Multiparty Quantum Computation for Summation and Multiplication with Mutually Unbiased Bases

Abstract

We present an efficient protocol to securely compute the summation and multiplication of the multiparty secure numbers via quantum states in MUBs. In our protocols, we assume the third party Alice is semi-honest which means Alice might want to steal the secret messages of the participants but cannot be corrupted by the participants. The agents use decoy photons which are randomly in one of 2d^m nonorthogonal multiparticle states to prevent the eavesdropper and potential dishonest agents from freely eavesdropping on the secure information. The scheme requires the agents of computation to transmit fewer particles for multiparty summation and multiplication, which makes the scheme more convenient to use than others. Moreover, it has the advantage of having high information capacity per photon for summation and multiplication in multiparty quantum computation.

1 Introduction

The application of quantum state as an information carrier in quantum communication enables some novel ways to transmit messages securely, such as quantum key distribution[1,2,3,4,5,6,7,8,9,10,11,12], quantum secret sharing [13,14,15,16,17,18], quantum secure direct communication [19,20,21,22,23,24,25,26,27], deterministic secure quantum communication [28,29,30,31], quantum entanglement concentration [32, 33], quantum state transfer [34, 35], quantum Zeno effect [36], blind quantum computation [37], quantum machine learning [38, 39] and secure multiparty quantum computation [40,41,42,43].

In secret sharing, the secret message M is split into two parts M = M₁ ⊕ M₂ [13, 14]. The agents can reconstruct the secret message if and only if all the agents cooperate. Quantum secret sharing (QSS) has provided a secure way to share the secret message and it has progressed quickly since the original quantum secret sharing scheme was first proposed in 1999 by Hillery, $\mathrm{Bu}\check{\mathrm{z}} \mathrm{ek}$ and Berthiaume using three-particle entangled states[13]. Various protocols for QSS have been proposed via different quantum entangled states [44,45,46]. In 2003, Guo et al. presented a scheme for QSS without quantum entanglement and the efficiency of QSS has been improved to 100% [44]. Now, theoretical and experimental protocols for QSS have been studied by many groups [44,45,46,47,48,49].

Another important branch in cryptography is secure multiparty computation (SMC). Secure multiparty summation and secure multiparty multiplication play important roles in SMC. Similar to QSS, researchers have devoted much time to quantum secure multiparty summation and multiplication based on quantum entanglement, or quantum secure multiparty summation protocols based on single-particle states. For example, in 2006, Hillery et al. presented a protocol for multiparty quantum summation with two-particle high-dimensional entangled states [50]. Du et al. proposed a scheme for a quantum secure addition module n + 1(n ≥ 2) based on non-orthogonal single-particle states [51]. Zhang et al. proposed a protocol for quantum multiparty secure summation based on single photons in both polarization and spatial-mode degrees of freedom [52]. In 2010, Chen et al. described a method for quantum summation between multiparties by using multiparticle entangled states as the information carrier [53]. Zhang proposed a protocol for three-party secure quantum summation with a six-qubit entangled state [54]. In 2016, Shi et al. presented a scheme for multiparty quantum summation with a 2m-qubit entangled state $\mid \psi \left\rangle =\frac{1}{\sqrt{N}}{\sum}_{j=0}^{N-1}{e}^{\frac{2\pi i{x}_1j}{N}}\mid jj\right\rangle$ [55]. Moreover, they proposed a scheme for multiparty quantum multiplication with the 2m-qubit entangled state. In 2017, Liu et al. presented a protocol for multiparty quantum secure summation with a two-particle Bell state [56]. Yang and Ye presented a protocol for multiparty quantum summation based on quantum Fourier transform [57]. Recently, the experimental realization of secure quantum summation via five-qubit IBM quantum computers on a cloud has been reported [58].

Mutually unbiased bases (MUBs), have attached much interest since the concept was first introduced by Ivanovic [59]. Wootters and Fields studied optimal state determination with the measurements in mutually unbiased bases [60]. Yuan et al. showed that measurements in MUB can be practically realized in the cavity quantum electrodynamics (QED) systems by performing corresponding unitary transmissions [61]. The security of a quantum key distribution with an MUB of d-dimensional system was discussed by Cerf et al. in 2002 [63]. Experimental realization of higher-dimensional quantum key distribution based on MUB via photons carrying orbital angular momentum was studied in [62], which demonstrated that the information capacity and key generation rate of quantum key distribution based on MUB increases with the dimension of the quantum system. MUBs in arbitrary bipartite spaces C^d ⊗ C^d are investigated via an unextendible maximally entangled basis [64].

In quantum secure communication, it’s long been understood that the agents can utilize single-particle states in mutually unbiased bases (MUBs) or quantum entangled states to guarantee the security of communication. But there is still no general method to perform multiparty secure summation and multiplication via single-particle states in MUBs [53,54,55,56]. In this work, we will present a protocol for multiparty secure quantum summation and multiplication via two MUBs of a high-dimensional quantum system. In our protocols, we assume the third party Alice is semi-honest which means Alice might want to steal the secret messages of the participants but cannot be corrupted by the participants. The agent uses decoy photons randomly chosen from d^2m nonorthogonal states to prevent eavesdropping and dishonest agents freely stealing the secret messages. Quantum entanglement is not necessary in our protocol for multiparty summation and multiplication, which makes this protocol more convenient to use than others. Moreover, the protocol has the advantage of having high efficiency since the information capacity and key generation rate per photon of quantum secure summation and multiplication increase with the dimensionality of the quantum system.

2 Secure Multiparty Quantum Summation Based on Mutually Unbiased Bases of D-Dimensional Quantum System

To present the principle of our scheme clearly, we first discuss a secure multiparty quantum summation based on the MUB of d-dimensional quantum system, then propose the protocol for secure multiparty quantum multiplication via d-dimension MUB.

Similar to Ref. [62], two orthonormal bases of N-dimensional quantum system $\left\{|{\psi}^{j_1}\Big\rangle, {j}_1=0,\cdots \kern0.3em ,N-1\right\}$, $\left\{\mid {\varphi}^{j_2}\right\rangle,$j₂ = 0,⋯ ,N − 1} are said to be MUBs if and only if they satisfy:

$$ \mid \left\langle {\psi}^{j_1}|{\varphi}^{j_2}\right\rangle \mid =\frac{1}{\sqrt{N}}. $$

(1)

The two MUBs of N-dimensional quantum system can be written as [63]:

$$ {\displaystyle \begin{array}{rcl}\mid {\psi}^{l_1}\Big\rangle & =& \mid {l}_1\Big\rangle \\ {}\mid {\varphi}^{l_2}\Big\rangle & =& \frac{1}{\sqrt{N}}\sum \limits_{j=0}^{N-1}{e}^{\frac{2\pi i}{N}j{l}_2}\mid j\Big\rangle \end{array}} $$

(2)

where l₁,l₂ = 0,1,⋯ ,N − 1. Similar to Ref. [65], the states $\mid {\psi}^{l_1}\Big\rangle$, $\mid {\varphi}^{l_2}\Big\rangle$ in the two MUBs can be written as a tensor product of m qudits (N = d^m).

$$ {\displaystyle \begin{array}{rcl}\mid {\psi}^{l_1}\Big\rangle & =& \mid {l}_{1,m-1}\left\rangle \otimes \mid {l}_{1,m-2}\right\rangle \otimes \cdots \otimes \mid {l}_{1,0}\Big\rangle \\ {}\mid {\varphi}^{l_2}\Big\rangle & =& \left(\frac{1}{\sqrt{d}}\sum \limits_{j_{m-1}=0}^{d-1}{e}^{\frac{2\pi i}{N}{d}^{m-1}{j}_{m-1}{l}_2}|{j}_{m-1}\Big\rangle \right)\\ {}& & \otimes \left(\frac{1}{\sqrt{d}}\sum \limits_{j_{m-2}=0}^{d-1}{e}^{\frac{2\pi i}{N}{d}^{m-2}{j}_{m-2}{l}_2}|{j}_{m-2}\Big\rangle \right)\\ {}& & \otimes \cdots \otimes \left(\frac{1}{\sqrt{d}}\sum \limits_{j_0=0}^{d-1}{e}^{\frac{2\pi i}{N}{j}_0{l}_2}|{j}_0\Big\rangle \right),\end{array}} $$

(3)

where

$$ {\displaystyle \begin{array}{rcl}{l}_1& =& {l}_{1,m-1}{d}^{m-1}+{l}_{1,m-2}{d}^{m-2}+\cdots +{l}_{1,0}\\ {}j& =& {j}_{m-1}{d}^{m-1}+{j}_{m-2}{d}^{m-2}+\cdots +{j}_0.\end{array}} $$

(4)

Here l_{1, m− 1},⋯ , l_1,0, j_m− 1,⋯ , j₀ = 0,⋯ , d − 1.

The unitary operation

$$ {U}_x^1=\sum \limits_{l=0}^{N-1}{e}^{\frac{2\pi i}{N} xl}\mid l\oplus x\left\rangle \right\langle l\mid $$

(5)

flips the m-qudit states into two mutually unbiased bases:

$$ {\displaystyle \begin{array}{rcl}{U}_x^1\mid {\psi}^l\Big\rangle & =& \mid {\psi}^{l\oplus x}\Big\rangle \\ {}{U}_x^1\mid {\varphi}^l\Big\rangle & =& \mid {\varphi}^{l\oplus x}\Big\rangle .\end{array}} $$

(6)

Suppose there are n participants Alice₁, Alice₂,⋯, Alice_n. Each participant Alice_i (i = 1,2,⋯ ,n) has a string of secret numbers X_i.

$$ {\mathbf{X}}_i=\left({x}_{i1},\cdots \kern0.3em ,{x}_{ip}\right), $$

(7)

where x_ij ∈{0,1,⋯, N − 1}, N = d^m and j = 1, 2,⋯ ,p. Similar to Ref. [55], all the participants want Alice to calculate the summation ${\sum}_{i=1}^n{\mathbf{X}}_i modN$ without revealing the secret number X_i.

$$ \sum \limits_{i=1}^n{\mathbf{X}}_i modN=\left(\sum \limits_{i=1}^n{x}_{i1} modN,\cdots \kern0.3em ,\sum \limits_{i=1}^n{x}_{ip} modN\right). $$

(8)

Similar to Ref. [52], the initiator Alice prepares a sequence of ordered p m-qudit states S which are randomly in one of two MUBs $\left\{|{\psi}^{l_j}\Big\rangle, {l}_j=0,1,\cdots \kern0.3em ,N-1\right\}$, $\left\{|{\varphi}^{l_j}\Big\rangle, {l}_j=0,1,\cdots \kern0.3em ,N-1\right\}$ (j = 1,2,⋯ ,p). To prevent potential eavesdroppers and dishonest agents from stealing the secret information freely, Alice prepares the decoy photons which are randomly in one of two MUBs {|ψ^l〉, l = 0, 1,⋯, N − 1}, {|φ^l〉, l = 0, 1,⋯, N − 1} and inserts them randomly into the sequence to form a new sequence S¹ [52]. Since the position of decoy photons are unknown by the potential eavesdropper and dishonest agent, their eavesdropping will disturb the state of decoy photons and be detected by Alice in the secure check process. Alice sends the sequence S¹ to Alice₁.

After confirming that Alice₁ has received all the m-qudit states sent by Alice, Alice publishes the positions of the decoy photons. Similar to Refs. [52, 66], Alice₁ first measures the decoys randomly in one of two MUBs, then publishes the information about this measurement, including the measurement basis and the measurement results. Alice can determine the error rate by comparing ${\mathrm{Alice}}_1^{\prime }s$ measurement results with the initial states of decoy photons. If the error rate exceeds the threshold, Alice aborts the secret communication. Otherwise, the protocol continues.

Alice₁ removes the decoy photons and applies unitary operation ${U}_{x_{1j}}^1$ (j = 1,2,⋯ ,p) on the jth m-qudit state in the ordered m-qudit sequence S according to his secret message X₁. Similar to Ref. [55], unitary operation ${U}_{x_{1j}}^1$ transforms the jth m-qudit state $\mid {\psi}^{l_j}\Big\rangle$, $\mid {\varphi}^{l_j}\Big\rangle$ in the ordered sequence S to the corresponding state $\mid {\psi}^{l_j\oplus {x}_{1j}}\Big\rangle$, $\mid {\varphi}^{l_j\oplus {x}_{1j}}\Big\rangle$. After performing the unitary operations, Alice₁ prepares the decoy photons in a way similar to Alice and then randomly inserts them into sequence S to form a new sequence S². Alice₁ sends the sequence S² to the next agent Alice₂. Alice₂ performs the process similar to Alice₁, then sends the particles to the next agent, and so on. After the last agent Alice_n applies the unitary operation ${U}_{x_{nj}}^1$ on the jth m-qudit state according to his secret message X_n, the jth m-qudit state in the ordered m-qudit sequence S transforms to the corresponding state$\mid {\psi}^{l_j\oplus {x}_{1j}\oplus \cdots \oplus {x}_{nj}}\Big\rangle$, $\mid {\varphi}^{l_j\oplus {x}_{1j}\oplus \cdots \oplus {x}_{nj}}\Big\rangle$. Since the unitary operations ${U}_{x_{ij}}^1$ (i = 1,2,⋯ ,n and j = 1,2,⋯ ,p) do not change the measurement basis [67], Alice can deterministic get the value l ⊕ x₁ ⊕⋯ ⊕ x_n by performing projective measurement on the each m-qudit state returned with the same MUB as he prepares it.

To perform the multiparty secure quantum summation protocol securely, Alice_n prepares decoy photons in a similar way to the previous agents and then inserts the decoy photons into the ordered sequence to form the new m-qudit sequence named S^n+ 1. Alice_n sends S^n+ 1 back to Alice. After confirming that Alice has received all the m-qudit states sent from Alice_n, Alice_n announces the positions of the decoy photons. Alice measures the decoy photons randomly in one of the two MUBs and publishes the information of this measurement, including measurement bases and measurement results. Alice_n analyzes the error rate. If the error rate exceeds the threshold, they abort the communication.

After the security check, Alice can deterministically obtain the value of l_1j ⊕ x_1j ⊕⋯ ⊕ x_nj (j = 1,2,⋯ ,p) by performing a projective measurement on each m-qudit state returned with the same MUB as it is prepared. According to his knowledge of l_j, Alice can compute the summation${\sum}_{i=1}^n{x}_{ij} modN$.

$$ \sum \limits_{i=1}^n{x}_{ij} modN={l}_j\oplus {x}_{1j}\oplus {x}_{2j}\oplus \cdots \oplus {x}_{nj}\oplus \left(N-{l}_j\right), $$

(9)

where j = 1,2,⋯ ,p.

3 Multiparty Secure Quantum Multiplication Based on MUBs

Similar to the case for multiparty secure quantum summation, suppose there are n participants Alice₁, Alice₂,⋯, Alice_n, each participant Alice_i (i = 1,2,⋯ ,n) has a string of secret numbers X_i = (x_i1, x_i2,⋯, x_ip), where x_ij ∈{1, 2,⋯, N − 1}, N = d^m and j = 1, 2,⋯ ,p. All the participants want to Alice compute the multiplication ${\prod}_{i=1}^n{\mathbf{X}}_i modN$ without revealing their secret numbers.

$$ \prod \limits_{i=1}^n{\mathbf{X}}_i modN=\left(\prod \limits_{i=1}^n{x}_{i1} modN,\cdots \kern0.3em ,\prod \limits_{i=1}^n{x}_{ip} modN\right). $$

(10)

The arbitrary dimension of quantum system d can be factorized and expressed as:

$$ d={q}_1^{k^1}{q}_2^{k^2}\cdots {q}_r^{k^r}, $$

(11)

where q₁,⋯ ,q_r are prime numbers, k¹,⋯ ,k^r are r integers. Similar to Ref. [55], each secret number x_ij (i = 1,⋯ ,n;j = 1,⋯ ,p) can be expressed as:

$$ {x}_{ij}={s}_{ij}{q}_1^{k_{ij}^1}{q}_2^{k_{ij}^2}\cdots {q}_r^{k_{ij}^r}. $$

(12)

Here, s_ij is coprime with d^m since s_ij is coprime with d. Similar to multiparty secure quantum multiplication with entangled states, the multiplication of n secret numbers ${\prod}_{i=1}^n{x}_{ij} modN$ can be written as:

$$ \prod \limits_{i=1}^n{x}_{ij} modN=\left({q}_1^{\sum_{i=1}^n{k}_{ij}^1}\cdots {q}_r^{\sum_{i=1}^n{k}_{ij}^r}\prod \limits_{i=1}^n{s}_{ij}\right) modN $$

(13)

If we get the results of ${\sum}_{i=1}^n{k}_{ij}^1 modN$, ⋯, ${\sum}_{i=1}^n{k}_{ij}^r$modN and ${\prod}_{i=1}^n{s}_{ij}$modN, we can easily compute ${\prod}_{i=1}^n{x}_{ij} modN$. Therefore, the computation of ${\prod}_{i=1}^n{x}_{ij}$modN can be translated into the computations of ${\sum}_{i=1}^n{k}_{ij}^1 modN$, ⋯, ${\sum}_{i=1}^n{k}_{ij}^r$modN and ${\prod}_{i=1}^n{s}_{ij}$modN. The method of computing ${\sum}_{i=1}^n{k}_{ij}^1 modN$, ⋯, ${\sum}_{i=1}^n{k}_{ij}^r$modN has been proposed previously. Below, we only discuss the method of computing ${\prod}_{j=1}^n{s}_j$modN via two MUBs of based on high-dimensional quantum systems.

Similar to the case for multiparty secure quantum summation, The initiator Alice prepares a sequence of ordered p m-qudit states R randomly in one of two nonorthogonal states $\mid {\psi}^{l_j}\Big\rangle$, $\mid {\varphi}^{l_j}\Big\rangle$ (j = 1,2,⋯ ,p) and l_j is coprime with N. To prevent the potentially dishonest agents from stealing the secret information freely, Alice prepares decoy photons in one of two MUBs {|ψ^l〉, l = 0, 1,⋯, N − 1}, {|φ^l〉, l = 0, 1,⋯, N − 1} and inserts them randomly into the m-qudit sequence to form the new sequence R¹. Alice sends R¹ to Alice₁.

After confirming that Alice₁ has received all the particles sent by Alice, Alice announces the positions of the decoy photons. To check the security of the communication Alice₁ measures the decoy photons randomly in one of two MUBs and publishes the measurement results. Alice compares the measurement results with the initial states of decoy photons. If the error rate exceeds the threshold, they abort the communication. Otherwise, the protocol continues.

Alice₁ removes decoy photons and applies unitary operation ${U}_{s_{1j}}^2$ according to his private secret number s_1j (j = 1,2,⋯ ,p) on the jth m-qudit state of the ordered sequence R.

$$ {U}_{s_{1j}}^2=\sum \limits_{l=0}^{N-1}\mid l{s}_{1j}^{-1} modN\left\rangle \right\langle l\mid . $$

(14)

Similar to Ref. [55], since s_1j is coprime with N and therefore its modulo-N multiplication inverse ${s}_{ij}^{-1}$ exists. The unitary operation flips the m-qudit states in the two MUBs and transforms the jth m-qudit state in the ordered sequence to the corresponding state

$$ {\displaystyle \begin{array}{rcl}{U}_{s_{1j}}^2\mid {\psi}^{l_j}\Big\rangle & =& \mid {\psi}^{l_j{s}_{1j}^{-1} modN}\Big\rangle \\ {}{U}_{s_{1j}}^2\mid {\varphi}^{l_j}\Big\rangle & =& \mid {\varphi}^{l_j{s}_{1j} modN}\Big\rangle .\end{array}} $$

(15)

To prevent the eavesdropper from stealing the secret information freely, Alice₁ prepares decoy photons in one of two MUBs by a method similar to Alice and inserts the decoy photons randomly into the ordered sequence R to form the new sequence R². Alice₁ sends the sequence R² to the next agent Alice₂. Similar to the case for multiparty secure summation, Alice₂ performs the process similar to Alice₁, then sends the particles to the next agent, and so on. The jth m-qudit state in the ordered m-qudit sequence R transform to the corresponding state $\mid {\psi}^{l_j{s}_{1j}^{-1}\cdots {s}_{nj}^{-1} modN}\Big\rangle$, $\mid {\varphi}^{l_j{s}_{1j}\cdots {s}_{nj} modN}\Big\rangle$ after the last agent Alice_n applies unitary operation${U}_{s_{nj}}^2$ on the jth m-qudit state according to his secret message X_n.

Since the unitary operations${U}_{s_{ij}}^2$ (i = 1,2,⋯ ,n and j = 1,2,⋯ ,p) do not change the measurement basis, Alice can deterministically get the value${l}_j{s}_{1j}^{-1}\cdots {s}_{nj}^{-1} modN$ or l_js_1j⋯s_njmodN by performing projective measurement on each m-qudit state returned with the same MUB that they prepared.

To perform the multiparty quantum multiplication protocol securely, Alice_n prepares the decoys photons in the same way as the previously agents and then inserts the decoy photons randomly into the ordered sequence Rⁿ to form the new m-qudit sequence R^n+ 1. The last agent Alice_n sends the new sequence R^n+ 1 back to Alice. After conforming that Alice has received all the m-qudit states sent from Alice_n, Alice_n announces the positions of the decoy photons. Similar to the case for multiparty secure quantum summation, Alice measures the decoy photons randomly in one of two MUBs and publishes the information of this measurement. Alice_n analyzes the error rate. If the error rate exceeds the threshold, they abort the communication.

After the security check, Alice can deterministically obtain the value of ${l}_j{s}_{1j}^{-1}\cdots {s}_{nj}^{-1}$modN (j = 1,2,⋯ ,p) or l_js_1js_2j⋯s_njmodN by performing projective measurement on each m-qudit state returned with the same MUB that they prepared. According to his information on l_j, Alice can compute the multiplication ${\prod}_{i=1}^n{s}_{ij} modN$

$$ {\displaystyle \begin{array}{rcl}\prod \limits_{i=1}^n{s}_{ij} modN& =& {l}_j{\varpi}_1^{-1} modN,\\ {}\prod \limits_{i=1}^n{s}_{ij} modN& =& {l}_j^{-1}{\varpi}_2 modN\end{array}} $$

(16)

where

$$ {\displaystyle \begin{array}{rcl}{\varpi}_1& =& {l}_j{s}_{1j}^{-1}\cdots {s}_{nj}^{-1} modN,\\ {}{\varpi}_2& =& {l}_j{s}_{1j}\cdots {s}_{nj} modN\end{array}} $$

(17)

and j = 1,2,⋯ ,p.

It is interesting to notice that the agents can prepare an N-dimensional (N = d^m) single-qudit state for multiparty secure summation and multiplication. This method has the advantage of transmitting fewer particles for multiparty secure summation and multiplication via the arbitrary number N at the expense of preparing and manipulating a quantum system with a higher dimension.

4 Security Analysis

In this section, we will analyze the security of our protocols for multiparty quantum summation and multiplication via MUBs. In contrast to quantum key distribution, in the multiparty quantum summation protocol, the attacks from the outside and the attacks from the all the participants should be considered in security analysis. Not only do eavesdroppers from outside want to steal the participants’ secret information but also some dishonest agents may try to steal other agents’ private secret information. The security task in a quantum summation protocol is to prevent the eavesdropper and dishonest agents from freely eavesdropping on the participants’ private secret inputs. To save the space, we only analyze the security of multiparty quantum summation protocol, since the security of multiparty quantum multiplication protocol is the same as that of multiparty quantum summation protocol.

In our protocol, the agents use decoy photon technique to prevent the eavesdropper from eavesdropping freely on the secret information. The principle of the decoy technique according to Li et al. is that the sender prepares some photons which are randomly in one of N² nonorthogonal states {|ψ^l〉, l = 0, 1,⋯, N − 1}, {|φ^l〉, l = 0, 1,⋯, N − 1}, and then inserts them into the photon sequences [66]. As the states and the positions of decoy photons are unknown for the outside eavesdropper, the eavesdropper will inevitably disturb the state of decoy photons and will be caught during the detection procedure. Thus, the outside eavesdropper’s different kinds of attacks, such as intercept-resend attack, measurement-resend attack and the denial-of-service attack, will be detected during the check procedure. Let us take the intercept-resend attack as an example. Suppose the state of decoy photon is |0〉, the eavesdropper measures the photon randomly in one of two MUBs since he does not know the initial state of the decoy photon. After the measurement, he prepares and sends the fake single photon according to his measurement result. Therefore, the probability of his eavesdropping being detected during the check procedure is $\frac{N-1}{2N}$. The probability of the eavesdropper being detected will be $1-{\left(\frac{N+1}{2N}\right)}^k$ when the sender uses k decoy photons for checking the eavesdropping. The eavesdropper will be detected in a secure check procedure and our protocol is secure against outside attack.

We now discuss the participant attacks in our protocol for multiparty quantum secure summation, which are more complicated in secure analysis than outside attacks. As we know, there are two sorts of participant attacks: individual attack and collusion attack. We first analyze the security of our protocol against an individual attack, then analyze the security of the protocol against a collusion attack. Suppose one of the participants wants to steal the other participant’s secret information. Without loss of generality, suppose Alice₁ wants to steal Alice_j’s (j = 2,3,⋯, n) secret key X_j, then Alice₁ has to intercept the sequence S^j sent from Alice_j, and measures the photons sequence. Alice₁’s eavesdropping will disturb the state of the decoy photons in the sequence S^j since Alice₁ does not know the states and the positions of the decoy photons. Therefore, the eavesdropping will be detected during the security check procedure. Our protocol is secure against an individual attack. However, if the agents Alice_l− 1 and Alice_l+ 1 are dishonest agents, they can collude to get Alice_l’s secret information. To resist the collusion of fewer than n-1 agents, we can use a random order communication model instead of the fixed order communication, as suggested by Shi et al. [55]. That is, the method to choose the next agent is randomly determined by Alice_l, and not predetermined by other agents. Similar to Refs. [54, 55], since any eavesdropping done by an eavesdropper or dishonest agent will inevitably disturb the state of decoy photon and will be detected in security check process [66], the agents can exploit the decoy-photon technique and the random order communication model to prevent outside and participant attacks.

5 Discussion and Summary

If we set p = 1 for all the agents, the vectors X_i is composed of single numbers. All agents can jointly compute the summation of n single numbers ${\sum}_{i=1}^n{X}_i modN$ and the multiplication of n single numbers ${\prod}_{i=1}^n{X}_i modN$ without revealing their secret information. Moreover, if we set m = 1, the m-qudit state is randomly in one of d² nonorthogonal states, which means the agents can calculate the multiparty quantum summation and multiplication with an arbitrary general number d. Similar to Ref. [55], our protocols have the advantage of performing multiparty summation and multiplication in the N-dimension (N = d^m) space by using qudits as the quantum information carriers. The agents can obtain the desired results with the general number d without revealing their respective secret information. From the perspective of entropy, the summation of n single numbers ${\sum}_{i=1}^n{X}_i modN$ (N = d^m) and the multiplication of n single numbers ${\prod}_{i=1}^n{X}_i modN$ with qudits contain more information than the summation of n single numbers ${\sum}_{i=1}^n{X}_i modN$ (N = 2^m) and the multiplication of n single numbers ${\prod}_{i=1}^n{X}_i modN$ with qubits.

In Ref. [55], the agents can exploit the nonlocal correlation of 2m-particle quantum entangled state$\mid \psi \left\rangle =\frac{1}{\sqrt{N}}{\sum}_{j=0}^{N-1}\mid jj\right\rangle$ to avoid the requirement of the application of decoy photons technique to prevent eavesdropper or dishonest agent from freely eavesdropping on the secure information. However, when the agents perform the multiparty secure quantum computation via m-particle state $\mid \psi \left\rangle =\frac{1}{\sqrt{N}}{\sum}_{j=0}^{N-1}\mid j\right\rangle$, the approach in Ref. [55] does not work. To compute multiparty quantum summation ${\sum}_{i=1}^n{X}_i modN$ with the general number N, the protocol for multiparty quantum summation based on the qubit system has to transmit $\mathrm{lo}{g}_2^N$ qubits to accomplish the computation. However, in the protocol for multiparty quantum summation based on qudit system, the agents only need to transmit the single qudit. Similar to Refs. [54, 62]. the protocols for multiparty quantum summation and multiplication with the high-dimensional quantum system have the advantage of having high information capacity and communication efficiency.

In summary, we have presented a protocol for multiparty secure quantum summation based on a high-dimensional quantum system. The agents utilize the decoy photons, which are randomly in one of two MUBs, to prevent the dishonest agents or the eavesdropper form eavesdropping freely on the secure information. The protocol is more convenient to use since it not require a 2m-particle entangled state for multiparty secure summation. We also discuss the protocol for multiparty secure quantum multiplication based on high-dimensional quantum system which is rarely considered in previous papers. Compared with previous protocols, our protocols for multiparty secure quantum summation and multiplication based on high-dimensional quantum system have the advantage of having high quantum communication efficiency.