Enhanced Bell state measurement for efficient measurement-device-independent quantum key distribution using 3-dimensional quantum states

We propose an enhanced discrimination measurement for tripartite 3-dimensional entangled states in order to improve the discernible number of orthogonal entangled states. The scheme suggests 3-dimensional Bell state measurement by exploiting composite two 3-dimensional state measurement setups. The setup relies on state-of-the-art techniques, a multi-port interferometer and nondestructive photon number measurements that are used for the post-selection of suitable ensembles. With this scheme, the sifted signal rate of measurement-device-independent quantum key distribution using 3-dimensional quantum states is improved by up to a factor of three compared with that of the best existing setup.

To compensate for this practical difficulty, a measurement-device-independent QKD (MDI-QKD) protocol was proposed in 2012 51 . This protocol can be more easily implemented than DI-QKD can because the MDI-QKD procedure does not rely on entanglement. In MDI-QKD, an untrusted third party, called Charlie, maintains quantum state detectors separately from Alice and Bob. After Alice and Bob send quantum states, e.g. single photon states, to Charlie, he performs a Bell state measurement (BSM) on the incoming photons to generate the correlation between Alice and Bob. In this protocol, Charlie acts as a referee to build up the necessary correlation. Due to the selective construction of the correlation, an eavesdropper who attacks the detector cannot obtain exact information about the secret key. For this reason, MDI-QKD possesses unbounded security against any detector attacks. Using MDI-QKD, most side-channel attacks made possible by detector imperfections can be resisted 52 .
However, MDI-QKD suffers from a low secret key rate. When the BSM in MDI-QKD is performed using linear optical elements, the success probability of the setup is only 50% 53 . In the original QKD protocol, the secret key can be extracted when Alice and Bob use the same encoding basis, which is true for half of the generated ensembles on average. However, in MDI-QKD, Alice and Bob can share information only when they use the same encoding basis and the BSM is successful, meaning that 75% of their trials must be discarded. This shortcoming makes this key distribution scheme quite inefficient.
To increase the key rate, aversion of MDI-QKD using high-dimensional quantum states was recently studied 54,55 , and a performance increase was demonstrated for MDI-QKD using 3-dimensional quantum states, called qutrits, instead of qubits 54 . However, the practicality of this scheme is still questionable. This is because a generalized BSM of a bipartite high-dimensional maximally entangled state cannot be implemented using only linear optical elements 56,57 . For the implementation of high-dimensional entangled state discrimination, multi-mode quantum scissors 58 and a linear optical setup for multipartite high-dimensional entangled state discrimination 59 have been proposed, although their success probabilities are still not sufficient for the implementation of efficient high-dimensional MDI-QKD.
In the present work, we propose an efficient discrimination setup for tripartite entangled qutrit states to enhance the discernible number of orthogonal entangled states. The setup relies on state-of-the-art techniques, a multi-port interferometer called a tritter 60 , and nondestructive photon number measurements 61,62 . The generation of multipartite high-dimensional entangled photonic states has not been well studied even now, and such states have been experimentally demonstrated only very recently 26,59,63,64 . With the technologies listed above, we construct a setup that can discriminate subsets of tripartite entangled qutrit states and show that qutrit MDI-QKD can be implemented using this setup. Moreover, we generalize the measurement to d-dimensional d-photon entangled state discrimination measurement and analyse the secret key rate of high-dimensional MDI-QKD using the generalized setup.
This article is organized as follows. We present a schematic description of the tripartite entangled qutrit state discrimination setup and the set of entangled states that the setup can discriminate. We also present schematic descriptions of the teleportation process and MDI-QKD using qutrit states with the setup we propose. We analyse the security of the MDI-QKD protocol using qutrit states as well. We generalize the proposed setup to a setup for d-dimensional d-photon entangled state discrimination and analyse the secret key rate of high-dimensional MDI-QKD. The efficiency of the proposed MDI-QKD setup when experimental factors are considered is described as well.

Results
Tripartite entangled qutrit state discrimination setup. Before we introduce the discrimination setup, we describe the physical system we are considering and introduce the related notation. We consider 3-dimensional photonic states, where |a〉, |b〉, and |c〉 denote 3-dimensional orthonormal states. Such 3-dimensional quantum states can be realized by exploiting various degrees of freedom, such as, high-dimensional time-bin states 20,31 and OAM modes of single photons 25,26 . As an example, Fig. 1 shows a schematic setup for generating 3-dimensional time-bin states 31 . The source generates a single photon and the photon is injected into a delay line. The delay lines have different lengths, and the user can choose into which of the delay lines the photon is injected. |a〉, |b〉, and |c〉 denote the photonic time-bin states when the photon passes though the shortest, intermediate, and longest delay lines, respectively.  31 . The diagram is based on a figure from our previous work 54 . In this setup, the photon injection time to the output port is controlled by three different delay lines and a photonic path switch. |a〉, |b〉, and |c〉 denote the time states when the photon passes through the shortest, intermediate, and longest delay lines, respectively. With regard to the qutrit states, we will focus on tripartite entangled states. To realize interference among three photons, we use a multi-port interferometer called a tritter 60 . The tritter we consider has three input ports and three output ports. We consider the three-path operation described in Eq. (1): where ˆ † a y is a photon creation operator on path y and Û 3 is a three-dimensional discrete Fourier transformation defined in terms of ω, which, in turn, is defined as ω = exp(2πi/3). The input and output ports are distinguished by the subscripted numbers 0, 1, and 2 and 3, 4, and 5, respectively.
In our notation, a single photon that is time-bin mode x in the port labelled y is represented by | 〉 = | 〉 † a x 0 xy y . We consider nine states, as given in Eq. where i ∈ {0, 1, 2}, ω is defined in Eq. (1), and we omit (mod 3) in the subscripts on the right-hand side. In the states described in Eq. (2), the three photons are in different time-bin modes, |a〉, |b〉, and |c〉. The tripartite entangled qutrit states |Ψ 0 〉, |Ψ 1 〉, and |Ψ 2 〉 are the quantum states in which each photon exists in a separate input port, and the other states are those in which two photons of different time-bin modes exist in one port and the other photon is in another port. The orthogonality of the nine tripartite entangled qutrit states is easily provable. A schematic diagram of the entire tripartite entangled qutrit state discrimination setup is shown in Fig. 2. Before photons that are in one of the states described in Eq. (2) are injected into the tritter, nondestructive photon number measurements are performed on each input port for post-selection. The details of the post-selection process will be described later. Subsequently, the photons enter the tritter, and the tritter performs the Û 3 operation on the photons. After interference, we perform a qutrit state discrimination measurement on each output port. Since we are using the time-bin modes of single photons, the states can be discriminated by measuring the arrival times of the photons at on-off detectors 65,66 or by using ultrafast optical switches 67 . We obtain a certain combination of clicked detectors when one of our input states described in Eq. (2) is injected into the entire setup, yielding an output state as shown in Eq. (14); the combination of clicked detectors for each state is given in Eq. (3):  (3) has an equal probability of 1/6. Since we are using on-off detectors, we cannot discriminate phase differences among the three states. This means that we can infer groups of entangled states from the measurement results, but we cannot discriminate exact entangled states. To discriminate the exact state, we post-select only those trials in which all three photons exist in different input ports by means of nondestructive photon number measurements. In a nondestructive measurement, the absorption of the photons during the measurement is ideally avoided, and the other degrees of freedom of the photons also remain unaffected. Nondestructive measurements of the photon number state can be successfully realized using nonlinear effects 68,69 or an atom-cavity system 70,71 . The remaining states after post-selection are |Ψ 0 〉, |Ψ 1 〉, and |Ψ 2 〉, which can be exactly discriminated from the combinations of clicked detectors given in Eq. (3). The nondestructive photon number measurements do not affect other degrees of freedom of the photons in the case that all photons are distributed in different ports, so the interference pattern among the three photons in the tritter is the same when there is no nondestructive photon number measurement. We note that it is sufficient to use a nondestructive photon number parity measurement instead of a full nondestructive photon number measurement. If nondestructive photon number parity measurements on the input ports indicate an odd photon number, then it is guarantee that all of the photons are in different input ports.
Path-encoded qutrit teleportation. In this section, we show that a qutrit state teleportation protocol can be implemented with the proposed tripartite entangled qutrit state discrimination setup. The protocol is very similar to the previously studied teleportation protocol using linear optical elements 59 . Figure 3 shows a schematic diagram of the qutrit teleportation protocol. The target state that we want to teleport is a path-encoded qutrit state, and its time-bin mode is |a〉. The target state can be written as shown in Eq. (4): where α i is an arbitrary complex number satisfying the normalization condition, . One user, called Alice, possesses the target state. She wants to send that state to the other user, called Bob. To teleport the state, Alice and Bob share a photonic entangled state |Ψ 0 〉. Previous studies have investigated the generation of multipartite photonic entangled states by means of an array of nonlinear crystals 64 and by means of tritter and nondestructive photon number measurements 59 . Alice has the target state and two photons generated from |Ψ 0 〉 in time-bin states |b〉 and |c〉, and Bob has a photon generated from |Ψ 0 〉 in time-bin state |a〉. Then, the entire system can be written as described in Eq. (5): where we omit (mod 3) in the subscripts. Alice applies the tripartite entangled qutrit state discrimination operation to her three photons. The entire system can be rewritten in the basis of Alice's measurement, as shown in Eq. (6):  where ω = exp(2πi/3) and we omit (mod 3) in all subscripts except those of Ψ. After Alice's measurement, Alice sends the result of the measurement to Bob. Bob can recover the initial target state by performing a unitary operation on his state corresponding to Alice's result. The operation that Bob should perform for each possible result is specified in Table 1. The operations that Bob needs to perform are two path rotating operations, which are described in Eq. (7): The unitary operators P 1 and P 2 can be implemented with phase shifters on Bob's photonic paths B0, B1, and B2. For instance, to realize P 1 , the phase shifters should simultaneously apply no phase shift on B0, a phase shift of ω 2 on B1, and a phase shift of ω on B2. After the unitary operation, Bob's photonic path state is as described in Eq. (8): This state is the same as the initial target state that is given in Eq. (4).

Measurement-device-independent quantum key distribution using qutrits. In this section,
we study the conceptual implementation of MDI-QKD using qutrit states. MDI-QKD is proposed to prevent side-channel attacks against imperfect measurement devices 51 . In MDI-QKD, Alice and Bob, who want to share a secret key, send their encoded photonic states to an untrusted third party, Charlie. Charlie then performs a BSM to measure the correlation of the photons and announces the result. Alice (Bob) can infer the state that Bob (Alice) sent to Charlie from the announced result and her (his) own encoded state. Since the measurement setup detects only the correlation of the photons, an eavesdropper Eve cannot obtain the information that Alice and Bob share by attacking the measurement setup. It has been proven that QKD with high-dimensional quantum states has a higher secret key rate than that of traditional qubit QKD [27][28][29][30] , and there are also studies that have shown that MDI-QKD with high-dimensional states has some advantages compared with qubit MDI-QKD 54,55 .
The procedure for MDI-QKD using qutrit states was introduced in our previous work 54 . Since the proposed setup is designed to discriminate tripartite entangled qutrit states, the quantum states in which Alice and Bob encode their information must be different from those used in the original protocol in order to exploit the setup. Here, we will show that MDI-QKD can be implemented with our proposed setup.
In the original MDI-QKD protocol, Alice and Bob use two encoding bases at each site. As an extension of that protocol, our protocol also uses two encoding bases, a path-encoding basis and one of its mutually unbiased bases (MUBs). The condition for the two bases to be MUBs in three-dimensional Hilbert space, 〈 | 〉 = i j 1/3 2 , should be satisfied for all i, j ∈ {0, 1, 2}, where {0, 1, 2} and { 0 , 1 , 2 } are orthonormal bases. In our physical system, {|x 0 〉, |x 1 〉, |x 2 〉} is a path-encoding basis, and 2 is one of its MUBs, as defined in Eq. (9): The states in the MUB can be generated with the tritter operation Û 3 . For example, state | 〉 x 0 can be generated by inputting the photonic state |x〉 into input port 0 of the tritter depicted in the methods section.
A description of MDI-QKD using qutrit states is given as follows. Since the measurement setup projects an incoming state onto tripartite entangled states, the total number of encoded photonic states that Alice and Bob send to Charlie should be three. We assume that Alice sends two photonic states and that Bob sends one photonic state as shown in Fig. 4. First, Alice randomly chooses encoding information from among the ordinary numbers 1, 2 and 3 and the bar numbers, 0, 1 and 2. After that, Alice generates the corresponding bipartite path entangled Bob's operation -P 1P2 . Bob chooses a number y from among the numbers Alice used and generates the state a y . Alice and Bob send their states to Charlie; then, Charlie performs tripartite entangled qutrit state discrimination on the incoming photons and announces the result through a public channel. Subsequently, Alice and Bob discard trials in which their encoding bases were different after a basis comparison through a public channel. The remaining data become the sifted key, and Alice and Bob can synchronize their information by performing the appropriate post-processing as described in our previous work 54 .
To evaluate the usefulness of the proposed protocol, a security analysis of this protocol is necessary. Such an analysis can be performed through an inspection of the equivalent protocol using the entanglement distillation process (EDP) 3,5,6 . If the two parties, Alice and Bob, share the maximally entangled state generated via the EDP, then an eavesdropper cannot establish correlations between her state and the states of Alice and Bob 72 . In this sense, if Alice and Bob share a maximally entangled state, then they are assured that their protocol is secure against eavesdroppers. Thus, the security of the proposed protocol can be analysed with respect to the number of maximally entangled states generated via the EDP.
A schematic diagram of the equivalent protocol that exploits the maximally entangled state is shown in Fig. 5. In this protocol, we assume that Alice has a tripartite qutrit path-entangled state generator and that Bob has a bipartite qutrit path entangled state generator. Implementations of multipartite high-dimensional path-entangled states using linear optical elements and nondestructive photon number parity measurements 59 and using overlapping paths of photon pairs created in different crystals 64 have recently been proposed. The generation of bipartite high-dimensional path-entangled states using nonlinear crystals has previously been studied and demonstrated 22,23 . With regard to the states, Alice keeps the state that is in time-bin mode a and sends the other photons to Charlie by using state discrimination elements, and Bob also keep one photon and sends the other to Charlie. Then the whole system can be described as written in Eq. (10):  In Eq. (11), the state |Ψ〉 represents the tripartite state that Alice and Bob sent to Charlie for the entangled state discrimination measurement. The bipartite states in the square brackets denote the path-entangled qutrit state that Alice and Bob share. With the proposed setup, the states |Ψ 0 〉, |Ψ 1 〉, and |Ψ 2 〉 can be exactly discriminated. The other states cannot be exactly discriminated, so Alice and Bob should discard any trials in which Charlie's announced result is not one of |Ψ 0 〉, |Ψ 1 〉, and |Ψ 2 〉. After sifting, Bob performs a unitary operation on his state based on Charlie's result; then, the final state Alice and Bob share is the maximally entangled state ∑ = a a 1/ 3 , j Aj Bj 0 2 when there is no error. Alice and Bob privately choose their measurement bases from between the photon path measurement and the corresponding MUB measurement and perform their measurements. The measurement results of Alice and Bob are strongly correlated only when Alice and Bob choose the same basis, so they discard any trial in which different bases are used after a basis comparison step conducted through public communication. The remaining data are correlated, so these data can be used as a secret key. Then, the security analysis of the MDI-QKD protocol using entangled qutrit states becomes equivalent to that of the QKD protocol using 3-dimensional maximally entangled states, which has already been studied 28,29,54 . According to the results, the secret key rate per sifted signal of the protocol, r 3 ,can be evaluated as shown in Eq. (12): 3 2 where H(x) is the Shannon entropy, defined as 2 2 , and Q denotes the state error rate in the path-encoding basis. Each sifted signal is the result of a trial in which Alice and Bob generated the |Ψ 0 〉 state and chose the same measurement basis. The error rate can be obtained as follows (number of signals that contain errors)/(number of sifted signals). An error corresponds to a case in which Alice and Bob share |Ψ x 〉 such that x ≠ 0 at the end of the protocol.

d-dimensional d-photon state discrimination setup and its efficiency.
We investigate applications of a d-dimensional generalized setup and their efficiency. With the generalized setup and states, the qutrit teleportation scheme and qutrit MDI-QKD scheme described in previous sections can be extended to the teleportation of arbitrary d-dimensional path-encoded states and d-dimensional MDI-QKD, respectively. For instance, the steps of the d-dimensional MDI-QKD protocol are very similar to those of the qutrit MDI-QKD protocol, except that Alice and Bob should prepare d-dimensional information instead of 3-dimensional information and Alice and Bob use the states A i and 0 j to encode their information, where A i is defined in the Methods section and i, j ∈ {0, 1, 2, …, d − 1}. The security proof for d-dimensional QKD using maximally entangled states has already been studied 28,29 . Using the results, the secret key rate per sifted signal of d-dimensional QKD can be written as given in Eq. (13): where Q is the state error rate. As previously mentioned, MDI-QKD has the disadvantage of a lower secret key rate than that of the original BB84 protocol since Alice and Bob must discard more trials in MDI-QKD than in BB84 because of the success probability of the BSM. Here, we investigate the secret key rate per total signal of d-dimensional MDI-QKD. The secret key rate per total signal R is obtained from (sifted signal rate) × (secret key  Fig. 6. It is already known that high-dimensional QKD is more robust against state error than qubit QKD is [27][28][29][30] , this phenomenon is also reflected in this plot. In the case of no error, when Q = 0, only MDI-QKD using qutrit states has a higher key rate than that of the original qubit MDI-QKD protocol. The expression for the secret key rate per total signal when Q = 0 is d d (log )/ 2 . In this expression, the denominator increases linearly with the number of dimensions while the numerator increases logarithmically, so the secret key rate decreases in the high-dimensional case. From the plot, we can identify that qutrit MDI-QKD has the highest secret key rate per total signal when 0 ≤ Q ≤ 0.0294. This means that qutrits are best high-dimensional quantum states for MDI-QKD in the low-error range.
In real experiments, our proposed setup can fail even if the input state is one of {|Φ i 〉i = 1, 2, …, d − 1} since the setup involves nondestructive photon number measurements and the success probability of such measurements is not 100%. The generalized d-dimensional d-photon entangled state discrimination setup involves d nondestructive photon number measurements, so the efficiency of this setup is exponentially affected by the success probability of these measurements. To investigate its usefulness, we compare the generalized setup with a "Bell filter" that consists only of linear optical elements 59 . The Bell filter can discriminate |Ψ 0 〉 regardless of dimensionality, so the sifted signal rate of d-dimensional MDI-QKD using the Bell filter is always 1/d 2 , where we ignore the probability that Alice and Bob choose the same basis since it is the same for all considered protocols. For the generalized setup we propose, the sifted signal rate is 1/d × (η) d , where η is the success probability of each nondestructive photon number measurement. For the sifted signal rates of the two setups to be the same, η should be η = (1/d) (1/d) ; examples of the value of η are 0.693, 0.707, and 0.725 for 3, 4, and 5 dimensions, respectively. Since the efficiency of nondestructive photon number measurements using an atom-cavity system was reported to be 0.66 in 2013 70 , the success probability of the proposed setup is lower than that of a Bell filter with current technology, even though the proposed setup can discriminate more states than the Bell filter can.

Discussion
We investigated a tripartite entangled qutrit state discrimination setup and its applications, especially teleportation and MDI-QKD. We showed that the proposed setup can discriminate three tripartite entangled qutrit states. We showed that the setup can be generalized to d-dimensional d-photon entangled state discrimination and that the secret key rate per total signal of d-dimensional MDI-QKD using the generalized setup is highest when qutrit states are used. We considered the efficiency of the nondestructive photon number measurements performed in the setup and calculated the efficiency bound of the proposed setup for which the sifted signal rate becomes higher than that of a Bell filter that consists of linear optical elements 59 . Since the success probability of the nondestructive photon number measurements using an atom-cavity system is 66% 70 , the proposed setup is Figure 6. The secret key rate per total signal of d-dimensional MDI-QKD in the ideal situation. Since the number of states that can be discriminated via generalized d-dimensional d-photon entangled state discrimination is d among the d 2 possible states considered, the success probability of entangled state discrimination is 1/d if all experimental factors are ignored. The secret key rate per total signal, R, can be obtained as follows: (secret key rate per sifted signal, r) × (probability that a trial produces a sifted signal). The plot shows that only MDI-QKD using 3-dimensional quantum states has a higher secret key rate than that of the original MDI-QKD protocol at Q = 0, the zero-error case.

Methods
Tritter operation in the proposed setup. A schematic diagram of the tritter that corresponds to the unitary operator Û 3 is shown in Fig. 7. The tritter contains only linear optical elements: two 50:50 beam splitters, one beam splitter whose reflectivity is 1/3 and several phase shifters. When the input states is one of the state described in Eq. (2), the output state after the tritter operation can be easily obtained from the input-output relation of the tritter given in Eq. (1); the possible states are given in Eq. (14):  where χ = exp(2πi/d). The unitary operation Û d can be realized by means of a tritter with d inputs and d outputs. As an extension of the tripartite entangled qutrit state discrimination setup, the d-dimensional d-photon entangled state discrimination setup consists of a d-input d-output tritter, d nondestructive photon number measurements, and d 2 on-off detectors. One of the states that the generalized setup can discriminate is very similar to the state that can be discriminated by means of the existing setup 59 , this state is given in Eq.   Figure 7. A schematic diagram of the tritter setup for realizing the unitary operator Û 3 described in Eq. (1). The blue box represents a mirror, each BS1 (blue line) represents a 50:50 beam splitter, BS2 (green line) represents a beam splitter whose reflectivity is 1/3, and the purple squares represent phase shifters.
Scientific REPORtS | (2019) 9:687 | DOI:10.1038/s41598-018-36513-x and |vac〉 means the vacuum state. Let us recall that in our notation, ˆ † a xy is the photon creation operator whose orthonormal mode is x and whose path label is y; thus, it can be rewritten as | 〉 = | 〉 † a x vac xy y . If we extend the state with respect to the first row, then the state is rewritten as shown in Eq. (18) 1)! det( ) vac (19) i i 0 and Λ 0i is the (d − 1) × (d − 1) submatrix obtained by omitting the (i + 1)th column and first row of Λ. Similar to the case of tripartite entangled qutrit state discrimination, all states that the generalized setup can discriminate are orthogonal to |Φ 0 〉 with a phase factor χ; these states can be described as given in Eq. (20):