1 Introduction

In secure multi-party computation (MC) problem, each player has an input which cannot be revealed to anyone else. Players want to compute the value of function in private. This kind of problem is first proposed by Yao [1]. He introduced the two-party millionaire problem, where two millionaires want to compare their values of assets without the help of any others. Another important problem is multi-party summation [2,3,4], in which players need to compute the summation of their private inputs. With the development of cloud computing [5], security of computation and secure MC attract a great deal of attention.

Because of the uncertainty principle, no-cloning theorem and entanglement, quantum cryptography provides the possibility of designing an unconditional secure protocol [6, 7]. Quantum version solutions of secure MC problem are researched widely [8,9,10,11,12]. For example, in 2007, Du et al. [10] proposed an n-party quantum addition module n + 1 protocol based on non-orthogonal states. After that, a quantum addition module 2 protocol via multi-particle entangled states was investigated by Chen et al. [11]. Recently, a secure summation and a secure multiplication protocols were given by Shi et al. [12]. The module of Shi et al.’s protocol is 2m. Here m is the number of bits.

In common protocols, players are supposed to be honest, semi-honest or dishonest. Players under different assumptions have different behavior patterns. In other word, their behaviors are limited by these assumptions, instead of free. Therefore, these protocols are not reasonable enough. Another weakness of common protocols is that fairness is usually not concerned. For example, in an MC protocol, one player may obtain the result but not inform it to the others. In this case, the other players have no choice to obtain the result. This case is unfair for them. Under the circumstances, rational protocols were introduced. In this kind of protocols, players are supposed to be rational and will perform the protocol for their own benefits. They may cooperate with the others faithfully, send false information, perform false operations or give up. The only principle is to maximize their benefits. In addition, a rational protocol should be fair for players. The probabilities of each player gaining the result should be equal.

In 2004, Halpern et al. [13] designed a rational three-party secret sharing protocol. Each player can generate a random bit 0 or 1 with probability \( \alpha \) or \( 1 - \alpha \), respectively, and choose a strategy according to this bit. The expected running rounds are \( 5/\alpha^{3} \). Authors proved that there exists no deterministic rational MC protocol at the same time. In 2015, Zhang et al. proposed a verifiable rational secret sharing scheme [14]. A non-interactively verifiable proof is provided for the correctness of players’ share. After that, Wang et al. [15] represented the research status of rational secure multi-party computing and some typical protocols. In 2016, Wang et al. [16] utilized fuzzy theory to research rational computing protocol. Compared with previous protocols, round complexity can be reduced in Wang et al.’s [16].

In 2015, Maitra et al. [17] firstly introduced rational players into quantum protocol and investigated rational quantum secret sharing (QSS) protocol. A (3, 7) threshold protocol was proposed at first. Then, it was generalized to (k, n) version. Actually, the shared secret is a quantum state in their protocol. This kind of QSS is usually called as quantum state sharing (QSTS). After that, Dou et al. [18] also proposed a rational QSTS protocol. Concretely, authors improved Li et al.’s QSTS protocol [19] to the rational version. Since only one player can get the state, i.e., the result, QSTS protocol is different from the others. Therefore, the definitions of utilities, correctness and fairness of rational QSTS were creatively given. Besides that, assumptions in this protocol are more practical and reasonable than previous ones.

In this paper, we follow the research on rational quantum protocol and design a rational quantum MC protocol. We focus on a kind of MC problems which are homomorphic, including but not limited to summation, multiplication, anonymous ranking. Firstly, a rational summation protocol is given as an example. Just like Halpern et al.’s protocol [13], players in our protocol also need to generate some random bits and determine their strategies thereafter. An improvement is that punishment is introduced into protocol to make players tend to send their inputs. Secondly, multi-party problems which can be computed by our protocol are discussed. If the key computation of a solution for a problem is homomorphic [20], this solution can be modified into a rational protocol. This problem can be resolved by our protocol further. Thirdly, utilities, correctness, Nash equilibrium, and fairness are analyzed. In order to achieve the last three characteristics, players can choose suitable coefficients. Our protocol satisfies all the criteria of rational protocol actually. Last but not least, another three analyses are also given. We analyze the security, calculate probabilities of the best and worst cases, and compare our protocol with Halpern et al.’s [13] and Maitra et al.’s [17]. These show that our protocol is secure, efficient and multifunctional. What’s more, no presupposition holds when analyzing players’ decision.

The structure of this paper is organized as follows. Preliminaries about rational MC and homomorphic function are given in Sect. 2. After that, we describe the proposed protocol in Sect. 3. Detailed analyses about our protocol are shown in Sect. 4. Finally, conclusions are given in Sect. 5.

2 Preliminaries

2.1 Rational multi-party computation

For an n-party game \( \varGamma = (\{ P_{i} \}_{i = 1}^{n} ,{\kern 1pt} \{ A_{i} \}_{i = 1}^{n} ,\{ U_{i} \}_{i = 1}^{n} ) \), Pi denotes the ith player, \( a_{i} \in A_{i} \) is one of his strategies. Ai is his strategy set further. Let \( A = A_{1} \times A_{2} \times \cdots \times A_{n} \), then \( \varvec{a} = (a_{1} ,a_{2} , \ldots ,a_{n} ) \in A \) denotes a strategy vector of this game, \( \varvec{o}(\varvec{a}) = (o_{1} ,o_{2} , \ldots ,o_{n} ) \) is the corresponding outcome, \( U_{i} (\varvec{a}) \) is Pi’s utility in this case. What’s more, if Pi prefers \( \varvec{a} \) than \( \varvec{a}^{{\prime }} \), then \( U_{i} (\varvec{a}) > U_{i} (\varvec{a}^{{\prime }} ) \). Besides that, for any given strategy vector \( \varvec{a} \), we define \( \varvec{a}_{ - i} = (a_{1} ,a_{2} , \ldots ,a_{i - 1} ,a_{i + 1} , \ldots ,a_{n} ) \), and can get \( (a_{i}^{{\prime }} ,\varvec{a}_{ - i} ) = (a_{1} ,a_{2} , \ldots ,a_{i - 1} ,{\kern 1pt} {\kern 1pt} a_{i}^{\prime } ,a_{i + 1} , \ldots ,a_{n} ) \) naturally.

In rational MC problem, we also introduce a symbol \( {\text{info}}_{i} (\varvec{a}) \) to describe whether the player Pi can get the computation result in strategy vector \( \varvec{a} \). Here \( {\text{info}}_{i} (\varvec{a}) = 1 \) if Pi can obtain the result, \( {\text{info}}_{i} (\varvec{a}) = 0 \) if not. Three notes, which will be mentioned in following sections, are shown here.

  • (N1) If \( {\text{info}}_{i} (\varvec{a}) > {\text{info}}_{i} (\varvec{a}^{{\prime }} ) \), then \( U_{i} (\varvec{a}) > U_{i} (\varvec{a}^{{\prime }} ). \)

  • (N2) If \( {\text{info}}_{i} (\varvec{a}) = {\text{info}}_{i} (\varvec{a}^{{\prime }} ) \), \( {\text{info}}_{j} (\varvec{a}) \ge {\text{info}}_{j} (\varvec{a}^{{\prime }} ) \) for all the \( j \ne i \), and \( {\text{info}}_{k} (\varvec{a}) > {\text{info}}_{k} (\varvec{a}^{{\prime }} ) \) for at least one player Pk, then \( U_{i} (\varvec{a}) < U_{i} (\varvec{a}^{{\prime }} ). \)

  • (N3) If \( {\text{info}}_{i} (\varvec{a}) = {\text{info}}_{i} (\varvec{a}^{{\prime }} ) \), \( {\text{info}}_{j} (\varvec{a}) \le {\text{info}}_{j} (\varvec{a}^{{\prime }} ) \) for all the \( j \ne i \), and \( {\text{info}}_{k} (\varvec{a}) < {\text{info}}_{k} (\varvec{a}^{{\prime }} ) \) for at least one player Pk, then \( U_{i} (\varvec{a}) > U_{i} (\varvec{a}^{{\prime }} ). \)

Definition 1

(Pure Strategy Nash Equilibrium [21]) A strategy vector \( \varvec{a} \) in the game \( \varGamma \) is a pure strategy Nash equilibrium, if we have

$$ U_{i} (a_{i}^{{\prime }} ,\varvec{a}_{ - i} ) \le U_{i} (\varvec{a}) $$
(1)

for each player Pi and his any other strategy \( a_{i}^{{\prime }} . \)

Definition 2

(Mixed Strategy [21]) In game \( \varGamma \), a player Pi has a strategy set \( A_{i} = \{ a_{i1} ,a_{i2} , \ldots ,a_{iK} \} \). A mixed strategy of \( P_{i} \) is denoted as \( \Pr_{i} = \{ p_{i1} ,p_{i2} , \ldots ,p_{iK} \} \), which means that Pi chooses \( a_{ij} \) with probability \( p_{ij} \), \( 0 \le p_{ij} < 1 \), and \( \sum\nolimits_{j = 1}^{K} {p_{ij} = 1} \). The mixed strategies of all the other players are denoted as \( \Pr_{ - i} = (\Pr_{1} ,\Pr_{2} , \ldots ,\Pr_{i - 1} ,\Pr_{i + 1} , \ldots ,\Pr_{n} {\kern 1pt} ) \), the mixed strategies of all the players are denoted as \( \Pr = (\Pr_{1} ,\Pr_{2} , \ldots ,\Pr_{n} ) \) further.

Definition 3

(Mixed Strategy Nash Equilibrium [21]) A strategy vector Pr in the game \( \varGamma \) is a mixed strategy Nash equilibrium, if we have

$$ U_{i} ({\Pr}_{i}^{\prime} ,{\Pr}_{- i}) \le U_{i} (\Pr ) $$
(2)

for each player Pi and his any other strategy \( \Pr_{i}^{{\prime }} . \)

Besides that, utilities, correctness, and fairness of rational multi-party protocol are described and analyzed in Sect. 4.

2.2 Homomorphic function

For a multivariate function \( y = f(x_{1} ,x_{2} , \ldots ,x_{n} ) \), \( x_{i} \in A_{i} \), domain of function f is \( A_{1} \times A_{2} \times \cdots \times A_{n} \). Accordingly, range is \( f(A_{1} \times A_{2} \times \cdots \times A_{n} ). \)

The addition in domain and range are denoted as \( \circ \) and \( \odot \), respectively. The function f is homomorphic if for any \( x_{i} ,x_{i}^{{\prime }} \in A_{i} \), \( {\kern 1pt} y = f(x_{1} ,x_{2} , \ldots ,x_{n} ) \), \( y^{{\prime }} = f(x_{1}^{{\prime }} ,x_{2}^{{\prime }} , \ldots ,x_{n}^{{\prime }} ) \), we have

$$ y^{{\prime \prime }} = f(x_{1} \circ x_{1}^{{\prime }} ,x_{2} \circ x_{2}^{{\prime }} , \ldots ,x_{n} \circ x_{n}^{{\prime }} ) = y \odot y^{{\prime }} . $$
(3)

Thus, another way to compute y is:

$$ \begin{aligned} y & = y^{\prime \prime } \odot y^{\prime - 1} \\ & = f(x_{1} \circ x_{1}^{{\prime }} ,x_{2} \circ x_{2}^{{\prime }} , \ldots ,x_{n} \circ x_{n}^{{\prime }} ) \odot [f(x_{1}^{{\prime }} ,x_{2}^{{\prime }} , \ldots ,x_{n}^{{\prime }} )]^{ - 1} . \\ \end{aligned} $$
(4)

Here \( y^{\prime - 1} \) is the inverse element of \( y^{\prime} \) in range.

3 The proposed rational quantum multi-party computation protocol

At first, a new rational multi-party summation protocol based on common protocols is investigated in Sect. 3.1. In order to solve more MC problems, this protocol is modified to a multifunctional rational MC protocol in Sect. 3.2.

3.1 A new rational quantum summation protocol

Suppose that there are n players who want to compute the summation of their private data. For the ith player Pi, his secret can be written as a d-ary number \( M_{i} \in \{ 0, \ldots ,d - 1\} \), where \( i \in \{ 1,2, \ldots ,n\} \), d is a prime number. The jth round processes of our protocol are shown as follows:

  • [S-1] In the jth round, he generates a random number \( R_{ij} \in \{ 0, \ldots ,d - 1\} \) and computes \( MR_{ij} = M_{i} \oplus_{d} R_{ij} \), here \( \oplus_{d} \) denotes the addition module d.

  • [S-2] Then, a common quantum summation protocol is performed. All the players compute the summation of \( MR_{ij} \). The result is denoted as \( S_{1j} \). Here any protocol could be employed as long as it is secure and correct.

  • [S-3] Pi chooses a bit \( c_{ij} \). The probability of \( c_{ij} = 0 \) is \( \alpha \), and the probability of \( c_{i} = 1 \) is \( 1 - \alpha \) accordingly. Then, he randomly generates n − 2 bits \( c_{ij}^{(1)} ,{\kern 1pt} \ldots ,c_{ij}^{(i - 1)} , \) \( {\kern 1pt} c_{ij}^{(i + 1)} , \ldots ,c_{ij}^{(n - 1)} \) and computes \( c_{ij}^{(n)} = c_{ij} \oplus c_{ij}^{(1)} \oplus \cdots \oplus c_{ij}^{(i - 1)} \oplus {\kern 1pt} {\kern 1pt} c_{ij}^{(i + 1)} \oplus \cdots \oplus c_{ij}^{(n - 1)} \), here \( \oplus \) denotes the addition module 2.

  • [S-4] Pi sends \( c_{ij}^{(k)} \) to Pk for \( k \in \{ 1, \ldots ,i - 1,i + 1, \ldots ,n\} \). Then, Pi computes \( q_{ij} = c_{1j}^{(i)} \oplus c_{2j}^{(i)} \oplus \cdots \oplus c_{(i - 1)j}^{(i)} \oplus c_{(i + 1)j}^{(i)} \oplus \cdots \oplus c_{nj}^{(i)} \), and publishes it. Each player can compute \( q_{j} = \oplus_{i = 1}^{n} q_{ij} = \oplus_{i = 1}^{n} c_{ij} \) by himself. If \( q_{j} = c_{ij} = 0 \), then player Pi sends \( R_{ij} \) to the others. If \( q_{j} = 0 \) but \( c_{ij} = 1 \), Pi does nothing. Otherwise, \( q_{j} = 1 \), then all the players come to the next round.

  • [S-5] After that, if \( q_{j} = 0 \) but neither of players collects all the n random numbers \( R_{1j} ,R_{2j} , \ldots ,R_{nj} \), all of them publish their bits \( c_{ij}^{(k)} \), and check which player (named as Pm) should send his \( R_{mj} \). The player who did not publish \( R_{mj} \) in this round needs to send his random number before the others in the next \( \lambda \) rounds. Here \( \lambda \) is a constant.

    Otherwise, at least one player has collected all, he can obtain the summation of \( R_{ij} \). The result is denoted as \( S_{2j} \). Finally, the player can compute the summation of their secret Mi as \( S_{j} = S_{1j} { \ominus }_{d} S_{2j} \). Here \( { \ominus }_{d} \) is the subtraction module d.

3.2 Multifunctional rational protocol of quantum secure multi-party computation

Next, the rational multi-party summation protocol will be generalized to a rational MC protocol.

A MC problem could be regarded as a multivariate function \( y = f(x_{1} ,x_{2} , \ldots ,x_{n} ) \). Inputs and output correspond to independent variables and dependent variable, respectively. As one of the MC problems, multi-party summation also could be denoted as function \( y = x_{1} \oplus_{d} x_{2} \oplus_{d} \cdots \oplus_{d} x_{n} \) which is homomorphic. Therefore, from the view of multivariate function, operation \( M_{i} \oplus_{d} R_{ij} \) in our protocol corresponds to operation \( x_{i} \circ x_{i}^{{\prime }} \) in Sect. 2.2. Likewise, \( S_{1j} { \ominus }_{d} S_{2j} \) corresponds to \( y^{{\prime \prime }} \odot y^{{{\prime } - 1}} . \)

Furthermore, in order to modify the protocol in Sect. 3.1 to a rational MC protocol, calculations players need to make should be changed from \( M_{i} \oplus_{d} R_{ij} \) to \( x_{i} \circ x_{i}^{{\prime }} \) in step [S-1], and from \( S_{1j} { \ominus }_{d} S_{2j} \) to \( y^{{\prime \prime }} \odot y^{\prime - 1} \) in step [S-5]. Since Eq. (4) holds only for homomorphic function, our protocol could be employed to resolve the problem which could be regarded as homomorphic function.

Next, we will discuss common MC problems which could satisfy above requirement. As we have shown, multi-party summation is one of them. Addition of inputs xi could be computed by equation

$$ x_{1} + x_{2} + \cdots + x_{n} = \left( {x_{1} + x_{1}^{{\prime }} } \right) + \left( {x_{2} + x_{2}^{{\prime }} } \right) + \cdots + \left( {x_{n} + x_{n}^{{\prime }} } \right) - \left( {x_{1}^{{\prime }} + x_{2}^{{\prime }} + \cdots + x_{n}^{{\prime }} } \right). $$
(5)

Similarly, multi-party multiplication also belongs to this set. Multiplication could be computed by

$$ x_{1} x_{2} \ldots x_{n} = \left( {x_{1} x_{1}^{{\prime }} } \right)\left( {x_{2} x_{2}^{{\prime }} } \right) \ldots \left( {x_{n} x_{n}^{{\prime }} } \right)/\left( {x_{1}^{{\prime }} x_{2}^{{\prime }} \ldots x_{n}^{{\prime }} } \right). $$
(6)

Since d is a prime number, \( x_{1}^{{\prime }} x_{2}^{{\prime }} \ldots x_{n}^{{\prime }} \equiv 0\bmod d \) only if one of \( x_{i}^{{\prime }} = 0 \). In order to avoid this case, we can let \( x_{i}^{{\prime }} \ne 0. \)

If we reread existing quantum MC protocols, and check the key of their solutions, we can find some other examples. In many quantum millionaire protocols [8, 9], problem is resolved by subtraction essentially. The third party needs to compute \( x_{i} - x_{j} \) to determine which input is bigger. Subtraction is the inverse operation of addition, so this problem could be resolved by our protocol. Another example is quantum anonymous ranking protocols [22, 23]. In these protocols, if a player holds a value, he will add 1, i.e., perform an operation on the corresponding particle. In the end, players can obtain the number of addition which is applied to each value and the rank of each value further.

Actually, as Shi et al. mentioned in Ref. [12], summation and multiplication are both fundamental primitives of secure MC. Many computations could be performed on the basis of them, such as average, maximum and minimum. In other words, our protocol is multifunctional and has a wide range of applications.

4 Analyses

In this section, some analyses about the protocol are given. Utilities, correctness, Nash equilibrium, fairness are analyzed. These show that our protocol is rational. Furthermore, security, probabilities of two protocol outcomes and comparison are also analyzed. Our protocol is also secure, efficient and practical.

The processes of our protocol can be divided as two parts: steps [S-1]–[S-2] which are based on common secure quantum multi-party computation protocol and steps [S-3]–[S-5] which could be regarded as rational classical secret sharing protocol. These two parts can be called as quantum stage and classical stage, respectively. They will be mentioned next.

4.1 Utilities

In quantum stage, a player will be chosen to compute and publish the value of summation. His role is different from the others’. We can denote this player as P1. Concretely, P1 will determine whether compute and publish the value of \( S_{1j} \), while the others will choose whether encode their \( MR_{ij} \) \( (i \ne 1) \) to help P1 before that. However, in classical stage, all the players’ roles are same. They may send their random number \( R_{ij} \) or not. Here strategies, corresponding outcomes, explanations and utilities of all the cases are described in Table 1. They will be employed in the following analyses.

Table 1 The detailed strategies, outcomes, explanations and utilities
Full size table

Some illustrations about utilities are given. (1) The classical stage will be performed if and only if all the players cooperate in the quantum stage. (2) If all the players choose to cooperate and publish, their utilities will be Uc and Up, respectively. However, they will go to classical stage next, and their utilities can also be denoted as Us, \( U_{us} \), \( U_{sn} \), \( U_{nn} \), \( U_{pn} \), \( U_{w} \) or \( U_{o} \). Then, the latter seven symbols will be used to describe players’ utilities, instead of the former two. (3) From notes (N1)–(N3), we can know that \( U_{o} > U_{s} > U_{nn} > U_{us} \), \( U_{o} > U_{s} > U_{pn} > U_{us} \) and \( U_{o} > U_{s} > U_{sn} > U_{us} \). (4) Comparing the outcome “Unsuccessful computation” with “Punished computation,” we find that no player can obtain \( S_{2j} \) or Sj in both cases. The difference is Pi sends his random number in the former case. Since the player who did not fulfill his obligations may be discovered at the end of round, we say that \( U_{sn} > U_{pn} \). (5) Comparing the outcome “Unsuccessful computation” with “No one computation,” we find that player fulfills his obligation, but no one can obtain the result in both cases. The only difference is the player sends \( R_{ij} \) in the former case. It means that he does some extra work, so it is easy to get \( U_{sn} < U_{nn} \). Now, we can get \( U_{o} > U_{s} > U_{nn} > U_{sn} > U_{pn} > U_{us} \) further.

In quantum stage, P1 chooses to publish or stop after all the others encoded their \( MR_{ij} \). This stage could be considered as a dynamic game. Game tree is a visual description to show this kind of game. Here the quantum stage is analyzed in four-party version. The game tree of this game \( \varGamma_{1} \) is illustrated in Fig. 1. Dotted lines mean that P2, P3 and P4 know nothing about each other’s choice. In other words, they make choices at the same time.

Fig. 1
figure 1

Game tree of the quantum stage with four players

Full size image

If any player chooses the strategy Stopping1 or Stopping2, none of players will obtain useful result. They would restart the game. Otherwise, all the players will obtain \( S_{1j} \) and go to the classical stage. From the view of type of game, if any agent is punished to send the random number before the others, it will be a dynamic game. Otherwise, all the players choose their strategies at the same time and are equivalent. It is a static game. Consider the type of game and the value of \( c_{kj} \), four cases may occur: (1) Not all the \( c_{kj} = 0 \) in a static game; (2) all the \( c_{kj} = 0 \) in a static game; (3) not all the other \( c_{kj} = 0 \) in a dynamic game; (4) all the other \( c_{kj} = 0 \) in a dynamic game. Four cases are analyzed with examples as follows:

  1. (1)

    Since all the players are equivalent, we suppose \( c_{1j} = c_{3j} = 1 \) and \( c_{2j} = c_{4j} = 0 \), and denote this game as \( \varGamma_{2} \). In this case, utilities of players in different strategy vectors are shown in Table 2.

    Table 2 Utility matrix of four-party static game \( \varGamma_{2} \)
    Full size table
  2. (2)

    Here \( c_{1j} = c_{2j} = c_{3j} = c_{4j} = 0 \). Likewise, we denote this game as \( \varGamma_{3} \). Utilities are also given in Table 3.

    Table 3 Utility matrix of four-party static game \( \varGamma_{3} \)
    Full size table
  3. (3)

    Suppose P1 is punished, and \( c_{2j} = c_{3j} = c_{4j} = 0 \). Game tree is also utilized to describe this game \( \varGamma_{4} \)(Fig. 2).

    P1 needs to make a decision at first. If he stopped, the others need not send, the utility vector is \( (U_{pn} ,U_{nn} ,U_{nn} ,U_{nn} ) \). Otherwise, they choose strategies at the same time. Similarly, dotted lines in Fig. 2 imply that they make choices at the same time.

    Fig. 2
    figure 2

    Game tree of four-party dynamic game \( \varGamma_{4} \)

    Full size image
  4. (4)

    Likewise, suppose P1 is punished, \( c_{2j} = c_{3j} = 1 \), and \( c_{4j} = 0 \) (Fig. 3).

    Fig. 3
    figure 3

    Game tree of four-party dynamic game \( \varGamma_{5} \)

    Full size image

    The game tree of \( \varGamma_{5} \) is similar with the tree of \( \varGamma_{4} \). The differences are \( P_{2} \)’s and \( P_{3} \)’s utilities are changed from \( U_{pn} \) to \( U_{nn} \) if they choose Stopping3.

4.2 Correctness

Definition 4

(Correctness [17]) A rational multi-party protocol is correct if the following holds:

$$ \Pr [o_{ - i} (\varGamma ,(a_{i} ,a_{ - i} )) = {\it{Wrong}}\,\,{\it{computation}}] = 0 $$
(7)

for each player \( P_{i} \)’s arbitrary strategy \( a_{i} . \)

Theorem 1

The correctness is ensured if all the players are in fail-stop setting.

Proof

In our protocol, players are supposed to be in fail-stop, and they can only choose to send the number or not, instead of sending a false number. Because players’ private inputs cannot be revealed to any other in MC protocol, authenticity of inputs also cannot be confirmed. The fail-stop setting is the best of a bad bunch. In this case, no player will get a wrong result, and correctness of protocol holds further. □

4.3 Nash equilibrium

Equilibrium is the situation in which all the players are balanced. Nash equilibrium of our protocol will be discussed below. The existence of Nash equilibrium is given.

Theorem 2

There exist some values of x and \( \alpha \) that make the protocol achieve mixed strategy Nash equilibrium.

Proof

As we have shown, in our protocol, quantum stage could be regarded as a dynamic game. If there is no punishment, classical stage is a static game. Otherwise, it is also dynamic.

For static game, pure strategy or mixed strategy Nash equilibrium could be obtained easily. However, for dynamic game, backward induction is one of the most important methods. Specifically, the player who selects strategy earlier will consider which strategy the latter one may choose. Consequently, if we deduce which strategy the last player will choose in each case and which strategies the other players will choose backward one by one, the equilibrium of this game and the path to this equilibrium will be obtained. For the sake of describing our analysis more clearly, we take the four-party game as an example and then generalize the analysis to the n-party game.

  1. (1)

    Four-party game

Firstly, the game \( \varGamma_{5} \) will be analyzed. The game among players \( P_{2} \), \( P_{3} \) and \( P_{4} \) can be denoted as a static sub-game \( \varGamma_{6} \) which can be described by utility matrix (Table 4).

Table 4 Utility matrix of sub-game \( \varGamma_{6} \)
Full size table

Since \( U_{o} > U_{s} > U_{nn} > U_{sn} > U_{pn} > U_{us} \), it is easy to find that there only exists one Nash equilibrium: (Sending, Stopping3, Stopping3, Sending). Utilities of players are \( (U_{sn} ,U_{nn} ,U_{nn} ,U_{sn} ) \). In other words, a player will choose Sending if he has \( c_{ij} = 0 \), choose Stopping3 if \( c_{ij} = 1. \) This conclusion could be generalized to n-party version when \( q_{j} = 0 \) but not all the \( c_{kj} = 0. \)

Secondly, we analyze the game \( \varGamma_{4} \). The game among players \( P_{2} \), \( P_{3} \) and \( P_{4} \) can be denoted as a sub-game \( \varGamma_{7} \), which can also be described by utility matrix (Table 5).

From Table 5, we could find three pure strategy Nash equilibriums. However, since players do not know each other’s strategy, they only have to choose a mixed strategy. The mixed strategy Nash equilibrium will be sought later. Here, we suppose that \( P_{2} \), \( P_{3} \) and \( P_{4} \) choose the strategy Sending with probability \( p_{2}^{{\prime }} \), \( p_{3}^{{\prime }} \) and \( p_{4}^{{\prime }} \), respectively. Each player chooses suitable \( p_{i}^{{\prime }} \) to makes the others’ utilities completely equal when choosing different strategies. The following three equations can be deduced.

$$ \begin{aligned} & p_{3}^{{\prime }} p_{4}^{{\prime }} U_{s} + p_{3}^{{\prime }} \left( {1 - p_{4}^{{\prime }} } \right)U_{us} + \left( {1 - p_{3}^{{\prime }} } \right)p_{4}^{{\prime }} U_{us} + \left( {1 - p_{3}^{{\prime }} } \right)\left( {1 - p_{4}^{{\prime }} } \right)U_{sn} \\ & \quad = p_{3}^{{\prime }} p_{4}^{{\prime }} U_{o} + p_{3}^{{\prime }} \left( {1 - p_{4}^{{\prime }} } \right)U_{pn} + \left( {1 - p_{3}^{{\prime }} } \right)p_{4}^{{\prime }} U_{pn} + \left( {1 - p_{3}^{{\prime }} } \right)\left( {1 - p_{4}^{{\prime }} } \right)U_{pn} . \\ \end{aligned} $$
(8)
$$ \begin{aligned} & p_{2}^{{\prime }} p_{4}^{{\prime }} U_{s} + p_{2}^{{\prime }} \left( {1 - p_{4}^{{\prime }} } \right)U_{us} + \left( {1 - p_{2}^{{\prime }} } \right)p_{4}^{{\prime }} U_{us} + \left( {1 - p_{2}^{{\prime }} } \right)\left( {1 - p_{4}^{{\prime }} } \right)U_{sn} \\ & \quad = p_{2}^{{\prime }} p_{4}^{{\prime }} U_{o} + p_{2}^{{\prime }} \left( {1 - p_{4}^{{\prime }} } \right)U_{pn} + \left( {1 - p_{2}^{{\prime }} } \right)p_{4}^{{\prime }} U_{pn} + \left( {1 - p_{2}^{{\prime }} } \right)\left( {1 - p_{4}^{{\prime }} } \right)U_{pn} . \\ \end{aligned} $$
(9)
$$ \begin{aligned} & p_{2}^{\prime } p_{3}^{\prime } U_{s} + p_{2}^{\prime } \left( {1 - p_{3}^{\prime } } \right)U_{us} + \left( {1 - p_{2}^{\prime } } \right)p_{3}^{\prime } U_{us} + \left( {1 - p_{2}^{\prime } } \right)\left( {1 - p_{3}^{\prime } } \right)U_{sn} \\ & \quad = p_{2}^{\prime } p_{3}^{\prime } U_{o} + p_{2}^{\prime } \left( {1 - p_{3}^{\prime } } \right)U_{pn} + \left( {1 - p_{2}^{\prime } } \right)p_{3}^{\prime } U_{pn} + \left( {1 - p_{2}^{\prime } } \right)\left( {1 - p_{3}^{\prime } } \right)U_{pn} . \\ \end{aligned} $$
(10)
Table 5 Utility matrix of sub-game \( \varGamma_{7} \)
Full size table

In order to simplify the calculation, let \( a = U_{s} - U_{o} < 0 \), \( d = U_{sn} - U_{us} > 0 \), \( x = U_{sn} - U_{pn} > 0 \). After computation, we find that the solution of Eqs. (8)–(10) is

$$ p^{{\prime }} = \left\{ {\begin{array}{*{20}l} {\frac{{d - \sqrt {(d - x)^{2} - ax} }}{a + 2d - x},} \hfill & {{\text{if}}\,\,a + 2d - x \ne 0} \hfill \\ {1 + \frac{a}{2d},} \hfill & {{\text{if}}\,\,a + 2d - x = 0} \hfill \\ \end{array} } \right.. $$
(11)

Here \( 0 < p^{{\prime }} = p_{2}^{{\prime }} = p_{3}^{{\prime }} = p_{4}^{{\prime }} < 1 \). Utility expectation of players \( P_{2} \), \( P_{3} \) and \( P_{4} \) is \( U_{ex} = 2d(e - a + x)\frac{{d - \sqrt {(d - x)^{2} - ax} }}{{(a + 2d - x)^{2} }} - \frac{(2d + e)x}{a + 2d - x} + U_{sn} \) if \( {\kern 1pt} a + 2d - x \ne 0 \). \( U_{ex} = \) \( e - a + \frac{a(2d + e)}{d} + \frac{{a^{2} (2d + e)}}{{4d^{2} }} + U_{sn} \) if \( {\kern 1pt} a + 2d - x = 0 \). Here \( e = U_{s} - U_{sn} \).

For the sake of simplicity, we further suppose that utilities approximatively constitute an arithmetic progression, i.e., \( a = - 1 \), \( d = 2 \) and \( e = 1 \), then \( 0 < x < 2 \). Utility expectation of player \( P_{1} \) if he chooses to send is

$$ U_{1se} = \frac{{(24\sqrt {x^{2} - 3x + 4} + 24)x - 6x^{2} - 6x^{3} + 12\sqrt {x^{2} - 3x + 4} + 7\sqrt {(x^{2} - 3x + 4)^{3} } - 80}}{{(x - 3)^{3} }} + U_{sn} . $$
(12)

If and only if \( U_{1se} > U_{pn} \), \( P_{1} \) will send his random number. Fortunately, this inequality holds true for any \( 0 < x < 2 \). The image of \( U_{1se} - U_{pn} \) is drawn in Fig. 4 to show it.

Fig. 4
figure 4

The relationship between \( U_{{1{{se}}}} - U_{{pn}} \) and \( x \)

Full size image

From this figure, we can know that \( U_{1se} - U_{pn} \) is always bigger than 0, and positively related to \( x \). In a word, \( P_{1} \) will send even if he is punished.

Thirdly, \( \varGamma_{3} \) could be analyzed. Similarly, although there exist six pure strategy equilibriums, players will choose mixed strategies actually. We also suppose \( a = - 1 \), \( d = 2 \) and \( e = 1 \), then \( 0 < x < 2 \). The probability of sending is \( p_{i}^{{\prime \prime }} \) for player \( P_{i} \). Just similar as the first case, the following equations can also be deduced.

$$ \begin{aligned} & p_{2}^{{\prime \prime }} p_{3}^{{\prime \prime }} p_{4}^{{\prime \prime }} U_{s} + p_{2}^{{\prime \prime }} p_{3}^{{\prime \prime }} \left( {1 - p_{4}^{{\prime \prime }} } \right)U_{us} + p_{2}^{{\prime \prime }} \left( {1 - p_{3}^{{\prime \prime }} } \right)p_{4}^{{\prime \prime }} U_{us} + p_{2}^{{\prime \prime }} \left( {1 - p_{3}^{{\prime \prime }} } \right)\left( {1 - p_{4}^{{\prime \prime }} } \right)U_{sn} \\ & \quad + \,\left( {1 - p_{2}^{{\prime \prime }} } \right)p_{3}^{{\prime \prime }} p_{4}^{{\prime \prime }} U_{us} + \left( {1 - p_{2}^{{\prime \prime }} } \right)p_{3}^{{\prime \prime }} \left( {1 - p_{4}^{{\prime \prime }} } \right)U_{sn} + \left( {1 - p_{2}^{{\prime \prime }} } \right)\left( {1 - p_{3}^{{\prime \prime }} } \right)p_{4}^{{\prime \prime }} U_{sn} \\ & \quad + \,\left( {1 - p_{2}^{{\prime \prime }} } \right)\left( {1 - p_{3}^{{\prime \prime }} } \right)\left( {1 - p_{4}^{{\prime \prime }} } \right)U_{sn} = p_{2}^{{\prime \prime }} p_{3}^{{\prime \prime }} p_{4}^{{\prime \prime }} U_{o} + p_{2}^{{\prime \prime }} p_{3}^{{\prime \prime }} \left( {1 - p_{4}^{{\prime \prime }} } \right)U_{pn} + p_{2}^{{\prime \prime }} \left( {1 - p_{3}^{{\prime \prime }} } \right)p_{4}^{{\prime \prime }} U_{pn} \\ & \quad + \,p_{2}^{{\prime \prime }} \left( {1 - p_{3}^{{\prime \prime }} } \right)\left( {1 - p_{4}^{{\prime \prime }} } \right)U_{pn} + \left( {1 - p_{2}^{{\prime \prime }} } \right)p_{3}^{{\prime \prime }} p_{4}^{{\prime \prime }} U_{pn} + \left( {1 - p_{2}^{{\prime \prime }} } \right)p_{3}^{{\prime \prime }} \left( {1 - p_{4}^{{\prime \prime }} } \right)U_{pn} \\ & \quad + \,\left( {1 - p_{2}^{{\prime \prime }} } \right)\left( {1 - p_{3}^{{\prime \prime }} } \right)p_{4}^{{\prime \prime }} U_{pn} + \left( {1 - p_{2}^{{\prime \prime }} } \right)\left( {1 - p_{3}^{{\prime \prime }} } \right)\left( {1 - p_{4}^{{\prime \prime }} } \right)U_{pn} . \\ \end{aligned} $$
(13)
$$ \begin{aligned} & p_{1}^{\prime \prime } p_{3}^{\prime \prime } p_{4}^{\prime \prime } U_{s} + p_{1}^{\prime \prime } p_{3}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{us} + p_{1}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{us} + p_{1}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{sn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)p_{3}^{\prime \prime } p_{4}^{\prime \prime } U_{us} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{3}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{sn} + \left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{sn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{sn} = p_{1}^{\prime \prime } p_{3}^{\prime \prime } p_{4}^{\prime \prime } U_{o} + p_{1}^{\prime \prime } p_{3}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} + p_{1}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{pn} \\ & \quad + \,p_{1}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{3}^{\prime \prime } p_{4}^{\prime \prime } U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{3}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} . \\ \end{aligned} $$
(14)
$$ \begin{aligned} & p_{1}^{\prime \prime } p_{2}^{\prime \prime } p_{4}^{\prime \prime } U_{s} + p_{1}^{\prime \prime } p_{2}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{us} + p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{us} + p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{sn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } p_{4}^{\prime \prime } U_{us} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{sn} + \left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{sn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{sn} = p_{1}^{\prime \prime } p_{2}^{\prime \prime } p_{4}^{\prime \prime } U_{o} + p_{1}^{\prime \prime } p_{2}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} + p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{pn} \\ & \quad + \,p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } p_{4}^{\prime \prime } U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } \left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)p_{4}^{\prime \prime } U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{4}^{\prime \prime } } \right)U_{pn} . \\ \end{aligned} $$
(15)
$$ \begin{aligned} & p_{1}^{\prime \prime } p_{2}^{\prime \prime } p_{3}^{\prime \prime } U_{s} + p_{1}^{\prime \prime } p_{2}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)U_{us} + p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)p_{3}^{\prime \prime } U_{us} + p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)U_{sn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } p_{3}^{\prime \prime } U_{us} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)U_{sn} + \left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)p_{3}^{\prime \prime } U_{sn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)U_{sn} = p_{1}^{\prime \prime } p_{2}^{\prime \prime } p_{3}^{\prime \prime } U_{o} + p_{1}^{\prime \prime } p_{2}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)U_{pn} + p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)p_{3}^{\prime \prime } U_{pn} \\ & \quad + \,p_{1}^{\prime \prime } \left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } p_{3}^{\prime \prime } U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)p_{2}^{\prime \prime } \left( {1 - p_{3}^{\prime \prime } } \right)U_{pn} \\ & \quad + \,\left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)p_{3}^{\prime \prime } U_{pn} + \left( {1 - p_{1}^{\prime \prime } } \right)\left( {1 - p_{2}^{\prime \prime } } \right)\left( {1 - p_{3}^{\prime \prime } } \right)U_{pn} . \\ \end{aligned} $$
(16)

The solution is:

$$ p^{{\prime \prime }} = \frac{{2 + 2\left( {\cos \frac{\theta }{3} - \sqrt 3 \sin \frac{\theta }{3}} \right)}}{5 - x}. $$
(17)

Here \( \theta = \arccos \left( {\frac{{x(x - 5)^{2} }}{16} - 1} \right) \), \( 0 < p^{{\prime \prime }} = p_{1}^{{\prime \prime }} = p_{2}^{{\prime \prime }} = p_{3}^{{\prime \prime }} = p_{4}^{{\prime \prime }} < 1 \). The utility expectation of each player is \( U_{ex2} = (p^{{\prime \prime }} )^{2} (7p^{{\prime \prime }} - 6) + U_{sn} . \)

Fourthly, \( \varGamma_{2} \) could be analyzed. This game is very similar to \( \varGamma_{6} \). Likewise, there only exists one Nash equilibrium: (Stopping3, Sending, Stopping3, Sending). Utilities of players are \( (U_{nn} ,U_{sn} ,U_{nn} ,U_{sn} ). \)

Fifthly, consider the game \( \varGamma_{1} \). We analyze this game simply. If players do not go to the classical stage, they will get nothing. Otherwise, they may get the result of computation. That is to say, they will all cooperate to go to classical stage.

In conclusion, player \( P_{i} \) will choose Stopping3 without doubt if \( q_{j} = 1 \) or \( c_{ij} = 1 \), he will consider whether sending or not only if \( q_{j} = c_{ij} = 0 \). There are two cases when \( q_{j} = c_{ij} = 0 \): (1) Two of three other players hold \( c_{kj} = 1 \) with probability \( 3\alpha (1 - \alpha )^{2} \). \( P_{i} \) will choose Sending without doubt. (2) All the other \( c_{kj} \) are equal to 0 with probability \( \alpha^{3} \). In this case, \( P_{i} \) will choose Sending with probability \( p^{{\prime \prime }} \). Hence, the conditional probability of case (1) is \( 3(1 - \alpha )^{2} /(4\alpha^{2} - 6\alpha + 3) \), case (2) is \( \alpha^{2} /(4\alpha^{2} - 6\alpha + 3) \). On the whole, if \( q_{j} = c_{ij} = 0 \), the probability of \( P_{i} \) sending is:

$$ p_{wh} = \frac{{\alpha^{2} }}{{4\alpha^{2} - 6\alpha + 3}}p^{{\prime \prime }} + \frac{{3(1 - \alpha )^{2} }}{{4\alpha^{2} - 6\alpha + 3}}. $$
(18)
  1. (2)

    n-party game

Similarly, in a n-party protocol, if all the \( c_{kj} = 0 \) (\( 1 \le k \le n \)), mixed strategy Nash equilibrium could also be deduced. For the player \( P_{i} \), the probability of sending is \( p_{i} \). The other players will choose their probabilities to make:

$$ p_{Ai} U_{s} + p_{Bi} U_{us} + p_{Ci} U_{sn} = p_{Ai} U_{o} + p_{Bi} U_{pn} + p_{Ci} U_{pn} . $$
(19)

Here \( p_{Ai} = \prod\nolimits_{j \ne i}^{n} {p_{j} } \), \( p_{Bi} = \sum\nolimits_{\begin{subarray}{l} k = 1 \\ k \ne i \end{subarray} }^{n} {\prod\nolimits_{\begin{subarray}{l} j \ne i \\ j \ne k \end{subarray} }^{n} {p_{j} (1 - p_{k} )} } \), and \( p_{Ci} = 1 - p_{Ai} - p_{Bi} \). If we put all \( P_{i} \)’s equations together and simplify it, the following equation can be obtained.

$$ \begin{aligned} & p^{n - 1} a + (n - 1)p^{n - 2} (1 - p)(x - d) + [1 + (n - 2)p^{n - 1} - (n - 1)p^{n - 2} ]x = 0 \\ & \quad \Rightarrow p^{n - 1} [a + (n - 1)d - x] - (n - 1)p^{n - 2} d + x = 0. \\ \end{aligned} $$
(20)

Where \( 0 < p = p_{1} = p_{2} = \cdots = p_{n} < 1 \). Let \( g(p) = p^{n - 1} [a + (n - 1)d - x] - (n - 1)p^{n - 2} d + x \), it is easy to get \( g(0) = x > 0 \) and \( g(1) = a < 0 \). Thus, \( g(p) = 0 \) has a solution for \( 0 < p < 1 \). In other words, each player can find a suitable \( p \) to make the other players’ utilities the same when they choose different strategies. The mixed strategy Nash equilibrium is achieved.

In addition, as we mentioned in the four-party case, if \( q_{j} = 0 \) but not all the \( c_{kj} = 0 \) in an n-party protocol, a player will choose Sending if he has \( c_{ij} = 0 \), choose Stopping3 if \( c_{ij} = 1 \).

Furthermore, we could also compute the probability of each player sending his random number if \( q_{j} = c_{ij} = 0 \). Just as we discussed before, there also are two cases: (1) even but not zero numbers of \( c_{kj} \) are equal to 1 with probability \( \beta_{1n} = \sum\nolimits_{k = 1}^{{\left\lceil {n/2} \right\rceil - 1}} {C_{n - 1}^{2k} \alpha^{n - 2k - 1} (1 - \alpha )^{2k} } \); (2) all the \( c_{kj} \) are equal to 0 with probability \( \beta_{2n} = \alpha^{n - 1} \). In general, if \( q_{j} = c_{ij} = 0 \), the probability of \( P_{i} \) sending is:

$$ p_{nwh} = \frac{{\beta_{2n} }}{{\beta_{1n} + \beta_{2n} }}p + \frac{{\beta_{1n} }}{{\beta_{1n} + \beta_{2n} }}. $$
(21)

Here p is the solution of Eq. (20).

In summary, there exist some suitable coefficients x and \( \alpha \) to make the protocol achieve mixed strategy Nash equilibrium. □

4.4 Fairness

Definition 5

(Fairness [17]) A rational multi-party protocol is fair if the following holds:

$$ \begin{aligned} & \Pr [o_{i} (\varGamma ,(a_{i} ,a_{ - i} )) = {\it{Successful}}\,\,{\kern 1pt} {\it{computation}}] \\ & \quad \quad + \,\Pr [o_{i} (\varGamma ,(a_{i} ,a_{ - i} )) = {\it{Only}}\,\,{\it{him}}\,\,{\it{computation}}] \\ & \quad \le \Pr [o_{ - i} (\varGamma ,(a_{i} ,a_{ - i} )) = {\it{Successful}}\,\,{\it{computation}}] \\ & \quad \quad + \,\Pr [o_{ - i} (\varGamma ,(a_{i} ,a_{ - i} )) = {\it{Only}}\,\,{\kern 1pt} {\it{him}}\,\,{\it{computation}}] \\ \end{aligned} $$
(22)

for each player \( P_{i} \)’s arbitrary strategy \( a_{i} . \)

Theorem 3

There exist some values of coefficients x and \( \alpha \) that make the protocol achieve fairness.

Proof

Just like Ref. [17], for each player, if the probability of sending is very close to 1, he will not have incentive to deviate the protocol. Fairness of our protocol will be ensured further. As we analyzed in Sect. 4.3, in classical stage, player \( P_{i} \) will choose a mixed strategy if \( q_{j} = c_{ij} = 0 \). Next, we will discuss how to select coefficients to make the probability close to 1, i.e., \( p_{nwh} = 99.95\% . \)

We also suppose that \( a = - 1 \), \( d = 2 \) and \( e = 1 \). Since \( 0 < x < 2 \) and we hope that all the players send their \( R_{ij} \), we give \( x = 1.9 + \varepsilon \) (\( \varepsilon \) is a small number), then we can compute p and \( \alpha \) to satisfy \( p_{nwh} = 99.95\% \). When one of p and \( \alpha \) is fixed, the other is determined. A possible pair of values of p and \( \alpha \) is given in Table 6 for n = 5, 10, 20, 50, 100, 200, 500, 1000. For the other value of n, it is also easy to find suitable x and \( \alpha \) to make \( p_{nwh} \) close to 1. In other words, there exist some coefficients to ensure the fairness of protocol. □

Table 6 Values of coefficients to make \( p_{nwh} \)\( = 99.95\% \)
Full size table

4.5 Security

Firstly, in quantum stage, any secure quantum multi-party homomorphic computation protocol could be utilized as a black box, for example, Refs. [22, 23]. Since that, as long as the original protocol is secure, this stage is also secure.

Secondly, let us take our rational quantum summation protocol as an example. All the \( R_{ij} \) which are sent among different players are random in classical stage. Player \( P_{1} \) cannot deduce any useful information about other players’ inputs \( M_{k} \) from \( R_{kj} . \)

Thirdly, since \( R_{ij} \) are random, \( MR_{ij} \) and \( S_{1j} \) are also random. It means that even if \( MR_{ij} \) and \( S_{1j} \) are revealed, the protocol is secure as long as the eavesdropping is found before all the players publish their \( R_{ij} \). From this point of view, our protocol is something like quantum key distribution protocol [24, 25] or quantum key agreement protocol [26].

In other words, our protocol is more secure than general MC protocols. The security of our protocol holds easily.

4.6 Probability and efficiency

Let us look over all the outcomes of our protocol. The outcome Successful computation means that the protocol is performed successfully, which is desired for us. The probability of this outcome is \( p_{nwh}^{n} \) if all the \( c_{ij} = 0 \). What we last expect is the outcome Only him/Someone else computation, which happens if and only if only one player chooses Stopping3 in classical stage. The probability of this outcome is \( np_{nwh}^{n - 1} (1 - p_{nwh} ) \) if all the \( c_{kj} = 0. \)

Just as we discussed before, \( p_{nwh} \) is related to coefficients \( \alpha \), p and n. At the same time, p is related to n and x. Here, we also give \( x = 1.9 + \varepsilon \), then compute p when n = 5, 10, 20, 50, 100, 200, 500, 1000. After that, we compute \( p_{nwh} \) which makes \( p_{nwh}^{n} \) two, ten, hundred times as big as \( np_{nwh}^{n - 1} (1 - p_{nwh} ) \), respectively. Next, \( \alpha \) can be determined. We list all the coefficients in following tables.

From Tables 7, 8, 9, we can know that it is easy to make the probability of outcome Successful computation much bigger than Only him/Someone else computation. Therefore, the latter outcome would almost never happen. At the same time, the probability of outcome Successful computation could be very close to 1. This also shows that our protocol is efficient.

Table 7 Values of coefficients to make \( p_{nwh}^{n} /np_{nwh}^{n - 1} (1 - p_{nwh} ) = 2 \)
Full size table
Table 8 Values of coefficients to make \( p_{nwh}^{n} /np_{nwh}^{n - 1} (1 - p_{nwh} ) = 10 \)
Full size table
Table 9 Values of coefficients to make \( p_{nwh}^{n} /np_{nwh}^{n - 1} (1 - p_{nwh} ) = 100 \)
Full size table

In addition, we can also find some relationships among coefficients. Firstly, if x is approximatively fixed, p increases with increasing n. Secondly, if x, p and n are all fixed, \( \alpha \) decreases with increasing \( p_{nwh} \). Thirdly, if x, p and \( p_{nwh}^{n} /np_{nwh}^{n - 1} (1 - p_{nwh} ) \) are all fixed, \( \alpha \) decreases with increasing n. These relationships could help us to choose coefficients for protocol under different circumstances.

4.7 Comparison

In this subsection, we compare our protocol with two valuable rational protocols, Halpern et al.’s classical protocol [13] and Maitra et al.’s quantum protocol [17], from the following aspects.

Firstly, we consider the application of the protocol. Halpern et al.’s protocol [13] is used to resolve secret sharing. Maitra et al.’s protocol [17] is utilized to settle sharing known quantum state. However, our protocol can be employed to solve various multi-party problems. This characteristic is a kind of universality of protocol [27]. As we all know, shares in players’ hands are random in classical secret sharing, QSS and QSTS protocols. Therefore, they could be transmitted among players. However, in MC protocols, inputs of players are deterministic and private, so they could not be conveyed among players directly. In our protocol, we introduce random number to solve this problem. Only random numbers are transmitted, so true input of one player cannot be obtained by any others. Security of players’ inputs is ensured in our protocol further.

Secondly, think about the assumption of the protocol. When Halpern et al. [13] and Maitra et al. [17] analyze \( P_{1} \)’s strategy, they suppose that \( P_{2} \) and \( P_{3} \) will obey the protocol. In this situation, cooperation is better than deviation for the third party. This assumption is not practical because the others’ strategies cannot be known beforehand for any player. In this paper, we analyze each case of players’ strategies without presupposition.

Last but not least, consider the number of participants of the protocol. In Ref. [17], a (k, n) threshold protocol was investigated via quantum error correcting code. As for Ref. [13], Halpern et al. also generalized their three-party protocol to n-party version. Nevertheless, all the players are divided into three sets. In each set, players elect a leader and send shares to their leader. In the end, leaders perform the rational three-party protocol. This generalization is trivial. Compared with Ref. [13], in our n-party protocol, each player performs the protocol equally. Ours is more like a rational n-party protocol than Halpern et al.’s [13].

In summary, our protocol is better than Halpern et al.’s [13] and Maitra et al.’s [17] in these aspects.

5 Conclusion

In this paper, rational quantum MC protocol was investigated. Processes of our protocol are learned and improved from Ref. [13]. This is the first rational quantum multifunctional computation protocol. For any problem, if the key of a quantum solution is a computation which is homomorphic, this problem could be resolved by our protocol. Besides that, our rational protocol was analyzed in detail. It is secure, multifunctional and efficient. No extra assumption about players’ strategies holds in our protocol.