1 Introduction

The problem for private comparison of equality is that two parties want to know whether their private information are equal or not without disclosing their private information. It’s an important problem in the filed of secure multi-party computation. The problem for private comparison was well-studied in classical cryptography [1–4], but they cannot withstand powerful quantum computers. In 2009, Yang et al. [5] proposed a quantum private comparison protocol(QPC) based on the decoy photon and two-photon entangled Einstein −Podolsky −Rosen (EPR) pairs. In Yang’s protocol, a dishonest third party (TP) is introduced. Then, Chen et al. [6] proposed a new QPC protocol to deal with the private comparison of equal information based on the simple single-particle measurement and the triplet entangled states Greenberger −Horne −Zeilinger (GHZ). In [7], Tseng et al. proposed a QPC protocol using EPR, which provided easier implementation as well as better qubit efficiency than the other quantum private comparison protocols. In [8–12], Liu et al. proposed some QPC protocols based on the triplet W states, GHZ states, χ − type states and Bell entangled states. These protocols all included a semi-honest third party(TP). In [13, 14], Liu et al. studied the extended problem of QPC. With the help of a semi-honest third party (TP), n parties can compare whether their information are equal or not in one execution of the protocol using d-dimensional Bell states as the information carriers.

In this paper, we proposed a dynamic multi-party quantum private comparison(DQPC) protocol with single photons in both polarization and spatial-mode degrees of freedom. The dynamic character of our protocol is reflected in the following two aspects:

  1. (1)

    We can randomly choose arbitrary two parties of the n parties to compare their private information with the help of n − 2 parties and don’t disclose any information about their private information. And any two party of the n parties can get their comparison result simultaneously.

  2. (2)

    Any number of new parties, not only one party, can dynamically join the DQPC protocol and take part in the comparison before the single photon state in both polarization and spatial-mode degrees of freedom are measured. The protocol of n parties can be extend to a protocol of n + n ′ parties.

In [15], Prof. Du, the earliest researchers of secure multi-party computation, pointed out that extending our two-party computation protocol to secure multi-party protocols is not trivial. So in this paper, we study a multi-party protocol, which is not a simple extend protocol of two parties’. Our multi-party protocol can used in some applications, such as multi-keyword ranking, multi-keyword search and personalized search in [16–21]. For example, there are n 1 keywords \(w_{1} ,w_{2} ,...,w_{n_{1} }\) which are need to research. The keywords of a paper are \(w_{n_{1} + 1} ,w_{n_{1} + 2} ,...,w_{n}\). In order to determine whether \(w_{1} ,w_{2} ,...,w_{n_{1} } \subseteq w_{n_{1} + 1} ,w_{n_{1} + 2} ,...,w_{n}\) , we have to use the protocol n 1(n − n 1) times and need to prepare n 1(n − n 1)L single photons to carry information, where L is the length of every keyword in in \(F_{2^{L}}\). Using our protocol, we can use the protocol one time, need to prepare L single photons to carry information.

The structure of this paper is as follows: we propose a dynamic quantum private comparison(DQPC) protocol with the single photon in both polarization and spatial-mode degrees of freedom in Section 2; and we analyze the security of this protocol in Section 3. A brief discussion and the concluding summary are given in Section 4.

2 The Dynamic Multi-Party Quantum Private Comparison(DMQPC) Protocol with the Single Photon in Both Polarization and Spatial-Mode Degrees of Freedom

Before describing this protocol, we define a single photon state in both polarization and spatial-mode degrees of freedom as follows:

$$ \left| \phi \right\rangle = \left| \phi \right\rangle_{P} \otimes \left| \phi \right\rangle_{S} $$
(1)

where |ϕ〉 P and |ϕ〉 S respectively are the single photon states in the polarization and spatial-mode degrees of freedom. \(\left | \phi \right \rangle _{P} \in \{ \left | H \right \rangle ,\left | V \right \rangle ,\left | S \right \rangle _{P} = \frac {1}{{\sqrt 2 }}(\left | H \right \rangle + \left | V \right \rangle ),\left | A \right \rangle _{P} = \frac {1}{{\sqrt 2 }}(\left | H \right \rangle - \left | V \right \rangle )\), here H and V respectively denote the horizontal and vertical polarization of single photons; \(\left | \phi \right \rangle _{P} \in \{ \left | {a_{1} } \right \rangle ,\left | {a_{2} } \right \rangle ,\left | s \right \rangle _{P} = \frac {1}{{\sqrt 2 }}(\left | {a_{1} } \right \rangle + \left | {a_{2} } \right \rangle ),\left | a \right \rangle _{S} = \frac {1}{{\sqrt 2 }}(\left | {a_{1} } \right \rangle - \left | {a_{2} } \right \rangle )\), here a 1 and a 2 respectively represent the upper and lower spatial mode of single photons.

Similar to [15, 16], there are two interesting unitary operations in each degree of freedom of single photons. These unitary operations are:

$$ \begin{array}{l} I_{P} = \left| H \right\rangle \left\langle H \right| + \left| V \right\rangle \left\langle V \right|,\quad U_{P} = \left| V \right\rangle \left\langle H \right| - \left| H \right\rangle \left\langle V \right|, \\ I_{S} = \left| {a_{1} } \right\rangle \left\langle {a_{1} } \right| + \left| {a_{2} } \right\rangle \left\langle {a_{2} } \right|,\quad U_{S} = \left| {a_{2} } \right\rangle \left\langle {a_{1} } \right| - \left| {a_{1} } \right\rangle \left\langle {a_{2} } \right|. \\ \end{array} $$
(2)

Using these unitary operations, we can get that:

$$ \begin{array}{l} I_{P} \left| H \right\rangle = \left| H \right\rangle ,\;\quad \;\,U_{P} \left| H \right\rangle = \left| V \right\rangle , \\ I_{P} \left| V \right\rangle = \left| V \right\rangle ,\;\quad \;\,\,\,U_{P} \left| V \right\rangle = - \left| H \right\rangle , \\ I_{P} \left| S \right\rangle_{P} = \left| S \right\rangle_{P} ,\;\quad U_{P} \left| S \right\rangle_{P} = - \left| A \right\rangle_{P} , \\ I_{P} \left| A \right\rangle_{P} = \left| A \right\rangle_{P} ,\;\;\;\,U_{P} \left| A \right\rangle_{P} = \left| S \right\rangle_{P} , \\ I_{S} \left| {a_{1} } \right\rangle = \left| {a_{1} } \right\rangle ,\;\quad \;\,\,U_{P} \left| {a_{1} } \right\rangle = \left| {a_{2} } \right\rangle , \\ I_{S} \left| {a_{2} } \right\rangle = \left| {a_{2} } \right\rangle ,\;\quad \;\,U_{P} \left| {a_{2} } \right\rangle = - \left| {a_{1} } \right\rangle , \\ I_{S} \left| s \right\rangle_{S} = \left| s \right\rangle_{S} ,\quad \;\,\,U_{S} \left| s \right\rangle_{S} = - \left| a \right\rangle_{S} , \\ I_{S} \left| a \right\rangle_{S} = \left| a \right\rangle_{S} ,\quad \;\,U_{P} \left| a \right\rangle_{S} = \left| s \right\rangle_{S} . \\ \end{array} $$
(3)

Supposed that there are n(n ≥ 4) parties P 1, P 2,..., P n . Each of them has a private information M i (i = 1, 2, ..., n). The length of the private information is L. The secret messages M i in \(F_{2^{L} }\) of P i is denoted by \({m_{1}^{i}} ,{m_{2}^{i}} ,...,{m_{L}^{i}}(i=1,2,...,n)\). In the DQPC protocol, arbitrary two parties of the n party can compare their private information with the help of others n − 2 parties and don’t disclose any information about their private information. And n ′ parties can dynamically join in the protocol and take part in the comparison before the states are measured. P 1, P 2,..., P n agree that I P (I S ) encodes 0; U P (U S ) encodes 1; they also agree that |H〉,|S〉 P ,|a 1〉,|s〉 S encode 0; |V〉,|A〉 P ,|a 2〉,|a〉 S encode 1. In our protocol, we introduce a semi-honest third party TP. TP executes the protocol loyally, keeps a record of all its intermediate computations and may try to steal the others parties’ private inputs from the record, but he cannot be corrupted by the adversary.

The dynamic multi-party quantum private comparison(DMQPC) protocol with the single photon in both polarization and spatial-mode degrees of freedom is divided into sub-protocol 1 and sub-protocol 2. Sub-protocol 1 describes how n paries compare their private information secretly; Sub-protocol 2 describes how n ′ additional parties take part in the comparison protocol.

Sub-protocol 1

is as follow:

  1. (1)

    For i = 1, 2, ..., n, P i divides his binary representation of M i into \(\left \lceil {\frac {L}{2}} \right \rceil \) groups \({G_{1}^{i}} ,{G_{2}^{i}},...,G_{\left \lceil {\frac {L}{2}} \right \rceil }^{i}\) . Each group \({G_{j}^{i}}(j=1,...,\left \lceil {\frac {L}{2}} \right \rceil )\) includes two binary bits of M i . If L mod 2 = 1, P i adds one 0 into the last group \(G_{\left \lceil {\frac {L}{2}} \right \rceil }^{i}\).

  2. (2)

    TP prepares a sequence S q T P of \(\left \lceil {\frac {L}{2}} \right \rceil \) single photons. TP also prepares L ′ single photons. Each photon is in one of the 8 quantum states |ϕ〉=|ϕ〉 P ⊗|ϕ〉 S ,|ϕ〉 P ∈{|H〉,|V〉},|ϕ〉 S ∈{|a 1〉,|a 2〉} or |ψ〉=|ψ〉 P ⊗|ψ〉 S ,|ψ〉 P ∈{|S〉 P ,|A〉 P },|ψ〉 S ∈{|s〉 S ,|a〉 S }. TP also records the coding of S q T P and the coding sequence is denoted by \(I{v_{1}^{1}} I{v_{1}^{2}} ,...,Iv_{\left \lceil {\frac {L}{2}} \right \rceil }^{1} Iv_{\left \lceil {\frac {L}{2}} \right \rceil }^{2}\). And TP inserts L ′ single photons into S q T P and gets \(Sq_{TP}^{\prime }\). TP records the insert positions P o T P and sends \(Sq_{TP}^{\prime },Po_{TP}\) to P 1.

  3. (3)

    After receiving \(Sq_{TP}^{\prime },Po_{TP}\), P 1 chooses L ′ single photons from S q T P according to P o T P and measures them with one of 8 bases |H〉⊗|a 1〉,|H〉⊗|a 2〉,|V〉⊗|a 1〉,|V〉⊗|a 2〉,|S〉 P ⊗|s〉 S ,|S〉 P ⊗|a〉 S ,|A〉 P ⊗|s〉 S ,|A〉 P ⊗|a〉 S . P 1 publishes his measurement results. TP can determine the error rate according to the measurement and initial states in step(1). If the error rate is smaller than the prior threshold determined by the channel noise, P 1 proceeds to the next step; otherwise P 1 aborts the communication and repeat the step (1).

  4. (4)

    P 1 discards the measured L ′ photons and the rest photons of \(Sq_{TP}^{\prime }\) form a sequence S q T P . P 1 performs \({U_{P}^{1}} \otimes {U_{S}^{2}} ({U_{P}^{1}} \in \{ I_{P} ,U_{P} \} ,{U_{S}^{2}} \in \{ I_{S} ,U_{S} \} )\) on the jth photon of S q T P according to \({G_{j}^{1}}\). These operated photons form a new sequence denoted by \(Sq_{P_{1}}\). P 1 prepares L ′ single photons which is the same as the step (2). Each photon is one of the 8 quantum states |ϕ〉=|ϕ〉 P ⊗|ϕ〉 S . P 1 inserts L ′ single photons into \(Sq_{P_{1}}\) and also records the insert position P o 1. P 1 sends the new sequence \(Sq_{P_{1}}^{\prime }\) and P o 1 to P 2.

  5. (5)

    For i = 2, ...n − 1, n

  6. (5.1)

    After P i gets \(Sq_{P_{i-1}}^{\prime }\), P i chooses L ′ single photons from \(Sq_{P_{i-1}}^{\prime }\) according to P o i − 1 and measures them with one of 8 bases |H〉⊗|a 1〉,|H〉⊗|a 2〉,|V〉⊗|a 1〉,|V〉⊗|a 2〉,|S〉 P ⊗|s〉 S ,|S〉 P ⊗|a〉 S ,|A〉 P ⊗|s〉 S ,|A〉 P ⊗|a〉 S . P i publishes his measurement results and P i − 1 can determine the error rate according to the measurements. If the error rate is smaller than the prior threshold determined by the channel noise, P i proceeds to the next step (5.1); otherwise P i aborts the communication.

  7. (5.2)

    P i discards the measured L ′ photons and the rest photons of \(Sq_{P_{i-1}}^{\prime }\) form a sequence \(Sq_{P_{i-1}}\). P i performs \({U_{P}^{1}} \otimes {U_{S}^{2}} ({U_{P}^{1}} \in \{ I_{P} ,U_{P} \} ,{U_{S}^{2}} \in \{ I_{S} ,U_{S} \} )\) on the jth photon of \(Sq_{P_{i-1}}\) according to \({G_{j}^{i}},j=1,2,...,L\). These operated photons form a new sequence denoted by \(Sq_{P_{i}}\). P i prepares L ′ single photons which is the same as the step (2). Each photon is one of the 8 quantum states |ϕ〉=|ϕ〉 P ⊗|ϕ〉 S . P i inserts L ′ single photons into \(Sq_{P_{i}}\) and also records the insert position P o i . P i sends the new sequence \(Sq_{P_{i}}^{\prime }\) and P o i to P i + 1. If i = n, P n sends the new sequence \(Sq_{P_{n}}^{\prime }\) and P o n to TP.

    The step(5) will continue until i = n

  8. (6)

    After TP gets \(Sq_{P_{n}}^{\prime }\), TP and P n use the same method as step (5.1) to check whether the transmission is secure or not. If the transmission is secure, TP can use the correct base according to the single-photon state in step (1) and get the result denoted by R. The binary representations of R are \({r_{1}^{1}} {r_{1}^{2}} ...r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1} r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2}\)

  9. (7)

    With the help of TP and others n − 2 parties, any P k (k ∈ {1, 2, ..., n}) can respectively compare his private information with P h (h = 1, 2, ..., k − 1, k + 1,.., n)).

    For k = 1, 2, ..., n, For h = 1, 2, ..., k − 1, k + 1,.., n:

    TP sends R to P j (j ∈ {1, 2, ..., n}, j ≠ k, h). The n − 2 parties calculates

    $$ \begin{array}{l} r_{1{(kh)}}^{1\prime} r_{1{(kh)}}^{2'} = {r_{1}^{1}} {r_{1}^{2}} \oplus \underset{j \in \{ 1,2,...,n\} ,j \ne k,h}{\oplus} {G_{1}^{j}} , \\ ... \\ r_{\left\lceil {\frac{L}{2}} \right\rceil {(kh)}}^{1'} r_{\left\lceil {\frac{L}{2}} \right\rceil {(kh)}}^{2'} = r_{\left\lceil {\frac{L}{2}} \right\rceil }^{1} r_{\left\lceil {\frac{L}{2}} \right\rceil }^{2} \oplus \underset{j \in \{ 1,2,...,n\} ,j \ne k,h}{\oplus} G_{\left\lceil {\frac{L}{2}} \right\rceil }^{j} . \\ \end{array} $$
    (4)

    They also send \(r_{1{(kh)}}^{1'} r_{1{(kh)}}^{2'} ,...,r_{\left \lceil {\frac {L}{2}} \right \rceil (kh) }^{1'} r_{\left \lceil {\frac {L}{2}} \right \rceil (kh) }^{2'}\) to TP.

    TP calculates

    $$ \begin{array}{l} R_{kh}^{1}=r_{1{(kh)}}^{1'} r_{1{(kh)}}^{2'} \oplus Iv_{1}^{1'} Iv_{1}^{2'}, \\ ...\\ R_{kh}^{\left\lceil {\frac{L}{2}} \right\rceil}=r_{\left\lceil {\frac{L}{2}} \right\rceil{(kh)} }^{1'} r_{\left\lceil {\frac{L}{2}} \right\rceil {(kh)} }^{2'} \oplus Iv_{\left\lceil {\frac{L}{2}} \right\rceil }^{1'} Iv_{\left\lceil {\frac{L}{2}} \right\rceil }^{2'}.\\ \end{array} $$
    (5)

    For k = 1, 2, ..., n,

    For h = 1, 2, ..., k − 1, k + 1,.., n:

    \(R_{kh}^{1} = ,..., = R_{kh}^{\left \lceil {\frac {L}{2}} \right \rceil } = 00\), TP can know the private information M k = M h ; otherwise M k ≠ M h .

Sub-protocol 2

is as follow:

Before TP measured \(Sq_{P_{n}}^{\prime }\), n ′ parties can join in the protocol, where n ′ can be arbitrary integer.

  1. (1)

    For i = 1, ..., n ′: P n + i divides his binary representation of X n + i into \(\left \lceil {\frac {L}{2}} \right \rceil \) groups \(G_{1}^{n+i} ,G_{2}^{n+i},...,G_{\left \lceil {\frac {L}{2}} \right \rceil }^{n+i}\). Each group \(G_{j}^{n+i}(j=1,...,\left \lceil {\frac {L}{2}} \right \rceil )\) includes two binary bits in X n + i . If L mod 2=1, P n + i adds one 0 into the last group \(G_{\left \lceil {\frac {L}{2}} \right \rceil }^{n+i}\).

  2. (2)

    P n can send \(Sq_{P_{n}}^{\prime }\) and P o n to P n + 1. The same as the step (5) of sub-protocol 1, P n + 1 checks whether the transmission between P n and him is secure or not. And he performs \({U_{P}^{1}} \otimes {U_{S}^{2}} ({U_{P}^{1}} \in \{ I_{P} ,U_{P} \} ,{U_{S}^{2}} \in \{ I_{S} ,U_{S} \} )\) on the jth photon of \(Sq_{P_{n}}\) according to \(G_{j}^{n+1},j=1,2,...,L\). These operated photons form a new sequence denoted by \(Sq_{P_{n+1}}\).

  3. (3)

    For i = 1,..., n ′ − 1: P n + i sends \(Sq_{P_{n+i}}\) to P n + i + 1. The same as the step (5) of sub-protocol 1, P n + i + 1 checks whether the transmission between P n + i and him is secure or not. And he performs \({U_{P}^{1}} \otimes {U_{S}^{2}} ({U_{P}^{1}} \in \{ I_{P} ,U_{P} \} ,{U_{S}^{2}} \in \{ I_{S} ,U_{S} \} )\) on the jth photon of \(Sq_{P_{n+i}}\) according to \(G_{j}^{n+i+1},j=1,2,...,L\). These operated photons form a new sequence denoted by \(Sq_{P_{n+i+1}}\).

  4. (4)

    \(P_{n+n^{\prime }}\) sends \(Sq_{P_{n+n^{\prime }}}\) to TP. The same as the step (5) of sub-protocol 1, TP checks whether the transmission between \(P_{n+n^{\prime }}\) and him is secure or not.

  5. (5)

    With the help of TP and others n + n ′ − 2 parties, any P k (k ∈ {1, 2, ..., n, n + 1,..., n + n ′}) can respectively compare his private information with P h (h = 1, 2, ..., k − 1, k + 1,.., n, n + 1,..., n + n ′}).

    For k = 1, 2, ..., n, n + 1,..., n + n ′}, For h = 1, 2, ..., k − 1, k + 1,.., n, n + 1,..., n + n ′}:

    TP sends R to P j (j ∈ {1, 2, ..., n, n + 1,..., n + n ′}}, j ≠ k, h). The n − 2 parties calculates

    $$ \begin{array}{l} r_{1{(kh)}}^{1\prime} r_{1{(kh)}}^{2'} = {r_{1}^{1}} {r_{1}^{2}} \oplus \underset{j \in \{ 1,2,...,n\} ,j \ne k,h}{\oplus} {G_{1}^{j}} , \\ ... \\ r_{\left\lceil {\frac{L}{2}} \right\rceil {(kh)}}^{1'} r_{\left\lceil {\frac{L}{2}} \right\rceil {(kh)}}^{2\prime} = r_{\left\lceil {\frac{L}{2}} \right\rceil }^{1} r_{\left\lceil {\frac{L}{2}} \right\rceil }^{2} \oplus \underset{j \in \{ 1,2,...,n\} ,j \ne k,h}{\oplus} G_{\left\lceil {\frac{L}{2}} \right\rceil }^{j} . \\ \end{array} $$
    (6)

    They also send \(r_{1{(kh)}}^{1'} r_{1{(kh)}}^{2'} ,...,r_{\left \lceil {\frac {L}{2}} \right \rceil (kh) }^{1'} r_{\left \lceil {\frac {L}{2}} \right \rceil (kh) }^{2'}\) to TP.

    TP calculates

    $$ \begin{array}{l} R_{kh}^{1}=r_{1{(kh)}}^{1'} r_{1{(kh)}}^{2'} \oplus Iv_{1}^{1'} Iv_{1}^{2'}, \\ ...\\ R_{kh}^{\left\lceil {\frac{L}{2}} \right\rceil}=r_{\left\lceil {\frac{L}{2}} \right\rceil{(kh)} }^{1'} r_{\left\lceil {\frac{L}{2}} \right\rceil {(kh)} }^{2'} \oplus Iv_{\left\lceil {\frac{L}{2}} \right\rceil }^{1'} Iv_{\left\lceil {\frac{L}{2}} \right\rceil }^{2'}.\\ \end{array} $$
    (7)

    For k = 1, 2, ..., n, n + 1,..., n + n ′},

    For h = 1, 2, ..., k − 1, k + 1,.., n, n + 1,..., n + n ′}:

    \(R_{kh}^{1} = ,..., = R_{kh}^{\left \lceil {\frac {L}{2}} \right \rceil } = 00\), TP can know the private information M k = M h ; otherwise M k ≠ M h .

3 Analysis

3.1 Correctness Analysis

In this section, we choose 8 cases to show that the output of four-party protocol is correct in Table 1. There are four parties, P 1, P 2, P 3, P 4. Each of them has a private information M i , i = 1, 2, 3, 4. For i = 1, 2, 3, 4, P i divides his binary representation of M i into \(\left \lceil {\frac {L}{2}} \right \rceil \) groups and each groups includes two bits denoted by \({G_{j}^{i}} \). The initial states of TP are denoted by \(I{v_{j}^{1}}I{v_{j}^{2}}(j=1,2,...,\left \lceil {\frac {L}{2}} \right \rceil )\). P 1, P 2, P 3, P 4 agree that I P (I S ) encodes 0; U P (U S ) encodes 1; they also agree that |H〉,|S〉 P ,|a 1〉,|s〉 S encode 0; |V〉,|A〉 P ,|a 2〉,|a〉 S encode 1. In the table 1, we suppose that the initial state is |H〉|a 2〉 and the initial state is encode by 01. P 1, P 2, P 3, P 4 perform the unitary operations on the initial state and get new state. The measurement of new state is encode by \({r_{j}^{1}}{r_{j}^{2}}\). The comparison result of P 1, P 2’s private information \({G_{j}^{1}},{G_{j}^{2}}\) is denoted by \(R_{j}^{12}\), where \(R_{j}^{12} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{3}} \oplus {G_{j}^{4}} \oplus 01\); The comparison result of P 1, P 3’s private information \({G_{j}^{1}},{G_{j}^{3}}\) is denoted by \(R_{j}^{13}\), where \(R_{j}^{13} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{2}} \oplus {G_{j}^{4}} \oplus 01\) ; the comparison result of P 2, P 3’s private information \({G_{j}^{2}},{G_{j}^{3}}\) is denoted by \(R_{i}^{23}\), where \(R_{j}^{23} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{4}} \oplus 01\) ; The comparison result of P 1, P 4’s private information \({G_{j}^{1}},{G_{j}^{4}}\) is denoted by \(R_{j}^{14}\) , , where \(R_{j}^{14} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{2}} \oplus {G_{j}^{3}} \oplus 01\); the P 2, P 4’s private information \({G_{j}^{1}},{G_{j}^{4}}\) is denoted by \(R_{j}^{24}\), where \(R_{j}^{24} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{3}} \oplus 01\) ; the P 3, P 4’s private information \({G_{j}^{3}},{G_{j}^{4}}\) is denoted by \(R_{j}^{34}\), where \(R_{j}^{34} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{2}} \oplus 01\).

Table 1 P 1, P 2, P 3, P 4
Full size table

Before TP measures the states, P 5 can join the protocol to compare his private information. The output of five-party protocol is also correct and we choose 4 cases to show that the output of five-party protocol is correct in Table 2. There are five parties, P 1, P 2, P 3, P 4, P 5. Each of them has a private information M i , i = 1,2,3,4,5. For i = 1,2,3,4,5, P i divides his binary representation of M i into \(\left \lceil {\frac {L}{2}} \right \rceil \) groups and each groups includes two bits denoted by \({G_{j}^{i}} \). The initial states of TP are denoted by \(I{v_{j}^{1}}I{v_{j}^{2}}(j=1,2,...,\left \lceil {\frac {L}{2}} \right \rceil )\). P 1, P 2, P 3, P 4, P 5 agree that I P (I S ) encodes 0; U P (U S ) encodes 1; they also agree that |H〉,|S〉 P ,|a 1〉,|s〉 S encode 0; |V〉,|A〉 P ,|a 2〉,|a〉 S encode 1. In the table 2, we suppose that the initial state is |H〉|a 2〉 and the initial state is encode by 01. P 1, P 2, P 3, P 4, P 5 perform the unitary operations on the initial state and get new state. The measurement of new state is encode by \({r_{j}^{1}}{r_{j}^{2}}\). The comparison result of P 1, P 2’s private information \({G_{j}^{1}},{G_{j}^{2}}\) is denoted by \(R_{j}^{12}\), where \(R_{j}^{12} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{3}} \oplus {G_{j}^{4}}\oplus {G_{j}^{5}} \oplus 01\); The comparison result of P 1, P 3’s private information \({G_{j}^{1}},{G_{j}^{3}}\) is denoted by \(R_{j}^{13}\), where \(R_{j}^{13} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{2}} \oplus {G_{j}^{4}} \oplus {G_{j}^{5}}\oplus 01\); the comparison result of P 1, P 4’s private information \({G_{j}^{1}},{G_{j}^{4}}\) is denoted by \(R_{j}^{14}\), where \(R_{j}^{14} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{2}} \oplus {G_{j}^{3}} \oplus {G_{j}^{5}} \oplus 01\); the comparison result of P 1, P 5’s private information \({G_{j}^{1}},{G_{j}^{5}}\) is denoted by \(R_{j}^{15}\), where \(R_{j}^{14} = {r_{j}^{1}} {r_{j}^{5}} \oplus {G_{j}^{2}} \oplus {G_{j}^{3}} \oplus {G_{j}^{4}} \oplus 01\); the comparison result of P 2, P 3’s private information \({G_{j}^{2}},{G_{j}^{3}}\) is denoted by \(R_{i}^{23}\), where \(R_{j}^{23} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{4}} \oplus {G_{j}^{5}}\oplus 01\) ; the P 2, P 4’s private information \({G_{j}^{2}},{G_{j}^{4}}\) is denoted by \(R_{j}^{24}\) , where \(R_{j}^{24} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{3}} \oplus {G_{j}^{5}} \oplus 01\); the P 2, P 5’s private information \({G_{j}^{2}},{G_{j}^{5}}\) is denoted by \(R_{j}^{25}\), where \(R_{j}^{25} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{3}} \oplus {G_{j}^{4}} \oplus 01\) ; the P 3, P 4’s private information \({G_{j}^{3}},{G_{j}^{4}}\) is denoted by \(R_{j}^{34}\), where \(R_{j}^{34} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{2}} \oplus {G_{j}^{5}} \oplus 01\) ; the P 3, P 5’s private information \({G_{j}^{3}},{G_{j}^{5}}\) is denoted by \(R_{j}^{35}\), where \(R_{j}^{35} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{2}} \oplus {G_{j}^{4}} \oplus 01\); the P 4, P 5’s private information \({G_{j}^{3}},{G_{j}^{4}}\) is denoted by \(R_{j}^{45}\), where \(R_{j}^{45} = {r_{j}^{1}} {r_{j}^{2}} \oplus {G_{j}^{1}} \oplus {G_{j}^{2}} \oplus {G_{j}^{3}} \oplus 01\).

Table 2 P 1, P 2, P 3, P 4, P 5
Full size table

3.2 Security Analysis

Firstly, we show that the outside attack is invalid to our protocol. Secondly, we show that the P 1, P 2, P 3, P 4 can not get any information about the private information of each other.

3.2.1 Outside Attack

According to the description of our protocol in Sub-protocol 1, we can know that P 1,.., P n have to do two times security checking in step (3) and step (5.1)(6). In step (3)((5.1)(6)), the eavesdropper can attack the quantum channel and get the sequence \(Sq_{TP}^{\prime },(Sq_{P_{i-1}}^{\prime },Sq_{P_{n}}^{\prime })\), but he does not know the preparing basis, the photon’s original states and the unitary operation formed on the particles. So in step (3)((5.1)(6)), we performed eavesdropper checking process and several kinds of outside attacks, such as the intercept-resend attack, the measure-resend attack, the entangle-measure attack, were detected with nonzero probability. Therefore, our process is also secure.

According to the description of our protocol in Sub-protocol 2, we can know that \(P_{n^{\prime }},...,P_{n+n^{\prime }}\) have to do two times security checking in step (3) and step (4). In step (3)(4), the eavesdropper can attack the quantum channel and get the sequence \(Sq_{P_{n^{\prime }}},...,Sq_{P_{n+n^{\prime }}}\), but he does not know the preparing basis, the photon’s original states and the unitary operation formed on the particles. So in step (3)(4), we performed eavesdropper checking process and several kinds of outside attacks, such as the intercept-resend attack, the measure-resend attack, the entangle-measure attack, were detected with nonzero probability. Therefore, our process is also secure.

3.2.2 Participant Attack

The term ”participant attack”, which emphasizes that the attacks from dishonest users are generally more powerful and should be paid more attention to, is first proposed by Gao et al in Ref. [22] and has attracted much attention in the cryptanalysis of quantum cryptography [23–28]. We analyze the possibility of the three participants to get information about M i in our protocol.we suppose that any two parties of P h , P k want to know that wether their private information M h , M k are equal or not. Because the roles of others n − 1 parties are the same, firstly analyze the case that P i (i = 1, 2, ..., n, n ≥ 4) wants to learn P j (j = 1,2,..., n, j ≠ i)’s private information M j . Secondly, we analyze the case that TP wants to learn the P i (i = 1, 2, ..., n, n ≥ 4)’s private information M i .

  1. Case 1:

    P i (i = 1, 2, ..., n) wants to learn P h (h = 1, 2, ..., n, j ≠ i)’s private information M h . In our protocol, P i only knows \(Sq_{P_{i-1}}^{\prime }, {r_{1}^{1}} {r_{1}^{2}} \oplus \underset {j = \{ 1,...,n\} ,j < i,j \ne h,k}{\oplus } {G_{1}^{j}} ,...,r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1} r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2} \oplus \underset {j = \{ 1,...,n\} ,j < i,j \ne h,k}{\oplus } G_{\left \lceil {\frac {L}{2}} \right \rceil }^{j}\). P i doesn’t know the initial states S q T P chosen by TP, so he cannot deduce any information from \(Sq_{P_{i-1}}^{\prime }\). And he also doesn’t know the \({r_{i}^{1}},{r_{i}^{2}}\) which is the measurement of \(Sq_{P_{n}}\), so he cannot deduce any information about others parties private information from \({r_{1}^{1}} {r_{1}^{2}} \oplus \underset {j = \{ 1,...,n\} ,j < i,j \ne h,k}{\oplus } {G_{1}^{j}} ,...,r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1} r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2} \oplus \underset {j = \{1,...,n\} ,j < i,j \ne h,k}{\oplus } G_{\left \lceil {\frac {L}{2}} \right \rceil }^{j}\).

  2. Case 2:

    TP wants to learn \(P_{i}^{\prime }s(i = 1,2,...,n,n \ge 4)\) private information M i . TP can get \(Sq_{TP},Sq_{P_{n}}, {r_{1}^{1}} {r_{1}^{2}} ...r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1} r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2},r_{1}^{1'} r_{1}^{2'} ,...,r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1'} r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2'} \),

From our protocol, we can know that n parties perform \({U_{P}^{1}},{U_{S}^{2}}\) on S q T P according to their private information and get \(Sq_{P_{n}}\). Because there are n parties, TP cannot infer the private information of every party according \(Sq_{P_{n}}, Sq_{TP}\).

From the protocol, we can know the relationship between \({r_{1}^{1}} {r_{1}^{2}} ...r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1} r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2}, r_{1}^{1\prime } r_{1}^{2\prime } ,...,r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1\prime } r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2\prime }\) is that \(r_{1}^{1\prime } r_{1}^{2\prime } = {r_{1}^{1}} {r_{1}^{2}} \oplus \underset {j \in \{ 1,2,...,n\} ,j \ne k,h}{\oplus } {G_{1}^{j}} , ... r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1\prime } r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2\prime } = r_{\left \lceil {\frac {L}{2}} \right \rceil }^{1} r_{\left \lceil {\frac {L}{2}} \right \rceil }^{2} \oplus \underset {j \in \{ 1,2,...,n\},j \ne k,h}{\oplus } G_{\left \lceil {\frac {L}{2}} \right \rceil }^{j}\). Because there are n parties and n ≥ 4, we have to execute exclusive OR operation of 2 parties’ private information with \({r_{k}^{1}} {r_{k}^{2}}\) and gets \(r_{k}^{1\prime } r_{k}^{2\prime }\) . TP cannot exactly know the private information of two parties from \({r_{k}^{1}} {r_{k}^{2}}\) and \(r_{k}^{1\prime } r_{k}^{2\prime }\).

4 Discussion and Conclusions

In summary, we have put forward a dynamic quantum private comparison protocol based on single photons in both polarization and spatial-mode degrees of freedom. The dynamic property of our protocol is reflected in two aspects: one is that two parties can be dynamically chosen from n parties to compare their private information with the help of other n − 2 parties. The other aspect is that before the particles are measured, n ′ party can join in the comparison protocol and the n parties’ comparison protocol dynamically extend to a n + n ′ parties’ protocol. The proposed protocol uses the single photons in both polarization and spatial-mode degrees of freedom as the information carriers. The proposed protocol can resist the outside attacks using the checking particles. And any one party cannot get others parties’ private information.