W-state Analyzer and Multi-party Measurement-device-independent Quantum Key Distribution

W-state is an important resource for many quantum information processing tasks. In this paper, we for the first time propose a multi-party measurement-device-independent quantum key distribution (MDI-QKD) protocol based on W-state. With linear optics, we design a W-state analyzer in order to distinguish the four-qubit W-state. This analyzer constructs the measurement device for four-party MDI-QKD. Moreover, we derived a complete security proof of the four-party MDI-QKD, and performed a numerical simulation to study its performance. The results show that four-party MDI-QKD is feasible over 150 km standard telecom fiber with off-the-shelf single photon detectors. This work takes an important step towards multi-party quantum communication and a quantum network.

the assumption that the measurement devices are trusted.As aforementioned, the occurrence of many quantum hacking attacks indicates that this is a highly unrealistic assumption.
In order to remove the demanding requirement for trusted measurement devices, we focus our attention on multi-party MDI-QKD.Appropriate entanglement states and their analyzers are the premises for the design of a multi-party MDI-QKD protocol.An elegant GHZ-type multi-party MDI-QKD protocol has been recently proposed in ref. 38, and this protocol shows that three-party MDI-QKD is highly feasible in practice.However, ref.
38 is primarily limited to three participants, and in a situation with more participants, the GHZ-type MDI-QKD is restricted to a very low key rate.Another potential candidate to build multi-party MDI-QKD is cluster state, but an efficient cluster-state analyzer based on linear optics remains unknown.Therefore, in a large-scale quantum Internet, a better analyzer and a different type of entanglement state are essential and required in order to design a multi-party MDI-QKD protocol and to obtain a high key rate.
W-state is a category of multi-particle entanglement state that can be used in a number of quantum information processing protocols 39 .W-state can be generated by type-II spontaneous parametric down-conversion (SPDC) and linear optical components 40,41 .In comparison with GHZ state, an important property of W-state is that, if one particle is traced out and projected into a specified state, the remaining particles are still entangled.That is, W-state is highly robust.Nonetheless, a W-state analyzer, which would enable the state of multiple particles to be projected into a W-state, still has to be constructed properly.
Here, we, for the first time, propose a multi-party QKD protocol based on W-state.We present the application of W-state in multi-party QKD, and construct a new W-state analyzer to distinguish the four-qubit W-state, based on linear optics only.With this analyzer, a four-party W-state MDI-QKD protocol is proposed.In this protocol, the four users, Alice, Bob, Charlie, and David, each send BB84 qubits to the central relay, Emma, with a W-state analyzer.The qubits with successful measurement outputs and coincident bases are used to build a secret key.The results show that the scheme is highly feasible for practically distributing the post-selected-state entanglement and for generating secure keys over a distance of more than 150 km standard telecom fiber for experimentally accessible parameter regimes.With state-of-the-art high-efficiency detectors, four-party MDI-QKD is feasible over 250 km fiber.We remark that, our protocol can be extended to the case with more participants and still remain a high key rate.All these features move an important step towards practical multi-party quantum communication.

Results
W-state and its analyzer.In this section, a group of four-particle entanglement W states is introduced, and a four-particle W-state analyzer based on linear optics is proposed.There are nine families of states that correspond to nine different ways of entangling four qubits 43 .For W-state, the widely used state is the standard one, given by equation (2).Here, based on the W 4 state, 16 four-qubit W states can be constructed, and these states appear in Supplementary I.All these W 4 states form a group of orthogonal bases in a 16-dimensional Hilbert space.Any four-qubit state can be expressed as a linear combination of these 16 W 4 states.The protocol proposed in this paper is based on these states.
A four-photon W 4 state analyzer.The tomography of W-states has been a hot topic in recent years [44][45][46] .However, the method for designing an analyzer to verify a W-state is still an open question.
In fact, a four-qubit W 4 state can be expressed by Bell states, which is presented as below.
( ) ( ) where φ + , φ − , and ψ + are three Bell states.From equation (3), we find that it is possible to design a W 4 state analyzer based on a Bell-state analyzer.Indeed, this is our method to construct the W 4 state analyzer.Generally, with an optimal linear optics-based scheme and without the use of auxiliary photons, only two out of four Bell states can be distinguished 47 .However, an important time-bin-based Bell-state analyzer can distinguish three out of four Bell states 48 .Its schematic representation is shown in Fig. 1.In this scheme, the qubit is encoded with time bins 49 .The qubit 0 ( 1 ) corresponds to a photon in state ˆ † a 0 ) under Z-basis, or in state under X-basis, where and τ is a constant time.The device consists of two beam splitters, BS 1 and BS 2 , two fibers with time delay τ, and two single photon detectors, D 1 and D 2 , all of which build a time-bin interferometer.
In Fig. 2 for modes e and f ).After passing through BS 1 , let the relative phase between the transmitted light field and the reflected light field be π., then the operators evolve as follows 50 → / ( − + ) , ( ) where δ is the phase derived from the path length difference in the interferometer 48 .Equations ( 6) and (7) indicate that the photons may arrive at D 1 or D 2 at different time instants, t 0 , t 1 , or t 2 , according to input states, as shown in Fig. 1.From the output coincidence, in principle, Bell-states ψ + ab can be detected with 100% probability, and ψ − ab and φ + ab can be detected with 50% probability, respectively 48 .The W-state analyzer shown in Fig. 2 is proposed.The qubits 0 and 1 are also encoded with the time-bin.At the first stage, the states of the photons in spatial modes a and b evolve into the states at modes e and f, according to equations ( 6) and (7).In ways that are also similar to equations ( 6) and (7), the states of the photons in spatial modes c and d evolve into the ones in modes g and h; the ones in modes f and g evolve into the ones in modes j and k; the ones in modes e and h evolve into the ones in modes l and m.
After BS 9 and BS 10 , the states of photons evolve into  48 .BS 1 and BS 2 are ideal 50/50 optical beam splitters that have equal reflection and transmission coefficients and no absorption loss.The delay ∆t derived from the path length difference of the interferometer equals τ.When two qubits enter the interferometer, the output state is a mixture of photons in two spatial modes (e and f ) and three temporal modes ( , t t 0 1 and t 2 ).Three Bell states can be distinguished through an analysis of different combinations of these modes of photons.The state of photons at the output is in a superposition state of four spatial modes ( , , , s u v w) and four temporal modes ( , , t t t Based on equations (6-11), the output detection modes of each of 16 W 4 states can be obtained.As an example, the state , W 4 0 is discussed.Its operator form is a a a a a a a a a a a a a a a a 1 2 0 12

a t b t c t d t a t b t c t d t a t b t c t d t a t b t c t d t
Then, by using equations (6-11), There are 200 terms in equation (13).That means that the output state is a superposition of 200 states.Each of the states is called a detection mode.Here, detection mode means SPD clicks at some spatial modes and time-bins; e.g., , , , , means that photons clicks occur in spatial modes s, u, v, and w at the time instant t i , t j , t k , and t l ( , , , = , , , ) means that two photons arrive in s mode at t i .One photon occurs in u mode at t j , and one photon occurs in v mode at time t k , respectively.The spatial and temporal modes are shown in Fig. 3.
All detection modes of 16 W 4 states have been obtained.By comparing the detection modes among different states, the unique modes belonging to one specific state are obtained.These modes make one state distinguishable from the others.Here, only the modes in which the SPD click derives from one photon are taken into account; i.e., all four SPDs in each mode have a click. .These four states can be applied to build keys among four users, a process that will be discussed in the next section.
It is worth mentioning that four other states, i.e.,  Measurement-device-independent quantum key distribution based on W-state.In this section, we propose a four-party MDI-QKD protocol based on W 4 state and the analyzer presented in the previous section.The security of the protocol is also proved.
The protocol.Conceptually, the four-party MDI-QKD can be implemented based on a time-reversal W 4 state protocol.In this protocol, each of the four users can prepare an entangled EPR photon pairs, keep one photon from each pair, and send the other photon to the central relay.Then projective measurement on the state of the photons can be performed by the relay.If the state is projected into a W 4 state by the relay, the state of the remaining four photons in the users is projected to the same W 4 state.Through the use of the idea of a virtual qubit 16 , a four-party MDI-QKD scheme can be constructed.
The proposed setup of four-party MDI-QKD protocol is shown in Fig. 4.There are four participants, i.e., Alice, Bob, Charlie, and David.Photons from single photon sources (SPS) are encoded with time-bin.Generally, weak coherent pulse (WCP) sources combined with decoy state technology [51][52][53] can also be used to replace the SPS.Here, SPS is used to simplify the discussion.
The procedures of the protocol are as follows: (1) Preparing: Each one of the participants, i.e., Alice, Bob, Charlie, and David, prepares single photons, which are in the four possible BB84 time-bin states (i.e., 0 , 1 , + , and − ) and sends them to an untrusted relay, Emma, with an analyzer in the middle.The preparation processes are implemented by single photon sources and a time-bin encoder.(2) Measuring: Emma performs W 4 state measurement by using the analyzer in Fig. 2. Then the incoming signals are projected into a W 4 state.(3) Sifting: Emma uses public channels to announce the events in which she obtained successful outputs; i.e., some of the states in Table 1 are identified.When all participants use the rectilinear (Z) basis, two of them announce their bits, and the other two perform operations according to the scenarios shown in Table 2.
In addition to the case that all participants encode their qubits in Z basis, another case is that they encode their qubits in X basis.For the latter, the W-states can be described as states + and − , e.g., In this case, the first two announce the values of the qubits ( +− or −+ ), and the other two perform phase error rate estimation.(4) Post-processing: After obtaining the sifted key, the two participants perform information reconciliation and privacy amplification.The suggestion is that an error correction code-based reconciliation protocol be used, since the interactive protocol, e.g., Cascade 54 , requires many communications.A low-density parity-check (LDPC) code-based reconciliation scheme 55 can be used.
Security analysis.The security of the four-party W-state-based MDI-QKD protocol is inspired by the security of a time reversed W-state-based QKD protocol.First, we briefly introduce the W-state-based QKD protocol.In a three-party W-state-based QKD protocol, three particles in W 3 state are distributed to three participants respectively.The announcement of the measurement bases and the measurement results of one participant enables the other two to perform key distribution or security verification.The protocol can be extended to the one with four participants.Compared with a three-party QKD

No
Distinguished states Detection modes Success probability , can be identified by the proposed analyzer.Detection modes s i u j v k w l mean that photons clicks occur in the spatial modes s, u, v, and w, and at the temporal modes t i , t j , t k , and t l (i, j, k, l = 0,1,2,3), respectively.
protocol, in the one with four participants, two participants announce their measurement bases and results, and the other two are in a maximally entangled Bell state and can obtain a secret key.
Secondly, it can be demonstrated that a time reversed W-state-based QKD protocol exists as the same as the time reversed EPR protocol 56 .With reference to the two-party MDI-QKD protocol 15 , the idea of a virtual qubit is also used.One can imagine that each of four participants prepares an EPR entanglement state, sends one qubit to Emma, and retains the other qubit as a virtual qubit.The virtual qubit is subsequently measured, and a BB84 state is thus prepared.In principle, each one could keep his or her virtual qubit in his or her memory and delay his or her measurement of it.Only after Emma has announced that she has obtained a successful outcome will each perform a measurement on his or her virtual qubit in order to decide which state he or she is sending to Emma.Furthermore, it is shown that W-state can be prepared among four participants by entanglement swapping, while each participant prepares an EPR pair initially.So, in such a virtual qubit setting, the protocol is equivalent to an entanglement-based protocol.Alice, Bob, Charlie, and David share quadruple qubits in their quantum memories, and they can compute the quantum bit error rate (QBER) on their virtual qubits on a special basis.

Key rate of the four-party MDI-QKD protocol.
The key rate of the W-state-based MDI-QKD protocol is evaluated with SPS.According to the procedures described in the previous section, any two participants can build a secret key after Emma announces successful outputs, and the other two participants' classic bits are 00 or 11.So the key rate can be obtained by referring to the case of two-party MDI-QKD 15 and to the basic work of Shor and Preskill 57 .The difference between the four-party and the two-party MDI-QKD is that the gain in the four-party  2).Successful output corresponds to the observation of one of four W 4 states shown in Table 1.The four participants' laboratories are well shielded from the eavesdropper, and the measurement setup can be untrusted.

Announced bits
Participants who obtain the key bits and their operation Alice Bob Charlie David 0  ).Any two participants announce their classic bits.If the bits are "00" ("11"), the other two participants can obtain the raw key bits; i.e., one of them flips his or her bits.For example, when Alice and Bob announce classic bits "00" ("11"), one of the pair Charlie and David flips his bits.This way, any two participants can perform QKD.The optical quantum channel need not be changed.one refers to the joint probability that Emma announces successful output and two of participants' classic bits are 00 (or 11), according to Table 2. Since any two participants can build a secret key, the maximum information loss value in data reconciliation and the privacy amplification processes of each pair are considered.So the key rate can be given as where e jk X (e jk Z ) denotes the QBER between participants j and k under X (Z) basis, given that each of Alice (a), Bob (b), Charlie (c), and David (d) sends single photon states, , = , , , j k a b c d; Q 1 denotes the gain (the joint probability of Emma's announcement of a successful detection in the Z basis, and also of the announced classic bits being 00 or 11, according to Table 2).q means the basis reconciliation factor; ( ) is the binary entropy function with parameter x given by . In this protocol, the QBER in Z basis equals the one in X-basis under SPS, i.e. = e e jk X jk Z .The assumption is that there is no misalignment error, that the data size is infinite, and that the ideal reconciliation algorithm is applied.There is also an assumption that the quantum channels between the participants and Emma are identical.For the sake of simplicity, if we assume e 1 to be e jk Z , then equation ( 16) can be reduced to Let the probability of Z basis be nearly one, i.e., ≈ q 1. Q 1 can be estimated as (the detailed for obtaining Q 1 and e 1 are shown in Methods and Supplementary III) ; α and l are the attenuation coefficient and fiber length between the participant and analyzer, and η d is the detection efficiency of a single photon detector.Here, it is assumed that each SPD at each time instant has the same detection efficiency.
In numerical simulation, the parameters include the detection efficiency η d , the background count rate Y 0 and the attenuation coefficient α.Let η d be .% 14 5 and Y 0 be .× − 6 02 10 6 .These values are chosen from the 144-Km QKD experiment reported in ref. 58.A superconducting nanowire single-photon detector (SNSPD) with a detection efficiency of 93%, as reported by Marsili et al. 59 , is also used.Parameter α is set by a typical value, .0 2. The simulation results of the asymptotic key rate are shown in Fig. 5.The secure transmission distance between two participants is about 180 km for a detection efficiency of 14.5%, and is about 260 km for a detection efficiency of 93%.The distance is 100 km and 180 km for two detectors when the key rate is about − 10 10 .

Discussion
In practice, the SPS may still be challenging with current technology.However, based on the so-called decoy state method [51][52][53] , one can simply replace the SPS with weak coherent pulses (WCP) or parametric down-conversion (PDC) sources.As noted already in ref. 38 regarding the three-party MDI-QKD, the decoy state analysis and the Both curves are key rates with single photon sources (SPSs).The solid curve is the one with a detection efficiency of 14.5%.The dash-and-dot is the one with the higher detection efficiency of 93%.
finite-key analysis are similar to the initial two-party MDI-QKD protocol [24][25][26][27][28] .Therefore, the expectation is that, with decoy states, the results here can be easily extended to the cases with WCP and PDC sources.
In our proposal, any two of four parties can share a secure key bit.This is compatible to the usual network scenario, in which any two parties in the network can perform secure communications.There are several advantages as compared to the initial two-party MDI-QKD protocol.First, our proposal is faster in sharing key bits when the parties are reassigned.This is because the quantum channel is not required to be initialized.Second, the group key can also be built if one party serves as a controller.Finally, the initial MDI-QKD requires a clever design of fast and low-loss optical switches for a network setting, which might be challenging in a large-scale network.In contrast, our scheme does not have such requirement.
In the conclusion, we proposed a four-party W-state-based MDI-QKD protocol, in which any two of four participants can build secret keys, when the W-state analyzer announces a successful output, and the other two participants' classic bits sent are 00 (the distinguished states are ).Since the time-bin coded MDI-QKD protocol was verified to be feasible 20,22,29 , and several schemes of SPS (e.g.quantum dot SPS) 60 have been presented, the proposed W-state analyzer can be implemented with current technology.The work presented here puts forward an important avenue for practical multi-party quantum communication.Estimation of Q 1 and e 1 .We assume that there is no misalignment error (i.e.all mismatches in quantum channels are perfectly compensated), the four optical channels are identical, and ideal single photon sources are used.Therefore, the qubit error derives from dark counts of SPDs.As mentioned in Results, we only take into account the case in which SPD count in each spatial-temporal mode derives from no more than one photon.
For Emma, a successful output can be obtained from five cases: (1) all four counts of SPDs derive from background noise (dark counts); (2) one count derives from photon detection and the other three counts derive from background noise; (3) two counts derive from photon detections and the other two counts derive from background noise; (4) three counts derive from photon detections and the other one derives from background noise; (5) all four counts derive from photons.We assume that Alice (a) and Bob (b) announce their classical bits, while, Charlie (c) and David (d) try to generate secret key bits.In cases (2)-( 5) we compute the output states of photons successfully passing through the analyzer and their probabilities.Then, we obtain the gain at each case according to the modes in Table 1.The details for obtaining Q 1 and e 1 are shown in Supplementary III.

Figure 1 .
Figure 1.A schematic diagram of Bell-state measurement48 .BS 1 and BS 2 are ideal 50/50 optical beam splitters that have equal reflection and transmission coefficients and no absorption loss.The delay ∆t derived from the path length difference of the interferometer equals τ.When two qubits enter the interferometer, the output state is a mixture of photons in two spatial modes (e and f ) and three temporal modes ( , t t

Figure 2 .
Figure 2. A schematic diagram of a W-state analyzer.The analyzer consists of four time-bin interferometers.Each interferometer is the same as the one shown in Fig. 1.Two photons from port A and B enter into the interferometer I.The photon in spatial mode e enters into interferometer IV, and the photon in spatial mode f enters into interferometer III.Another two photons from port C and D enter into interferometer II.The photon in spatial mode g enters into interferometer III, and the photon in spatial mode h enters into interferometer IV.The state of photons at the output is in a superposition state of four spatial modes ( , , , s u v w) and four temporal modes ( , , t t t

, 4 ,
can also be distinguished if photon-number-resolving detectors can be used.In addition, the detection probabilities of states , increased with this type of detector.

Figure 3 .
Figure 3.The spatial and temporal modes at the output of the W-state analyzer.There are four spatial modes (i.e., , ,s u v, and w) and four temporal modes (i.e., , , t t t 0 1 2 , and t 3 ).The time separation between time-bins is τ.The output state is a superposition of spatial modes and temporal modes.

Figure 4 .
Figure 4. Basic setup of a W 4 -based four-party MDI-QKD protocol.Alice, Bob, Charlie, and David prepare single photon pulses in a different BB84 time-bin coded state, which is selected independently and at random for each signal.The time-bin encoder can follow the design proposed in ref. 20.Inside the measurement setup, signals from Alice, Bob, Charlie, and David are sent into a W-state analyzer (see Fig.2).Successful output corresponds to the observation of one of four W 4 states shown in Table1.The four participants' laboratories are well shielded from the eavesdropper, and the measurement setup can be untrusted.
, one of their bits flips.

Figure 5 .
Figure5.Key rates with different detection efficiencies.Both curves are key rates with single photon sources (SPSs).The solid curve is the one with a detection efficiency of 14.5%.The dash-and-dot is the one with the higher detection efficiency of 93%.

MethodsW-
state preparation based on entanglement swapping.A process of entanglement swapping for generating W 4 -state is shown in Fig.6.In Fig.6, all the photon pairs A and ′ A , B and ′ B , C and ′ C , D and ′ D are in Einstein-Podolsky-Rosen (EPR) entangled states.When the state of 4 photons, ′, ′, ′ A B C and ′ D , are projected into to any W 4 state, the state of remaining four photons , , , A B C and D, is projected into the corresponding W 4 sate.The detailed processes are shown in Supplementary II.

Figure 6 .
Figure 6.A schematic diagram of entanglement swapping for generating W 4 state.Each of Alice, Bob, Charlie and David prepares an EPR pair and sends half of them to Emma with a W 4 State analyzer.

Table 1 .
There are four W 4 states, i.e., The success rate is determined by the corresponding coefficients of output states.For states

Table 1 . Distinguishable W 4 states and their detection modes.
Four W 4 states, i.e.,

Table 2 . Four participants' post-selection after Emma announces a successful output of states
,W 4 0 or , W 4 1 (