit exclusive OR operation, Alice may derive K by performing ACTION 1 on the corresponding particle in cases ② and ③_BAnd K_C(ii) a Only when Bob and Charlie collaborate can they recover Alice's secret.

Images