Introduction

The quantum key distribution (QKD) protocol, which is based on the principles of quantum mechanism, is unconditionally secure in theory1,2. For a review, see, e.g. Ref. 3. In practice, however, a QKD system still has security loopholes due to the gap between theory and practice. Various attacks have been successfully launched through the exploration of these loopholes, e.g. a time-shift attack4,5, a phase-remapping attack6, a blinding attack7,8 and so forth9,10,11. To close this gap, the first method is to build precise mathematical models for all the devices and refine the security proofs to include these models12. However, this method is challenging to implement due to the complexity of QKD components. In addition, a device-independent QKD (DI-QKD) was proposed13,14. In DI-QKD, the legitimate participants during the process of communication, namely, Alice and Bob, do not need to obtain precise mathematical models for their devices and all side-channels can be removed from QKD implementations if certain requirements can be satisfied. However, the implementation requires a loophole-free Bell test, which is still out the scope of current technology. Instead, a new protocol, measurement-device-independent QKD (MDI-QKD)15 (for a review, see ref. 16), was proposed. This protocol is fully practicable with current technology. Unlike security patches17,18, MDI-QKD can remove all detector side-channel attacks. This kind of attack is arguably the most important security loophole in conventional QKD implementations7,8,9,10,11,19. The measurement setup in MDI-QKD can be fully untrusted and even manufactured by Eve. The experimental feasibility of MDI-QKD has been demonstrated in both the laboratory and field tests20,21,22,23. MDI-QKD has also attracted a lot of scientific attention from theoretical side24,25,26,27,28,29,30,31. In addition to the application in QKD, MDI technique can also be used in other quantum information processing tasks, such as MDI entanglement-witness32.

In addition to the two-party QKD protocol, researchers have also proposed various multi-party QKD protocols. Generally, there are three types of multi-party QKD schemes. The first one is based on a trusted center (TC)33, in which each user shares a secret key with the TC and builds a common session key. The second one is an entanglement-based multi-party QKD protocol. Cabello proposed a multi-party QKD protocol that uses Greenberger-Horne-Zeilinger (GHZ) states34 and that is an extension of a two-party entanglement-based QKD protocol2. Chen and Lo proposed a wide class of distillation schemes for multi-party entanglement, which have been applied to implement conference key agreement35,36. The third one is a multi-party QKD protocol without the use of entanglement and TC. Matsumoto proposed a QKD protocol in which Alice sends the same qubits sequence to Bob and Charlie respectively and the qubits with coincident bases are used to build a secret key after post-processing37. In the first type of scheme, information may be leaked since pre-shared secret bits are used repeatedly. In the second type, a perfect GHZ state should be prepared. In the third type, two prepare-and-measure QKD processes are implemented. Nevertheless, up until now, a key weakness of all multi-party quantum cryptographic protocols is the assumption that the measurement devices are trusted. As aforementioned, the occurrence of many quantum hacking attacks indicates that this is a highly unrealistic assumption.

In order to remove the demanding requirement for trusted measurement devices, we focus our attention on multi-party MDI-QKD. Appropriate entanglement states and their analyzers are the premises for the design of a multi-party MDI-QKD protocol. An elegant GHZ-type multi-party MDI-QKD protocol has been recently proposed in ref. 38 and this protocol shows that three-party MDI-QKD is highly feasible in practice. However, ref. 38 is primarily limited to three participants and in a situation with more participants, the GHZ-type MDI-QKD is restricted to a very low key rate. Another potential candidate to build multi-party MDI-QKD is cluster state, but an efficient cluster-state analyzer based on linear optics remains unknown. Therefore, in a large-scale quantum Internet, a better analyzer and a different type of entanglement state are essential and required in order to design a multi-party MDI-QKD protocol and to obtain a high key rate.

W-state is a category of multi-particle entanglement state that can be used in a number of quantum information processing protocols39. W-state can be generated by type-II spontaneous parametric down-conversion (SPDC) and linear optical components40,41. In comparison with GHZ state, an important property of W-state is that, if one particle is traced out and projected into a specified state, the remaining particles are still entangled. That is, W-state is highly robust. Nonetheless, a W-state analyzer, which would enable the state of multiple particles to be projected into a W-state, still has to be constructed properly.

Here, we, for the first time, propose a multi-party QKD protocol based on W-state. We present the application of W-state in multi-party QKD and construct a new W-state analyzer to distinguish the four-qubit W-state, based on linear optics only. With this analyzer, a four-party W-state MDI-QKD protocol is proposed. In this protocol, the four users, Alice, Bob, Charlie and David, each send BB84 qubits to the central relay, Emma, with a W-state analyzer. The qubits with successful measurement outputs and coincident bases are used to build a secret key. The results show that the scheme is highly feasible for practically distributing the post-selected-state entanglement and for generating secure keys over a distance of more than 150 km standard telecom fiber for experimentally accessible parameter regimes. With state-of-the-art high-efficiency detectors, four-party MDI-QKD is feasible over 250 km fiber. We remark that, our protocol can be extended to the case with more participants and still remain a high key rate. All these features move an important step towards practical multi-party quantum communication.

Results

W-state and its analyzer

In this section, a group of four-particle entanglement W states is introduced and a four-particle W-state analyzer based on linear optics is proposed.

W4 state. The standard n-qubit W-state is defined by ()42

If n = 4, the four-qubit W-state is given by

There are nine families of states that correspond to nine different ways of entangling four qubits43. For W-state, the widely used state is the standard one, given by equation (2). Here, based on the W4 state, 16 four-qubit W states can be constructed and these states appear in Supplementary I. All these W4 states form a group of orthogonal bases in a 16-dimensional Hilbert space. Any four-qubit state can be expressed as a linear combination of these 16 W4 states. The protocol proposed in this paper is based on these states.

A four-photon W4 state analyzer

The tomography of W-states has been a hot topic in recent years44,45,46. However, the method for designing an analyzer to verify a W-state is still an open question.

In fact, a four-qubit W4 state can be expressed by Bell states, which is presented as below.

where , and are three Bell states. From equation (3), we find that it is possible to design a W4 state analyzer based on a Bell-state analyzer. Indeed, this is our method to construct the W4 state analyzer.

Generally, with an optimal linear optics-based scheme and without the use of auxiliary photons, only two out of four Bell states can be distinguished47. However, an important time-bin-based Bell-state analyzer can distinguish three out of four Bell states48. Its schematic representation is shown in Fig. 1. In this scheme, the qubit is encoded with time bins49. The qubit () corresponds to a photon in state () under Z-basis, or in state under X-basis, where and is a constant time. The device consists of two beam splitters, and , two fibers with time delay and two single photon detectors, and , all of which build a time-bin interferometer.

Figure 1
figure 1

A schematic diagram of Bell-state measurement48.

and are ideal 50/50 optical beam splitters that have equal reflection and transmission coefficients and no absorption loss. The delay derived from the path length difference of the interferometer equals . When two qubits enter the interferometer, the output state is a mixture of photons in two spatial modes ( and ) and three temporal modes ( and ). Three Bell states can be distinguished through an analysis of different combinations of these modes of photons.

Full size image

In Fig. 1, let denote the creation operators in spatial mode () and temporal mode ( for modes ; for modes and ). After passing through , let the relative phase between the transmitted light field and the reflected light field be ., then the operators evolve as follows50

Next, after the time-bin interferometer, the creation operators evolve into

where δ is the phase derived from the path length difference in the interferometer48. Equations (6) and (7) indicate that the photons may arrive at D1 or D2 at different time instants, , , or , according to input states, as shown in Fig. 1. From the output coincidence, in principle, Bell-states can be detected with 100% probability and and can be detected with 50% probability, respectively48.

The W-state analyzer shown in Fig. 2 is proposed. The qubits and are also encoded with the time-bin. At the first stage, the states of the photons in spatial modes and b evolve into the states at modes e and f, according to equations (6) and (7). In ways that are also similar to equations (6) and (7), the states of the photons in spatial modes c and d evolve into the ones in modes g and h; the ones in modes f and evolve into the ones in modes j and k; the ones in modes e and h evolve into the ones in modes l and m.

Figure 2
figure 2

A schematic diagram of a W-state analyzer.

The analyzer consists of four time-bin interferometers. Each interferometer is the same as the one shown in Fig. 1. Two photons from port A and B enter into the interferometer I. The photon in spatial mode enters into interferometer IV and the photon in spatial mode f enters into interferometer III. Another two photons from port C and D enter into interferometer II. The photon in spatial mode enters into interferometer III and the photon in spatial mode h enters into interferometer IV. The state of photons at the output is in a superposition state of four spatial modes () and four temporal modes (and ). By analysis of different combinations of these modes, four out of sixteen -states can be distinguished.

Full size image

After and , the states of photons evolve into

Based on equations (6, 7, 8, 9, 10, 11), the output detection modes of each of 16 W4 states can be obtained. As an example, the state is discussed. Its operator form is

Then, by using equations (6, 7, 8, 9, 10, 11), evolves into

There are 200 terms in equation (13). That means that the output state is a superposition of 200 states. Each of the states is called a detection mode. Here, detection mode means SPD clicks at some spatial modes and time-bins; e.g., means that photons clicks occur in spatial modes s, u, v and w at the time instant ti, tj, tk and tl , respectively. means that two photons arrive in mode at . One photon occurs in u mode at and one photon occurs in v mode at time , respectively. The spatial and temporal modes are shown in Fig. 3.

Figure 3
figure 3

The spatial and temporal modes at the output of the W-state analyzer.

There are four spatial modes (i.e., and ) and four temporal modes (i.e., and ). The time separation between time-bins is . The output state is a superposition of spatial modes and temporal modes.

Full size image

All detection modes of 16 W4 states have been obtained. By comparing the detection modes among different states, the unique modes belonging to one specific state are obtained. These modes make one state distinguishable from the others. Here, only the modes in which the SPD click derives from one photon are taken into account; i.e., all four SPDs in each mode have a click. There are four W4 states, i.e., , , and , that can be identified with the proposed analyzer. Their detection modes are shown in Table 1. The success rate is determined by the corresponding coefficients of output states. For states and , the probability of successful detection is For states and , the probability of successful detection is Therefor the total success probability is . These four states can be applied to build keys among four users, a process that will be discussed in the next section.

Table 1 Distinguishable W4 states and their detection modes.
Full size table

It is worth mentioning that four other states, i.e., , , and , can also be distinguished if photon-number-resolving detectors can be used. In addition, the detection probabilities of states , , and can also be increased with this type of detector.

Measurement-device-independent quantum key distribution based on W-state

In this section, we propose a four-party MDI-QKD protocol based on W4 state and the analyzer presented in the previous section. The security of the protocol is also proved.

The protocol. Conceptually, the four-party MDI-QKD can be implemented based on a time-reversal W4 state protocol. In this protocol, each of the four users can prepare an entangled EPR photon pairs, keep one photon from each pair and send the other photon to the central relay. Then projective measurement on the state of the photons can be performed by the relay. If the state is projected into a W4 state by the relay, the state of the remaining four photons in the users is projected to the same W4 state. Through the use of the idea of a virtual qubit16, a four-party MDI-QKD scheme can be constructed.

The proposed setup of four-party MDI-QKD protocol is shown in Fig. 4. There are four participants, i.e., Alice, Bob, Charlie and David. Photons from single photon sources (SPS) are encoded with time-bin. Generally, weak coherent pulse (WCP) sources combined with decoy state technology51,52,53 can also be used to replace the SPS. Here, SPS is used to simplify the discussion.

Figure 4
figure 4

Basic setup of a W4-based four-party MDI-QKD protocol.

Alice, Bob, Charlie and David prepare single photon pulses in a different BB84 time-bin coded state, which is selected independently and at random for each signal. The time-bin encoder can follow the design proposed in ref. 20. Inside the measurement setup, signals from Alice, Bob, Charlie and David are sent into a W-state analyzer (see Fig. 2). Successful output corresponds to the observation of one of four W4 states shown in Table 1. The four participants’ laboratories are well shielded from the eavesdropper and the measurement setup can be untrusted.

Full size image

The procedures of the protocol are as follows:

  1. 1

    Preparing: Each one of the participants, i.e., Alice, Bob, Charlie and David, prepares single photons, which are in the four possible BB84 time-bin states (i.e.,, , and ) and sends them to an untrusted relay, Emma, with an analyzer in the middle. The preparation processes are implemented by single photon sources and a time-bin encoder.

  2. 2

    Measuring: Emma performs W4 state measurement by using the analyzer in Fig. 2. Then the incoming signals are projected into a W4 state.

  3. 3

    Sifting: Emma uses public channels to announce the events in which she obtained successful outputs; i.e., some of the states in Table 1 are identified. When all participants use the rectilinear (Z) basis, two of them announce their bits and the other two perform operations according to the scenarios shown in Table 2.

    Table 2 Four participants’ post-selection after Emma announces a successful output of states or ( or ).
    Full size table

    In addition to the case that all participants encode their qubits in Z basis, another case is that they encode their qubits in X basis. For the latter, the W-states can be described as states and , e.g.,

    and

    In this case, the first two announce the values of the qubits (  or ) and the other two perform phase error rate estimation.

  4. 4

    Post-processing: After obtaining the sifted key, the two participants perform information reconciliation and privacy amplification. The suggestion is that an error correction code-based reconciliation protocol be used, since the interactive protocol, e.g., Cascade54, requires many communications. A low-density parity-check (LDPC) code-based reconciliation scheme55 can be used.

Security analysis

The security of the four-party W-state-based MDI-QKD protocol is inspired by the security of a time reversed W-state-based QKD protocol.

First, we briefly introduce the W-state-based QKD protocol. In a three-party W-state-based QKD protocol, three particles in W3 state are distributed to three participants respectively. The announcement of the measurement bases and the measurement results of one participant enables the other two to perform key distribution or security verification. The protocol can be extended to the one with four participants. Compared with a three-party QKD protocol, in the one with four participants, two participants announce their measurement bases and results and the other two are in a maximally entangled Bell state and can obtain a secret key.

Secondly, it can be demonstrated that a time reversed W-state-based QKD protocol exists as the same as the time reversed EPR protocol56. With reference to the two-party MDI-QKD protocol15, the idea of a virtual qubit is also used. One can imagine that each of four participants prepares an EPR entanglement state, sends one qubit to Emma and retains the other qubit as a virtual qubit. The virtual qubit is subsequently measured and a BB84 state is thus prepared. In principle, each one could keep his or her virtual qubit in his or her memory and delay his or her measurement of it. Only after Emma has announced that she has obtained a successful outcome will each perform a measurement on his or her virtual qubit in order to decide which state he or she is sending to Emma. Furthermore, it is shown that W-state can be prepared among four participants by entanglement swapping, while each participant prepares an EPR pair initially. So, in such a virtual qubit setting, the protocol is equivalent to an entanglement-based protocol. Alice, Bob, Charlie and David share quadruple qubits in their quantum memories and they can compute the quantum bit error rate (QBER) on their virtual qubits on a special basis.

Key rate of the four-party MDI-QKD protocol

The key rate of the W-state-based MDI-QKD protocol is evaluated with SPS. According to the procedures described in the previous section, any two participants can build a secret key after Emma announces successful outputs and the other two participants’ classic bits are 00 or 11. So the key rate can be obtained by referring to the case of two-party MDI-QKD15 and to the basic work of Shor and Preskill57. The difference between the four-party and the two-party MDI-QKD is that the gain in the four-party one refers to the joint probability that Emma announces successful output and two of participants’ classic bits are 00 (or 11), according to Table 2. Since any two participants can build a secret key, the maximum information loss value in data reconciliation and the privacy amplification processes of each pair are considered. So the key rate can be given as

where () denotes the QBER between participants j and k under X (Z) basis, given that each of Alice (), Bob (), Charlie () and David () sends single photon states, ; denotes the gain (the joint probability of Emma’s announcement of a successful detection in the Z basis and also of the announced classic bits being 00 or 11, according to Table 2). means the basis reconciliation factor; is the binary entropy function with parameter given by .

In this protocol, the QBER in Z basis equals the one in X-basis under SPS, i.e. . The assumption is that there is no misalignment error, that the data size is infinite and that the ideal reconciliation algorithm is applied. There is also an assumption that the quantum channels between the participants and Emma are identical. For the sake of simplicity, if we assume to be , then equation (16) can be reduced to

Let the probability of Z basis be nearly one, i.e., . can be estimated as (the detailed for obtaining and are shown in Methods and Supplementary III)

and the QBER as

where is the channel transmittance between the participant and the analyzer, ; and are the attenuation coefficient and fiber length between the participant and analyzer and is the detection efficiency of a single photon detector. Here, it is assumed that each SPD at each time instant has the same detection efficiency.

In numerical simulation, the parameters include the detection efficiency , the background count rate and the attenuation coefficient . Let be and be 6.02 × 10−6. These values are chosen from the 144-Km QKD experiment reported in ref. 58. A superconducting nanowire single-photon detector (SNSPD) with a detection efficiency of 93%, as reported by Marsili et al.59, is also used. Parameter is set by a typical value, . The simulation results of the asymptotic key rate are shown in Fig. 5. The secure transmission distance between two participants is about 180 km for a detection efficiency of 14.5% and is about 260 km for a detection efficiency of 93%. The distance is 100 km and 180 km for two detectors when the key rate is about .

Figure 5
figure 5

Key rates with different detection efficiencies.

Both curves are key rates with single photon sources (SPSs). The solid curve is the one with a detection efficiency of 14.5%. The dash-and-dot is the one with the higher detection efficiency of 93%.

Full size image

Discussion

In practice, the SPS may still be challenging with current technology. However, based on the so-called decoy state method51,52,53, one can simply replace the SPS with weak coherent pulses (WCP) or parametric down- conversion (PDC) sources. As noted already in ref. 38 regarding the three-party MDI-QKD, the decoy state analysis and the finite-key analysis are similar to the initial two-party MDI-QKD protocol24,25,26,27,28. Therefore, the expectation is that, with decoy states, the results here can be easily extended to the cases with WCP and PDC sources.

In our proposal, any two of four parties can share a secure key bit. This is compatible to the usual network scenario, in which any two parties in the network can perform secure communications. There are several advantages as compared to the initial two-party MDI-QKD protocol. First, our proposal is faster in sharing key bits when the parties are reassigned. This is because the quantum channel is not required to be initialized. Second, the group key can also be built if one party serves as a controller. Finally, the initial MDI-QKD requires a clever design of fast and low-loss optical switches for a network setting, which might be challenging in a large-scale network. In contrast, our scheme does not have such requirement.

In the conclusion, we proposed a four-party W-state-based MDI-QKD protocol, in which any two of four participants can build secret keys, when the W-state analyzer announces a successful output and the other two participants’ classic bits sent are 00 (the distinguished states are or ) or 11 (the distinguished states are or ). Since the time-bin coded MDI-QKD protocol was verified to be feasible20,22,29 and several schemes of SPS (e.g. quantum dot SPS)60 have been presented, the proposed W-state analyzer can be implemented with current technology. The work presented here puts forward an important avenue for practical multi-party quantum communication.

Methods

W-state preparation based on entanglement swapping

A process of entanglement swapping for generating W4-state is shown in Fig. 6.

Figure 6
figure 6

A schematic diagram of entanglement swapping for generatingstate.

Each of Alice, Bob, Charlie and David prepares an EPR pair and sends half of them to Emma with a State analyzer.

Full size image

In Fig. 6, all the photon pairs A and , and , and , and are in Einstein-Podolsky-Rosen (EPR) entangled states. When the state of 4 photons, and , are projected into to any W4 state, the state of remaining four photons , and , is projected into the corresponding W4 sate. The detailed processes are shown in Supplementary II.

Estimation of Q1 and e1

We assume that there is no misalignment error (i.e. all mismatches in quantum channels are perfectly compensated), the four optical channels are identical and ideal single photon sources are used. Therefore, the qubit error derives from dark counts of SPDs. As mentioned in Results, we only take into account the case in which SPD count in each spatial-temporal mode derives from no more than one photon.

For Emma, a successful output can be obtained from five cases: (1) all four counts of SPDs derive from background noise (dark counts); (2) one count derives from photon detection and the other three counts derive from background noise; (3) two counts derive from photon detections and the other two counts derive from background noise; (4) three counts derive from photon detections and the other one derives from background noise; (5) all four counts derive from photons. We assume that Alice (a) and Bob (b) announce their classical bits, while, Charlie (c) and David (d) try to generate secret key bits. In cases (2)–(5) we compute the output states of photons successfully passing through the analyzer and their probabilities. Then, we obtain the gain at each case according to the modes in Table 1. The details for obtaining and are shown in Supplementary III.

Additional Information

How to cite this article: Zhu, C. et al. W-state Analyzer and Multi-party Measurement-device-independent Quantum Key Distribution. Sci. Rep. 5, 17449; doi: 10.1038/srep17449 (2015).