Experimental Demonstration of Sequential Multiparty Quantum Secret Sharing and Quantum Conference Key Agreement

Quantum secret sharing (QSS) and quantum conference key agreement (QCKA) provide efficient encryption approaches for realizing multi-party secure communication, which are essential components of future quantum networks. We present three practical, scalable, verifiable (k, n) threshold QSS protocols that are secure against eavesdroppers and dishonest players. The proposed QSS protocols eliminate the need for each player preparing the laser source and laser phase locking of the overall players. The dealer can implement the parameter evaluation and get the secret information of each player without the cooperation from other players. We consider the practical security of the proposed QSS systems with Trojan-horse attack, untrusted source intensity fluctuating and untrusted noisy sources. Our QSS systems are versatile, they can support the QCKA protocol by only modifying the classic post-processing and requiring no changes to the underlying hardware architecture. We experimentally implement the QSS and QCKA protocol with five parties over 25 km (55 km) single mode fibers, and achieve a key rate of 0.0061 (7.14*10^-4) bits per pulse. Our work paves the way for the practical applications of future QSS and QCKA.


Introduction
In recent years, quantum communication has made significant breakthroughs, in particular, quantum key distribution (QKD) [1,2,3] ensures secure communication between legitimate parties based on the principles of quantum mechanics.The invention of QKD provides an effective approach to solve the point-topoint security key distribution between two users.Inspired by the idea of QKD and classical cryptography protocols [4,5,6], the quantum secret sharing (QSS) [7] and quantum conference key agreement (QCKA) [8] using multiparticle Greenberger-Horne-Zeilinger (GHZ) entangled states were proposed.The QSS combines quantum cryptography with classical secret sharing and uses quantum state as a secret encoding carrier.The secret message is divided into n pieces and distributed to n players in an appropriate way [7].For a (k, n) threshold protocol, if no less than k players combine their pieces of information together, the secret message can be recovered [4].QSS can protect secret message from the eavesdroppers and dishonest players, and has important applications in key management, identity authentication, remote voting, and quantum sealed-bid auction.The task of QCKA is to establish a common secret key among n players.All players can encrypt the public messages and decrypt the encrypted public messages broadcasted by other players, whereas the eavesdroppers cannot obtain any public messages broadcasted by the players [8].
The above works significantly improve the feasibility of QSS and QCKA.However, there are still key limitations in security and practicability.For instance, the single qubit QSS protocol is vulnerable to Trojan horse attacks [37,38] where an eavesdropper sends a signal to the player's secure station and unambiguously determine the private information by measuring the output signals.The QSS [7,9,10,11,12,13] and QCKA [8,29,30,31,32,33] based on the GHZ entangled state are appealing, but the scalability is a challenge due to the difficulty of generation, manipulation of multi-partite entangled states with very large dimension at present [39].The post-selection GHZ entangled state QSS and QCKA alleviate this issue [20,35].However, the implementation of this scheme requires the intervention of multiple players, which increases the complexity of the experiment.Continuous variable QSS (CV-QSS) based on coherent states has good compatibility with telecom techniques [25,26,27].Unfortunately, current coherent-state CV-QSS protocol requires that all players have to prepare their own laser sources (although there is a QSS scheme to solve the laser source problem, it is still difficult to achieve with the current experimental technology [28]), and the laser phases of all players should be strictly stabilized, which adds considerable complexity and cost to the system.On the other hand, the superposition of channel excess noises from other players severely reduces the secret key rate due to the joint measurement by the dealer [25,26,28].Furthermore, most of the existing QSS and QCKA require dedicated hardware devices and many QSS are (n, n) schemes, which limit the flexibility and versatility of the protocols.
To solve above issues, in this paper we propose three practical, scalable, and verialbe (k, n) threshold CV-QSS protocols: dense wavelength division multiplexing (DWDM) QSS protocol, multiple sideband modulation (MSB) QSS protocol and their composite protocol.In contrast to previous works, our protocols do not require each player preparing a laser source and the phase locking of the overall lasers, furthermore, the evaluation of the channel parameters for each player is independent, which significantly reduce the complexity of QSS system and increase the secure secret key rate and transmission distance.The proposed QSS schemes are versatile and flexible.They can switch between QSS and QCKA just by switching the classical post-processing program and no modification of hardware devices are required.We perform strict security analysis for Trojan horse attacks and the untrusted sources intensity fluctuation and noise.The protocols are proved to be secure against eavesdroppers on the quantum channel and dishonest players.We experimentally demonstrate the QSS and QCKA protocols with five-party over long-distance single mode fiber, and investigate the excess noise variations versus the number of the player and fiber length.The DWDM-QSS and MSB-QSS protocols The sketch of the DWDM-QSS protocol is shown in Figure 1a, each player prepares a laser source of different wavelength in the secure station and performs Gaussian modulation to encode the information.
Then the signal fields with different wavelengths are multiplexed via the add/drop multiplexer (ADM) and sent to the dealer through a common quantum channel.The dealer demultiplexs the relieved signal fields via a demultiplexer (DEMUX) and measures them separately via heterodetection.The detailed steps are as follows.
Step 1.All players prepare a laser source of different wavelength λ i , i ∈ {1, 2, . . ., n}.The first player modulates the laser and prepares a coherent state |X λ 1 + iP λ 1 with a pair of Gaussian random numbers {X λ 1 , P λ 1 } and sends the prepared state to the neighboring player.
Step 2. The second player prepares the coherent state |X λ 2 + iP λ 2 and adds it into the quantum channel via ADM.Above procedure is repeated until the nth player prepares the coherent state |X λn + iP λn and adds it into the quantum channel.
Step 3.After the quantum states of all players reaches the dealer through a common quantum channel, the dealer uses a demultiplexer to separate the received quantum states and measures them using heterodyne detection.The measurement results (raw data) are Step 4. Repeat the above steps until enough raw keys are accumulated.At this stage, the quantum distribution phase of the protocol is completed.
Step 5.The dealer and each player independently evaluate the channel parameters including the quantum channel transmittance {T λ 1 , T λ 2 , • • • , T λn } and excess noise {ε λ 1 , ε λ 2 , • • • , ε λn } by using the same procedure as that of the continuous variable QKD (CV-QKD).Based on the channel parameters, the key rates between the dealer and each player can be estimated.If all of them are positive, the dealer selects the lowest key rate K λ i among all players as the key rate of the QSS, that means the QSS works at the rate of the worst performing player, then using the data reconciliation and privacy amplification, the secure keys Step 6.For a (k, n) threshold QSS, the dealer randomly selects a k − 1 power polynomial f (S λ ) in the finite field Z, where f Here, the polynomial coefficients {S, a 1 , a 2 , • • • , a k−1 } ∈ Z and S is the sharing secret key.The dealer calculates {S λ i , f (S λ i )}, and selects a Hash function H (S λ ) to calculate the authentication tag {H (S λ 1 ) , H(S λ 2 ), Next, the dealer sends f (S λ i ), the Hash function, and the authentication tags to each player through the authenticated classical channel.
Step 7.Each player know f (S λ i ) and the authentication tags of all players.If k players want to reconstruct the sharing secret keys, they use the Hash function to calculate the authentication tags {H (S λ 1 ) , H (S λ 2 ), • • • , H (S λ k )} and compare them with those sent by the dealer.By checking the consistency of the authentication tag, the dishonest players can be discovered.After verification, the sharing secret key S can be calculated directly using the Lagrange interpolation formula: Although above procedures are classical, we take each distributed key S λi as a independent variable of a polynomial f (S λ ) and combine it with a Hash function, which makes our scheme secure against eavesdroppers and dishonest players in both the quantum distribution stage and the key reconstruction stage.
The MSB-QSS protocol is depicted in Figure 1b, the dealer prepares a laser source that passes through each player in sequence and the players perform independent Gaussian modulation to encode the key information at different sidebands of the light field [40].The dealer extracts the encoded signals by resolving the sidebands that are modulated by the players.The detailed procedure is as follows.
Step 1.The dealer first prepares a coherent laser source.The first player prepares a coherent state |X f 1 + iP f 1 with weak modulation at sideband frequency f 1 of the light field and sends the modulated light field to the neighboring player.The composite QSS protocol.The dealer prepares a number of laser sources of different wavelengths and sends them to the neighboring players.The players use Gaussian modulation to encode their information in different sidebands of the lasers and subsequently send the modulated light fields to the next player.Next, all the signal fields are coupled into one fiber channel through the ADMs and sent to the dealer.Finally, the dealer demultiplexs all players's signal fields and measures them with heterodyne detection.
Step 2. The rest n − 1 players prepares the coherent state |X f i + iP f i , i ∈ {2, 3, . . ., n} on different sidebands respectively, and the nth player sends the prepared states to the dealer via the quantum channel.
Step 3. The dealer measures the received signal modes by performing heterodyne detection, and extracts the corresponding sideband information of each player.The measurement results X fn , P m fn are recorded as raw data.
Step 4. The remaining procedures are the same as those of the DWDM-QSS protocol.

The composite QSS protocol
To enhance the versatility and practicality of the QSS, we combine the DWDM-QSS and MSB-QSS protocols to form a composite QSS scheme as illustrated in Figure 2. In this scheme, the dealer prepares a number of laser sources of different wavelengths and sends them to adjacent players.For each laser source, the players implement independent Gaussian modulation to encode their information in different sidebands of the light field and subsequently send the modulated light field to the next one.Next, all the signal fields are coupled into the common quantum channel through the ADMs and sent to the dealer.Finally, the received signal fields are separated by the dealer using a demultiplexer and measured separately with the heterodyne detection.The detailed process is similar to that of DWDM-QSS and MSB-QSS schemes.

The QCKA protocol
Considering actual application scenarios, a quantum network should not support only a single protocol.On the premise of not changing the underlying architecture, it is desired that the network can support multiple protocols which can be conveniently switched according to the needs of the players.Such a network structure is flexible and versatile [20,27,35].If a network can only implement a specific protocol with dedicated hardwares, it means that the network is not very practical.
Our experimental system is flexible and versatile and can be switched between QSS and QCKA on demand.The system can be used to implement QCKA without modifying any hardware devices, one only need to switch the corresponding post-processing procedure.Below we present the implementation process of QCKA in detail.
Step 1.By utilizing the same quantum stage as that of the QSS scheme, the dealer establishs different quantum keys with all players.The dealer selects the lowest secret key rate K λ i f i among all players, that means the QCKA works at the key rate of the worst performing player.
Step 2. The dealer prepares a common secret key S c , which are encrypted using the player's quantum secret key S λ i f i , S e = S λ i f i ⊕ S c , and then sent to the designated players through the authenticated classical channel.Then the players decrypt the encrypted keys with their own quantum secret key, recover the common secret key S c = S e ⊕ S λ i f i [30].
Our QCKA scheme has following advantages compared with the QCKA based on multipartite GHZ entangled states.Quantum state preparation: our scheme only requires off-the-shelf telecom components such as commercial narrow linewidth lasers, amplitude and phase modulators, thus the state preparation process is simple and low-cost.In contrast, the preparation of large scale multipartite GHZ entanglement is still a challenge with the current experimental technology.Scalability: our scheme can be conveniently extended to plenty of players (on the order of hundreds), while the scalability is difficult for multipartite GHZ entanglement scheme due to the multiphoton coincidence counting is required for the key generation.In this case, the key rate will decline exponentially versus the total transmission loss [33].

Security analysis
For the MSB-QSS and composite QSS scheme, similar to the theoretical framework of plug-and-play CV-QKD, the transmission of the laser source from the dealer to the players can be controlled by Eve.In this case, Eve may performs potential attacks.In this section, we analyze the security of our protocol under the condition of Trojan horse attacks, untrusted source intensity fluctuation, and untrusted source noise.

Security proof of Trojan horse attacks
Due to the bidirectional feature of the MSB-QSS and composite QSS scheme, the Trojan horse attack should be considered.As shown in Figure 3a, Eve can use a beam splitter with transmittance of S 0 to couple her probe laser at wavelength of λ 0 with the laser at wavelength of λ i , i ∈ {1, 2, . . ., n} sent by the dealer and send them to the player.The probe laser will carry the key information after being modulated by the modulators of the players.Just at the outside of the player's station, Eve uses a dichroic beam splitter (DBS) to separate the probe laser for her measurement to obtain the key information.
To deal with this attack, we insert a 50-GHz narrow-band optical filter (0.4 nm bandwidth) into the player's input port, thereby limiting Eve's probe laser wavelength to |λ 0 -λ i | ≤ 0.2 nm.A beam splitter with transmittance of S 1 is added after the modulator to monitor the modulated light fields.The measured light intensity is given by where η λ i and η λ 0 are the total detection efficiency of the player and Eve, respectively, including the modulator's loss, split ratio of beam splitter, and the photodiode's quantum efficiency.I λ i and I λ 0 are the light intensity of the player and Eve respectively, and I el is the electronic noise of the monitoring detector.Since a weak electro-optic modulation is employed, the modulation variance is proportional to the light intensity of the modulated laser.The modulation variance of the player and Eve can be expressed as where M λ i and M λ 0 are the modulation coefficients of the electro-optic modulators.Substituting Eq. ( 3) into Eq.( 2) we get Considering that the wavelength of the probe light is very close to the wavelength of the dealer' laser λ 0 ≈ λ i , we have Eq. ( 4) can be simplified to Therefore, by measuring the partial light intensity of the modulated laser, the overall variance V M = V A + V λ 0 of the modulated light fields can be monitored.Note that the effect of the Trojan horse attack has nothing to do with the specific value of λ 0 given that the average photon number of the probe light remains unchanged.Without loss of generality, we can choose and replace the DBS of Eve with a beam splitter of transmittance S 2 as shown in Figure 3b.Eq. ( 6) can be rewritten as Therefore, the Trojan horse attack of the eavesdropper is equivalent to the increase of the attenuation of the untrusted quantum channel (Figure 3c), i.e.T 1 = T S 2 , where T is the original channel transmittance and S 2 = I λ i /(I λ i + I λ 0 ).Since the quantum key distribution protocol is information-theoretical secure for untrusted quantum channel, the Trojan horse attack is discoverable and ineffective.The measurement of the modulated laser intensity is an average of plenty of measurement data in one data block (> 10 6 ).In this case, the effect of the electronic noise can be ignored.Eq. ( 7) can be rewritten as To defeat Eve's Trojan horse attack, we can estimate the channel transmittance and escess noise using the player's and dealer's data, and the monitored V M . where 2 is the variance of the quadratures measured by Bob.η and υ el are the efficiency and electronic noise of homodyne detector, respectively.

Security proof of untrusted source intensity fluctuations
Since the laser source is untrusted, Eve can also perform source intensity fluctuation attacks.Supposes that the dealer plans to prepare a signal pulse with intensity I λ i , however, he actually prepares a pulse with the intensity of I λ i (1+σ) [41], where σ is the intensity fluctuation caused by the instability of the laser source with mean value zero and variance V σ .The intensity of the signal pulse received by the player is I λ i (1+σ+ϕ), where ϕ is the intensity fluctuation caused by Eve's intensity fluctuation attack with mean value zero and variance V ϕ .The actual coherent state that encoding the Gaussian random variables (X A 1 , P A 1 ) of the player is given by To deal with Eve's source intensity fluctuation attack, we added a photodetector at the player's input port to monitor the intensity of each light pulse and the measured signal is where I el is the electronic noise of the detector.The measured intensity fluctuation of the light pulse relative to the average light intensity is expressed as where δI λ i and δI el are the light pulse fluctuation and electronic noise fluctuation relative to the average light intensity and they satisfy δI λ i =σ+ϕ, δI λ i =0, δI λ i 2 =V λ i , δI el =0, and δI el 2 = V el .Considering the source intensity fluctuation, the prepared coherent states can be rewritten as Notice that the fluctuations of the optical pulses cannot be accurately determined due to the electronic noise of the detector.To ensure the security of the protocol, the player revises his data from (X A 1 , P A 1 ) to where I max el is the maximum of the electronic noise of the monitoring detector.In this case, the channel loss and excess noise will be overestimated by the dealer and players [41] (see Section S1, Supporting Information for more details).
The fluctuation variance V λ i of the light pulse intensity cannot be directly measured.We can only measure the total variance δI m 2 = V λ i + V el of the fluctuation of the laser and the electronic noise, and then subtract the electronic noise variance V el to obtain the variance V λ i of the fluctuation of the laser.

Security proof of untrusted source noises
In addition to the potential Trojan horse attack and untrusted source intensity fluctuation attack, Eve can also perform source noise attacks.In the following, we will present the Prepare-and-measurement (PM) scheme and the equivalent entanglement-based (EB) scheme.

PM scheme
In Figure 4a, a PM scheme is shown.The dealer prepares a coherent state source and its sidemodes quantum state is |X N +iP N with δX N 2 = δP N 2 = 1 shot noise units (SNU).Eve introduces Gaussian noise {δX E , δP E } on the sidebands where the players encoding the information by modulating the laser, and the noise satisfies δX E 2 = δP E 2 = ξ E .The untrusted source received by the player can be expressed as b) The equivalent EB scheme.Eve may introduce noise at the sidebands where the player encoding key information by modulating the laser in the PM scheme.In the equivalent EB scheme, a three-mode entangled state ρ AE0B0 is generated with the mode E 0 controlled by Eve.
After encoding the key information onto the source, the quantum state of the player is given by The variance of the quadratures for the quantum state is given by where V = V A +1.The conditional variance of X P M (P P M ) given X A 1 or δX E are

EB scheme
The equivalent EB scheme of the MSB-QSS and composite QSS protocol are shown in Figure 4b, a threemode Gaussian entangled state ρ AE 0 B 0 is generated with the mode E 0 controlled by Eve.For mode A (X A , P A ), mode E 0 (X E 0 , P E 0 ), and mode B 0 (X B 0 , P B 0 ), we assume the following realtions are satisfied The covariance matrix γ AE 0 B 0 charactering the state ρ AE 0 B 0 has the form where c → +∞ is a large real number.
The player performs a heterodyne detection on mode A and the measurement result is given by The player use the measurement results (X m A , P m A ) to estimate the mode B 0 , Eq. ( 26), we have The conditional variances can be expressed as From Eqs. ( 26) and ( 27), the mode B 0 is projected onto states with variable mean values of (X B 0 ,P B 0 ) and corresponding variance of V A conditioned on the player's measurement.The uncertainty on the inferred values of mode B 0 for the player (Eq.( 28)) coincides with the noisy coherent state in the PM scheme (Eq.( 21)).Furthermore, from Eq. ( 29), the uncertainty on the inferred values of mode B 0 for Eve is identical to that in the PM scheme (Eq.( 22)).Therefore, the EB scheme is equivalent to the PM scheme.

Secret key rate
On the basis of the previous practical security analysis of MSB-QSS and composite QSS scheme, we derive the secret key rate in this part.
The lower bound of the asymptotic secret key rate of the QSS and QCKA protocols against collective attack are given by [42].
where β is the reconciliation efficiency, I AB is the Shannon mutual information between the player and dealer, and χ BE is the maximum information available to the dishonest players and eavesdroppers conditioned on dealer's measurement.
The channel added noise referred to the channel input is given by where 1/T 2 − 1 is introduced by the quantum channel loss.The detection noise referred to the dealer's input is expressed by The total noise referred to the channel input is The mutual information I AB is calculated directly from the dealer's measured quadratures variance V B = T 2 η (V +ξ E +χ tot ), and the conditional variance Eve's access information is up bounded by the Holevo quantity where m B 1 is the measurement of dealer.p(m B 1 ) is the probability density of the dealer's measurement outcomes.ρ is the quantum state of Eve and dishonest players conditioned on the dealer's measurement result.S(.) denotes the von Neumann entropy.To calculate Eve's accessible information, we know that Eve's system can purifiy the system AE 0 B (Figure 4b), S (ρ E 0 E ) =S (ρ AB ), and the system AE 0 EF G is pure after the dealer's heterodyne measurement, so that S ρ ρ AF G is independent of m B 1 for the Gaussian modulated Gaussian states protocol.Now, Eq. ( 35) can be rewritten as The covariance matrix of the Gaussian state ρ AB where I= 1 0 0 1 and σ z = 1 0 0 −1 .
The symplectic eigenvalues of γ AB have the form where The symplectic eigenvalues of where The Holevo quantity χ BE is given by where Using Eqs. ( 30), (34), and ( 38)-( 42), we can calculate the lower bound of the secret key rate.
4 Experimental section & methods

Modulation
In our experiment, the weak modulation technique is adopted to prepare the coherent states at the sideband modes.Before the modulation, the complex amplitude of a single frequency laser has the form where α 0 and f 0 are the amplitude and frequency of the laser.When the laser is weakly modulated at frequency f i , the sidemode of the modulated laser is given by where M a 1 and M p 1 denote the amplitude and phase modulation depths respectively.Because the average photon number of the carrier satisfies |α 0 | 2  1, even if a very weak modulation can faithfully prepare a coherent state with mean photon number of a few photons at the sidemode.From Eq. ( 44), the sidemode states can be written as where X = M a α 0 , P = M p α 0 .Therefore, under the condition of large |α 0 | and small modulation depths, we can conveniently prepare sidemode coherent states by weakly modulating the amplitude and phase of the laser field.

Carrier phase evaluation
In our experiment, the quantum signals and local oscillators (LO) are transmitted through two different long-distance fibers to simulate the local local oscillator (LLO) scheme.In this case, there exists fast phase drifts between the quantum signals and LO.At present, several phase recovered schemes have been proposed that mainly using the pilot-aided feedforward data recovery scheme.The basic idea of the pilot-sequence scheme is to use adjacent pilot pulses to estimate the middle signal's phase drift [43].The pilot-multiplexed scheme divides the phase drift into the fast drift and the slow drift parts, and one can implement two remapping procedures to compensate them separately [44].
In our scheme, we use a simple method to estimate the phase of the signals.As shown in Figure 5, the quantum signals are generated by modulating the carrier of the lasers and they have fixed phase relations.
Although the player's quantum signals are not generated at the same time, the quantum signals and the carrier pass through the same path and are subject to the same phase evolution.Therefore, all the quantum signals have the same phase and we can infer the phase of the quantum signals by evaluating the phase of the carriers.

Experimental system
The schematic of the experimental setup is shown in Figure 6.Two continuous wave single-frequency lasers with different wavelengths (1553.78nm and 1549.26nm) were prepared by the dealer.A small portion of the lasers are employed as the signals and the rest are acted as the LO fields.The 1553.78 nm and 1549.26nm signals are sent to the player 1 and player 3, respectively.The players 1 and 3 independently generate two sets of Gaussian random numbers at a repetition rate of 250 kHz, and mix them with a 7 MHz sine signals.Then the mixed signals are loaded on the phase and amplitude waveguide modulators to modulate the two quadrature components of the signal fields.The optical filters at the input port of the players' station limits the wavelength range of Eve's Trojan horse attacks.To counter against the untrusted source intensity fluctuation attack, a small portion of the incoming signal beams is split and monitored by a photodetector (PD).The PD after the amplitude modulators (AM) monitors the modulation variance in real time by detecting the intensity of the modulated laser beam.Combine with the optical filter together, they can resist the Trojan horse attacks.
The modulated signal beams are sent to the players 2 and 4 through a 2 km and 5 km single mode fiber (SMF-28e), respectively.After correcting the state of the polarization by the polarization controller (PC), the players 2 and 4 encode their secret key information at the 9 MHz sideband of the signal beams.By using the ADM, two signal beams are coupled into a 50 km single-mode fiber.The two LO beams are sent to the dealer though 52 km and 55 km single mode fiber, respectively.At the dealer's station, the signal beams are decoupled by the ADM and measured by heterodyne detection.To this end, two 90°optical hybrid (Kylia) and four balanced homodyne detectors are employed to measure both the amplitude and phase quadrature of the incoming signals.The outputs of the detectors are mixed with 7 MHz and 9 MHz sine waveforms, respectively, and then filtered by two 500 kHz low pass filters.The dealer identifies and extracts the key information of each player in terms of the corresponding wavelengths and sidebands on which the players encoding the information.
Table 1: The parameters of the QSS and QCKA experimental system.L, single mode fiber length; V M , the overall modulation variance; V el , the electronic noise of the photodetector that monitoring light intensity fluctuations; V λi , the variance of light pulse intensity fluctuation; I max el , the maximum electronic noise of the photodetector that monitoring the fluctuations of the light intensity; v el , the electronic noise of the homodyne detector; η, the efficiency of the homodyne detector; β, reconciliation efficiency; ε 1 , excess noise; S, secret key rate.The lower key rates for players 1 and 3 is mainly because that their quantum signals pass through players 2 and 4, resulting in larger channel losses.We demonstrated the proof-of-principle experiment of the proposed QSS and QCKA protocols different long-distance fiber links.The experimental parameters are shown in Table 1.To investigate the effect of different multiplexing methods on the player's excess noise, we measured the excess noises under different scenarios, only a single player, two players with sideband multiplexing, and four players with both the DWDM and sideband multiplexing.The results is shown in Figure 7. x p e r i m e n t a l p o i n t s P l a y e r 2 , e x p e r i m e n t a l p o i n t s P l a y e r 3 , e x p e r i m e n t a l p o i n t s P l a y e r 4 , e x p e r i m e n t a l p o i n t s  In Figure 7a, the average values of the excess noise of player 1 at total transmission distance of 22 km under three cases are 0.00847 (only player 1 encoding the information), 0.0102 (both player 1 and player 2 encoding the information), and 0.098 (all players (1-4) encoding the information), respectively.We can see that the frequency multiplexing has a slight influence on the excess noise.It is possible that the frequency multiplexing causes a little crosstalk during the modulation and demodulation of the quantum signals.For the DWDM of the quantum signals, the player's excess noise has negligible impact on each other.Above phenomenon is also confirmed by the similar results observed in Figure 7b, c, and d.
The experimental secret key rates of the QSS (QCKA) system are shown in Figure 8.The black line represents the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [45].The two purple rhombus, black triangles, blue pentagrams, and red squares corresponds to the secret key rate of the players 1, 2, 3, and 4 at single mode fiber links of (22 km, 52 km ), (20 km, 50 km), (25 km, 55 km), and (20 km, 50 km), respectively.The blue and red curves represent the simulated secret key rates for the players 1, 3 and the players 2, 4, respectively.Due to the channel loss of the players 1 and 3 is larger than that of the players 2 and 4 (the players 2 and 4 are regarded as eavesdroppers from the viewpoint of the player of 1 and 3), the key rate of the players 1 and 3 are lower.After all players estimate their key rate with the dealer, the lowest key rate of all the players is set as the key rate for the QSS (QCKA) system.In our case, the key rate of the QSS (QCKA) at 25 and 55 km fiber links are 0.0061 and 7.14 × 10 −4 bits per pulse, respectively, which are determined by the key rate of players 3 and 1.

Discussion
On the basis of our presented scheme, in this section we propose the possible construction of a network topology for metropolitan QSS and QCKA network.
In our proof of principle experiment, we employ the fiber-based components such as amplitude and phase modulators, optical filter, beam-splitters.These fiber pigtailed components have relative large insertion

Access network
Figure 9: The schematic diagram of the QSS and QCKA network topology.The metropolitan network is composed of the access network and the backbone network.If the total distance between the farthest player in each access network and the dealer is determined, the distance between each adjacent player can be arbitrary, and the distance between the access nodes of the backbone network can be arbitrary.
losses, which are detrimental to the performance of the QSS and QCKA protocols.In fact, the players can employ free space optical devices at their stations, which can significantly reduce the adverse insertion losses and increase the player amount.Table 2 shows the typical losses of state of the art optical devices that are required in the proposed protocol.From the loss values, we can estimate the total insertion losses (d) for each player's station is around 1.35 dB.Using the estimated loss, we propose a possible network topology for metropolitan QSS and QCKA network, as shown in Figure 9.The metropolitan network consists of a backbone network and multiple access networks.The backbone network employs the DWDM-QSS scheme and the access network utilizes the MSB-QSS scheme.The backbone network have m access points, which enables the end players to connect to the network.The upper limit value of the channel loss for each access network is assumed to be D. The construction process of the metropolitan network is as follows.
Step 1.The fiber distance between the farthest player and the dealer in each access network is given as L, and the channel linear loss is 0.2L for standard single mode fiber.
Step 2. Since the insertion loss of the player's station is greater than that of the ADM, in order to maximize the number of the players in the metropolitan network, the backbone network should configure the access nodes as many as possible.When the number of the players in the farthest access network is the least, the number of access nodes of the backbone network are the most.The number of access nodes can be given by where AW G and ADM refer to insertion loss of the AWG and ADM.
Step 3. The number of the players in the jth access network counting from receiver can be expressed as where j ∈ {1, 2, . . ., m}.
Step 4. The maximum number of the players in the entire metropolitan network is Notice that, given the fiber distance between the farthest players of the access networks and the dealer, the position of the players in each access network is unrestricted.The span between two adjacent access points can also be freely configured as needed.
Based on the construction method mentioned above, we simulate the maximum number of the players at different transmission distances in Figure 10.The black and blue points represent the results of theoretical simulations under D = 20 dB and 30 dB.The red and black curves are the fitting curves.The network exhibits a nonlinear dependence between the transmission distance and number of the players.When the channel loss limit is set to 20 dB, we can see that the secure QSS and QCKA among 180 (53) players are feasible within a metropolitan area over 20 km (50 km).If the channel loss limit increases to 30 dB, the number of the players can improve to 651 (307) accordingly.

Conclusion
In conclusion, we propose three practical, scalable, verifiable (k, n) threshold QSS and QCKA schemes.Our protocols allow each player's secret information to be modulated, transmitted, measured, and processed separately, which effectively eliminate the issues of laser phase locking, excess noise superposition, and preparing laser source for each player.We analyze the practical security for the proposed QSS systems under Trojan horse attack, untrusted sources intensity fluctuating, and noisy untrusted sources.The proposed system are flexible and versatile, they can realize both the QSS and QCKA tasks by just switching the post-processing program.We experimentally investigated the effects of the quantum channel multiplexing of multiple players on the excess noise of the player, and verified the five-party QSS and QCKA quantum communication protocols.A secure key rate of 0.0061 (7.14 × 10 −4 ) bits per pulse are achieved over 25 (55) km standard single mode fiber.In our protocols, the players do not prepare the lasers and thus the optical module of the player is easy to integrate on a CMOS compatible silicon-based optical chip.Such on-chip integration is beneficial to future applications.Our work provides a feasible solutions for practical quantum private communication network.

Figure 1 :
Figure1: The QSS protocols.M, modulator; ADM, add/drop multiplexer; DEMUX, demultiplexer.a) The DWDM-QSS scheme: each player prepares a laser source of different wavelength and implements the Gaussian modulation to encode the key information, then the signal fields with different wavelengths are multiplexed via ADM.After transmission, the dealer demultiplexs the signals of different players and measures them separately by heterodyne detection.b) The MSB-QSS scheme: the dealer prepares a coherent laser source that passes through each player in sequence, and all players implement independent Gaussian modulation to encode the information in different sidebands of the laser field.After transmission, the dealer measures the signals by heterodyne detection and extracts the corresponding sideband information in terms of the encoding rules of the players.

Figure 2 :
Figure2:The composite QSS protocol.The dealer prepares a number of laser sources of different wavelengths and sends them to the neighboring players.The players use Gaussian modulation to encode their information in different sidebands of the lasers and subsequently send the modulated light fields to the next player.Next, all the signal fields are coupled into one fiber channel through the ADMs and sent to the dealer.Finally, the dealer demultiplexs all players's signal fields and measures them with heterodyne detection.

Figure 3 :
Figure 3: Schematic diagram of the Trojan horse attack model.a)Eve uses a beam splitter to inject her probe light at wavelength of λ 0 into the player's station.After being modulated by the player, the probe light is separated by a DBS at outside of the station.Then Eve can acquire the key information by measuring the probe beam.b) The effect of the attack has nothing to do with the specific value of λ i .We can assume λ 0 = λ i , and replace the DBS with beam splitter S 2 with transmittance S 2 = I λi /(I λi + I λ0 ) at I λ0 .c) The Trojan horse attack is equivalent to decrease the transmittance of the untrusted quantum channel from T to T 1 = T S 2 .

1 B 1 Figure 4 :
Figure 4: PM and EB schemes of the MSB-QSS and composite QSS protocols with untrusted coherent source.a) The PM scheme.b)The equivalent EB scheme.Eve may introduce noise at the sidebands where the player encoding key information by modulating the laser in the PM scheme.In the equivalent EB scheme, a three-mode entangled state ρ AE0B0 is generated with the mode E 0 controlled by Eve.

Figure 5 :
Figure 5: Distribution of quantum signals and carrier signals in frequency domain.The player's signals are generated by modulating the carrier of the lasers, thus the carrier and signals have the same phase.The phase of the signals can be determined by estimating the phase of the carrier.

Figure 7 :
Figure 7: Experimental excess noises of player 1 and player 2 measured over 6 h.a), b) The excess noise of player 1 under different multiplexing methods for total transmission distance of 22 km and 52 km.The blue pentagrams are excess noise with only the player 1 encoding the information.The red triangles represent the excess noise of player 1 when players 1 and 2 encode information at different sidebands.The black squares represent the excess noise of player 1 when players 1, 2, 3, and 4 encode information at different sidebands and wavelengths.c), d) The excess noises of the player 2 under different multiplexing methods for total transmission distance of 20 km and 50 km.The blue pentagrams are excess noise with only player 2 encoding the information.The red triangles represent the excess noise of player 2 when players 2 and 1 encoded information at different sidebands.The black squares represent the excess noise of player 2 when players 2, 1, 3, and 4 encode information at different sidebands and wavelengths.
B b o u n d P l a y e r 1 , 3 , t h e o r e t i c a l k e y r a t e P l a y e r 2 , 4 , t h e o r e t i c a l k e y r a t e P l a y e r 1 , e

Figure 8 :
Figure 8:  Secret key rates of QSS (QCKA).The black line is the PLOB bound.The two purple rhombus, black triangles, blue pentagrams, and red squares corresponds to the secret key rate of the players 1, 2, 3 and 4 at single mode fiber links of (22 km, 52 km ), (20 km, 50 km), (25 km, 55 km), and (20 km, 50 km), respectively.The blue and red curves represent the simulated secret key rates for the players 1, 3 and the players 2, 4, respectively.The key rate of the QSS (QCKA) at 25 and 55 km fiber links are 0.0061 and 7.14 × 10 −4 bits per pulse, respectively, which are determined by the lowest key rate of the players at 25 km link (player 3) and 55 km (player 1).

Figure 10 :
Figure10: The number of the players versus the transmisssion distance.The black squares and blue rhombus are the simulated number of the players.The red and black curve is the fitting according to the simulated values.Given the channel loss limits of 20 dB and 30 dB, we find that the secure QSS and QCKA among 180 (53) and 651 (307) players are feasible over a metropolitan area over 20 km (50 km).

Table 2 :
The insertion loss of the optical devices of the network system.Filter, fiber optical filter; PC, fiber polarization controller; 1/99 BS, free-space 1/99 beam splitter; PBS, free-space polarization beam splitter; PM, free-space phase modulator; AM, free-space amplitude modulator biased at 96% transmission point; Coupling efficiency, fiber to free-space and free-space to fiber coupling efficiency; ADM, add/drop multiplexer; AWG 48-CH, arrayed waveguide grating of 48-channel.