Introduction

Quantum cryptography is a mature research field that exploits the principles of quantum mechanics to ensure its information theoretical security. The core protocol of quantum cryptography is quantum key distribution (QKD), which is the process of generating a secret key that is shared between two distant parties, called Alice and Bob. These parties are assumed to be exposed to a potential malicious eavesdropper, conventionally called Eve. Since the proposal of the first QKD protocols1,2, many efforts have been made to improve the security of QKD based on quantum principles3,4,5,6. Various types of QKD have also been experimentally demonstrated to date7,8,9,10.

The earliest proposal for QKD used 2-dimensional quantum states, called qubits11. After this proposal, significant efforts were made to increase the key rate of QKD protocols. For example, protocols involving high-dimensional quantum states, called qudits, were introduced. It is well known that higher-dimensional quantum states can carry more information per quantum. In fact, there have been many theoretical proposals of the exploitation of qudits in various types of quantum information processing, such as non-locality testing12,13,14,15,16 and quantum teleportation17,18. High-dimensional quantum states have been experimentally demonstrated in various quantum systems, energy-time eigenstates19,20, multipath-entangled states21,22,23,24, and quantized orbital angular momentum (OAM) modes of photons25,26.

Furthermore, applying high-dimensional states in QKD is known to increase the efficiency of key distribution under a potential attack by Eve in the ideal case27,28,29,30. The results show that QKD based on qudits can achieve a higher key rate and a higher upper bound on the allowed error rate than the original QKD protocol can. Such protocols have been demonstrated using various photon degrees of freedom, such as energy-time states31,32,33,34 and OAM modes35,36,37.

Along another branch of investigation, the security of the original QKD system has been scrutinized in more detail. Device-independent QKD (DI-QKD) has been proposed to extend the notion of ultimate security in the device attack scenario38,39,40,41,42,43,44. In this protocol, Alice and Bob can generate a secret key without any a priori assumptions regarding device performance. This scheme is designed to protect the key from side-channel attack when the measurement device is not very reliable. In this case, the security of the protocol is guaranteed only by nonlocal correlations as identified by the Clauser-Horne-Shimony-Holt (CHSH) inequality45. However, the DI-QKD protocol is not easy to be implemented in practice since it requires a loophole-free Bell test experiment, which poses high technological demands46,47,48,49,50.

To compensate for this practical difficulty, a measurement-device-independent QKD (MDI-QKD) protocol was proposed in 201251. This protocol can be more easily implemented than DI-QKD can because the MDI-QKD procedure does not rely on entanglement. In MDI-QKD, an untrusted third party, called Charlie, maintains quantum state detectors separately from Alice and Bob. After Alice and Bob send quantum states, e.g. single photon states, to Charlie, he performs a Bell state measurement (BSM) on the incoming photons to generate the correlation between Alice and Bob. In this protocol, Charlie acts as a referee to build up the necessary correlation. Due to the selective construction of the correlation, an eavesdropper who attacks the detector cannot obtain exact information about the secret key. For this reason, MDI-QKD possesses unbounded security against any detector attacks. Using MDI-QKD, most side-channel attacks made possible by detector imperfections can be resisted52.

However, MDI-QKD suffers from a low secret key rate. When the BSM in MDI-QKD is performed using linear optical elements, the success probability of the setup is only 50%53. In the original QKD protocol, the secret key can be extracted when Alice and Bob use the same encoding basis, which is true for half of the generated ensembles on average. However, in MDI-QKD, Alice and Bob can share information only when they use the same encoding basis and the BSM is successful, meaning that 75% of their trials must be discarded. This shortcoming makes this key distribution scheme quite inefficient.

To increase the key rate, aversion of MDI-QKD using high-dimensional quantum states was recently studied54,55, and a performance increase was demonstrated for MDI-QKD using 3-dimensional quantum states, called qutrits, instead of qubits54. However, the practicality of this scheme is still questionable. This is because a generalized BSM of a bipartite high-dimensional maximally entangled state cannot be implemented using only linear optical elements56,57. For the implementation of high-dimensional entangled state discrimination, multi-mode quantum scissors58 and a linear optical setup for multipartite high-dimensional entangled state discrimination59 have been proposed, although their success probabilities are still not sufficient for the implementation of efficient high-dimensional MDI-QKD.

In the present work, we propose an efficient discrimination setup for tripartite entangled qutrit states to enhance the discernible number of orthogonal entangled states. The setup relies on state-of-the-art techniques, a multi-port interferometer called a tritter60, and nondestructive photon number measurements61,62. The generation of multipartite high-dimensional entangled photonic states has not been well studied even now, and such states have been experimentally demonstrated only very recently26,59,63,64. With the technologies listed above, we construct a setup that can discriminate subsets of tripartite entangled qutrit states and show that qutrit MDI-QKD can be implemented using this setup. Moreover, we generalize the measurement to d-dimensional d-photon entangled state discrimination measurement and analyse the secret key rate of high-dimensional MDI-QKD using the generalized setup.

This article is organized as follows. We present a schematic description of the tripartite entangled qutrit state discrimination setup and the set of entangled states that the setup can discriminate. We also present schematic descriptions of the teleportation process and MDI-QKD using qutrit states with the setup we propose. We analyse the security of the MDI-QKD protocol using qutrit states as well. We generalize the proposed setup to a setup for d-dimensional d-photon entangled state discrimination and analyse the secret key rate of high-dimensional MDI-QKD. The efficiency of the proposed MDI-QKD setup when experimental factors are considered is described as well.

Results

Tripartite entangled qutrit state discrimination setup

Before we introduce the discrimination setup, we describe the physical system we are considering and introduce the related notation. We consider 3-dimensional photonic states, where |a〉, |b〉, and |c〉 denote 3-dimensional orthonormal states. Such 3-dimensional quantum states can be realized by exploiting various degrees of freedom, such as, high-dimensional time-bin states20,31 and OAM modes of single photons25,26. As an example, Fig. 1 shows a schematic setup for generating 3-dimensional time-bin states31. The source generates a single photon and the photon is injected into a delay line. The delay lines have different lengths, and the user can choose into which of the delay lines the photon is injected. |a〉, |b〉, and |c〉 denote the photonic time-bin states when the photon passes though the shortest, intermediate, and longest delay lines, respectively.

Figure 1
figure 1

A schematic diagram of the time-bin qutrit generating source31. The diagram is based on a figure from our previous work54. In this setup, the photon injection time to the output port is controlled by three different delay lines and a photonic path switch. |a〉, |b〉, and |c〉 denote the time states when the photon passes through the shortest, intermediate, and longest delay lines, respectively.

Full size image

With regard to the qutrit states, we will focus on tripartite entangled states. To realize interference among three photons, we use a multi-port interferometer called a tritter60. The tritter we consider has three input ports and three output ports. We consider the three-path operation described in Eq. (1):

$$(\begin{array}{c}{\hat{a}}_{3}^{\dagger }\\ {\hat{a}}_{4}^{\dagger }\\ {\hat{a}}_{5}^{\dagger }\end{array})={\hat{U}}_{3}(\begin{array}{c}{\hat{a}}_{0}^{\dagger }\\ {\hat{a}}_{1}^{\dagger }\\ {\hat{a}}_{2}^{\dagger }\end{array})=\frac{1}{\sqrt{3}}(\begin{array}{ccc}1 & 1 & 1\\ 1 & \omega & {\omega }^{2}\\ 1 & {\omega }^{2} & \omega \end{array})(\begin{array}{c}{\hat{a}}_{0}^{\dagger }\\ {\hat{a}}_{1}^{\dagger }\\ {\hat{a}}_{2}^{\dagger }\end{array})$$
(1)

where \({\hat{a}}_{y}^{\dagger }\) is a photon creation operator on path y and \({\hat{U}}_{3}\) is a three-dimensional discrete Fourier transformation defined in terms of ω, which, in turn, is defined as ω = exp(2πi/3). The input and output ports are distinguished by the subscripted numbers 0, 1, and 2 and 3, 4, and 5, respectively.

In our notation, a single photon that is time-bin mode x in the port labelled y is represented by \({\hat{a}}_{xy}^{\dagger }|0\rangle =|{x}_{y}\rangle \). We consider nine states, as given in Eq. (2):

$$\begin{array}{ccc}|{{\rm{\Psi }}}_{i}\rangle & = & \frac{1}{\sqrt{6}}\sum _{j=0}^{2}{\omega }^{2ij}|{a}_{j}\rangle (|{b}_{j+1},{c}_{j+2}\rangle -|{b}_{j+2},{c}_{j+1}\rangle )\\ |{{\rm{\Psi }}}_{3+i}\rangle & = & \frac{1}{\sqrt{6}}\sum _{j=0}^{2}{\omega }^{2ij}|{a}_{j}\rangle (|{b}_{j},{c}_{j+1}\rangle -|{b}_{j+1},{c}_{j}\rangle )\\ |{{\rm{\Psi }}}_{6+i}\rangle & = & \frac{1}{\sqrt{6}}\sum _{j=0}^{2}{\omega }^{2ij}|{a}_{j}\rangle (|{b}_{j+2},{c}_{j}\rangle -|{b}_{j},{c}_{j+2}\rangle ),\end{array}$$
(2)

where i ∈ {0, 1, 2}, ω is defined in Eq. (1), and we omit (mod 3) in the subscripts on the right-hand side. In the states described in Eq. (2), the three photons are in different time-bin modes, |a〉, |b〉, and |c〉. The tripartite entangled qutrit states |Ψ0〉, |Ψ1〉, and |Ψ2〉 are the quantum states in which each photon exists in a separate input port, and the other states are those in which two photons of different time-bin modes exist in one port and the other photon is in another port. The orthogonality of the nine tripartite entangled qutrit states is easily provable.

A schematic diagram of the entire tripartite entangled qutrit state discrimination setup is shown in Fig. 2. Before photons that are in one of the states described in Eq. (2) are injected into the tritter, nondestructive photon number measurements are performed on each input port for post-selection. The details of the post-selection process will be described later. Subsequently, the photons enter the tritter, and the tritter performs the \({\hat{U}}_{3}\) operation on the photons. After interference, we perform a qutrit state discrimination measurement on each output port. Since we are using the time-bin modes of single photons, the states can be discriminated by measuring the arrival times of the photons at on-off detectors65,66 or by using ultrafast optical switches67. We obtain a certain combination of clicked detectors when one of our input states described in Eq. (2) is injected into the entire setup, yielding an output state as shown in Eq. (14); the combination of clicked detectors for each state is given in Eq. (3):

$${|{\rm{\Psi }}}_{3i}\rangle \to \{\begin{array}{c}{D}_{3a},{D}_{4b},{D}_{5c}\\ {D}_{3a},{D}_{5b},{D}_{4c}\\ {D}_{4a},{D}_{3b},{D}_{5c}\\ {D}_{4a},{D}_{5b},{D}_{3c}\\ {D}_{5a},{D}_{3b},{D}_{4c}\\ {D}_{5a},{D}_{4b},{D}_{3c}\end{array},\,|{{\rm{\Psi }}}_{3i+1}\rangle \to \{\begin{array}{c}{D}_{3a},{D}_{3b},{D}_{4c}\\ {D}_{3a},{D}_{4b},{D}_{3c}\\ {D}_{4a},{D}_{4b},{D}_{5c}\\ {D}_{4a},{D}_{5b},{D}_{4c}\\ {D}_{5a},{D}_{3b},{D}_{5c}\\ {D}_{5a},{D}_{5b},{D}_{3c}\end{array},\,|{{\rm{\Psi }}}_{3i+2}\rangle \to \{\begin{array}{c}{D}_{3a},{D}_{3b},{D}_{5c}\\ {D}_{3a},{D}_{5b},{D}_{3c}\\ {D}_{4a},{D}_{3b},{D}_{4c}\\ {D}_{4a},{D}_{4b},{D}_{3c}\\ {D}_{5a},{D}_{4b},{D}_{5c}\\ {D}_{5a},{D}_{5b},{D}_{4c}\end{array},$$
(3)

where i ∈ {0, 1, 2} and Dxy denotes a click of the detector corresponding to the single-photon state |yx〉. Each possible detection listed in Eq.(3) has an equal probability of 1/6. Since we are using on-off detectors, we cannot discriminate phase differences among the three states. This means that we can infer groups of entangled states from the measurement results, but we cannot discriminate exact entangled states. To discriminate the exact state, we post-select only those trials in which all three photons exist in different input ports by means of nondestructive photon number measurements. In a nondestructive measurement, the absorption of the photons during the measurement is ideally avoided, and the other degrees of freedom of the photons also remain unaffected. Nondestructive measurements of the photon number state can be successfully realized using nonlinear effects68,69 or an atom-cavity system70,71. The remaining states after post-selection are |Ψ0〉, |Ψ1〉, and |Ψ2〉, which can be exactly discriminated from the combinations of clicked detectors given in Eq. (3). The nondestructive photon number measurements do not affect other degrees of freedom of the photons in the case that all photons are distributed in different ports, so the interference pattern among the three photons in the tritter is the same when there is no nondestructive photon number measurement. We note that it is sufficient to use a nondestructive photon number parity measurement instead of a full nondestructive photon number measurement. If nondestructive photon number parity measurements on the input ports indicate an odd photon number, then it is guarantee that all of the photons are in different input ports.

Figure 2
figure 2

A schematic diagram of the measurement setup. \({\hat{U}}_{3}\) denotes the tritter setup described in the Methods section; the pink rectangular boxes represent state discrimination elements, which correspond to polarization beam splitters in polarization qubit experiments; the black semicircles denote on-off detectors; and the green circles on the input ports denote nondestructive measurement devices for detecting the parity of the photon number. Dxy denotes a detector corresponding to a single photon state |yx〉.

Full size image

Path-encoded qutrit teleportation

In this section, we show that a qutrit state teleportation protocol can be implemented with the proposed tripartite entangled qutrit state discrimination setup. The protocol is very similar to the previously studied teleportation protocol using linear optical elements59. Figure 3 shows a schematic diagram of the qutrit teleportation protocol. The target state that we want to teleport is a path-encoded qutrit state, and its time-bin mode is |a〉. The target state can be written as shown in Eq. (4):

$${\alpha }_{0}|{a}_{0}\rangle +{\alpha }_{1}|{a}_{1}\rangle +{\alpha }_{2}|{a}_{2}\rangle $$
(4)

where αi is an arbitrary complex number satisfying the normalization condition, \({\sum }_{i=0}^{2}{|{\alpha }_{i}|}^{2}=1\). One user, called Alice, possesses the target state. She wants to send that state to the other user, called Bob. To teleport the state, Alice and Bob share a photonic entangled state |Ψ0〉. Previous studies have investigated the generation of multipartite photonic entangled states by means of an array of nonlinear crystals64 and by means of tritter and nondestructive photon number measurements59. Alice has the target state and two photons generated from |Ψ0〉 in time-bin states |b〉 and |c〉, and Bob has a photon generated from |Ψ0〉 in time-bin state |a〉. Then, the entire system can be written as described in Eq. (5):

$$|{\rm{\Xi }}\rangle =({\alpha }_{0}|{a}_{0}\rangle +{\alpha }_{1}|{a}_{1}\rangle +{\alpha }_{2}|{a}_{2}\rangle )\otimes [\frac{1}{\sqrt{6}}\sum _{j=0}^{2}|{a}_{Bj}\rangle (|{b}_{j+1},{c}_{j+2}\rangle -|{b}_{j+2},{c}_{j+1}\rangle )]$$
(5)

where we omit (mod 3) in the subscripts. Alice applies the tripartite entangled qutrit state discrimination operation to her three photons. The entire system can be rewritten in the basis of Alice’s measurement, as shown in Eq. (6):

$$\begin{array}{rcl}|{\rm{\Xi }}\rangle & = & \frac{1}{3}[\sum _{i=0}^{2}({|{\rm{\Psi }}}_{i}\rangle \otimes \sum _{j=0}^{2}{\alpha }_{j}{\omega }^{ij}|{a}_{Bj}\rangle )+\sum _{i=0}^{2}({|{\rm{\Psi }}}_{3+i}\rangle \otimes \sum _{j=0}^{2}{\alpha }_{j+1}{\omega }^{i(j+\mathrm{1)}}|{a}_{Bj}\rangle )\\ & & +\,\sum _{i=0}^{2}({|{\rm{\Psi }}}_{6+i}\rangle \otimes \sum _{j\mathrm{=0}}^{2}{\alpha }_{j+2}{\omega }^{i(j+\mathrm{2)}}|{a}_{Bj}\rangle )]\end{array},$$
(6)

where ω = exp(2πi/3) and we omit (mod 3) in all subscripts except those of Ψ. After Alice’s measurement, Alice sends the result of the measurement to Bob. Bob can recover the initial target state by performing a unitary operation on his state corresponding to Alice’s result. The operation that Bob should perform for each possible result is specified in Table 1. The operations that Bob needs to perform are two path rotating operations, which are described in Eq. (7):

$${\hat{P}}_{1}=(\begin{array}{ccc}1 & 0 & 0\\ 0 & {\omega }^{2} & 0\\ 0 & 0 & \omega \end{array}),\,\,{\hat{P}}_{2}={\hat{P}}_{1}^{\mathrm{\ 2}}=(\begin{array}{ccc}1 & 0 & 0\\ 0 & \omega & 0\\ 0 & 0 & {\omega }^{2}\end{array})\mathrm{.}$$
(7)
Figure 3
figure 3

A schematic diagram of 3-dimensional path-encoded state teleportation. The purple circles represent 2 × 1 couplers, fiber optical devices combining two paths into one path. ESD is the tripartite entangled qutrit state discrimination setup, and the numbers 0, 1, and 2 denote the ports. The blue circles represent photons, and the letters on the circles denote the time-bin states of the photons. The numbers 0, 1, and 2 correspond to the input ports connected to ESD, and B0, B1, and B2 denote the ports of the result states. Alice and Bob share the entangled state |Ψ0〉 (orange circle), where Alice has the photons in time-bin states b and c and Bob has the photon in time-bin state a. Teleportation can be performed using the result of Alice’s tripartite ESD measurement and Bob’s corresponding unitary operation. The details of the scheme are described in the text.

Full size image
Table 1 Bob’s unitary operations for qutrit teleportation corresponding to the result of Alice’s entangled state discrimination measurement. The definition of each unitary operator is given in Eq. (7).
Full size table

The unitary operators \({\hat{P}}_{1}\) and \({\hat{P}}_{2}\) can be implemented with phase shifters on Bob’s photonic paths B0, B1, and B2. For instance, to realize \({\hat{P}}_{1}\), the phase shifters should simultaneously apply no phase shift on B0, a phase shift of ω2 on B1, and a phase shift of ω on B2. After the unitary operation, Bob’s photonic path state is as described in Eq. (8):

$${\alpha }_{0}|{a}_{B0}\rangle +{\alpha }_{1}|{a}_{B1}\rangle +{\alpha }_{2}|{a}_{B2}\rangle \mathrm{.}$$
(8)

This state is the same as the initial target state that is given in Eq. (4).

Measurement-device-independent quantum key distribution using qutrits

In this section, we study the conceptual implementation of MDI-QKD using qutrit states. MDI-QKD is proposed to prevent side-channel attacks against imperfect measurement devices51. In MDI-QKD, Alice and Bob, who want to share a secret key, send their encoded photonic states to an untrusted third party, Charlie. Charlie then performs a BSM to measure the correlation of the photons and announces the result. Alice (Bob) can infer the state that Bob (Alice) sent to Charlie from the announced result and her (his) own encoded state. Since the measurement setup detects only the correlation of the photons, an eavesdropper Eve cannot obtain the information that Alice and Bob share by attacking the measurement setup. It has been proven that QKD with high-dimensional quantum states has a higher secret key rate than that of traditional qubit QKD27,28,29,30, and there are also studies that have shown that MDI-QKD with high-dimensional states has some advantages compared with qubit MDI-QKD54,55. The procedure for MDI-QKD using qutrit states was introduced in our previous work54. Since the proposed setup is designed to discriminate tripartite entangled qutrit states, the quantum states in which Alice and Bob encode their information must be different from those used in the original protocol in order to exploit the setup. Here, we will show that MDI-QKD can be implemented with our proposed setup.

In the original MDI-QKD protocol, Alice and Bob use two encoding bases at each site. As an extension of that protocol, our protocol also uses two encoding bases, a path-encoding basis and one of its mutually unbiased bases (MUBs). The condition for the two bases to be MUBs in three-dimensional Hilbert space, \({|\langle \bar{i}|j\rangle |}^{2}=\mathrm{1/3}\), should be satisfied for all i, j ∈ {0, 1, 2}, where {0, 1, 2} and \(\{|\bar{0}\rangle ,|\bar{1}\rangle ,|\bar{2}\rangle \}\) are orthonormal bases. In our physical system, {|x0〉, |x1〉, |x2〉} is a path-encoding basis, and \(\{|{x}_{\bar{0}}\rangle ,\,|{x}_{\bar{1}}\rangle ,\,|{x}_{\bar{2}}\rangle \}\) is one of its MUBs, as defined in Eq. (9):

$$\begin{array}{c}|{x}_{\bar{0}}\rangle =\frac{1}{\sqrt{3}}(|{x}_{0}\rangle +|{x}_{1}\rangle +|{x}_{2}\rangle )\\ |{x}_{\bar{1}}\rangle =\frac{1}{\sqrt{3}}(|{x}_{0}\rangle +\omega |{x}_{1}\rangle +{\omega }^{2}|{x}_{2}\rangle )\\ |{x}_{\bar{2}}\rangle =\frac{1}{\sqrt{3}}(|{x}_{0}\rangle +{\omega }^{2}|{x}_{1}\rangle +\omega |{x}_{2}\rangle \mathrm{).}\end{array}$$
(9)

The states in the MUB can be generated with the tritter operation \({\hat{U}}_{3}\). For example, state \(|{x}_{\bar{0}}\rangle \) can be generated by inputting the photonic state |x〉 into input port 0 of the tritter depicted in the methods section.

A description of MDI-QKD using qutrit states is given as follows. Since the measurement setup projects an incoming state onto tripartite entangled states, the total number of encoded photonic states that Alice and Bob send to Charlie should be three. We assume that Alice sends two photonic states and that Bob sends one photonic state as shown in Fig. 4. First, Alice randomly chooses encoding information from among the ordinary numbers 1, 2 and 3 and the bar numbers, \(\bar{0}\), \(\bar{1}\) and \(\bar{2}\). After that, Alice generates the corresponding bipartite path entangled state. If Alice chooses a number x, Alice generates the state \(\mathrm{(1/}\sqrt{2})(|{b}_{x}\mathrm{,\ }{c}_{x+1}\rangle -|{b}_{x+1}\mathrm{,\ }{c}_{x}\rangle )\). Bob chooses a number y from among the numbers Alice used and generates the state ay. Alice and Bob send their states to Charlie; then, Charlie performs tripartite entangled qutrit state discrimination on the incoming photons and announces the result through a public channel. Subsequently, Alice and Bob discard trials in which their encoding bases were different after a basis comparison through a public channel. The remaining data become the sifted key, and Alice and Bob can synchronize their information by performing the appropriate post-processing as described in our previous work54.

Figure 4
figure 4

A schematic diagram of MDI-QKD using qutrits. The purple circles represent 2 × 1 couplers, ESD denotes the entengled state discrimination measurement setup, and the numbers 0,1, and 2 denote three paths. Subscripts x and y in the states of Alice and Bob represent the labels of the paths on which the photons exist, meaning that x, y ∈ {0, 1, 2} and we omit (mod 3) in the subscripts. The photons in the large orange circle are in an entangled state. Alice generates a bipartite path-entangled photon pair in time-bin states b and c on paths x and x + 1 and sends them to an untrusted third party, Charlie. Bob generates a photon in state a on path y and also sends it to Charlie.The details of the states are described in the text.

Full size image

To evaluate the usefulness of the proposed protocol, a security analysis of this protocol is necessary. Such an analysis can be performed through an inspection of the equivalent protocol using the entanglement distillation process (EDP)3,5,6. If the two parties, Alice and Bob, share the maximally entangled state generated via the EDP, then an eavesdropper cannot establish correlations between her state and the states of Alice and Bob72. In this sense, if Alice and Bob share a maximally entangled state, then they are assured that their protocol is secure against eavesdroppers. Thus, the security of the proposed protocol can be analysed with respect to the number of maximally entangled states generated via the EDP.

A schematic diagram of the equivalent protocol that exploits the maximally entangled state is shown in Fig. 5. In this protocol, we assume that Alice has a tripartite qutrit path-entangled state generator and that Bob has a bipartite qutrit path entangled state generator. Implementations of multipartite high-dimensional path-entangled states using linear optical elements and nondestructive photon number parity measurements59 and using overlapping paths of photon pairs created in different crystals64 have recently been proposed. The generation of bipartite high-dimensional path-entangled states using nonlinear crystals has previously been studied and demonstrated22,23. With regard to the states, Alice keeps the state that is in time-bin mode a and sends the other photons to Charlie by using state discrimination elements, and Bob also keep one photon and sends the other to Charlie. Then the whole system can be described as written in Eq. (10):

$$|{\rm{\Xi }}\rangle =\frac{1}{\sqrt{6}}\sum _{i=0}^{2}|{a}_{Ai}\rangle (|{b}_{i+1},{c}_{i+2}\rangle -|{b}_{i+2},{c}_{i+1}\rangle )\otimes \frac{1}{\sqrt{3}}\sum _{j=0}^{2}|{a}_{j},{a}_{Bj}\rangle \mathrm{.}$$
(10)
Figure 5
figure 5

A schematic diagram of MDI-QKD using entangled qutrit states for security analysis. Alice prepares tripartite entangled qutrits and sends two of them, in states b and c, to Charlie using state discrimination elements. Bob prepares bipartite maximally path-entangled qutrits with both photons in state a and sends one of them to Charlie. Charlie performs tripartite entangled qutrit state discrimination (ESD) on the incoming photons and announces the result. By means of a unitary operation applied to Bob’s state, Alice and Bob can share bipartite maximally entangled qutrits.

Full size image

The entire system can be rewritten as given in Eq. (11):

$$\begin{array}{c}|{\rm{\Xi }}\rangle =\frac{1}{3}\{\sum _{i=0}^{2}[{|{\rm{\Psi }}}_{i}\rangle \otimes \frac{1}{\sqrt{3}}\sum _{j\mathrm{=0}}^{2}{\omega }^{ij}|{a}_{Aj},{a}_{Bj}\rangle ]+\sum _{i=0}^{2}[{|{\rm{\Psi }}}_{i+3}\rangle \otimes \frac{1}{\sqrt{3}}\sum _{j=0}^{2}{\omega }^{i(j+\mathrm{1)}}|{a}_{Aj},{a}_{B(j+\mathrm{1)}}\rangle ]\\ \,\,\,+\,\sum _{i\mathrm{=0}}^{2}[{|{\rm{\Psi }}}_{i+6}\rangle \otimes \frac{1}{\sqrt{3}}\sum _{j=0}^{2}{\omega }^{i(j+\mathrm{2)}}|{a}_{Aj},{a}_{B(j+\mathrm{2)}}\rangle ]\}\mathrm{.}\end{array}$$
(11)

In Eq. (11), the state |Ψ〉 represents the tripartite state that Alice and Bob sent to Charlie for the entangled state discrimination measurement. The bipartite states in the square brackets denote the path-entangled qutrit state that Alice and Bob share. With the proposed setup, the states |Ψ0〉, |Ψ1〉, and |Ψ2〉 can be exactly discriminated. The other states cannot be exactly discriminated, so Alice and Bob should discard any trials in which Charlie’s announced result is not one of |Ψ0〉, |Ψ1〉, and |Ψ2〉. After sifting, Bob performs a unitary operation on his state based on Charlie’s result; then, the final state Alice and Bob share is the maximally entangled state \(\mathrm{1/}\sqrt{3}{\sum }_{j\mathrm{=0}}^{2}{a}_{Aj},{a}_{Bj}\) when there is no error. Alice and Bob privately choose their measurement bases from between the photon path measurement and the corresponding MUB measurement and perform their measurements. The measurement results of Alice and Bob are strongly correlated only when Alice and Bob choose the same basis, so they discard any trial in which different bases are used after a basis comparison step conducted through public communication. The remaining data are correlated, so these data can be used as a secret key. Then, the security analysis of the MDI-QKD protocol using entangled qutrit states becomes equivalent to that of the QKD protocol using 3-dimensional maximally entangled states, which has already been studied28,29,54. According to the results, the secret key rate per sifted signal of the protocol, r3,can be evaluated as shown in Eq. (12):

$${r}_{3}\ge {\mathrm{log}}_{{\rm{2}}}3-2Q-2H(Q)$$
(12)

where H(x) is the Shannon entropy, defined as \(H(x)=-x{\mathrm{log}}_{2}x-\mathrm{(1}-x){\mathrm{log}}_{2}(1-x)\), and Q denotes the state error rate in the path-encoding basis. Each sifted signal is the result of a trial in which Alice and Bob generated the |Ψ0〉 state and chose the same measurement basis. The error rate can be obtained as follows (number of signals that contain errors)/(number of sifted signals). An error corresponds to a case in which Alice and Bob share |Ψx〉 such that x ≠ 0 at the end of the protocol.

d-dimensional d-photon state discrimination setup and its efficiency

We investigate applications of a d-dimensional generalized setup and their efficiency. With the generalized setup and states, the qutrit teleportation scheme and qutrit MDI-QKD scheme described in previous sections can be extended to the teleportation of arbitrary d-dimensional path-encoded states and d-dimensional MDI-QKD, respectively. For instance, the steps of the d-dimensional MDI-QKD protocol are very similar to those of the qutrit MDI-QKD protocol, except that Alice and Bob should prepare d-dimensional information instead of 3-dimensional information and Alice and Bob use the states Ai and 0j to encode their information, where Ai is defined in the Methods section and i, j ∈ {0, 1, 2, …, d − 1}. The security proof for d-dimensional QKD using maximally entangled states has already been studied28,29. Using the results, the secret key rate per sifted signal of d-dimensional QKD can be written as given in Eq. (13):

$${r}_{d}\ge {\mathrm{log}}_{2}d+\mathrm{2(1}-Q){\mathrm{log}}_{2}\mathrm{(1}-Q)+2Q{\mathrm{log}}_{2}(\frac{Q}{d-1})\mathrm{.}$$
(13)

where Q is the state error rate. As previously mentioned, MDI-QKD has the disadvantage of a lower secret key rate than that of the original BB84 protocol since Alice and Bob must discard more trials in MDI-QKD than in BB84 because of the success probability of the BSM. Here, we investigate the secret key rate per total signal of d-dimensional MDI-QKD. The secret key rate per total signal R is obtained from (sifted signal rate) × (secret key rate per sifted signal), where the sifted signal rate contains the probability that the d-dimensional d-photon entangled state discrimination succeeds and that Alice and Bob chose the same basis. In d-dimensional MDI-QKD, the number of possible combinations that Charlie can receive is d2 since Alice and Bob each use d different orthonormal states. Among the possible combinations, only the states in which all photons exist in different ports are post-selected by means of nondestructive photon number measurements. They are projected onto {|Φi〉 |Φi||i = 0, 1, 2, …, d − 1}, and all other states are discarded. Thus, the success probability of d-dimensional d-photon entangled state discrimination is 1/d in the ideal situation in which we ignore all experimental factors and there is no eavesdropper. With this probability, the secret key rate per total signal of d-dimensional MDI-QKD can be calculated as rd/(2d), where the 2 in the denominator comes from the probability that Alice and Bob choose the same basis. The secret key rates per total signal of d-dimensional MDI-QKD with various values of d are shown in Fig. 6. It is already known that high-dimensional QKD is more robust against state error than qubit QKD is27,28,29,30, this phenomenon is also reflected in this plot. In the case of no error, when Q = 0, only MDI-QKD using qutrit states has a higher key rate than that of the original qubit MDI-QKD protocol. The expression for the secret key rate per total signal when Q = 0 is \(({\mathrm{log}}_{2}d)/d\). In this expression, the denominator increases linearly with the number of dimensions while the numerator increases logarithmically, so the secret key rate decreases in the high-dimensional case. From the plot, we can identify that qutrit MDI-QKD has the highest secret key rate per total signal when 0 ≤ Q ≤ 0.0294. This means that qutrits are best high-dimensional quantum states for MDI-QKD in the low-error range.

Figure 6
figure 6

The secret key rate per total signal of d-dimensional MDI-QKD in the ideal situation. Since the number of states that can be discriminated via generalized d-dimensional d-photon entangled state discrimination is d among the d2 possible states considered, the success probability of entangled state discrimination is 1/d if all experimental factors are ignored. The secret key rate per total signal, R, can be obtained as follows: (secret key rate per sifted signal, r) × (probability that a trial produces a sifted signal). The plot shows that only MDI-QKD using 3-dimensional quantum states has a higher secret key rate than that of the original MDI-QKD protocol at Q = 0, the zero-error case.

Full size image

In real experiments, our proposed setup can fail even if the input state is one of {|Φi〉i = 1, 2, …, d − 1} since the setup involves nondestructive photon number measurements and the success probability of such measurements is not 100%. The generalized d-dimensional d-photon entangled state discrimination setup involves d nondestructive photon number measurements, so the efficiency of this setup is exponentially affected by the success probability of these measurements. To investigate its usefulness, we compare the generalized setup with a “Bell filter” that consists only of linear optical elements59. The Bell filter can discriminate |Ψ0〉 regardless of dimensionality, so the sifted signal rate of d-dimensional MDI-QKD using the Bell filter is always 1/d2, where we ignore the probability that Alice and Bob choose the same basis since it is the same for all considered protocols. For the generalized setup we propose, the sifted signal rate is 1/d × (η)d, where η is the success probability of each nondestructive photon number measurement. For the sifted signal rates of the two setups to be the same, η should be η = (1/d)(1/d); examples of the value of η are 0.693, 0.707, and 0.725 for 3, 4, and 5 dimensions, respectively. Since the efficiency of nondestructive photon number measurements using an atom-cavity system was reported to be 0.66 in 201370, the success probability of the proposed setup is lower than that of a Bell filter with current technology, even though the proposed setup can discriminate more states than the Bell filter can.

Discussion

We investigated a tripartite entangled qutrit state discrimination setup and its applications, especially teleportation and MDI-QKD. We showed that the proposed setup can discriminate three tripartite entangled qutrit states. We showed that the setup can be generalized to d-dimensional d-photon entangled state discrimination and that the secret key rate per total signal of d-dimensional MDI-QKD using the generalized setup is highest when qutrit states are used. We considered the efficiency of the nondestructive photon number measurements performed in the setup and calculated the efficiency bound of the proposed setup for which the sifted signal rate becomes higher than that of a Bell filter that consists of linear optical elements59. Since the success probability of the nondestructive photon number measurements using an atom-cavity system is 66%70, the proposed setup is not as efficient as a Bell filter with current technology. However, we expect that the proposed setup will be more efficient with future technologies.

Methods

Tritter operation in the proposed setup

A schematic diagram of the tritter that corresponds to the unitary operator \({\hat{U}}_{3}\) is shown in Fig. 7. The tritter contains only linear optical elements: two 50:50 beam splitters, one beam splitter whose reflectivity is 1/3 and several phase shifters. When the input states is one of the state described in Eq. (2), the output state after the tritter operation can be easily obtained from the input-output relation of the tritter given in Eq. (1); the possible states are given in Eq. (14):

$$\begin{array}{c}{\hat{U}}_{3}{|{\rm{\Psi }}}_{3i}\rangle \sim \frac{1}{\sqrt{6}}\sum _{j=3}^{5}{\omega }^{ij}|{a}_{j}\rangle (|{b}_{j+1},{c}_{j+2}\rangle -|{b}_{j+2},{c}_{j+1}\rangle )\\ {\hat{U}}_{3}{|{\rm{\Psi }}}_{3i+1}\rangle \sim \frac{1}{\sqrt{6}}\sum _{j=3}^{5}{\omega }^{ij}|{a}_{j}\rangle (|{b}_{j},{c}_{j+1}\rangle -|{b}_{j+1},{c}_{j}\rangle )\\ {\hat{U}}_{3}|{{\rm{\Psi }}}_{3i+2}\rangle \sim \frac{1}{\sqrt{6}}\sum _{j=3}^{5}{\omega }^{ij}|{a}_{j}\rangle (|{b}_{j+2},{c}_{j}\rangle -|{b}_{j},{c}_{j+2}\rangle ),\end{array}$$
(14)

where i ∈ {0, 1, 2}, the value of a subscript j in Eq. (14) is equal to as 3 + [j (mod 3)] if a number in the subscript is larger than 5, and an unimportant global phase is ignored. The results for the discrimination setup (Eq. (3)) are obtained directly from Eq. (14).

Figure 7
figure 7

A schematic diagram of the tritter setup for realizing the unitary operator \({\hat{U}}_{3}\) described in Eq. (1). The blue box represents a mirror, each BS1 (blue line) represents a 50:50 beam splitter, BS2 (green line) represents a beam splitter whose reflectivity is 1/3, and the purple squares represent phase shifters.

Full size image

d-dimensional d-photon state discrimination setup

Our proposed setup can be easily generalized to a setup for d-dimensional d-photon entangled state discrimination. For d-dimensional d-photon entangled state discrimination, we need to generalize the three-path operation in Eq. (1) to a d-path operation, which is described by a d × d discrete Fourier transform operation \({\hat{U}}_{d}\), as shown in Eq. (15):

$${\hat{U}}_{d}=\frac{1}{\sqrt{d}}(\begin{array}{cccccc}1 & 1 & 1 & 1 & \cdots & 1\\ 1 & \chi & {\chi }^{2} & {\chi }^{3} & \cdots & {\chi }^{d-1}\\ 1 & {\chi }^{2} & {\chi }^{4} & {\chi }^{6} & \cdots & {\chi }^{\mathrm{2(}d-\mathrm{1)}}\\ 1 & {\chi }^{3} & {\chi }^{6} & {\chi }^{9} & \cdots & {\chi }^{\mathrm{3(}d-\mathrm{1)}}\\ \vdots & \vdots & \vdots & \vdots & \ddots & \vdots \\ 1 & {\chi }^{d-1} & {\chi }^{\mathrm{2(}d-\mathrm{1)}} & {\chi }^{\mathrm{3(}d-\mathrm{1)}} & \cdots & {\chi }^{(d-\mathrm{1)(}d-\mathrm{1)}}\end{array})$$
(15)

where χ = exp(2πi/d). The unitary operation \({\hat{U}}_{d}\) can be realized by means of a tritter with d inputs and d outputs. As an extension of the tripartite entangled qutrit state discrimination setup, the d-dimensional d-photon entangled state discrimination setup consists of a d-input d-output tritter, d nondestructive photon number measurements, and d2 on-off detectors. One of the states that the generalized setup can discriminate is very similar to the state that can be discriminated by means of the existing setup59, this state is given in Eq. (16):

$${|{\rm{\Phi }}}_{0}\rangle =\frac{1}{\sqrt{d!}}{\rm{\det }}({\rm{\Lambda }})|{\rm{vac}}\rangle $$
(16)

where

$${\rm{\Lambda }}=(\begin{array}{cccc}{\hat{a}}_{00}^{\dagger } & -{\hat{a}}_{01}^{\dagger } & \cdots & {(-\mathrm{1)}}^{(d-\mathrm{1)}}{\hat{a}}_{\mathrm{0(}d-\mathrm{1)}}^{\dagger }\\ {\hat{a}}_{10}^{\dagger } & {\hat{a}}_{11}^{\dagger } & \cdots & {\hat{a}}_{\mathrm{1(}d-\mathrm{1)}}^{\dagger }\\ \vdots & \vdots & \ddots & \vdots \\ {\hat{a}}_{(d-\mathrm{1)0}}^{\dagger } & {\hat{a}}_{(d-\mathrm{1)1}}^{\dagger } & \cdots & {\hat{a}}_{(d-\mathrm{1)(}d-\mathrm{1)}}^{\dagger }\end{array})$$
(17)

and |vac〉 means the vacuum state. Let us recall that in our notation, \({\hat{a}}_{xy}^{\dagger }\) is the photon creation operator whose orthonormal mode is x and whose path label is y; thus, it can be rewritten as \({\hat{a}}_{xy}^{\dagger }|\mathrm{vac}\rangle =|{x}_{y}\rangle \). If we extend the state with respect to the first row, then the state is rewritten as shown in Eq. (18):

$${|{\rm{\Phi }}}_{0}\rangle =\frac{1}{\sqrt{d!}}{\rm{\det }}({\rm{\Lambda }})|{\rm{vac}}\rangle =\frac{1}{\sqrt{d!}}\sum _{i=0}^{d-1}{\hat{a}}_{0i}^{\dagger }{\rm{\det }}({{\rm{\Lambda }}}_{0i})|{\rm{vac}}\rangle =\frac{1}{\sqrt{d}}\sum _{i=0}^{d-1}|{0}_{i}\rangle |{A}_{i}\rangle ,$$
(18)

where

$$|{A}_{i}\rangle =\frac{1}{\sqrt{(d-\mathrm{1)!}}}{\rm{\det }}({{\rm{\Lambda }}}_{0i})|{\rm{vac}}\rangle $$
(19)

and Λ0i is the (d − 1) × (d − 1) submatrix obtained by omitting the (i + 1)th column and first row of Λ. Similar to the case of tripartite entangled qutrit state discrimination, all states that the generalized setup can discriminate are orthogonal to |Φ0〉 with a phase factor χ; these states can be described as given in Eq. (20):

$$|{{\rm{\Phi }}}_{i}\rangle =\frac{1}{\sqrt{d}}\sum _{j=0}^{d-1}{\chi }^{ij}|{0}_{j}\rangle |{A}_{j}\rangle ,$$
(20)

where i ∈ {0, 1, 2, 3, …, d − 1}. These d states can be discriminated from the combinations of clicked detectors in the generalized setup after post-selection using nondestructive photon number measurements.