Experimental quantum multiparty communication protocols

Abstract

Quantum information science breaks limitations of conventional information transfer, cryptography and computation by using quantum superpositions or entanglement as resources for information processing. Here we report on the experimental realisation of three-party quantum communication protocols using single three-level quantum system (qutrit) communication: secret-sharing, detectable Byzantine agreement and communication complexity reduction for a three-valued function. We have implemented these three schemes using the same optical fibre interferometric setup. Our realisation is easily scalable without compromising on detection efficiency or generating extremely complex many-particle entangled states.

Introduction

Many tasks in communications, computation and cryptography can be enhanced beyond classical imitations by using quantum resources. Such quantum technologies often rely on distributing strongly correlated data that cannot be reproduced with classical theory: i.e., it violates a Bell inequality.¹ To violate a Bell inequality, the parties involved in the scheme must share an entangled quantum state on which they perform suitable local measurements returning outcomes that can be locally processed and communicated by classical means. Such entanglement-assisted schemes have been shown to be successful in a wide variety of information-processing tasks, including secret sharing for which additional security features are enabled, detectable Byzantine Agreement for which a classically unsolvable task can be solved and reduction of communication complexity for which optimal classical techniques are outperformed.

Let us shortly introduce these three communication protocols. Secret sharing is a cryptographic primitive that can conceptually be regarded as a generalisation of quantum key distribution.^2,3 Secret-sharing schemes have wide applications in secure multiparty computation and management of keys in cryptography. In such schemes, a message (secret) is divided in shares distributed to recipient parties in such a way that some number of parties must collaborate in order to reconstruct the message. However, the security of classical secret sharing relies on limiting assumptions of the computation power available to an adversary. Quantum cryptography introduces the concept of unconditional security, and it can improve security beyond classical constraints. Quantum secret-sharing protocols have been proposed with parties sharing a multipartite qubit entangled state^4,5 where their security is linked to Bell inequality violations.

A fundamental problem in fault-tolerant distributed computing is to achieve coordination between computer processes in spite of some processes randomly failing because of, e.g., crashing, transmission failure or distribution of incorrect information in the network. For example, such coordination applies to the problem of synchronising the clocks of individual processes in distributed networks, which is pivotal in many technologies including data transfer networks and telecommunication networks. A method to achieve synchronisation is to use interactive consistency algorithms in which all nonfaulty processes reach a mutual agreement about all the clocks.⁶ Interactive consistency is achieved through solving the problem of Byzantine agreement, which can be solved only if less than one-third of the processes are faulty.⁷ However, for most applications, it is sufficient to consider a scenario called detectable Byzantine agreement (DBA), in which the processes either achieve mutual agreement or jointly exit the protocol. Several quantum protocols based on multipartite entanglement have been proposed for achieving the DBA even in the presence of one-third or more faulty processes, thus breaking the classical limitation.^8–10

In communication complexity problems (CCPs), separated parties perform local computations and exchange information in order to accomplish a globally defined task, which is impossible to solve single-handedly. Here we consider the situation in which one would like to maximise the probability of successfully solving a task with a restricted amount of communication.¹¹ Such studies aim, for example, at speeding up a distributed computation by increasing the communication efficiency, or at optimising VLSI circuits and data structures.¹² Quantum protocols involving multipartite entangled states have been shown to be superior to classical protocols for a number of CCPs.^13,14

Quantum multiparty communication protocols that require only sequential communication of single qubits and no shared multipartite entanglement have been proposed for secret sharing¹⁵ and CCP,¹⁶ and CCP using the quantum Zeno effect.¹⁷ Very recently, generalisations to d-level quantum system (called a qudit) have been proposed. These protocols are multiparty quantum secret-sharing¹⁸ and a quantum solution to the DBA, which can then be used to achieve clock synchronisation in the presence of an arbitrary number of faulty processes by efficient classical means of communications.¹⁹ Besides experimentally realising these protocols, we propose and demonstrate a new single-qudit protocol for a multiparty CCP, which outperforms any classical counterpart. Although the mentioned information-processing tasks cover very different topics, such as cryptography, synchronisation and communication complexity, we will show that the quantum schemes that distribute these correlated data sets uphold strong similarities and the differences emerge from the classical processing of the correlated data required to execute these protocols.

Our single-qudit communication protocols hold several experimental advantages in scalability over the corresponding entanglement-assisted schemes. Although entanglement-assisted protocols typically require the preparation of a high-fidelity N-partite d-level entangled quantum state, the single-qudit protocols earn their name from requiring only the preparation of a single-qudit independently of the number of parties, N, involved in the protocol. Furthermore, in the likely case of parties using non-ideal detectors with efficiencies η∈[0, 1], entanglement-assisted protocols require N detections and therefore succeed with an exponentially decreasing probability, approximately η^N, whereas single-qudit protocols only require a single detection, which succeeds with probability η, independently of N.

Results

Communication protocols

In this report, we will present for the first time the experimental realisation of quantum communication protocols, secret sharing, DBA and clock synchronisation, and reduction of communication complexity in a multipartite setting involving three parties, Alice, Bob and Charlie, communicating three-level quantum states (qutrits). We will now very briefly present these protocols.

Secret sharing

Alice (a.k.a. the distributor) prepares the initial qutrit state $|\mathit{\psi }〉=\frac{1}{\sqrt{3}}\left(|0〉+|1〉+|2〉\right)$ and applies her action $U^{a_0}{V}^{a_1}$ on the state $|\mathit{\psi }〉$ according to her input data (a₀, a₁), where a₀ and a₁ are two pseudorandom independent numbers and the operators U and V are given by

$$\begin{array}{}\text{(1)}& \begin{array}{c}U=|0〉〈0|+e^{\frac{2\pi i}{3}}|1〉〈1|+e^{-\frac{2\pi i}{3}}|2〉〈2|\hfill \end{array}\end{array}$$

$$\begin{array}{}\text{(2)}& \begin{array}{c}V=|0〉〈0|+e^{\frac{2\pi i}{3}}|1〉〈1|+e^{\frac{2\pi i}{3}}|2〉〈2|\hfill \end{array}\end{array}$$

Then, she sends the qutrit to Bob, who according to his input data (b₀, b₁) acts on the qutrit with operator $U^{b_0}{V}^{b_1}$, and sends the state to Charlie who acts on the qutrit with operator $U^{c_0}{V}^{c_1}$, where (c₀, c₁) are his input data. Finally, Charlie performs a measurement on the qutrit in the Fourier basis $\{\frac{1}{\sqrt{3}}\left(1,1,1\right),\frac{1}{\sqrt{3}}(1,e^{\frac{2\pi i}{3}},e^{-\frac{2\pi i}{3}}),\frac{1}{\sqrt{3}}(1,e^{-\frac{2\pi i}{3}},e^{\frac{2\pi i}{3}})\}$, obtaining a trit outcome m (Figure 1). In random order, the parties then announce their data a₁, b₁, c₁ and if condition a₁+b₁+c₁=0 mod3 is verified the round is treated as valid and equation a₀+b₀+c₀=0 mod3 produces the shared secret. Otherwise, if a₁+b₁+c₁≠0 mod3, the qutrit is not in an eigenstate of the measurement operator at the time of measurement. Thus, the outcome m is random and the run is discarded. At this point, all users should publicly announce a₀, b₀ and c₀ for a relevant number of runs and estimate the quantum trit error rate (QTER) defined as QTER=number of incorrect outcomes/total number of outcomes. Finally, to reconstruct the shared secret, at least two users are required to collaborate.¹⁸

Figure 1

Schematic illustration for the three single-qutrit three-party communication protocols. Alice prepares state $|\mathit{\psi }〉$, Alice, Bob and Charlie act with the operation UⁱV^j sequentially on the received state according to their input data (i, j), where (i, j) are (a₀, a₁), (b₀, b₁) and (c₀, c₁) for Alice, Bob and Charlie, respectively. Finally, Charlie performs a measurement on the qutrit in the Fourier basis.

Secret-sharing schemes can be subjected not only to eavesdropping attacks but also to attacks from parties within the scheme. Examples are known in which such attacks can breach the security of secret-sharing schemes.²⁰ In the Supplementary Material, we outline a scheme enforcing security that can, at the cost of a lower efficiency, arbitrarily minimise the impact of such attacks. Furthermore, we mention that the full security can be obtained from device-independent implementations of entanglement-based quantum key distribution.²¹ However, to our knowledge, there are no device-independent protocols for secret sharing. In our proposed protocol, we assume that the users have control over the devices.

Detectable Byzantine agreement

To solve the DBA problem, the three processes (i.e., parties) need to share the data in the form of lists l_k of numbers subject to specific correlations, and the distribution must be such that the list l_k held by process P_k is known only to P_k, where k=1, 2, 3. Quantum mechanics provides methods to generate and securely distribute such data. In this case, Alice’s state preparation and each user’s action are the same as in the previous protocol, except for b₀ and c₀ being bits instead of trits. The difference is in the data processing part: if the measurement outcome is ‘0’, the parties reveal a₁, b₁, c₁, and if condition a₁+b₁+c₁=0 mod3 is satisfied, the round is treated as valid. It follows that they now hold one of the data sets {(a₀, b₀, c₀)∈(0, 0, 0), (1, 1, 1), (2, 1, 0), (2, 0, 1)} from which the DBA can be solved.¹⁹

Communication complexity reduction

In the single-qutrit protocol for reducing communication complexity, the distributor supplies Alice, Bob and Charlie with two pseudorandom trits each: (a₀, a₁), (b₀, b₁) and (c₀, c₁). Each party’s pair can be mapped into an integer by defining S_x≡3x₀+x₁∈{0, …, 8}, with x∈{a, b, c}. The distributor promises the parties that S_a+S_b+S_c=0 mod3 and asks Charlie to guess the value of function

T=(S_a+S_b+S_c mod9)/3 given that only two (qu)trits may be communicated in total. After the $|\mathit{\psi }〉$ state preparation, Alice acts with $U^{\frac{S_a}{3}}$ (with U defined as in Equation (1)) and sends the qutrit to Bob, who applies $U^{\frac{S_b}{3}}$ before forwarding it to Charlie. Finally, after applying $U^{\frac{S_c}{3}}$ Charlie performs a measurement on the resulting state $|{\mathit{\psi }}_{final}〉=\frac{1}{\sqrt{3}}(|0〉+e^{\frac{2\pi i}{3}T}|1〉+e^{-\frac{2\pi i}{3}T}|2〉)$. This state is an element of the Fourier basis, so a measurement in this basis will output the correct value of function T with (ideally) unit probability.

The CCP is to maximise the success probability of guessing T correctly, with the given communication restrictions. We have just seen that this success probability, save for experimental errors, is 100% with our quantum protocol. However, it can be shown (Supplementary Material) that the optimal classical protocol achieves only a success probability of 7/8≈0.778, which is clearly inferior to that of the quantum protocol.

Each protocol setting was run 100,000 times per second (i.e., 10⁵ laser triggers), and the collected data were used to calculate the QTER. Because of the substantial loss from the setup itself (mainly in the phase modulators) and to the 20% detection efficiency, the final amount of runs with detection was 400 per setting. Our results for secret sharing and DBA experiments are reported in Tables 1 and 2.

Table 1 Results for the secret-sharing protocol

Table 2 Results for the DBA protocol

We can easily see that QTER for the secret-sharing and DBA protocols are always below 10%. Our results are better than other results obtained with entanglement-based two-party quantum key distribution protocols,²² and QTER s clearly are below the 15.95% security threshold of qutrit-based quantum key distribution.²³ Therefore, secure communication can be obtained with this configuration.¹⁸ Consistently, CCP experimental results, of which a sample of obtained data is reported in Table 3, show success probabilities always above 90%, thus proving the superiority of the quantum protocol to any classical protocol (limited to 77.8% success probability). The primary source of QTER is the so-called ‘dark counts’. Our detectors’ average dark count probabilities, measured with 10⁶ runs, are 5.9 10⁻⁵, 2.8 10⁻⁵ and 20.5 10⁻⁵ per trigger for detectors D₀, D₁ and D₂, respectively. Considering our measurements, these dark counts contribute up to half of the QTER.

Table 3 Results for the communication complexity reduction protocol

Other important systematic contributions to the QTER are because of the phase drift affecting the interferometer. This phase drift causes two problems: it slightly changes the relative phases from the desired settings and it forces a recalibration of the phases before each experiment. Both these contributions can be quantified by propagating phase errors in interference equations (Supplementary Material) to be ~1% each to QTERs.

Discussion

For future and practical implementations of these communication protocols, one needs to use a bright true or heralded single-photon source, integrated optics interferometer and high quantum efficiency superconducting single-photon detectors.

We have experimentally realised three-party quantum communication protocols using single-qutrit communication: secret sharing; detectable Byzantine agreement; and communication complexity reduction for a three-valued function. We have implemented for the first time these three protocols using the same optical fibre interferometric setup. Our novel protocols are based on single quantum system communication rather than entanglement. Moreover, the number of detectors (detector noise) used in our schemes is independent of the number of parties participating in the protocol. Our realisation is easily scalable without compromising on detection efficiency or generating extremely complex many-particle entangled states. These breakthrough and advances make multiparty communication tasks feasible. They become technologically comparable to quantum key distribution, which is so far the only commercial application of quantum information. Finally, our methods and techniques can be generalised to other communication protocols. These protocols can also be easily adapted for other encodings and physical systems.

Materials and methods

We have realised the three above-mentioned communication protocols with the same optical setup reported in Figure 2. The setup is based on a three-arm Mach–Zehnder-like interferometer built with optical fibres and a retro-reflective mirror (this configuration is a practical solution to the natural phase-drift problem, which affects every Mach–Zehnder interferometer, further complicated here by the fact that we have three paths). The information transmitted between users is encoded in relative phase differences between the three states constituting the qutrit. The state preparation is carried out by sending light pulses from a 1,550- nm diode laser (ID300 by ID Quantique) to the first 3×3 coupler of the Mach–Zehnder interferometer.

Figure 2

Experimental setup used in this work. The components are isolator (ISO), polarisers (POL), circulator (CIR), two 3×3 fibre couplers (CPL), phase modulators (PM), fibre stretcher (STR), polarisation controllers (PC), variable digital attenuator (ATT), retro-reflective mirror (MRR) and three single-photon avalanche detectors (D₀, D₁, D₂). The three parties’ stations are polarisation maintaining, whereas the links connecting them are single-mode fibres. respectively.

The laser repetition rate is 100 kHz. The outcome after the second coupler is a superposition of the three paths, so that the optical phase of each pulse of the qutrit can be individually modulated with commercial phase modulators (COVEGA Mach-10 Lithium Niobate Modulators). The delays in the interferometer are ΔL_M=68.40±0.05 ns and ΔL_L=136.80±0.05 ns. On the way to the mirror, users passively let the qutrit pass through while after the reflection Charlie, Bob and Alice sequentially act on the qutrit with a combination of operators U and V (see Equations (1) and (2)). After passing through the three arms on their way back, the three pulses recombine at the first coupler, and depending on their relative phases they yield different interference counts at the single-photon detectors (Princeton Lightwaves PGA600). These gated detectors provide 20% quantum efficiency and ~10⁻⁵ dark count probability. Importantly, in order to prevent possible eavesdropping attacks, each pulse is attenuated to the single-photon level by a digital variable attenuator (OZ Optics DA-100) at Charlie’s station output.

We would like to emphasise that phase modulators are polarisation sensitive, and for this reason they include a horizontal polariser at the output port. Therefore, controlling polarisation throughout the setup is crucial. We thus choose to use polarisation-maintaining fibre components for all three parties’ stations.

However, in order to make the configuration more realistic, links between users are standard single-mode fibres. Therefore, polarisation controllers have been placed after these fibre links. Finally, the whole experiment was controlled by an FPGA card that worked both as master clock and trigger source, for the electronics driving laser and phase modulators and for the single-photon detectors.