1 Introduction

Secure multi-party computation(SMC) is an important subfield of cryptography, which was introduced by Goldreich in [1]. Secure multi-party computation has been extended to the quantum field and many researchers have investigated secure multi-party computation problems based on quantum states, such as quantum protocol for millionaire problem [2,3,4,6], quantum private comparison protocol [7,8,9,10,11,12,13,14,15,16,16], secure multiparty quantum summation [17,18,19,20,22,22], quantum private query [23,24,25,26,27] etc.

Secure multi-party summation problem is a special problem in secure multi-party computation. The problem of secure multi-party summation is described as follows: there are n parties P 1, P 2, .. , P n and every party P i has a private information x i . They want to correctly calculate a summation function F(x 1, x 2,..., x n ) without revealing any party’s secret information. It is a fundamental primitive of SMC, which can be used to build complex secure protocols for other multiparty computations.

However, there are only a few quantum protocols for Secure Multiparty Summation. In 2006, Hillery et al. [18], proposed a multi-party summation protocol with the two-particle N-level entangled states. In 2007, Du et al. [18] presented a secure quantum addition module n + 1 based on non-orthogonal single states. In 2010, Chen et al. [19] presented a quantum summation protocol with the multi-particle entangled GHZ states. In 2014, Zhang et al. [20] employed single photons in both polarization and spatial-mode degrees of freedom to design a quantum summation protocol. In 2015, Zhang et al. [21] proposed a quantum summation protocol based on the genuinely maximally entangled six-qubit states. In 2016, Shi et al. [22] present a quantum summation protocol based on quantum Fourier transform and CNOT gate operators.

In this paper, we firstly proposed a quantum secure two-party summation protocol based on two-particle Bell states. This protocols includes a semi-honest third party(TP). TP can prepares the initial states and gets the calculation results. TP also executes the protocol loyally, keeps a record of all its intermediate computations and might try to steal the players’ private inputs from the record, but he cannot be corrupted by the adversary. Then, we extent the two-party protocol to multi-party quantum summation without TP. Secure multiparty summation can be applied in secret sharing, electronic voting, secure sorting, data mining and so on. In our protocol, participants only use common EPR states and single particle operations without using entanglement swapping. So our protocol is simpler and easier to implement.

The structure of this paper is as follows: we propose a quantum secure two-party summation protocol based on two-particle Bell states in Section 2; and we analyze the security of this protocol in Section 3; we propose a quantum secure multi-party summation protocol based on two-particle Bell states in Section 4. A brief discussion and the concluding summary are given in Section 5.

2 The Quantum Secure Two-Party Summation Protocol Based on Two-Particle Bell States

Before presenting the protocol, we firstly give a description of two-level EPR states used in our protocol as follows:

$$ \left| {B_{00} } \right\rangle = \frac{{\left| {00} \right\rangle + \left| {11} \right\rangle }}{{\sqrt 2 }}\quad \quad \left| {B_{11} } \right\rangle = \frac{{\left| {01} \right\rangle - \left| {10} \right\rangle }}{{\sqrt 2 }} $$
(1)

The four Pauli matrices are described as follows:

$$ \begin{array}{l} \sigma_{00} = \left( {\begin{array}{cc} 1 & 0 \\ 0 & 1 \end{array}} \right)\quad \quad \;\sigma_{01} = \left( {\begin{array}{cc} 0 & 1 \\ 1 & 0 \end{array}} \right) \\ \sigma_{10} = \left( {\begin{array}{cc} 1 & 0 \\ 0 & { - 1} \end{array}} \right)\quad \quad \sigma_{11} = \left( {\begin{array}{cc} 0 & { - 1} \\ 1 & 0 \end{array}} \right). \end{array} $$
(2)

Using these Pauli matrices operations on |0〉, |1〉, we can get that:

$$ \begin{array}{l} \sigma_{00} \left| 0 \right\rangle = \left| 0 \right\rangle ,\sigma_{00} \left| 1 \right\rangle = \left| 1 \right\rangle ,\sigma_{01} \left| 0 \right\rangle = \left| 1 \right\rangle ,\sigma_{01} \left| 1 \right\rangle = \left| 0 \right\rangle, \\ \sigma_{10} \left| 0 \right\rangle = \left| 0 \right\rangle ,\sigma_{10} \left| 1 \right\rangle = - \left| 1 \right\rangle ,\sigma_{11} \left| 0 \right\rangle = \left| 1 \right\rangle ,\sigma_{11} \left| 1 \right\rangle = - \left| 0 \right\rangle. \end{array} $$
(3)

Supposed that there are two binary numbers x 1, x 2 ∈ {0, 1}, we apply \(\sigma _{x_{1}x_{2}}\) on \(\left | {B_{00} } \right \rangle ,\left | {B_{11} } \right \rangle \):

$$ \begin{array}{l} \sigma_{x_{1} x_{2} } \left| {B_{00} } \right\rangle = \left| {B_{00} } \right\rangle \\ \sigma_{x_{1} x_{2} } \left| {B_{11} } \right\rangle = (- 1)^{x_{1} \oplus x_{2} } \left| {B_{11} } \right\rangle \end{array} $$
(4)

The Hadamard matrix is described as follows:

$$ H = \frac{1}{{\sqrt 2 }}\left( {\begin{array}{cc} 1 & 1 \\ 1 & { - 1} \end{array}} \right). $$
(5)

Using these Hadamard matrix on \(\left | 0 \right \rangle ,\left | 1 \right \rangle \), we can get that:

$$ \begin{array}{l} H\left| 0 \right\rangle = \frac{1}{{\sqrt 2 }}(\left| 0 \right\rangle + \left| 1 \right\rangle ),H\left| 1 \right\rangle = \frac{1}{{\sqrt 2 }}(\left| 0 \right\rangle - \left| 1 \right\rangle )\\ H\frac{1}{{\sqrt 2 }}(\left| 0 \right\rangle + (- 1)^{0} \left| 1 \right\rangle ) = \left| 0 \right\rangle ,\;H\frac{1}{{\sqrt 2 }}(\left| 0 \right\rangle + (- 1)^{1} \left| 1 \right\rangle ) = \left| 1 \right\rangle \end{array} $$
(6)

Supposed that there two parties, Alice and Bob, where Alice has a secret X and Bob has a secret Y. The binary strings of X, Y are (x 1, x 2,...x L ),(y 1, y 2,...y L ). TP can get the summation result (x 1 ⊕ y 1, x 2 ⊕ y 2,...x L ⊕ y L ), where ⊕ denotes the addition module 2. The detail of our secure two-party summation protocol is described as follows:

  1. (1)

    TP prepares a L-length sequence of three-particle states:

    \( \frac {1}{{\sqrt 2 }}(\left | 0 \right \rangle \left | {B_{00} } \right \rangle + \left | 1 \right \rangle \left | {B_{11} } \right \rangle )_{T_{1}A_{1}B_{1}} ,...,\frac {1}{{\sqrt 2 }}(\left | 0 \right \rangle \left | {B_{00} } \right \rangle + \left | 1 \right \rangle \left | {B_{11} } \right \rangle )_{T_{L}A_{L}B_{L}} \).

    TP takes the first particle from each state in this sequence to form an ordered particles sequence

    $$ [(P_{T_{1}}),(P_{T_{2}}),....,(P_{T_{L}})] $$
    (7)

    which is called S T .

    TP takes the second particle from each state in this sequence to form an ordered particles sequence

    $$ [(P_{A_{1}}),(P_{A_{2}}),....,(P_{A_{L}})] $$
    (8)

    which is called S A .

    TP takes the third particle from each state in this sequence to form an ordered particles sequence

    $$ [(P_{B_{1}}),(P_{B_{2}}),....,(P_{B_{L}})] $$
    (9)

    which is called S B .

    TP also prepares two sequences of L′ particles, which are randomly chosen from four photon states |0〉, |1〉, |+〉, |−〉 and randomly inserts these two sequences of L′ particles into S A , S B to form two new sequence \(S_{A}^{\prime },S_{B}^{\prime }\). TP records the insert positions sequences P o A , P o B and sends \(S_{A}^{\prime },S_{B}^{\prime }\) to Alice,Bob respectively.

  2. (2)

    After receiving \(S_{A}^{\prime }(S_{B}^{\prime })\), Alice(Bob) and TP perform the eavesdropping check. TP announces the insert positions P o A (P o B ) and the measuring bases of \(S_{A}^{\prime }(S_{B}^{\prime })\). If the insert particle is |0〉 or |1〉, the measuring basis is Z basis; if the insert particle is |+〉 or |−〉, the measuring basis is X basis. Then Alice(Bob) chooses the L′ particles from \(S_{A}^{\prime }(S_{B}^{\prime })\) according to the insert positions P o A (P o B ) and measures these particles according to the measuring bases. Alice(Bob) and TP can find the existence of an eavesdropper by a predetermined threshold of error rate according to their measuring results. If the error rate exceeds the threshold they preset, they abort the scheme. Otherwise, they discards the measured photons in \(S_{A}^{\prime }(S_{B}^{\prime })\) and continue to the next step.

    For i = 1, 2, ... , L, Alice calculates \(P_{A_{i}}^{\prime }=\sigma _{x_{i},r_{i}} P_{A_{i}} \). The sequence of \(P_{A_{1}}^{\prime },P_{A_{2}}^{\prime },...,P_{A_{L}}^{\prime }\) is denoted by S q A .

    For i = 1, 2, ... , L, Bob calculates \(P_{B_{i}}^{\prime }=\sigma _{y_{i},r_{i}} P_{B_{i}} \). The sequence of \(P_{B_{1}}^{\prime },P_{B_{2}}^{\prime }, ...,P_{B_{L}}^{\prime }\) is denoted by S q B .

    where r i (i = 1, 2, ... , L) is randomly chosen from 0,1.

    Alice(Bob) also prepares a L′-particle sequence, which are randomly chosen from four photon states \( \left | 0 \right \rangle ,\left | 1 \right \rangle ,\left | + \right \rangle ,\left | - \right \rangle \) and randomly inserts these L′ particles into S q A (S q B ) to form a new sequence \(Sq_{A}^{\prime }(Sq_{B}^{\prime })\). Alice(Bob) records the insert positions \(Po_{A}^{\prime }(Po_{B}^{\prime })\) and sends \(Sq_{A}^{\prime }(Sq_{B}^{\prime })\) to TP.

  3. (3)

    After receiving \(Sq_{A}^{\prime }(Sq_{B}^{\prime })\), Alice(Bob) and TP perform the eavesdropping check. Alice(Bob) announces the insert positions \(Po_{A}^{\prime }(Po_{B}^{\prime })\) and the measuring bases of \(Sq_{A}^{\prime }(Sq_{B}^{\prime })\). If the insert particle is |0〉 or |1〉, the measuring basis is Z basis; if the insert particle is |+〉 or |−〉, the measuring basis is X basis. Then TP chooses the L′ particles from \(Sq_{A}^{\prime }(Sq_{B}^{\prime })\) according to the insert positions \(Po_{A}^{\prime }(Po_{B}^{\prime })\) and measures these particles according to the measuring bases. Alice(Bob) and TP can find the existence of an eavesdropper by a predetermined threshold of error rate according to their measuring results. If the error rate exceeds the threshold they preset, they abort the scheme. Otherwise, they discards the measured photons in \(Sq_{A}^{\prime }(Sq_{B}^{\prime })\) and continue to the next step.

    For i = 1, 2, ... , L:

    Except the first particle, TP sets others particles to 0 and applies the Hadamard operation to the first particle \(P_{T_{i}}\):

    $$ H(\left| 0 \right\rangle + (- 1)^{x_{i} \oplus r_{i} } (- 1)^{y_{i} \oplus r_{i} } \left| 1 \right\rangle ) = \left| {x_{i} \oplus y_{i} } \right\rangle. $$
    (10)

    P 1 uses Z basis to measure the state and gets x i ⊕ y i .

3 Security Analysis

Firstly, we show that the outside attack is invalid to our protocol. Secondly, we show that the Alice, Bob, TP can not get any information about the private information of each other.

3.1 Outside Attack

We analyze the possibility of the outside eavesdropper to get information about X and Y in every step of protocol. In our protocol, the chance of attack from the outside eavesdropper is to attack the quantum channel in Step (2). In Step (2), the outside eavesdropper can attack the quantum channel when Alice,Bob sent S q A , S q B to TP. Because of the use of nonorthogonal decoy photons, we performed eavesdropper checking process in Step (3) and several kinds of outside attacks, such as the intercept-resend attack, the measure-resend attack, the entangle-measure attack, were detected with nonzero probability. Anyone who do not know the insert positions and bases of decoy particles cannot distinguish the decoy particles and the signal particles. For some special attacks, such as the photon-number-splitting (PNS) attack, the decoy-photon Trojan horse attack and the invisible photon Trojan horse attack, participants can defeat these attacks by using some beam splitters to split the sampling signals chosen for eavesdropping check before their operations and inserting filters in front of their devices to filter out the photon signal with an illegitimate wavelength. So, our quantum protocol is robust against outside attack.

3.2 Participant Attack

The term ”participant attack”, which emphasizes that the attacks from dishonest users are generally more powerful and should be paid more attention to, is first proposed by Gao et al. in Ref. [28] and has attracted much attention in the cryptanalysis of quantum cryptography [29,30,31,32,33,34]. We analyze the possibility of the three parties to get information about X and Y in our protocol. We firstly analyze the case that Alice wants to learn Bob’s private information Y. Secondly, we analyze the case that TP wants to learn the private information X, Y of Alice and Bob.

  1. Case 1:

    Alice and Bob want to learn the private information of each other.

    In our protocol, Alice can only gets \(P_{A_{1}},P_{A_{2}},....,P_{A_{L}}\) from TP and Bob can only gets \(P_{B_{1}},P_{B_{2}},....,P_{B_{L}}\). These particles aren’t related to Alice’s or Bob’s private information B. So Alice and Bob cannot infer any information about the private information of each other.

  2. Case 2:

    TP wants to learn the private information X, Y of Alice and Bob.

    In our protocol, TP knows \(P_{A_{1}},P_{A_{2}},....,P_{A_{L}}, P_{B_{1}},P_{B_{2}},....,P_{B_{L}}\) and also gets \(P_{A_{1}}^{\prime },P_{A_{2}}^{\prime },....,P_{A_{L}}^{\prime },P_{B_{1}}^{\prime },P_{B_{2}}^{\prime },....,P_{B_{L}}^{\prime }\).

    For i = 1, 2, ... , L: \(P_{A_{i}}^{\prime }=\sigma _{x_{i},r_{i}} P_{A_{i}} \); \(P_{B_{i}}^{\prime }=\sigma _{y_{i},r_{i}} P_{B_{i}} \).

    Because r i (i = 1,2,..., L) is randomly chosen from {0,1} by Alice and Bob, TP cannot exactly know r i (i = 1, 2, ... , L). So TP cannot infer any information about the private information of Alice and Bob.

4 The Quantum Secure Multi-Party Summation Protocol Based on Two-Particle Bell States

Supposed that there n parties, P 1, P 2,..., P n , where each P i has a secret X i . The binary strings of X i is \(\left ({x_{i}^{1}} ,{x_{i}^{2}} ,...{x_{i}^{L}} \right )\). P 1, P 2,..., P n can get the summation result \(\left (\overset {n}{\underset {i = 1}{\oplus }} {x_{i}^{1}} ,\overset {n}{\underset {i = 1}{\oplus }} {x_{i}^{2}} ,...,\overset {n}{\underset {i = 1}{\oplus }} {x_{i}^{L}} \right )\), where ⊕ denotes the addition module 2. In this case, we suppose that the player P 1 can act as TP.

The detail of our secure multi-party summation protocol is described as follows:

  1. (1)

    If n − 1 mod 2 = 0, P 1 prepares a L-length sequence of n-particle states: \( ((\left | 0 \right \rangle \left | {B_{00} } \right \rangle ...\left | {B_{00} } \right \rangle + \left | 1 \right \rangle \left | {B_{11} } \right \rangle ...\left | {B_{11} } \right \rangle )_{{P_{1}^{1}} {P_{1}^{2}} ...{P_{1}^{n}} } ,...,(\left | 0 \right \rangle \left | {B_{00} } \right \rangle ...\left | {B_{00} } \right \rangle + \left | 1 \right \rangle \left | {B_{11} } \right \rangle ...\left | {B_{11} } \right \rangle )_{{P_{L}^{1}} {P_{L}^{2}} ...{P_{L}^{n}} } )\).

    P 1 takes the i th particle from each state in this sequence to form an ordered particles sequence

    $$ \left[({P_{1}^{i}}),({P_{2}^{i}}),....,({P_{L}^{i}})\right] $$
    (11)

    which is called S i (i = 1,..., n) sequence.

    P 1 keeps S 1 and prepares \(n-1 L^{\prime }\)-particle sequences. He inserts these particles into S 2,..., S n respectively and gets new sequences \(S_{2}^{\prime },...,S_{n}^{\prime }\). He also also records insert positions P o i and sends S i to P i , where i = 2,..., n.

    If n − 1 mod 2 = 1, P 1 prepares a L-length sequence of n + 1-particle states: \(((\left | 0 \right \rangle \left | {B_{00} } \right \rangle ...\left | {B_{00} } \right \rangle + \left | 1 \right \rangle \left | {B_{11} } \right \rangle ...\left | {B_{11} } \right \rangle )_{{P_{1}^{1}}...P_{1}^{n + 1} },...,(\left | 0 \right \rangle \left | {B_{00} } \right \rangle ...\left | {B_{00} } \right \rangle + \left | 1 \right \rangle \left | {B_{11} } \right \rangle ...\left | {B_{11} } \right \rangle )_{{P_{L}^{1}}...P_{L}^{n + 1} } )\).

    P 1 takes the i th particle from each state in this sequence to form an ordered particles sequence

    $$ [({P_{1}^{i}}),({P_{2}^{i}}),....,({P_{L}^{i}})] $$
    (12)

    which is called S i (i = 1,2,..., n + 1) sequence.

    P 1 keeps S 1, S n+1 and prepares \(n-1 L^{\prime }\)-particle sequences. He inserts these particles into S 2,..., S n respectively and gets new sequences \(S_{2}^{\prime },...,S_{n}^{\prime }\). He also records insert positions P o i sends \(S_{i}^{\prime }\) to P i , where i = 2,..., n.

  2. (2)

    If n − 1 mod 2 = 0:

    For i = 2, ... , n: After receiving \(S_{i}^{\prime }\), P 1 and P i perform the eavesdropping check. P i announces the insert positions P o i and the measuring bases of \(S_{i}^{\prime }\). If the insert particle is |0〉 or |1〉, the measuring basis is Z basis; if the insert particle is |+〉 or |−〉, the measuring basis is X basis. Then P i chooses the L′ particles from \(S_{i}^{\prime }\) according to the insert positions P o i and measures these particles according to the measuring bases. P 1 and P i can find the existence of an eavesdropper by a predetermined threshold of error rate according to their measuring results. If the error rate exceeds the threshold they preset, they abort the scheme. Otherwise, they discards the measured photons in \(S_{i}^{\prime }\) and continue to the next step.

    For i = 2, ... , n:

    For k = 1, 2, ... , L:

    P i calculates \(P_{k}^{i^{\prime }}=\sigma _{{x_{i}^{k}},r_{\left \lceil {\frac {i}{2}} \right \rceil } } {P_{k}^{i}} \). The sequence of \(P_{1}^{i^{\prime }},P_{2}^{i^{\prime }},...,P_{L}^{i^{\prime }}\) is denoted by S q i , where \(r_{\left \lceil {\frac {i}{2}} \right \rceil }\) is randomly chosen from 0,1.

    For i = 2, ... , n:

    P i also prepares a \(L^{\prime }\)-particle sequence, which are randomly chosen from four photon states \( \left | 0 \right \rangle ,\left | 1 \right \rangle ,\left | + \right \rangle ,\left | - \right \rangle \) and randomly inserts these \(L^{\prime }\) particles into S q i to form a new sequence \(Sq_{i}^{\prime }\). P i records the insert positions \(Po_{i}^{\prime }\) and sends \(Sq_{i}^{\prime }\) to P 1.

    For i = 2, ... , n: After receiving \(Sq_{i}^{\prime }\), P 1 and P i perform the eavesdropping check. P i announces the insert positions P o i and the measuring bases of \(Sq_{i}^{\prime }\). If the insert particle is |0〉 or |1〉, the measuring basis is Z basis; if the insert particle is |+〉 or |−〉, the measuring basis is X basis. Then P i chooses the L′ particles from \(Sq_{i}^{\prime }\) according to the insert positions \(Po_{i}^{\prime }\) and measures these particles according to the measuring bases. P 1 and P i can find the existence of an eavesdropper by a predetermined threshold of error rate according to their measuring results. If the error rate exceeds the threshold they preset, they abort the scheme. Otherwise, they discards the measured photons in \(Sq_{i}^{\prime }\) and continue to the next step.

    If n − 1 mod 2 = 1:

    For i = 2, ... , n: After receiving \(S_{i}^{\prime }\), P 1 and P i perform the eavesdropping check. P i announces the insert positions P o i and the measuring bases of \(S_{i+1}^{\prime }\). If the insert particle is |0〉 or |1〉, the measuring basis is Z basis; if the insert particle is |+〉 or |−〉, the measuring basis is X basis. Then P i chooses the L′ particles from \(S_{i}^{\prime }\) according to the insert positions P o i and measures these particles according to the measuring bases. P 1 and P i can find the existence of an eavesdropper by a predetermined threshold of error rate according to their measuring results. If the error rate exceeds the threshold they preset, they abort the scheme. Otherwise, they discards the measured photons in \(S_{i}^{\prime }\) and continue to the next step.

    For i = 2, ... , n:

    For k = 1, 2, ... , L:

    P i calculates \(P_{k}^{i^{\prime }}=\sigma _{{x_{i}^{k}},r_{\left \lceil {\frac {i}{2}} \right \rceil }} P_{i} \). The sequence of \(P_{1}^{i^{\prime }},P_{2}^{i^{\prime }},...,P_{L}^{i^{\prime }}\) is denoted by S q i , where \(r_{\left \lceil {\frac {i}{2}} \right \rceil }\) is randomly chosen from 0,1.

    For k = 1, 2, ... , L:

    P 1 calculates \(P_{k}^{n+1^{\prime }}=\sigma _{{r_{1}^{k}},r_{\left \lceil {\frac {n}{2}} \right \rceil }} P_{k}^{n+1} \). The sequence of \(P_{1}^{n+1^{\prime }},P_{2}^{n+1^{\prime }},...,P_{L}^{n+1^{\prime }}\) denoted by S q n+1, where \({r_{1}^{k}}=0\).

    For i = 2, ... , n:

    P i also prepares a L′-particle sequence, which are randomly chosen from four photon states \( \left | 0 \right \rangle ,\left | 1 \right \rangle ,\left | + \right \rangle ,\left | - \right \rangle \) and randomly inserts these L′ particles into S q i to form a new sequence \(Sq_{i}^{\prime }\). P i records the insert positions \(Po_{i}^{\prime }\) and sends \(Sq_{i}^{\prime }\) to P 1.

    For i = 2, ... , n:

    After receiving \(Sq_{i}^{\prime }\), P 1 and P i perform the eavesdropping check. P i announces the insert positions P o i and the measuring bases of \(Sq_{i}^{\prime }\). If the insert particle is |0〉 or |1〉, the measuring basis is Z basis; if the insert particle is |+〉 or |−〉, the measuring basis is X basis. Then P i chooses the L′ particles from \(Sq_{i}^{\prime }\) according to the insert positions \(Po_{i}^{\prime }\) and measures these particles according to the measuring bases. P 1 and P i can find the existence of an eavesdropper by a predetermined threshold of error rate according to their measuring results. If the error rate exceeds the threshold they preset, they abort the scheme. Otherwise, they discards the measured photons in \(Sq_{i}^{\prime }\) and continue to the next step.

  3. (3)

    If n − 1 mod 2 = 0: For k = 1, 2, ... , L:

    Except the first particle, P 1 sets others particles to 0 and applies the Hadamard operation to the first particle:

    $$ H\left( \left| 0 \right\rangle + (- 1)^{\overset{n}{\underset{i = 2}{\oplus}}\left( {x_{i}^{k}} \oplus r_{\left\lceil {\frac{i}{2}} \right\rceil } \right)} \left| 1 \right\rangle \right) = \left|{\overset{n}{\underset{i = 2}{\oplus}} \left( {x_{i}^{k}} \right)} \right\rangle. $$
    (13)

    P 1 uses Z basis to measure the state and gets \(\overset {n}{\underset {i = 2}{\oplus }} \left ({x_{i}^{k}} \right )\). Then, he adds his secret \({x_{1}^{k}}\) to the summation and obtains the final result \( \overset {n}{\underset {i = 1}{\oplus }} \left ({x_{i}^{k}} \right )\).

    If n − 1 mod 2 = 1:

    For k = 1, 2, ... , L:

    Except the first particle, P 1 sets others particles to 0 and applies the Hadamard operation to the first particle:

    $$ H\left( \left| 0 \right\rangle + (- 1)^{\overset{n}{\underset{i = 2}{\oplus}} \left( {x_{i}^{k}} \oplus r_{\left\lceil {\frac{i}{2}} \right\rceil } \right)} \left| 1 \right\rangle \right) = \left|{ \overset{n}{\underset{i = 2}{\oplus}} \left( {x_{i}^{k}} \right)} \right\rangle. $$
    (14)

    P 1 uses Z basis to measure the state and gets \( \overset {n}{\underset {i = 2}{\oplus }} ({x_{i}^{k}} )\). Then, he adds his secret \({x_{1}^{k}}\) to the summation and obtains the final result \( \overset {n}{\underset {i = 1}{\oplus }} ({x_{i}^{k}} )\).

    The security of the present multi-party quantum summation protocol is the same as the two-party quantum summation protocol. The collusive attack performed by at most n − 2 players is invalid for this protocol.

5 Discussion and Conclusions

In summary, we have put forward a novel and efficient quantum protocol to compute secure multiparty summation. In our protocol, we use two-particle Bell states to carry private information. We also use Pauli matrices operations to encode information and Hadamard matrix to extract information. The proposed protocol can also resist various attacks, such as disturbance attack, Trojan horse attack, intercept-resend attack, entanglement-and-measure attack and man-in-the-middle attack. Without using the entanglement swapping of Bell states, our proposed quantum protocol overcomes the problem of information leakage with acceptable efficiency. In theory, our protocol can be generalized to compute lots of secure multiparty numerical computations.