Quantum Clock Synchronization with a Single Qudit

Clock synchronization for nonfaulty processes in multiprocess networks is indispensable for a variety of technologies. A reliable system must be able to resynchronize the nonfaulty processes upon some components failing causing the distribution of incorrect or conflicting information in the network. The task of synchronizing such networks is related to Byzantine agreement (BA), which can classically be solved using recursive algorithms if and only if less than one-third of the processes are faulty. Here we introduce a nonrecursive quantum algorithm, based on a quantum solution of the detectable BA, which achieves clock synchronization in the presence of arbitrary many faulty processes by using only a single quantum system.

distributes its value to every other process. Every process uses the value received from P 1 and, in case no value is obtained, uses 0. If n . 0, then P 1 distributes its value to every other process. For k 5 2, …, m, let x k denote the value obtained by P k from P 1 . If P k receives no message, then let x k 5 0. P k acts as P 1 in algorithm OM(n 2 1) by distributing x k to the remaining m 2 2 processes. For every k and for all j ? k, let x j be the value received by P k from P j using OM(n 2 1), and in case no value was received x j 5 0. P k decides on the value obtained from the median of (x 1 , …, x m ). Thus, OM(n) requires O(m n11 ) transmitted messages to solve the task.
The DBA is an example of a communication task for which quantum resources can provide a solution, while classical tools cannot. Nevertheless, the special case of DBA in a three process network with one faulty process, has been solved using quantum methods based on three-qutrit singlet states 7,9 , four-qubit entangled states 10 , and three 8 or two 12 pairwise quantum key distribution (QKD) channels, and experimentally demonstrated using four photon-polarization entangled state 11 .
Interestingly, later works have shown that there are quantum solutions for certain communication complexity problems and secret sharing tasks which do not require entanglement, but, instead, sequential communication of a single quantum system 13,14 . These protocols have been shown to be much more resistant to noise and imperfections, and significantly more scalable than protocols based on entanglement.
In this article, we introduce a quantum algorithm that solves the DBA and achieves clock synchronization in the presence of an arbitrary number of faulty processes, with only one single round of message passing per process independently of the number of faulty processes, utilizing only a single quantum system.
In order to solve the DBA problem, the m processes need to share data in the form of lists l k , of numbers subject to specific correlations, and the distribution must be such that the list l k held by process P k is known only by P k . Quantum mechanics provides methods to generate and securely distribute such data, here we shall seek for one which is simple, efficient, and easily extendible to an arbitrary number of processes. We assume that all processes can communicate with one another with oral messages by pairwise authenticated error-free classical channels and pairwise authenticated quantum channels.

Correlated lists and their use
The initial stage of the quantum protocol is to distribute lists l k , for k 5 1, …, m, each of them available only to process P k . All lists have to be of the same length L and are required to satisfy the property that if N 5 0 (or 1) is at position j in l 1 , then 0 (respectively, 1) is at position j in lists l k for k 5 2, …, m (i.e., they are perfectly correlated). However, if N g {2, …, m 2 1} is at position j in l 1 , then the sum of numbers at positions j in lists l k for k 5 2, …, m equals m 2 N, and all elements in these lists are either 0 or 1. Given an N, all the possible combinations of binary numbers satisfying the condition are uniformly probable.
Note that, on one hand, P 1 has information about at which positions the lists of all other processes the values are perfectly correlated, and at which positions they are random bits, with the property that their sum is anticorrelated with the value, N $ 1, in l k . On the other hand, the holder of one the lists l k , with k 5 2, …, m, has no information whatsoever on whether the lists are correlated at a given position or not.
Once the processes have these lists, they can use them to achieve mutual agreement and solve the DBA by applying the algorithmic part of the protocol, which we shall call QB(n, m). The special case, QB(1, 3), reproduces the protocol in 11 .
(1) P 1 sends bit-valued messages to all processes. The message sent to process P k will be denoted by m 1,k . Together with each message, P 1 sends a list l 1,k of all of the positions in l 1 in which the value m 1,k appears. If P 1 is nonfaulty all lists and messages are identical. The full information which P k receives from P 1 will be denoted by {m 1,k , l 1,k }. (2) The receiving processes P k analyze (singlehandedly) the obtained lists and messages. If the analysis of P k shows that l 1,k is of appropriate length (i.e., about L/m) and {m 1,k , l 1,k } is consistent with l k at all positions, then if P k is nonfaulty, it conveys {m 1,k , l 1,k } to all other processes P k?1 . A faulty process sends a flipped bit value of the message with whatever list it chooses. The full information which P j receives from P k will be denoted by {m k,j , l k,j }. A nonfaulty P k will also decide on the final bit value it adopts V k . This is m 1,k , unless messages from the other processes force it to decide that P 1 is faulty. However, if {m 1,k , l 1,k } is not consistent with l k , then P k immediately ascertains that P 1 is faulty and relays to other processes neither 0 nor 1 but H, meaning ''I have received inconsistent data.'' (3) Once all messages have been exchanged between P 2 , …, P m , each process considers the obtained data and acts according to the instructions in Table 1. The overall aim is, if P 1 is nonfaulty, to have the same value of V k for all nonfaulty processes, or all of them aborting.
Quantum protocol for distributing lists l k All processes are equipped with devices which can unitarily transform qudits. In addition, P 1 has a source of single qudits of dimension m and the last process, P m , has additionally a measurement device. The protocol runs as follows (for an illustration, see Fig. 1): (II) P 1 randomly chooses the ''encoding basis'' from m different options U 0 ,...,U m21 and labels the choice c 1 . Having chosen the c 1 'st encoding basis, process P 1 applies the following unitary transformation to the qudit: where v~e i 2p m . From the interferometric point of view, applying U c 1 introduces a phase-shift of 22pc 1 /m in the first beam. (III) After that, P 1 randomly chooses a value N 1 in the set {0, 1, …, m 2 1} and encodes N 1 , by applying the following unitary transformation: Afterwards, the qudit is sent to P 2 . (IV) P 2 , in the same manner as P 1 , choses a c 2 g{0,...,m21} and applies the unitary U c 2 corresponding to choice of encoding basis. (V) Next, P 2 randomly chooses a value N 2 in the set {0, 1}. If N 2 5 0, no action is taken, i.e., P 2 applies the transformation U N 2~0 ð Þ~. If N 2 5 1, then P 2 applies U(N 2 5 1) and then sends the qudit to P 3 .
and, if X m k~1 N k~0 , modulo m, then Whenever this condition is not satisfied, the final state of the system is orthogonal to jy 0 ae and will therefore never be an outcome of P m 's measurement.

Clock synchronization
Now, we will show how to apply our method for solving the DBA to achieve fault tolerant clock synchronization. However, a problem arises from clocks ticking during the synchronization procedure. This is solved by exploiting assumption A3: Instead of sending a number, the processes send their clock differences to each other. In the classical case, we achieve clock synchronization by running the algorithm OM(1) m times, sending clock differences instead of the binary values, and analogously for OM(n) 4 . In analogy with the classical case, the processes send clock differences also in the quantum case, exploiting the fact that the clock differences can be decomposed into binary strings up to arbitrary accuracy agreed upon in advance. We run QB(n, m) m times in such a way that for each run a new processes takes the roll of P 1 in QB(n, m). More explicitly, P y reads the clock difference D xy between its own clock and the clock of P x . If P y is nonfaulty it will relay D xy to P z but if P y is a faulty process, it can arbitrarily change D xy before sending it. If P y relays the value obtained from P x to P z , then P z knows the time difference between P x and P y . Also, since QB(n, m) is ran m times, P z will also obtain D yz from P y and thus P z knows that P y is claiming that the time difference between P x and P z is D xy 1 D yz , which can then be compared to D xz obtained directly from P x .

Comparison with the other solutions
The correlated lists needed for achieving DBA can be distributed by other means than with the single-qudit protocol. Successful distribution can be achieved by the process P m sharing a QKD channel with every other process. P m uses a QKD protocol, e.g., BB84 17 to distribute numbers such that (1) P m and P 1 share a string All QKD channels except that shared between P 1 and P m transmit bit values. In order to transmit elements of {0, …, m 2 1} to P 1 , the numbers must be encoded into qlog 2 m ð Þr qubits. One additional requirement that has to be made for solving the DBA using the QKD distributed lists is that P m is not required to convey any lists. This is necessary since P m has full knowledge about the lists of all other processes and therefore easily could cheat. Instead, P m may announce the message it received from P 1 , and if any inconsistency is noted by P 2 , …, P m21 , then P m will change its final value if the other processes convince P m of them being nonfaulty.
There are also other proposed solutions to the DBA considering three processes where one is faulty. The first one, proposed in Ref. 7, relies on the three qutrit entangled Aharonov state. The goal is to distribute lists given by all permutations of the elements of the set {0, 1, 2}, i.e., (0-1-2, 0-2-1, 1-0-2, 1-2-0, 2-0-1, and 2-1-0). Table 1 | Once P k receives all messages and lists from all other processes, it will study the obtained lists and messages and compare to its own list l k . Depending on the consistency between the obtained and private data, P k will act according to table below. Notation m j,k ,l j,k È É %l k means that m j,k and l j,k are found to be consistent with l k whereas 6% means ''inconsistent with.'' The symbol H means ''I have received inconsistent data.'' By M k we denote some nonempty subset of {1, …, m} \ {k} local analysis of all data received by P k decision of P k on the value V k (iia) Vj[N m \ k f g, m j,k ,l j,k È É %l k and all messages are equal V k 5 m 1,k , no faulty process f g, m j,k ,l j,k È É %l k and not all messages are equal as P 1 is faulty, V k 5 abort where i~i 1 , . . . ,i n f g , S m 5 {0, …, m 2 1} and N(s(S m )) is the parity of the permutation of S m . Already for the simplest case of m 5 3, this approach requires the preparation of a very complex state which, to our knowledge, has not yet been experimentally realized. However, for the three process case, it has been pointed out in Ref. 12 that the distribution of the lists can be realized without the state (6), by utilizing two separated QKD channels. With small modification for the m process setting, distribution of the lists is achieved with m 2 1 QKD channels. However, to encode the entire space provided by S m , the QKD requires qlog 2 m ð Þr qubits. If the efficiency of a detector g is not perfect and the QKD is performed with single qubits using von Neuman measurements, successful distribution occurs only with probability g m{1 ð Þ qlog 2 m ð Þr . Typically, the classical part of the protocol in Ref. 7 and its possible generalizations scale rapidly with the number of processes. It is required that m! different types of lists are distributed. However, a solution to the three party DBA exploiting four-qubit entanglement provides a simpler classical part of the protocol: the number of different lists is lowered from six to four 11 .
The general m process protocol presented in this paper generalizes the protocol in Ref. 11 and requires 2 m21 different types of lists. As emphasized earlier, the distribution of the required lists can be achieved both with single-qudit and with m 2 1 QKD channels. Using QKD channels, only one channel needs to transmit all elements in S m while the remaining m 2 2 channels only transmit bit values. In the presence of nonperfect detectors, successful distribution occurs with probability g m{2zqlog 2 m ð Þr . However, in the single-qudit approach only one single detection is needed and, therefore, successful distribution of the lists occur with probability g independently of m. The single-qudit protocol is highly scalable, both in terms of success probability with inefficient detectors and requirements on the classical lists.

Conclusions
We have presented a single-qudit protocol which provides an efficient solution to an important multiparty communication problem: It solves DBA and achieves clock synchronization in the presence of arbitrary many faulty clocks. In principle, our quantum algorithm is not limited to the case of clock synchronization, it can with small adaptation be used for other tasks requiring oral message interactive consistency. Interestingly, our algorithm works by transmitting a single qudit among the parties rather than by distributing a quantum entangled state among them. This makes the protocol much more practical, as single qudits can be experimentally realized easily in many ways. For example, using unbiased multiport beamsplitters 15 or time-bin 16 . Compared to schemes based on several QKD channels, the single-qubit protocol is more scalable and robust against detection inefficiencies. This results shows that single-qudit quantum information protocols are interesting beyond QKD 18,19 and random number generation 20,21 , and should stimulate experimental implementations and further research in quantum information protocols.