Introduction

In many multiprocess networks, including data transfer networks, telecommunications networks, the global positioning system and long baseline interferometry, the individual processes need to have clocks that must be synchronized with one another1,2. To this purpose, individual processes' clocks must periodically be resynchronized. This motivates the need for clock synchronization algorithms which work despite the faulty behavior by some of the processes. Faulty behavior can occur due to a variety of causes, including crashing, transmission failure and distribution of incorrect or inconsistent information in the network3. A clock synchronization algorithm should achieve the following tasks: C1) For any given instant, the time of all nonfaulty processes' clocks must be the same. This is necessary, but not sufficient, since simply stopping all clocks at zero satisfies C1. We therefore need to assume that a process' logical clock also keeps the rate of its corresponding physical clock. In addition, synchronizing may cause further errors, so we require that: C2) There is a small bound on the amount that a process' clock is changed during synchronization4.

Reliable clock synchronization algorithms can be complicated. To simplify the problem we shall work under the following assumptions4: A1) Initially, all clocks are synchronized to the same value. Physical clocks typically do not keep perfect time but drift with respect to one another. This motivates the following assumption: A2) All nonfaulty processes' clocks run at one second in clock time per second in real time. A general problem arises from the clocks continuously changing during the synchronization procedure. Unless the synchronization algorithm is very fast, this will cause problems. This motivates our last assumption: A3) A nonfaulty process can read the time difference between the clock of another process and its own.

A method to achieve synchronization is to use interactive consistency algorithms (ICAs) in which all nonfaulty processes reach a mutual agreement about all the clocks4. An ICA should satisfy that, for every process p: (1) Any two nonfaulty processes obtain the same value of process p's clock, even if p is faulty. (2) If p is nonfaulty, then every nonfaulty process obtains the value of p's clock. The synchronization problem can classically be solved using recursive algorithms if and only if less than one-third of the clock are faulty.

The conditions for an ICAs are similar to the ones of the problem of Byzantine Agreement (BA) in the case of which: (i) All nonfaulty processes obtain the same value and (ii) if process p is nonfaulty, then all nonfaulty processes obtain the value it sends4,5. Nevertheless, it has been shown that even quantum methods cannot solve the BA if one-third or more of processes are faulty6.

However, for most applications, including clock synchronization, it is sufficient to consider a scenario called detectable Byzantine agreement (DBA) or detectable broadcast7,8. In this case, conditions (i) and (ii) are replaced with: (i′) either all nonfaulty processes obtain the same value or all abort and (ii′) if process p is nonfaulty, then either every nonfaulty process obtains the same value or aborts. By “abort” we mean treating the value as undefined and exiting the protocol.

Classical ICAs can only achieve DBA if less than one-third of the processes are faulty4 and agreement is achieved by majority voting using a recursive algorithm, called OM(n), where n is the number of faulty processes. The OM(n) algorithm works as follows. We label the processes as Pk, with k = 1, 2, …, m. If n = 0, then P1 distributes its value to every other process. Every process uses the value received from P1 and, in case no value is obtained, uses 0. If n > 0, then P1 distributes its value to every other process. For k = 2, …, m, let xk denote the value obtained by Pk from P1. If Pk receives no message, then let xk = 0. Pk acts as P1 in algorithm OM(n − 1) by distributing xk to the remaining m − 2 processes. For every k and for all j ≠ k, let xj be the value received by Pk from Pj using OM(n − 1) and in case no value was received xj = 0. Pk decides on the value obtained from the median of (x1, …, xm). Thus, OM(n) requires O(mn+1) transmitted messages to solve the task.

The DBA is an example of a communication task for which quantum resources can provide a solution, while classical tools cannot. Nevertheless, the special case of DBA in a three process network with one faulty process, has been solved using quantum methods based on three-qutrit singlet states7,9, four-qubit entangled states10 and three8 or two12 pairwise quantum key distribution (QKD) channels and experimentally demonstrated using four photon-polarization entangled state11.

Interestingly, later works have shown that there are quantum solutions for certain communication complexity problems and secret sharing tasks which do not require entanglement, but, instead, sequential communication of a single quantum system13,14. These protocols have been shown to be much more resistant to noise and imperfections and significantly more scalable than protocols based on entanglement.

In this article, we introduce a quantum algorithm that solves the DBA and achieves clock synchronization in the presence of an arbitrary number of faulty processes, with only one single round of message passing per process independently of the number of faulty processes, utilizing only a single quantum system.

In order to solve the DBA problem, the m processes need to share data in the form of lists lk, of numbers subject to specific correlations and the distribution must be such that the list lk held by process Pk is known only by Pk. Quantum mechanics provides methods to generate and securely distribute such data, here we shall seek for one which is simple, efficient and easily extendible to an arbitrary number of processes. We assume that all processes can communicate with one another with oral messages by pairwise authenticated error-free classical channels and pairwise authenticated quantum channels.

Correlated lists and their use

The initial stage of the quantum protocol is to distribute lists lk, for k = 1, …, m, each of them available only to process Pk. All lists have to be of the same length L and are required to satisfy the property that if N = 0 (or 1) is at position j in l1, then 0 (respectively, 1) is at position j in lists lk for k = 2, …, m (i.e., they are perfectly correlated). However, if N ∈ {2, …, m − 1} is at position j in l1, then the sum of numbers at positions j in lists lk for k = 2, …, m equals m − N and all elements in these lists are either 0 or 1. Given an N, all the possible combinations of binary numbers satisfying the condition are uniformly probable.

Note that, on one hand, P1 has information about at which positions the lists of all other processes the values are perfectly correlated and at which positions they are random bits, with the property that their sum is anticorrelated with the value, N ≥ 1, in lk. On the other hand, the holder of one the lists lk, with k = 2, …, m, has no information whatsoever on whether the lists are correlated at a given position or not.

Once the processes have these lists, they can use them to achieve mutual agreement and solve the DBA by applying the algorithmic part of the protocol, which we shall call QB(n, m). The special case, QB(1, 3), reproduces the protocol in11.

  1. 1

    P1 sends bit-valued messages to all processes. The message sent to process Pk will be denoted by m1,k. Together with each message, P1 sends a list l1,k of all of the positions in l1 in which the value m1,k appears. If P1 is nonfaulty all lists and messages are identical. The full information which Pk receives from P1 will be denoted by {m1,k, l1,k}.

  2. 2

    The receiving processes Pk analyze (singlehandedly) the obtained lists and messages. If the analysis of Pk shows that l1,k is of appropriate length (i.e., about L/m) and {m1,k, l1,k} is consistent with lk at all positions, then if Pk is nonfaulty, it conveys {m1,k, l1,k} to all other processes Pk≠1. A faulty process sends a flipped bit value of the message with whatever list it chooses. The full information which Pj receives from Pk will be denoted by {mk,j, lk,j}. A nonfaulty Pk will also decide on the final bit value it adopts Vk. This is m1,k, unless messages from the other processes force it to decide that P1 is faulty. However, if {m1,k, l1,k} is not consistent with lk, then Pk immediately ascertains that P1 is faulty and relays to other processes neither 0 nor 1 but ⊥, meaning “I have received inconsistent data.”

  3. 3

    Once all messages have been exchanged between P2, …, Pm, each process considers the obtained data and acts according to the instructions in Table 1. The overall aim is, if P1 is nonfaulty, to have the same value of Vk for all nonfaulty processes, or all of them aborting.

    Table 1 Once Pk receives all messages and lists from all other processes, it will study the obtained lists and messages and compare to its own list lk. Depending on the consistency between the obtained and private data, Pk will act according to table below. Notation means that mj,k and lj,k are found to be consistent with lk whereas means “inconsistent with.” The symbol ⊥ means “I have received inconsistent data.” By we denote some nonempty subset of {1, …, m} \ {k}
    Full size table

Quantum protocol for distributing lists lk

All processes are equipped with devices which can unitarily transform qudits. In addition, P1 has a source of single qudits of dimension m and the last process, Pm, has additionally a measurement device. The protocol runs as follows (for an illustration, see Fig. 1):

  1. I

    P1 prepares the state

  2. II

    P1 randomly chooses the “encoding basis” from m different options U0,...,Um−1 and labels the choice c1. Having chosen the c1’st encoding basis, process P1 applies the following unitary transformation to the qudit:

    where . From the interferometric point of view, applying EquationSource math mrow msub miU mrow msub mic mn1 introduces a phase-shift of −2πc1/m in the first beam.

  3. III

    After that, P1 randomly chooses a value N1 in the set {0, 1, …, m − 1} and encodes N1, by applying the following unitary transformation:

    Afterwards, the qudit is sent to P2.

  4. IV

    P2, in the same manner as P1, choses a c2∈{0,...,m−1} and applies the unitary EquationSource math mrow msub miU mrow msub mic mn2 corresponding to choice of encoding basis.

  5. V

    Next, P2 randomly chooses a value N2 in the set {0, 1}. If N2 = 0, no action is taken, i.e., P2 applies the transformation . If N2 = 1, then P2 applies U(N2 = 1) and then sends the qudit to P3.

  6. VI

    P3, …, Pm consecutively repeat the same procedure as P2 with independent choices of basis and encoding their respective random values N3, …, Nm.

  7. VII

    In addition, Pm measures the qudit using a device which distinguishes the state |ψ0〉 from any set of states orthogonal to it.

  8. VIII

    If Pm obtains |ψ0〉, then the processes consecutively reveal their encoding bases (but not their values Nk) in reverse order: First Pm and last P1. If it turns out that the sum of the basis choices modulo m equals zero, then the run is treated as a valid distribution of the numbers Nk at the same position in the private lists lk.

Figure 1
figure 1

Scheme of the quantum protocol for the distribution of the correlated lists.

P1 prepares a uniform d-level superposition state, makes a choice of basis and encoding and forwards the qudit to P2 which applies a choice a basis and encoding and forwards the qudit to P3. Processes P3, …, Pm act in analogy with P2. Finally Pm projects the state onto the initial state prepared by P1 and, if the outcome is 1, the processes reveal their bases and, if all bases are the same, the round is treated as valid.

Full size image

The protocol distributes the numbers in the required way because all the unitary operators are diagonal and, therefore, commute. Additionally, if then

and, if , modulo m, then

Whenever this condition is not satisfied, the final state of the system is orthogonal to |ψ0〉 and will therefore never be an outcome of Pm's measurement.

Clock synchronization

Now, we will show how to apply our method for solving the DBA to achieve fault tolerant clock synchronization. However, a problem arises from clocks ticking during the synchronization procedure. This is solved by exploiting assumption A3: Instead of sending a number, the processes send their clock differences to each other. In the classical case, we achieve clock synchronization by running the algorithm OM(1) m times, sending clock differences instead of the binary values and analogously for OM(n)4. In analogy with the classical case, the processes send clock differences also in the quantum case, exploiting the fact that the clock differences can be decomposed into binary strings up to arbitrary accuracy agreed upon in advance. We run QB(n, m) m times in such a way that for each run a new processes takes the roll of P1 in QB(n, m). More explicitly, Py reads the clock difference Δxy between its own clock and the clock of Px. If Py is nonfaulty it will relay Δxy to Pz but if Py is a faulty process, it can arbitrarily change Δxy before sending it. If Py relays the value obtained from Px to Pz, then Pz knows the time difference between Px and Py. Also, since QB(n, m) is ran m times, Pz will also obtain Δyz from Py and thus Pz knows that Py is claiming that the time difference between Px and Pz is Δxy + Δyz, which can then be compared to Δxz obtained directly from Px.

Comparison with the other solutions

The correlated lists needed for achieving DBA can be distributed by other means than with the single-qudit protocol. Successful distribution can be achieved by the process Pm sharing a QKD channel with every other process. Pm uses a QKD protocol, e.g., BB8417 to distribute numbers such that (1) Pm and P1 share a string , where . (2) For every l = 2, …, m − 1, Pm and Pl share a string such that . (3) For a given j, the lists satisfy . (4) None of P2, …, Pm−1 have any information about a particular list element of any other process. (5) Whenever P1 receives an element , P1 has no information on the bit value of for l = 2, …, m and whenever P1 receives , P1 knows that for all l = 2, …, m. All QKD channels except that shared between P1 and Pm transmit bit values. In order to transmit elements of {0, …, m − 1} to P1, the numbers must be encoded into qubits. One additional requirement that has to be made for solving the DBA using the QKD distributed lists is that Pm is not required to convey any lists. This is necessary since Pm has full knowledge about the lists of all other processes and therefore easily could cheat. Instead, Pm may announce the message it received from P1 and if any inconsistency is noted by P2, …, Pm−1, then Pm will change its final value if the other processes convince Pm of them being nonfaulty.

There are also other proposed solutions to the DBA considering three processes where one is faulty. The first one, proposed in Ref. 7, relies on the three qutrit entangled Aharonov state. The goal is to distribute lists given by all permutations of the elements of the set {0, 1, 2}, i.e., (0–1–2, 0–2–1, 1–0–2, 1–2–0, 2–0–1 and 2–1–0). Generalization to m parties along the lines of Ref. 7 would require the usage of multipartite m-level entanglement, provided by the state

where , Sm = {0, …, m − 1} and N(σ(Sm)) is the parity of the permutation of Sm. Already for the simplest case of m = 3, this approach requires the preparation of a very complex state which, to our knowledge, has not yet been experimentally realized. However, for the three process case, it has been pointed out in Ref. 12 that the distribution of the lists can be realized without the state (6), by utilizing two separated QKD channels. With small modification for the m process setting, distribution of the lists is achieved with m − 1 QKD channels. However, to encode the entire space provided by Sm, the QKD requires qubits. If the efficiency of a detector η is not perfect and the QKD is performed with single qubits using von Neuman measurements, successful distribution occurs only with probability . Typically, the classical part of the protocol in Ref. 7 and its possible generalizations scale rapidly with the number of processes. It is required that m! different types of lists are distributed. However, a solution to the three party DBA exploiting four-qubit entanglement provides a simpler classical part of the protocol: the number of different lists is lowered from six to four11.

The general m process protocol presented in this paper generalizes the protocol in Ref. 11 and requires 2m−1 different types of lists. As emphasized earlier, the distribution of the required lists can be achieved both with single-qudit and with m − 1 QKD channels. Using QKD channels, only one channel needs to transmit all elements in Sm while the remaining m − 2 channels only transmit bit values. In the presence of nonperfect detectors, successful distribution occurs with probability . However, in the single-qudit approach only one single detection is needed and, therefore, successful distribution of the lists occur with probability η independently of m. The single-qudit protocol is highly scalable, both in terms of success probability with inefficient detectors and requirements on the classical lists.

Conclusions

We have presented a single-qudit protocol which provides an efficient solution to an important multiparty communication problem: It solves DBA and achieves clock synchronization in the presence of arbitrary many faulty clocks. In principle, our quantum algorithm is not limited to the case of clock synchronization, it can with small adaptation be used for other tasks requiring oral message interactive consistency. Interestingly, our algorithm works by transmitting a single qudit among the parties rather than by distributing a quantum entangled state among them. This makes the protocol much more practical, as single qudits can be experimentally realized easily in many ways. For example, using unbiased multiport beamsplitters15 or time-bin16. Compared to schemes based on several QKD channels, the single-qubit protocol is more scalable and robust against detection inefficiencies. This results shows that single-qudit quantum information protocols are interesting beyond QKD18,19 and random number generation20,21 and should stimulate experimental implementations and further research in quantum information protocols.