Greenberger-Horne-Zeilinger states-based blind quantum computation with entanglement concentration.

In blind quantum computation (BQC) protocol, the quantum computability of servers are complicated and powerful, while the clients are not. It is still a challenge for clients to delegate quantum computation to servers and keep the clients' inputs, outputs and algorithms private. Unfortunately, quantum channel noise is unavoidable in the practical transmission. In this paper, a novel BQC protocol based on maximally entangled Greenberger-Horne-Zeilinger (GHZ) states is proposed which doesn't need a trusted center. The protocol includes a client and two servers, where the client only needs to own quantum channels with two servers who have full-advantage quantum computers. Two servers perform entanglement concentration used to remove the noise, where the success probability can almost reach 100% in theory. But they learn nothing in the process of concentration because of the no-signaling principle, so this BQC protocol is secure and feasible.

Introduction

Blind quantum computation (i.e. BQC)[1-7] is still a challenging research field, where a client has not enough quantum computability, and delegates her quantum computing to the servers who have full-advanced quantum computers. In long-distance BQC, quantum entanglement plays an important role and three mainly blind entangled states have already been studied which are blind brickwork state[1], blind topological state[2] and Affleck-Kennedy-LiebTasaki (i.e. AKLT) state[3]. Some BQC protocols[1, 4–6] are based on the blind brickwork state which is proposed by Broadbent et al.[1]. Later, Barz et al.[7] demonstrated the blindness of the brickwork state. Broadbent et al.[1] in 2009 proposed a single-server BQC protocol based on single-qubit states and double-server BQC protocol based on the entanglement swapping of Bell states. However, the quantum entanglement of Bell states in double-server BQC protocol[1] will suffer quantum channel loss due to the influence of noisy channel. To solve this problem, Morimae and Fujii[4] proposed a method of entanglement distillation to extract high-fidelity Bell states, meanwhile its security can also be guaranteed. Li et al.[5] proposed a triple-server BQC protocol based on Bell states. Sheng and Zhou[6] proposed a double-server BQC protocol based on Bell states, where the deterministic entanglement distillation can remove the noise that transforms pure entangled states into mixed entangled states. As we can see that the aims of BQC protocols[1, 4–6] are all to obtain the single-qubit states with to create the blind brickwork states[1]. The other two blind graph states[2, 3] can also be used to perform BQC successfully. The Raussendorf-Harrington-Goyal (i.e. RHG) lattice[2], which the blindness is guaranteed in a topological manner, is used to perform four quantum measurements {X, Y, Z, T} only known by clients. Compared with the cluster states, AKLT states can be prepared efficiently and simply in linear optics with biphotons[8]. Recently, more and more interesting BQC protocols are proposed[9-18]. In BQC, the quantum channel noise is still an urgent problem. Previous works[4, 6, 14] have studied quantum channel noises in BQC protocols. For example, Takeuchi et al.[14] proposed three BQC protocols based on decoherence-free subspace (i.e. DFS) to resist the collective noise of quantum channel.

The new BQC protocol is based on maximally GHZ entangled states, where there are three participants (a client Alice, two servers Bob and Charlie). The BQC protocol is divided into four steps. First, Bob prepares initial GHZ states, remains one photon and sends other two photons to Alice. Alice disturbs the orders of two photons and sends to Charlie. Second, Bob and Charlie perform entanglement concentration to get ideal maximally entangled states, where two identical less-entangled states can be used to concentrate a maximally entangled state by two-step parity check and project measurements. Third, Bob performs Pauli operations on his photons under Alice’s instruction. Then Charlie performs measurement on one photon with the basis {|0〉, |1〉}. Alice randomly chooses θ and sends to Charlie. Charlie performs measurement on the other photon and Bob gets the single-qubit. Finally, Alice and Bob perform single-server BQC protocol.

This BQC protocol has four contributions. First, two servers can communication with each other without degrading the security. Second, it does not need a trusted center. The task of preparing initial entangled states can be assigned to Bob. Third, Bob and Charlie don’t need to exchange their classical information. If they collude, they don’t know any information about Alice’s inputs, outputs and algorithms. The last one, entanglement concentration can be used to remove the channel noise.

Results

BQC protocol based on maximally GHZ entangled states

Photons are the best physical systems for the long-distance transmission of entangled states, thus entangled photons states are used as quantum information carriers in BQC. In this BQC protocol, we use |0〉 and |1〉 to express photons. In entanglement concentration, we use |H〉 and |V〉 to express photons, where |H〉 is equal to |0〉 and |V〉 is equal to |1〉. In this section, we propose the BQC protocol based on maximally GHZ photons entangled states () (Fig. 1). The cross-Kerr nonlinear can be used to construct a CNOT gate in ref. 19. There are also many other methods to realize it[19-23]. In the BQC protocol, we suppose that these quantum devices are all ideal. The client owns quantum channels with two servers and quantum disturbing device. Since the orders of sequences S , S and S are different, both Bob and Charlie cannot know which state (u∈{1, 2, 3, 4}) they shared.

Figure 1

Schematic diagram of BQC protocol is based on maximally GHZ entangled states with z-basis ({|0〉, |1〉}) measurement M 1, basis measurement M 2, Pauli operations U, Bell measurement BM, Charlie’s measurement outcome c . The order of photons sequences A and C () are disturbed and rewritten as and (t 1, ). Photons and belong to Charlie, and B belongs to Bob, where , B and (t 1 ≠ t 2 ≠ j) belong to a GHZ state.

Bob generates enough maximally GHZ entangled states , where the subscripts A , B and C represents photons A , B and C . Bob keeps photons sequences S  = [B 1, B 2, …, B ] and sends photons sequences S  = [A 1, A 2, …, A ] and S  = [C 1, C 2, …, C ] to Alice successively. After receiving photons sequences, Alice disturbs the order of photons sequences S and S . The reordered photons sequences are rewritten as S  = [, , …, ] and S  = [, , …, ], meanwhile is remarked as . The orders of photons sequences S and S are different and only known by Alice. Then Alice sends photons sequences S and S to Charlie. Due to the effect of quantum channel noise, the maximally entangled states evolve into less-entangled states , where |α|2 + |β|2 + |δ|2 + |η|2 = 1. In order to get states , Bob and Charlie firstly perform entanglement concentration.

Bob performs one of four operations {I, σ , iσ , σ } randomly chosen by Alice on photons B and states evolve into one of four states , , , .

Charlie performs measurement on photons using the basis {|0〉, |1〉} under the guidance of Alice. Alice randomly chooses and sends to Charlie. Charlie performs measurement on the basis and Bob obtains photons states , where c (∈{0, 1}) is Charlie’s measurement outcome. Because the orders of and B are different, Bob can not know anything even if Charlie tells the value of θ to Bob.

Alice, Bob and Charlie repeat (1–3) steps such that Bob obtains single-photon states successfully. The remaining steps are the same as steps (2–3) of the BFK protocol[1] or steps (2–5) of blind topological BQC protocol[2]. The blindness of graph states and the correctness of quantum computation have already been exhibited in refs 1 and 2 in detail.

In the step 1 of this BQC, entanglement concentration is used to remove the noise. In the following, the process of entanglement concentration is showed with optical system.

Entanglement concentration of pure maximally GHZ entangled state

In a practical transmission, there exist two kinds of quantum channel noises, i.e. pure maximally entangled states evolve into mixed states or less-entangled states. Entanglement purification[24-28] is applied to extract high-fidelity maximally entangled states from mixed entangled states. Entanglement concentration[29-45] is often used to distill less-entangled states into pure maximally entangled states by local operations and classical communication (i.e. LOCC). Bennett et al.[29] firstly proposed an entanglement concentration protocol by using Schmidt projection. In 2003, Zhao et al.[42] not only demonstrated the entanglement concentration scheme in ref. 30 but also verified a quantum repeater in experiment. Li et al.[39] proposed two protocols to concentrate hyper-entangled GHZ states by using a single-photon state of two freedoms and two less-entangled states respectively. Sheng et al.[32] proposed to concentrate arbitrary W states by using two steps. Afterwards, a universal concentration scheme of an arbitrary less-entangled N-photon W state is proposed in ref. 43. Here, we consider a special quantum channel noise, i.e. pure maximally entangled states evolve into less-entangled states, which can be distilled by entanglement concentration. In the following, we give the entanglement concentration of GHZ states that were experimentally prepared in refs 46–48.

The first round of entanglement concentration

In the BQC, the maximally GHZ states can be rewritten in the form ofwhere we define |H〉 = |0〉 and |V〉 = |1〉. The subscripts a 1, b 1 and c 1 represent the spatial-mode of photons , B and . We consider the noisy model that pure maximally entangled states evolve pure less entangled states. Suppose less-entangled pure photons states arewhere four real numbers α, β, δ, η satisfy |α|2 + |β|2 + |δ|2 + |η|2 = 1.

Two identical less-entangled states, which the parameters are all unknown, can distill a maximally entangled state in Eq. (2). The schematic of entanglement concentration is shown in Fig. 2. Here, only Alice knows whether entanglement concentration is successful and the correct orders of , B and .

Figure 2

The schematic diagram of polarization-entanglement concentration. The sources is used to produce polarization-entangled states. Photons a 1(a 2) and c 1(c 2) belong to Charlie, where Bob retains photons b 1(b 2). HWP is half-wave plate which HWP 90° flips the horizontal and vertical polarization states. HWP 45° just likes a Hadamard operation to rotate horizontal and vertical polarization states. The polarizing beam splitters (PBSs) are used to transmit horizontal polarization |H〉 and reflect vertical polarization |V〉. QND (with i = 1, 2, 3) represents quantum nondemolition detections. Detectors  and belong to Bob, , , and belong to Charlie.

After passing HWP 90°, the state evolves towhere polarization photons a 1, b 1 and c 1 are flipped and relabeled as a 2, b 2 and c 2.

The entanglement concentration is divided into two steps. In the first step, the system composed of six photons isAfter both a 1 and a 2 (b 1 and b 2, c 1 and c 2) pass parity check device (Fig. 3), Bob and Charlie can get some specific quantum state by choosing phase shifts. Here, we suppose that Bob and Charlie are honest to perform the entanglement concentration. The concrete process of the parity check device is given in Methods.

Figure 3

Schematic diagram of QND[49]. ±θ = χt represents the cross-Kerr nonlinearity media that introduces the phase shift θ when photons pass through the media. |χ〉 〈χ| is homodyne measurement that can distinguish different phase shifts. The signal photons |α 1〉, |α 2〉 and |α 3〉 are related to a 1 and a 2, b 1 and b 2, c 1 and c 2 respectively. Here x 1 and x 2 can be specifically expressed as a 1 and a 2 (b 1 and b 2, c 1 and c 2).

For b 1 and b 2, a 1 and a 2, c 1 and c 2, if Bob and Charlie all choose ±2θ phase shifts of odd-parity check states, the state iswith the probability , where represents the probability of obtaining with the number of rounds v , the number of steps j (j = 1, 2) in vth round and the quantum state m (m = 1, 2, 3, 4) in jth step of vth round.

If Bob chooses 0 phase shift of even-parity check states for b 1 and b 2, Charlie chooses 0 phase shift of even-parity check states for c 1 and c 2, and ±2θ phase shift of odd-parity check states for a 1 and a 2, the state iswith the probability .

If Bob chooses ±2θ phase shift of odd-parity check states for b 1 and b 2, Charlie chooses 0 phase shifts of even-parity check states for a 1 and a 2, c 1 and c 2, the state iswith the probability .

If Bob chooses 0 phase shift of even-parity check state for b 1 and b 2, Charlie chooses ±2θ phase shift of odd-parity check states for c 1 and c 2, and 0 phase shift of even-parity check states for a 1 and a 2, the state iswith the probability .

We give an example for PBSs measurement. After passing through HWP 45°, evolves intoIf the detectors , , (or , , ) are triggered, we will getwhere represents the quantum state with the number of rounds v , the number of steps j (j = 1, 2) in vth round, the quantum state m (m = 1, 2, 3, 4) in jth step of vth round, and the quantum state (γ) (γ = 1, 2, 3, 4) of PBSs measurement for the states (ε = 1, 2, 3, 4).

If the detectors , , (or , , ) are triggered, we getBob and Charlie perform unitary transformation on photons a 1 and b 1 of state to get .

If the detectors , , (or , , ) are triggered, we will getCharlie performs unitary transformation on photons a 1 and c 1 of state to get .

If the detectors , , (or , , ) are triggered, we will getBob and Charlie perform unitary transformation on photons b 1 and c 1 of state to get .

For the three states , and , we have the similar resultsThe four quantum states , , and are not destroyed by quantum non-demolition detections. They are used as the initial states in the second step of the first round and rewritten as , , and .

In the second step, for quantum statephotons are all flipped by HWP 90° and relabeled as a 2, b 2 and c 2. We will getAfter parity checks and PBSs measurement, we obtain four quantum statesThe probabilities of getting quantum states , , and areThese are all failed cases, but they can be used as the initial states in the second round.

For quantum stateits process of concentration is the same as and we can getThis is the maximally GHZ entangled state. The success and failure probabilities of arewhere the subscripts s and f represent the success and failure probabilities respectively.

For quantum statesthe success and failure probabilities of and are respectivelyThe total success probability of the first round is

Discussion

Blindness and correctness analysis of the proposed BQC protocol

In the following, we will show that the proposed BQC protocol is secure by analyzing the blindness and correctness.

First, we show the blindness of the proposed BQC protocol.

Bob performs one of four Pauli operations randomly chosen by Alice on his photons and the initial states are correspondingly changed into one of , , , . Whether Bob colludes with Charlie or not, they guess the correct Bell state with the probability of . When this BQC protocol is repeated n times, the probability of obtaining correct quantum states is .

Alice randomly chooses the phase θ and disturbs the order of photons A , B , C . Bob and Charlie know nothing about the states because of the no-signaling principle. After repeating n times, the probability of guessing correct θ is . In the process of entanglement concentration, Bob and Charlie cannot eavesdropping any useful information by exchanging their results because of difference of orders of three photons.

The structures of blind brickwork states and blind topological states are private for servers. Therefore, Bob and Charlie can’t obtain anything about Alice’s private information whether they communicate with each other or not. The blindness of BFK single-server protocol and blind topological single-server protocol are showed in refs 1 and 2 in detail respectively.

Second, the correctness of quantum computation in BFK single-server protocol and blind topological single-server protocol are presented in refs 1 and 2 in detail.

So this BQC protocol is blind and correct.

Analysis of the success probabilities in iteration

In the above discussion, we have already elaborated the first round of the entanglement concentration with cross-Kerr nonlinearity in detail. QND provides a strong tool for us to perform a quantum nondemolition measurement that does not destroy entanglement of photons, which ensures that each step can be operated independently. Here, we analyse the second round and the k-th round of entanglement concentration.

For the three cases , and , only the first step is needed to concentrate the ideal maximally entangled states . However, we need to implement two steps for the state . We consider the three states , and first.

In the second round, for the quantum statesits analysis is the same as the Eq. (20). The success and failure probabilities areIn the k-th (k > 1) round, the success and failure probabilities areFor the quantum statesthe analyses of entanglement concentration are the same as the Eq. (23), the success and failure probabilities in the second round and the k-th round areFor the quantum states(where j = 1, 2) we give the relevant normalized coefficients and the probabilities of relevant quantum states. The iterative process is the same as the Eq. (3).

In the first step of the k-th round, for the quantum stateswhere k > 1 and the coefficients areIn the second step of the k-th round, for the quantum stateswhere the coefficients areThe probabilities of obtaining four quantum states in the first step or the second step of the k-th round arewhere j = 1, 2. The success probability of the kth round isThe total probability is , which depends on the number of iterations and parameters of the initial states. The relationship of the total success probability, parameters and the number of iterations is shown in Fig. 4. It can be seen that the total success probability has kept increasing with the parameters β and δ in the range of . When n = 4, the success probability has already reached 0.9196. When n = 9, the success probability has already reached 0.9975. Therefore, the entanglement concentration is successful in theory.

Figure 4

The success probability P of getting maximally entangled GHZ state relies on the initial coefficients β and δ. Here, we let , , , . n (n = 1, 2, 3, 4) represents the number of iterations.

In this paper, we only consider the ideal CNOT gate[19-23]. In experiment, there exist many nonideal factors such as the double effect of parameter conversion, the imperfect matching of the crystal lattice and phases, and so on. The probabilities of intrinsic error of experimental methods are unavoidable, such as QND measurements and CNOT operations. Thus optimizing the experimental system is a very meaningful research direction. In the BQC protocol, we only give the concrete quantum channel noise model but not universal. So, we will further study entanglement purification of GHZ states.

Methods

The optical devices are used to complete the entanglement concentration, where the parity check devices are based on cross-Kerr nonlinearity that can construct QND[38, 39, 41] to improve the successful probability. The cross-Kerr nonlinearity medium is described by the Hamiltonian,where and are the creation operators, a and a are the annihilation operators, a Fock state |n〉 and a coherent state |α 〉 interact. The whole system evolves intowhere , θ = χt is the phase shift and t is the interaction time (c = 1, 2, 3). θ is proportional to the number of photons in the signal state |α 〉. X-quadrature measurement can recognize the phase shift of signal states |α 〉. The cross-Kerr nonlinearity can measure the number of photons but do not destroy the photons.

For the parity check device in Fig. 3, we give an example. Two polarization photons are initially prepared with the forms of and that interact with a coherent beam |α 〉 (c = 1, 2, 3),where real numbers μ 0, μ 1, λ 0 and λ 1 satisfy the normalization condition |μ 0|2 + |μ 1|2 = 1, |λ 0|2 + |λ 1|2 = 1, respectively. Then the composite quantum system evolves toFrom the Eq. (39), we can pick up a phase shift 0 related with |HH〉 and |VV〉, and phase shift 2θ related with |HV〉 and |VH〉. One can distinguish |HH〉 and |VV〉 from |HV〉 and |VH〉 by different phase shifts, however, the states can not be distinguished by the setup.