1 Introduction

The discrimination of quantum states is a fundamental task in quantum information processing. It is well known that if and only if the quantum states of the given set are mutually orthogonal, the set can be perfectly distinguished by global measurement [1]. However, in practical quantum states are usually distributed in distant composite system, so only local operations and classical communication are allowed between participants. In this case, a state is randomly chosen from a known quantum states set in a composite systems, if we can identify the state under LOCC, we call the set locally distinguishable; otherwise, it is locally indistinguishable. It is difficult to give a complete characterization of whether the general set of orthogonal quantum states is locally distinguishable or not, therefore, most studies restrict themselves to two extreme cases: sets of product states and sets of maximally entangled states. In this paper, we only focus on sets of maximally entangled states.

Bell states are the most famous maximally entangled states, which are widely used because of their convenience in preparation, transmission and storage, and there have been many studies on their local discrimination [2,3,4,5]. In fact, any two Bell states are locally distinguishable, but any three or four are not [6]. In \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\), any \(l>d\) maximally entangled states are locally indistinguishable [7,8,9], that is, there are at most d locally distinguishable generalized Bell states in the d-dimensional system. Nathanson [8] proved that any three maximally entangled states in \({\mathbb {C}}^3\otimes {\mathbb {C}}^3\) are locally distinguishable. Wang et al. [10] showed that any three generalized Bell states are locally distinguishable in d-dimensional system \(d\ge 4\). Tian et al. [11] proved that any four generalized Bell states in \({\mathbb {C}}^4\otimes {\mathbb {C}}^4\) are either one-way locally distinguishable or locally indistinguishable. T. Singal et al. [12] studied all generalized Bell states in \({\mathbb {C}}^4\otimes {\mathbb {C}}^4\) and gave a necessary and sufficient condition for whether the four generalized Bell states (GBSs) are locally distinguishable or not. Fan [13] showed that any l generalized Bell states in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\) are locally distinguishable, if \(l(l-1)\le 2d\) and d is prime. Furthermore, Tian et al. [14] proved any generalized Bell states in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\) are one-way locally distinguishable if \(l(l-1)-(m+1)(m-2)\le 2d\) and d is a prime number, where m is the number of commuting unitary operators. In 2019, Wang et al. [15] studied the local discrimination of arbitrary dimensional generalized Bell states and found a sufficient condition for a set of GBSs to be one-way LOCC distinguishable. In 2021, Hashimoto et al. [2] studied GBSs in prime dimensional systems, a necessary and sufficient condition was presented.

In 2015, Rahaman [16] proposed to use only local operations and classical communication to design a quantum secret sharing (QSS) scheme, which could deal with the high cost problem caused by joint measurement. They also showed the restricted (2, n)-threshold scheme with GHZ states and (k, n)-threshold scheme with Dicke states. At present, there are many new research results about the QSS-LOCC scheme [17,18,19,20,21]. In [17], Bai used one-way distinguishable generalized Bell states to design the LOCC-QSS scheme, which has the following advantages: (1) one-way LOCC can reduce information leakage compared with two-way LOCC; (2) compared with the n-particle entangled states, the generalized Bell state is easier to generate, transmit and storage. However, this scheme is limited to the distinguishable generalized Bell states on the four-dimensional systems, so there are at most four generalized Bell states to encode classical information. In 2022, Li et al. [3] studied the distinguishability of generalized Bell states in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\), and proposed maximal commutative sets(MCS). On this basis, a sufficient condition for d-dimensional GBSs to be one-way LOCC distinguishable or indistinguishable was given, which means that we can find more distinguishable states to encode classical information and design more efficient LOCC-QSS schemes. In this paper, based on the Ref. [3], we present a method to calculate sets of GBSs that can be locally distinguishable by one-way LOCC in prime dimension d. Furthermore, we propose a (t, n)-threshold LOCC-QSS scheme uses one-way LOCC to distinguish between d(d is prime) orthogonal Bell states in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\).

The rest of this paper is organized as follows. In Sect. 2, we recall some relevant notations and results. In Sect. 3, we present the structure characterization of prime dimensional MCS, and analyze the one-way LOCC distinguishable GBSs set with cardinality d in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\). In Sect. 4, we propose a quantum secret sharing scheme and give an example. In Sect. 5, we prove its security. Finally, the conclusion is given in Sect. 6.

2 Preliminaries

2.1 One-way LOCC

There are two LOCC types: full two-way LOCC and one-way LOCC. Full two-way LOCC allows Alice and Bob to have classical communication as much as they like and to adapt their measurements until the quantum states are distinguished. In this paper, we consider the one-way LOCC, in which Bob may receive classical information from Alice and adapt his measurement, but Bob cannot send any information to Alice. We call a set of a set of orthogonal quantum states one-way local distinguishable if it can be completely distinguished by one-way LOCC, otherwise, it is said to be one-way LOCC indistinguishable.

Example 1

Alice and Bob share an entangled state in the known set \(S=\{|\phi ^{+}\rangle ,|\psi ^{+}\rangle \}\), where

$$\begin{aligned}&|\phi ^+\rangle =\frac{1}{\sqrt{2}}(|0\rangle _{\textrm{A}}|0\rangle _{\textrm{B}}+|1\rangle _{\textrm{A}}|1\rangle _{\textrm{B}}),\end{aligned}$$
(1)
$$\begin{aligned}&|\psi ^+\rangle =\frac{1}{\sqrt{2}}(|0\rangle _{\textrm{A}}|1\rangle _{\textrm{B}}+|1\rangle _{\textrm{A}}|0\rangle _{\textrm{B}}). \end{aligned}$$
(2)

The two particles A and B are separated, and particle A is operated by Alice and particle B is operated by Bob. First, Alice measures particle A with the orthogonal basis \(|0\rangle ,|1\rangle \), and sends the measurement outcome to Bob via one-way classical communication. Then, Bob uses basis \(|0\rangle ,|1\rangle \) to measure particle B. We assumed that both Alice and Bobs’ results are \(|0\rangle \), at this point, Bob learns that the quantum state collapses to \(|0\rangle _\text {A}{ \otimes }|0\rangle _\text {B }\), so it is inferred that the shared entangled state is \(|\phi ^{+}\rangle \).

Fig. 1
figure 1

Two kinds of one-way LOCC for n participants

Full size image

Figure 1 shows only two common one-way LOCC diagrams, where the blue arrow indicates the direction of classical communication and the red dotted arrow indicates the direction of quantum communication. (a) indicates that the classic information is sent by Alice to each participant, and (b) indicates that there is a one-way classical communication between the participant and Alice according to the ring structure.

2.2 Local discrimination of generalized Bell states

Supposed that d is an integer, \(\{|0\rangle ,|1\rangle ,\ldots ,|d-1\rangle \}\) is a group of computational basis in d-dimensional Hilbert space. Under this basis, the standard maximum entangled state of this system can be expressed as:\(|\psi _{00}\rangle =\frac{1}{\sqrt{d}}\sum _{i=0}^{d-1}|ii\rangle \). There are \(d^2\) generalized Bell states that can be expressed as:

$$\begin{aligned} \{|\psi _{mn}\rangle =(I\otimes X^mZ^n)|\psi _{00}\rangle =\frac{1}{\sqrt{d}}\sum _{j=0}^{d-1}\omega ^{jn}|j\rangle _A|j\bigoplus _dm\rangle _B|m,n\in {\mathbb {Z}}_d\}. \end{aligned}$$
(3)

where \(\omega =e^{\frac{2\pi i}{d}},X^m=\sum _{i=0}^{d-1}|i+1~\textrm{mod}~d\rangle \langle i|\text {,}Z^n=\sum _{i=0}^{d-1}\omega ^i|i\rangle \langle i|\). \(X^mZ^n\) is called the generalized Pauli matrix [22](GPMs; they are also known as Weyl operators [23, 24]). Since there is a one-to-one correspondence between the generalized Bell states and their defining unitary matrices, for convenience, we will regard the following three sets as equivalent:

$$\begin{aligned} S{:}=\{|\psi _{m_i,n_i}\rangle \}_{i=1}^l=\{X^{m_i}Z^{n_i}\}_{i=1}^l=\{(m_i,n_i)\}_{i=1}^l. \end{aligned}$$
(4)

Definition 1

Set \(U_{i}=X^{m_{i}}Z^{n_{i}},i=1,2,\ldots ,l\), we define the set difference \(\Delta S\) of \(S:=\{X^{m_{i}}Z^{n_{i}}\}_{i=1}^{l}=\{U_{i}\}_{i=1}^{l}\) as

$$\begin{aligned} \Delta S=\{U_i^\dagger U_j|1\le i<j\le l\}=\{(X^{m_i}Z^{n_i})^\dagger X^{m_j}Z^{n_j}\mid 1\le i<j\le l\}. \end{aligned}$$
(5)

Note that

$$\begin{aligned} (X^{m_i}Z^{n_i})^\dagger X^{m_j}Z^{n_j}=\omega ^{-(m_j-m_i)n_i}X^{m_j-m_i}Z^{n_j-n_i}. \end{aligned}$$
(6)

So that \(\Delta S\) can be defined as \(\{(m_{j}-m_{i},n_{j}-n_{i})|1\le i<j\le l\}.\)

In 2022, Li et al. [3] proposed the concept of maximal commutative set (MCS), which is defined as follows:

Definition 2

A subset \(\{X^{m_i}Z^{n_i}\}_{i=1}^n\) of GBSs is called a maximally commutative set(MCS) if the elements in this subset are mutually commutative, and there is no generalized Bell state outside the set that can be commutated with all the elements of the set.

It indicates that for any \(X^{s_{i}}Z^{t_{i}},X^{s_{j}}Z^{t_{j}}\in C\), we have \(X^{s_{i}}Z^{t_{i}}X^{s_{j}}Z^{t_{j}}=X^{s_{j}}Z^{t_{j}}X^{s_{i}}Z^{t_{i}}\), and for every generalized Bell state \(X^{s_{k}}Z^{t_{k}}\) that is not included in C, there is at least one \(X^{s_i}Z^{t_i}\in C,\mathrm {s.t.}~X^{s_k}Z^{t_k}X^{s_i}Z^{t_i}\ne X^{s_i}Z^{t_i}X^{s_k}Z^{t_k}\). For any two generalized Pauli matrices \(X^{s_i}Z^{t_i},X^{s_j}Z^{t_j}\in {\mathbb {Z}}_d\times {\mathbb {Z}}_d\), we have

$$\begin{aligned} X^{s_i}Z^{t_i}X^{s_j}Z^{t_j}=\omega ^{s_jt_i-t_js_i}X^{s_j}Z^{t_j}X^{s_i}Z^{t_i}. \end{aligned}$$
(7)

In fact, from mathematical induction, we can get \(X^s=\sum _{i=0}^{d-1}|i+smodd\rangle \langle i|,Z^t=\sum _{i=0}^{d-1}\omega ^{ti}|i\rangle \langle i|\), then

$$\begin{aligned} X^{s_i}Z^{t_i}X^{s_j}Z^{t_j}&=\left( \sum _{k=0}^{d-1}|k+\textrm{s}_i\mathrm {~mod~}d)\langle k|\sum _{l=0}^{d-1}\omega ^{t_il}|l\rangle \langle l|\right) \\ &\qquad \left( \sum _{k=0}^{d-1}|k+\textrm{s}_j\mathrm {~mod~}d\rangle \langle k|\sum _{l=0}^{d-1}\omega ^{t_jl}|l\rangle \langle l|\right) \\&=\sum _{k=0}^{d-1}\omega ^{t_ik}|k+s_i\bmod d\rangle \langle k|\sum _{l=0}^{d-1}\omega ^{t_jl}|l+s_j\bmod d\rangle \langle l|\\&=\sum _{l=0}^{d-1}\omega ^{t_i(l+s_j)+t_jl}|l+s_i+s_j\bmod d\rangle \langle l|\\&=\omega ^{n_im_j}\sum _{l=0}^{d-1}\omega ^{t_il+t_jl}|l+s_i+s_j\bmod d\rangle \langle l|, \end{aligned}$$

in the same way, \(X^{s_j}Z^{t_j}X^{s_i}Z^{t_i}=\omega ^{t_js_i}\sum _{l=0}^{d-1}\omega ^{t_il+t_jl}|l+s_i+s_jmodd\rangle \langle l|\), which means \(X^{s_i}Z^{t_i}X^{s_j}Z^{t_j}=\omega ^{s_jt_i-t_js_i}X^{s_j}Z^{t_j}X^{s_i}Z^{t_i}.\)

From Eq. (7), the MCS can also be written in coordinate form: \(\{(s_{i},t_{i})\}_{i=1}^{n}\subseteq {\mathbb {Z}}_{d}\times {\mathbb {Z}}_{d},\) such that \(s_it_j=t_is_j\) for each \(i,j\in {\mathbb {Z}}_d\), but there is no other \((s_k,t_k)\subseteq {\mathbb {Z}}_d\times {\mathbb {Z}}_d\setminus \{(s_i,t_i)\}_{i=1}^n,\) such that \(s_it_k=t_is_k\) for every i. Under the definition of MCS, they gave the following result.

Lemma 1

(see Ref [3]) Let S be a GBSs and C be a MCS of GBSs in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\). If \(\Delta S\cap C=\emptyset \) or \(\Delta S\subseteq C\), then the set is one-way locally distinguishable.

Moreover, [3] proved the structural characterization of all MCSs of GBSs in d-dimensional system.

Definition 3

(see Ref [3]) Let \(d\ge 3\) be an integer, for each \((i,j)\in {\mathbb {Z}}_{d}\times {\mathbb {Z}}_{d}\), where \(i\ne 0\), define the following set:

$$\begin{aligned} C_{i,j}:=\{(x,y)\in {\mathbb {Z}}_d\times {\mathbb {Z}}_d|\begin{vmatrix}i&j\\x&y\end{vmatrix}\equiv 0\mathrm {~mod~}d,x\in i{\mathbb {Z}}_d\}. \end{aligned}$$
(8)

For \(i=0\), set \(C_{0,0}:=\{(0,y)|y\in {\mathbb {Z}}_d\}\). Reference [3] proved the following results.

Lemma 2

(see Ref [3]) Let \(d\ge 3\) be an integer. \(C_{i,j}\) and \(C_{0,0}\) is defined above, then

  1. (1)

    \(C_{i,j}\) is a MCS of GBSs with d elements in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\).

  2. (2)

    Every MCS of GBSs in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\) must be one of \(C_{i,j}(i\ne 0)\) or \(C_{0,0}\).

  3. (3)

    There are totally \(\sigma (d)\) classes MCSs in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\) which can be expressed as follows:

    $$\begin{aligned} S_{MC,d}:=\{C_{i,j}|d=ik,0\le j\le k-1\}\cup \{C_{0,0}\}. \end{aligned}$$
    (9)

where \(\sigma (d)\) represents the sum of all positive integer factors of d.

Example 2

In \({\mathbb {C}}^4\otimes {\mathbb {C}}^4\), there are \(\sigma (4)=1+2+4=7\) classes MCSs of GBSs:

$$\begin{aligned}&C_{0,0}=\{(0,0),(0,1),(0,2),(0,3)\},\\&C_{1,0}=\{(0,0),(1,0),(2,0),(3,0)\},\\&C_{1,1} =\{(0,0),(1,1),(2,2),(3,3)\}, \\&C_{1,2} =\{(0,0),(1,2),(2,0),(3,2)\}, \\&C_{1,3} =\{(0,0),(1,3),(2,2),(3,1)\}, \\&C_{2,2} =\{(0,0),(0,2),(2,0),(2,2)\}, \\&C_{2,3} =\{(0,0),(0,2),(2,1),(2,3)\}. \end{aligned}$$

3 d-dimensional locally distinguishable generalized Bell states

Since most cryptographic protocols are designed on odd prime fields, in this section we let \(d\ge 3\) be a prime, next we consider the locally distinguishable state in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\). From Lemma 2, we find that when the dimension of a quantum system is a prime, the MCS has a certain rule in structure, which can be expressed as follows:

Theorem 1

In \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\)(\(d\ge 3\) is a prime), define the following sets:

$$\begin{aligned} C_{1,j}:=\{(x,jx\bmod d)|x=0,1,\ldots ,d-1\},j\in {\mathbb {Z}}_d. \end{aligned}$$
(10)

then there are \(d+1\) classes of maximally commutative sets of GBSs in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\), which can be expressed as:

$$\begin{aligned} S_{MC,p}:=\{C_{1,j}|j=0,1,\ldots ,d-1\}\cup \{C_{0,0}\}. \end{aligned}$$
(11)

Proof

First, from \(\begin{vmatrix}1&j\\x&jx\end{vmatrix}\equiv 0\mod d,x\in {\mathbb {Z}}_d\), we can get \(C_{1,j}\subseteq S_{MC,d}\), so \(C_{1,j}\) is a MCS of GBSs with cardinality d.

Second, when d is a prime, by the definition of \(C_{1,j}\), we can get \(d=ik=1\cdot d,0\le j\le k-1,\) as \(i\in {\mathbb {Z}}_d,\) then \(i=1,0\le j\le d-1\), by solving the equation \(\begin{vmatrix}1&j\\x&y\end{vmatrix}\equiv 0\bmod d\), we have \(\begin{aligned}&y\equiv jx~\textrm{mod}~d,x\in {\mathbb {Z}}_d\end{aligned}\). By lemma 2, every MCS of GBSs in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\) must be one of \(C_{i,j}(i\ne 0)\) or \(C_{0,0}\).

Finally, it is obvious that \(C_{0,0}\ne C_{1,j},\forall j\in {\mathbb {Z}}_d\), and for \(j_{1}\ne j_{2},C_{1,,j_{1}}\ne C_{1,j_{2}}\), that is, the \(d+1\) elements in \(S_{MC,p}\) are different from each other, \(\left| S_{MC,p}\right| =d+1.\) Therefore, \(S_{MC,p}\) shows all MCSs of GBSs in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\)(\(d\ge 3\) is a prime). \(\square \)

Example 3

In \({\mathbb {C}}^5\otimes {\mathbb {C}}^5\), we set \(d=5,7\), and give the MCSs of GBSs, respectively:

\(d=5\), there are six classes MCSs:

$$\begin{aligned} C_{0,0}=\{(0,0),(0,1),(0,2),(0,3),(0,4)\}\quad C_{1,0}=\{(0,0),(1,0),(2,0),(3,0),(4,0)\}\\ C_{1,1}=\{(0,0),(1,1),(2,2),(3,3),(4,4)\}\quad C_{1,2}=\{(0,0),(1,2),(2,4),(3,1),(4,3)\}\\ C_{1,3}=\{(0,0),(1,3),(2,1),(3,4),(4,2)\}\quad C_{1,4}=\{(0,0),(1,4),(2,3),(3,2),(4,1)\} \end{aligned}$$

\(d=7\), there are eight classes MCSs:

$$\begin{aligned}&C_{0,0}=\{(0,0),(0,1),(0,2),(0,3),(0,4),(0,5),(0,6)\}\\&C_{1,0}=\{(0,0),(1,0),(2,0),(3,0),(4,0),(5,0),(6,0)\}\\&C_{1,1}=\{(0,0),(1,1),(2,2),(3,3),(4,4),(5,5),(6,6)\}\\&C_{1,2}=\{(0,0),(1,2),(2,4),(3,6),(4,1),(5,3),(6,5)\}\\&C_{1,3}=\{(0,0),(1,3),(2,6),(3,2),(4,5),(5,1),(6,4)\}\\&C_{1,4}=\{(0,0),(1,4),(2,1),(3,5),(4,2),(5,6),(6,3)\}\\&C_{1,5}=\{(0,0),(1,5),(2,3),(3,1),(4,6),(5,4),(6,2)\}\\&C_{1,6}=\{(0,0),(1,6),(2,5),(3,4),(4,3),(5,2),(6,1)\} \end{aligned}$$

We can derive \(\Delta S\) from the calculated maximal commutative set C, which satisfies the condition of Lemma 1, and then find the corresponding S from the definition of \(\Delta S\); in this case, the set S found must be one-way locally distinguishable.

Theorem 2

In \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\)(\(d\ge 3\) is a prime), the GBSs S with d elements is one-way local distinguishable, if S is one of the following sets:

$$\begin{aligned}&\text {(1)}S =\{(i,0),(i,1),\ldots ,(i,d-1)|i=0,1,\ldots ,d-1\}; \\&\text {(2)}S =\{(i,j),(i+1,j+k),\ldots ,(i+d-1,j+(d-1)k)|i,j=0,1,\ldots ,d-1\}; \\&\text {(3)}S =\{(0,a_0),(1,a_1),\ldots ,(d-1,a_{d-1})|a_i\in {\mathbb {Z}}_d\mathrm {~,~}i=1,2,\ldots ,d\}; \\&\text {(4)}S =\{(m_1,n_1),(m_2,n_2),\ldots ,(m_d,n_d)|n_j-n_i\ne k(m_j-m_i),1\le i<j\le d\} \end{aligned}$$

Proof

When d is a prime, the \(\Delta S\) of S in \((1)\sim (4)\) can be calculated from the definition of \(\Delta S\). It is not difficult to find that these four kinds of \(\Delta S\) exactly satisfy the following conditions:

$$\begin{aligned} \text {(i)}\Delta S\subseteq C_{0,0},\text {(ii)}\Delta S\!\subseteq \! C_{1,k},k\in {\mathbb {Z}}_d,\text {(iii)}\Delta S\cap C_{0,0}\!=\!\emptyset ,\text {(iv)}\Delta S\cap C_{1,k}\!=\!\emptyset ,k\in {\mathbb {Z}}_d. \end{aligned}$$

It can be known from Lemma 1 that S can be locally distinguishable by one-way LOCC. \(\square \)

Furthermore, we can prove that the four kinds of GBS sets S given in Theorem 2 are all one-way locally distinguishable GBSs which can be judged by Lemma 1 in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d(d\ge 3\) is a prime). In fact, if \(\Delta S\subseteq C_{0,0}\), then \(\forall (m_j-m_i,n_j-n_i)\in \Delta S,m_j-m_i=0,\) that is \(\forall (m_j,n_j),(m_i,n_i)\in S,~m_j=m_i,0\le i<j\le d-1,m_1=m_2=\cdots m_d\), and there are d states in S,

$$\begin{aligned} S=\{(i,0),(i,1),(i,2),\ldots ,(i,d-1)|i=0,1,\ldots ,d-1\}. \end{aligned}$$

If \(\Delta S\cap C_{0,0}=\emptyset \), then \(\forall (m_j-m_i,n_j-n_i)\in \Delta S,m_j-m_i\ne 0,\) that is, \(\forall (m_{j},n_{j}),(m_{i},n_{i})\in S,m_{i}\ne m_{j},\) which means \(m_i\) takes all the \(0,1,...,d-1\), therefore,

$$\begin{aligned} S=\{(0,a_0),(1,a_1),\ldots ,(d-1,a_{d-1})|a_i\in {\mathbb {Z}}_d,i=1,2,\ldots ,d\} \end{aligned}$$

Condition (i), (iv) are similar to provable. See the following table:

Table 1 Quantum state sets that can be distinguished by one-way LOCC
Full size table

These locally distinguishable GBSs sets listed in Table 1 provide great convenience for us to design quantum secret sharing schemes. Such as the d elements in \(S=\{(0,a_0),(1,a_1),\ldots ,(d-1,a_{d-1})|a_i\in {\mathbb {Z}}_d\}\):

$$\begin{aligned} |\psi _{0,a_0}\rangle =&\frac{1}{\sqrt{d}}\big (|0\rangle _A|0\rangle _B+\omega ^{a_0}|1\rangle _A|1\rangle _B+\cdots +\omega ^{(d-1)a_0}|d-1\rangle _A|d-1\rangle _B\big ),\nonumber \\ |\psi _{1,\alpha _1}\rangle =&\frac{1}{\sqrt{d}}(|0\rangle _A|1\rangle _B+\omega ^{a_0}|1\rangle _A|2\rangle _B+\cdots +\omega ^{(d-1)a_0}|d-1\rangle _A|0\rangle _B),\nonumber \\ \vdots \nonumber \\ |\psi _{d-1,a_{d-1}})=&\frac{1}{\sqrt{d}}(|0\rangle _A|d-1\rangle _B+\cdots \nonumber \\&+\omega ^{(d-1)a_{d-1}}|d-1\rangle _A|(d-1)\bigoplus _d(d-1)\rangle _B). \end{aligned}$$
(12)

where \(\omega =e^{\frac{2\pi i}{d}}\). From Theorem 2, we know that they can be distinguished by one-way LOCC. If Alice and Bob share some entangled state in this set, Alice can measure the first particle with Z- basis \(\{|0\rangle ,|1\rangle ,\ldots ,|d-1\rangle \}\) and send the results to Bob, then Bob measure his particle with the same basis. By combining the two measurements, they can know which state they share. For example, the result of Alice is \(|0\rangle \), while that of Bob is \(|1\rangle \), this state collapses to \(|0\rangle |1\rangle \), so we can get what was originally shared was \(|\psi _{1,a_1}\rangle \).

4 Quantum secret sharing scheme

Next, we proposed a (t, n)-threshold LOCC-QSS scheme based on the d local distinguishable states constructed in the last section: Alice wants to share her secret among n participants, and only no less than t participants \(\{P_1,P_2,\ldots ,P_n\}\) cooperate can recover secrets. We use the delayed-measurement technology [25], the decoy particle technology [26, 27] and the block transmission [28] in this protocol. The flowchart of the scheme is shown in Fig. 2.

4.1 Preparation phase

Step 1. Alice randomly generated polynomials \(f(x)=a_0+a_1x+\ldots +a_{t-1}x^{t-1},\quad a_i\in {\mathbb {Z}}_d\), and calculates n shares \(s=\{s_{1},s_{2},\ldots ,s_{n}\}\), where \(s_i=f(i)\in {\mathbb {Z}}_d\).

Step 2. Alice randomly chooses a GBSs set \(S=\{|\psi _{m_0,n_0}\rangle ,|\psi _{m_1,n_1}\rangle ,\ldots ,|\psi _{m_{d-1},n_{d-1}}\rangle \}\) in Table 1.

Step 3. To improve the security of the protocol, Alice converts \(s_i\) to binary strings \(s_i=\{a_1^i,a_2^i,\ldots ,a_m^i\},i=1,2,\ldots ,n,\) where m is the smallest positive integer satisfying \(2^m>d-1\). Then, Alice prepares n arbitrary permutations \(\{\Pi _1,\Pi _2,\ldots ,\Pi _n\}\) correspondences to disrupt the order of \(s_i\) into \(s_{i}^{'}=\{b_{1}^{i},b_{2}^{i},\ldots ,b_{m}^{i}\}\).

Step 4. Alice chooses n GBSs \(s_1^{\prime },s_2^{\prime },\ldots ,s_n^{\prime }\) in S, note as \(\{|\varphi _0\rangle ,|\varphi _1\rangle ,\ldots ,|\varphi _n\rangle \}\), and puts them into corresponding registers \(R_{1},R_{2},\ldots ,R_{n}\) (see Fig. 3), where the two particles stored in \(R_i\) come from two different generalized Bell states.

Fig. 2
figure 2

Flowchart of our scheme

Full size image

In Fig. 3, the black dots in the register \(R_i\) represent the particles from the generalized Bell state, the dotted line between the two black dots indicates that the two particles come from an entangled state, and the arrow indicates the direction of one-way classical communication.

Step 5. Alice randomly chooses some single photons from d-dimensional generalized X-basis and Z-basis as decoy photons, and inserts them into every \(R_i\). In d-dimensional Hilbert space, the generalized X-basis and Z-basis are as follows:

$$\begin{aligned} Z=&\{|j\rangle |j=0,1,\ldots ,d-1\}, \end{aligned}$$
(13)
$$\begin{aligned} X=&\{|J_j\rangle |j=0,1,\ldots ,d-1\}, \end{aligned}$$
(14)

where \(|J_j\rangle =\frac{1}{\sqrt{d}}\Sigma _{k=0}^{d-1}e^{\frac{2\pi ijk}{d}}|k\rangle .\)

4.2 Distribution phase

In order to prevent dishonest participants, Alice randomly sends \(R_i\) to \(P_{j'},i,j=1,2,...,n\). Note that participants do not know which two registers’ particles form an entangled state.

4.3 Detection phase

Step 1. After all the participants received the particles, Alice announced the proposition of the decoy photons and the corresponding measurement basis. Each participant measures the decoy photons in his registers and sends the results to Alice.

Step 2. Alice calculates the error rate based on the measurements sent by all participants. If the error rate is higher than the threshold, then Alice will terminate the protocol and re-select a set of entangled states. Otherwise, continue the protocol.

4.4 Reconstruction phase

Step 1. If there is no eavesdropping, Alice requires each participant \(P_j\) to measure the second particle in their register using the specified measurement basis and send the measurement results to the designated next participant \(P_j'\) via one-way classical communication, where \(j^{\prime }\ne j,j,j^{\prime }\in \{1,2,\ldots ,n\}.\)

Step 2. After \(P_j'\) receives the result, Alice asks \(P_j'\) to measure the first particle in their registers with the measurement basis M. Furthermore, according to the results of two measurements, each participant can distinguish which entangled state his first particle belongs to. The one-to-one correspondence between classical bits and d maximally entangled states is agreed by Alice and participants in advance, so at this time all participants will get a value \(s_i^{\prime },i=1,2,...,n\).

Step 3. Alice publicly announces the permutation information \(\{\Pi _1,\Pi _2,\ldots ,\Pi _n\}\) to the corresponding participants. Each participant can convert their recovered message \(s_i^{\prime }\) into binary string \(s_i^{'}=\{b_1^i,b_2^i,\ldots ,b_m^i\}\), and translate \(s_i^{\prime }\) into \(\{a_1^i,a_2^i,\ldots ,a_m^i\}=s_i\) according to \(\Pi _1\).

Step 4. Alice selects an appropriate hash function h(x), and in order to prevent participants from publishing incorrect measurement results, each participant needs to send the hash value corresponding to the measurement result to the Alice test.

Step 5. If all participants are honest, Alice sends \(x_i=i\) to the participant who has received \(s_i=f(i),(i=1,2,\ldots ,n)\), according to the reconstruction algorithm of Shamir scheme, any \(\ge t\) participants cooperate to substitute the \(\left\{ (i_j,f(i_j))\right\} _{j=1}^t\) obtained into the Lagrange interpolation formula can restore the original secret \(a_0\).

Fig. 3
figure 3

Diagram of entangled particles in registers

Full size image

Example 4

Suppose that Alice is going to share secret \(a_0\) among five participants \(\{P_1,P_2,P_3,P_4,P_5\}\), so that no less than four participants can cooperate to restore the secret.

(1) Preparation phase

Let \(d=11\), Alice randomly selects cubic polynomials \(f(x)=a_0+a_1x+a_2x^2+a_3x^3, a_i\in {\mathbb {Z}}_{11},\) suppose she calculated \(f(1)=3,f(2)=0,f(3)=2,f(4)=10,f(5)=6\), the content to be shared is \(s=(3,0,2,10,6)\), its corresponding binary is represented as: (0 0 1 1),(0 0 0 0),(0 0 1 0),(1 0 1 0),(0 1 1 0).

(1-1) To improve security, Alice randomly selects 5 permutations \(\{\Pi _1,\Pi _2,\Pi _3,\Pi _4,\Pi _5\}\) to disrupt the above five binary strings, and produces five new sequences: (1 0 0 1),(0 0 0 0),(1 0 0 0),(0 1 0 1),(0 0 1 1), the classic bit to be sent becomes \(s^{\prime }=(9,0,8,5,3).\)

(1-2) Alice randomly chooses a 11-dimensional locally distinguishable GBSs S, and selects five entangled states according to \(s^{\prime }=(2,0,8,7,3).\) Without loss of generality, assume that Alice selected \(\{|\psi _{9i}\rangle ,|\psi _{0i}\rangle ,|\psi _{8i}\rangle ,|\psi _{5i}\rangle ,|\psi _{3i}\rangle \}(i\in {\mathbb {Z}}_{11})\) to encode \(s^{\prime }\), then the measurement operator set is \(M=\{|0\rangle ,|1\rangle ,\ldots ,|10\rangle \}\). Let the corresponding relationship between classical bits and entangled states be as follows:

$$\begin{aligned} |\psi _{9i}\rangle \rightarrow 9,~|\psi _{0i}\rangle \rightarrow 0,~|\psi _{8i}\rangle \rightarrow 8,~|\psi _{5i}\rangle \rightarrow 5,~|\psi _{3i}\rangle \rightarrow 3. \end{aligned}$$

(1-3)Alice puts these five entangled states into \(R_i\).

(1-4) Alice randomly selects some single photons as decoy particles in the 11-dimensional generalized X-basis and Z-basis, inserts them into each \(R_i\) and records the position.

(2) Distribution phase

(2-1) To prevent dishonest participants, Alice randomly sends \(R_i\) to \(P_j, j=1,2,3,4,5\). Let the sending order as follows (as shown in figure 4, only Alice knows the corresponding relationship between \(R_i\) and \(P_j\)):

$$\begin{aligned} R_1\rightarrow P_2,R_2\rightarrow P_4,R_3\rightarrow P_5,R_4\rightarrow P_1,R_5\rightarrow P_3. \end{aligned}$$

(3) Detection phase

(3-1) After all the participants received the particles, Alice announced the location and measurement basis of the decoy photos, and the participants measured the corresponding particles and sent the results to Alice. Alice can calculate the error rate according to the measurement results. If the error rate is higher than the threshold, the protocol is terminated; otherwise, continue.

Fig. 4
figure 4

Diagram of entangled particle transmission in example 5

Full size image

In Fig. 4, the state on the inside of the red dotted line indicates that the two connected particles come from this entangled state, two particles in each register are sent to the corresponding participant, and the curved arrow indicates the direction of classical communication between participants. In this example, the registers \(R_1,R_2\) are sent to \(P_2,P_4\), respectively, particle 2 in \(R_1\) and particle 1 in \(R_2\) come from entangled states \(|\psi _{9i}\rangle \).

(4) Reconstruction phase

(4-1) All participants measure the second particle in their hands using the measuring base M and sent the result to the next one \(P_{j^\prime }\) designated by Alice. At this point, the sending order should be: \(P_2\rightarrow P_4\rightarrow P_5\rightarrow P_1\rightarrow P_3\rightarrow P_2.\)

(4-2) After receiving the result, \(P_{j^\prime }\) measures the first particle in their hand with M. According to the results of two measurements, each participant can distinguish which entangled state the first particle in his hand belongs to and get the corresponding classical information. That is, \(P_1{:}|\psi _{3i}\rangle \rightarrow 8,\quad P_2{:}|\psi _{3i}\rangle \rightarrow 3,\quad P_3{:}|\psi _{7i}\rangle \rightarrow 7\text {,}\quad P_4{:}|\psi _{2i}\rangle \rightarrow 2\text {,}\quad P_5{:}|\psi _{0i}\rangle \rightarrow 0\)

(4-3) Alice publicly announces the permutation information \(\{\Pi _1,\Pi _2,\Pi _3,\Pi _4,\Pi _5\}\) to the corresponding participants. Each participant converts their classical information and gets:

$$\begin{aligned} P_1{:}2{,}P_2{:}6{,}P_3{:}10{,}P_4{:}3{,}P_5{:}0. \end{aligned}$$

(4-4)In order to prevent participants from publishing incorrect measurement results, Alice selects an appropriate h(x) and publishes it. Each participant calculates the hash value corresponding to the measurement result and sends it to Alice.

(4-5) If all participants are honest, Alice sends \(x_1=1\rightarrow P_4,x_2=2\rightarrow P_5,x_3=2\rightarrow P_1,x_4=2\rightarrow P_3,x_5=2\rightarrow P_2\).

At this time, no less than four participants can cooperate to replace \((x_i,s_i),i=1,2,3,4\) into Eq. (15) to recovery \(a_0\).

$$\begin{aligned} P_4(x)=\sum _{i=1}^4s_i\left( \prod _{j\ne i}^{1\le j\le 4}\frac{(x-x_j)}{(x_i-x_j)}\right) =f(x). \end{aligned}$$
(15)

Compared with the existing schemes, in [17], Alice can only use four entangled states to encode classical information, therefore, it is necessary to convert classical information into m-bit binary strings, and at least \(N(N>m)\) rounds can complete a secret sharing. However, in our protocol, we directly use d locally distinguished states to encode the classical information \({0,1,...,d-1}\), Alice only needs to be sent once to give all participants the appropriate share. Therefore, our scheme greatly improves the utilization efficiency of particles.

5 Security analysis

5.1 Participant attack

Participant attacks have a great impact on the quantum secret sharing protocol, because participants get much more information than foreign eavesdroppers. We consider the following three situations:

  1. (a)

    Dishonest participants publish false measurements while restoring secrets. In this case, we choose an appropriate hash function h(x) and ask all participants to give their hash values to prevent them from publishing incorrect measurements. By comparing the hash function values, Alice can verify that the participants are honest. If there are dishonest participants, the agreement will be terminated.

  2. (b)

    A dishonest participant obtains the measurement results of other participants by deceiving. In this case, we use random permutation to change the original classical information, so that the quantum state code is not the original value. Suppose that \(P_1\) is dishonest. Although \(P_1\) can obtain the measurement results of other participants by deceiving, because Alice uses random permutation \(\Pi _i(i=1,2,\ldots ,n)\) to change the value of classical information, the probability of \(P_1\) getting the information of permutation \(\Pi _i\) by guessing is only \(\frac{1}{m!}\). So he cannot get true classical information.

  3. (c)

    There are \(k(1<k<t)\) participants are dishonest. Our scheme is based on the Shamir protocol, so even if there is a dishonest participant, they are still unable to reconstruct the correct information.

5.2 Intercept-and-resend attack

First of all, we analyze the eavesdropper Eve’s use of intercept-and-resend attack. In this paper, Alice randomly selects some sample checking single photons from the X-bases and the Z-bases to check for the eavesdropper attack.

When Alice randomly sends register \(R_i\) to \(P_j(i,j=1,2,...,n)\), EVE can intercept all registers and measure them with generalized X-bases and Z-bases, and then transmit the fake registers \(R_1^*,R_2^*,\ldots ,R_n^*\) to participants. Although Eve intercepts all the registers, he does not know the location of the decoy photons, and when he measures them, he is bound to introduce some errors. In addition, the order in which Alice sends registers to participants is random, so Eve does not know the corresponding relationship between registers and participants, so there is no way to send false registers to the corresponding participants.

Assuming that Alice inserts k decoy particles into each register, the probability that Eve will correctly measure this register is \((\frac{1}{2})^k\), the probability that all registers are measured correctly is \((\frac{1}{2})^{nk}\), that is, the probability that Alice can detect eavesdropping is \(1-(\frac{1}{2})^{nk}\). When the number n, k get larger, the probability is \(1-(\frac{1}{2})^{kn}\rightarrow 1.\)

Even if Eve gets the position of decoy photons in each register, he does not know which two particles are entangled, and he does not know the information of permutation, so he cannot get classical information. Therefore, the intercept-and-resend attack will not succeed.

5.3 Entangle-and-measure attack

The second strategy of Eve is entangle-and-measure attack, that is, Eve uses some auxiliary qubits to entangle the particles sent by Alice to obtain the information.

Let us assume that Eve performs the following unitary transform on his particles and auxiliary ones.

$$\begin{aligned} U_{E}|k\rangle |E\rangle&=\sum _{l=0}^{d-1}a_{kl}|l\rangle |e_{kl}\rangle , \end{aligned}$$
(16)
$$\begin{aligned} U_{E}|J_{j}\rangle |E\rangle&=U_{E}(\frac{1}{\sqrt{d}}\Sigma _{k=0}^{d-1}\omega ^{kj}|k\rangle )|E\rangle \nonumber \\&=\frac{1}{\sqrt{d}}\sum _{k=0}^{d-1}\omega ^{kj}\big (\sum _{l=0}^{d-1}a_{kl}|l\rangle |e_{kl}\rangle \big ) \nonumber \\&=\frac{1}{\sqrt{d}}\sum _{k=0}^{d-1}\sum _{l=0}^{d-1}\omega ^{kj}a_{kl}\left( \frac{1}{\sqrt{d}}\sum _{m=0}^{d-1}\omega ^{-ml}|J_{m}\rangle \right) |e_{kl}\rangle \nonumber \\&=\frac{1}{d}\sum _{k=0}^{d-1}\sum _{l=0}^{d-1}\sum _{m=0}^{d-1}\omega ^{kj-ml}a_{kl}|J_{m}\rangle |e_{kl}\rangle , \end{aligned}$$
(17)

where \(\omega =e^{\frac{2\pi i}{d}}\), \(\left| E\right\rangle \) is the initial state of Eve’s auxiliary particles, and \(|e_{kl}\rangle (k,l=0,1,\ldots ,d-1)\) is the pure auxiliary state uniquely determined by the unitary transform \(U_E\) and \(\sum _{l=0}^{d-1}|a_{kl}|^{2}=1,(k=0,1,\ldots ,d-1).\)

To avoid introducing errors, Eve can only make \(a_{kl}=0,k\ne l,k,l\in {\mathbb {Z}}_d\). Therefore, the above expression can be written as follows:

$$\begin{aligned} U_E|j\rangle |E\rangle&=a_{jj}|0\rangle |e_j\rangle (j=0,1,\ldots ,d-1),\end{aligned}$$
(18)
$$\begin{aligned} U_E|J_j\rangle |E\rangle&=\frac{1}{d}\Sigma _{k=0}^{d-1}\Sigma _{m=0}^{d-1}\omega ^{k(j-m)}a_{kk}|J_m\rangle |e_{kk}\rangle . \end{aligned}$$
(19)

In addition, Eve has to set \(\sum _{m=0}^{d-1}\omega ^{k(j-m)}a_{kk}|e_{kk}\rangle =0(m\in {\mathbb {Z}}_d,m\ne j)\). For any \(j\in {\mathbb {Z}}_d\), we can get \(d-1\) equations:

$$\begin{aligned} {\left\{ \begin{array}{ll}\quad a_{00}|e_{00}\rangle +\omega a_{11}|e_{11}\rangle +\cdots +\omega ^{d-1}a_{d-1,d-1}|e_{d-1,d-1}\rangle =0,\\ \\ a_{00}|e_{00}\rangle +\omega ^2a_{11}|e_{11}\rangle +\cdots +\omega ^{2(d-1)}a_{d-1,d-1}|e_{d-1,d-1}\rangle =0,\\ \\ \vdots \\ a_{00}|e_{00}\rangle +\omega ^{d-1}a_{11}|e_{11}\rangle +\cdots +\omega ^{(d-1)^2}a_{d-1,d-1}|e_{d-1,d-1}\rangle =0. \end{array}\right. } \end{aligned}$$
(20)

According to these equations, we can get

$$\begin{aligned} a_{00}|e_{00}\rangle =a_{11}|e_{11}\rangle =\cdots =a_{d-1,d-1}|e_{d-1,d-1}\rangle . \end{aligned}$$
(21)

In order to get the information about the secret, Eve performs the unitary transform \(U_E\) on the first qubit of \(|\psi _{mn}\rangle =\frac{1}{\sqrt{d}}\Sigma _{j=0}^{d-1}\omega ^{jn}|j\rangle |j\oplus _{d}m\rangle \), that is,

$$\begin{aligned} (U_{E}\otimes I)|\psi _{mn}\rangle |E\rangle&=\frac{1}{\sqrt{d}}(\sum _{j=0}^{d-1}\omega ^{jn}a_{jj}|j\rangle |j\oplus _dm\rangle |e_{jj}\rangle ) \nonumber \\&=\frac{1}{\sqrt{d}}(\sum _{j=0}^{d-1}\omega ^{jn}|j\rangle |j\oplus _dm\rangle )\otimes (a_{00}|e_{00}\rangle ), \end{aligned}$$
(22)

where \(\omega =e^{\frac{2\pi i}{d}},j\oplus _dm=(j+m)\mathrm {~mod~}d.\)

The above formula indicates that if Eve wants not to be detected, he will not have any effect on the whole quantum system, that is, he cannot get any information, so the entangle-and-measure attack is also invalid.

6 Comparison with existing scheme

In this section, we present some differences between our scheme and existing schemes in classical communication, quantum states, and particle efficiency, as shown in Table 2.

6.1 Quantum state and decoy particles

In Rahaman et al.’s [16] scheme, they use n-qubit GHZ states to encode classical secrets. In the scheme proposed in [18], they use a set of locally distinguishable orthogonal multiqubit entangled states of n particles constructed based on the access structure to encode the secret. In this paper, we only use the generalized Bell state in \({\mathbb {C}}^d\otimes {\mathbb {C}}^d\). Under existing technology, the preparation and storage of two-particle generalized Bell states are easier than n-qubit GHZ states and orthogonal multiqubit entangled states. In terms of detecting eavesdropping, our scheme uses single photons, while Rahaman et al.’s [16] uses n-qubit GHZ states.

6.2 Number of particles cost

Since Rahaman et al.’s scheme [16] uses a pair of special n-qubit GHZ states, sharing n bit classical information requires the use of m quantum states with a total particle count of mn, of which nl are used for eavesdropping detection. The scheme in [18] requires n orthogonal multivariate entangled states of n-qubits to share n bit of classical secrets. If the number of decoy photons is l, the total number of required particles is \(n^2+l\). In [17], Bai et al. proposed a quantum secret sharing scheme that utilizes locally distinguishable generalized Bell states in \({\mathbb {C}}^4\otimes {\mathbb {C}}^4\) to encode classical information. In this scheme, since a set of distinguishable generalized Bell states in a four-dimensional system can only contain at most four elements, Bai’s scheme cannot directly encode classical information using generalized Bell states, but instead converts the classical information \(s=\{s_{1},s_{2},\ldots ,s_{n}\}\) to be shared into n corresponding m-bit binary strings, i.e., \(s_i=(a_{i1},a_{i2},\ldots ,a_{in}),1\le i\le n\), and then encoded with a selected set of locally distinguishable generalized Bell states. In the j-th transmission, the dealer Alice needs to select n generalized Bell states to encode, and send at least m times to complete the secret sharing. A total of mn generalized Bell states are required. Assuming Alice inserts l decoy particles each time, the number of particles required to share the secret is \(2mn+ml\). Our scheme directly uses d locally distinguishable generalized Bell states to encode the classical information \(s=\{s_{1},s_{2},\ldots ,s_{n}\}\) in \({\mathbb {Z}}_d\). Alice only needs to send it once to enable the participants to obtain the corresponding share, which means \(m=1\), and the required number of particles is \(2n+l\). From this, it can be seen that our scheme greatly saves the required number of particles, and reduces the number of transmissions and measurements.

6.3 Classical communication model

In Sect. 2, we introduced full-way LOCC and one-way LOCC. Both [16, 18] use two-way chain classical communication, but our scheme only requires one-way loop classical communication. Assuming that there are n participants cooperating to distinguish quantum states, after each participant completes the measurement, the required one-way classical communication frequency for this scheme is n, that is, the communication efficiency can be recorded as \(\eta _1=\frac{1}{n}\). The classical communication frequency required in full-way LOCC model is \(2n-2\), and the communication efficiency is \(\eta _2=\frac{1}{2n-2}\). When \(n\ge 2,\eta _1\ge \eta _2\). This indicates that the communication efficiency of the one-way LOCC model is superior to that of the full-way LOCC model.

Table 2 Comparison of the existing schemes and our scheme
Full size table

7 Conclusions

In this paper, we give a more simple structural characterization of prime dimensional maximally commutative sets, and obtain some distinguishable generalized Bell states in prime dimensional systems. What’s more, we use these distinguishable states to propose a quantum secret sharing scheme with (t, n)-threshold, in which participants can use one-way classical communication and local operation to distinguish these states. Only one-way cyclic classical communication is used in our scheme, which can reduce the influence of noise on information transmission and communication times, and save the corresponding communication cost. Furthermore, compared with the existing protocols, in our scheme Alice only needs to send the quantum state once to complete secret sharing, which greatly improves the efficiency. At the end of the paper, we prove that this protocol is secure against intercept-and-resend attack, entangle-and-measure attack and dishonest participant attack.