1: \documentclass[twocolumn,pra,superscriptaddress,eqsecnum]{revtex4}
2: %\usepackage[dvips]{graphics,color}
3: \usepackage{amsmath}
4: \usepackage{amsfonts}
5: %\newcommand{\openone}{\mathrm{I} \! \! 1}
6: \usepackage{amssymb}
7: \usepackage{amstext}
8: \usepackage[sort&compress]{natbib}
9: \usepackage{graphicx} % for full-width figs in 2-column
10: %\usepackage{bm} % for bold math symbols. ?Obsolete?
11: \usepackage{amsmath} % for \text and such
12: \usepackage{wasysym}
13: \usepackage{verbatim} % useful for commenting out stuff
14: \usepackage{amsfonts,amssymb,latexsym,amscd}
15: \usepackage{color}
16: \usepackage{times} % Nice fonts
17: %\usepackage{mathptm} % ?Obsolete?
18: \usepackage{amsthm}
19:
20: \theoremstyle{plain}
21: \newtheorem{theorem}{Theorem}
22: \newtheorem{definition}{Definition}
23: \newtheorem{lemma}[theorem]{Lemma}
24: \newtheorem{corollary}[theorem]{Corollary}
25: \newtheorem{proposition}[theorem]{Proposition}
26: \newtheorem{claim}[theorem]{Claim}
27: \newtheorem*{remark}{Remark}
28: \newtheorem{example}{Example}
29:
30: \begin{document}
31:
32: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
33: \title{Graph States for Quantum Secret Sharing}
34:
35: \author{Damian Markham}
36: \email{djhm@pps.jussieu.fr}
37: \affiliation{Universit\'{e} %de Paris VII, France}
38: Denis Diderot, 175 Rue du Chevaleret, 75013 Paris, France}
39: \affiliation{Department of Physics,
40: Graduate School of Science,
41: University of Tokyo, Tokyo 113-0033, Japan}
42: \author{Barry C. Sanders}
43: \affiliation{Institute for Quantum Information Science, University of Calgary, Alberta T2N 1N4,
44: Canada}
45:
46:
47: %\date{\today}
48:
49: %\pacs{03.67.Mn, 03.67.-a, 02.10.Ox}
50:
51: \begin{abstract}
52: We consider three broad classes of quantum secret sharing with and without eavesdropping
53: and show how a graph state formalism unifies otherwise disparate quantum secret sharing
54: models. In addition to the elegant unification provided by graph states, our approach provides
55: a generalization of threshold classical secret sharing via insecure quantum channels beyond
56: the current requirement of 100\% collaboration by players to just a simple majority in the case of
57: five players. Another innovation here is the introduction of embedded protocols within
58: a larger graph state that serves as a one-way quantum information processing system.
59:
60: \end{abstract}
61:
62: \maketitle
63: \section{Introduction}
64: \label{sec:introduction}
65:
66: Secret sharing is one of the most important information-theoretically secure cryptographic protocols
67: and is germane to online auctions, electronic voting, shared electronic banking,
68: and cooperative activation of bombs. Although first formulated
69: and solved in classical information terms~\cite{Sha79}, two directions have been followed
70: in the quantum case: classical secret sharing with quantum enhancement of channels to protect
71: against eavesdropping~\cite{HBB99} (and experimentally realized~\cite{GRTZ02})
72: and protecting quantum information as an application of quantum error correction~\cite{CGL99}
73: (and experimentally realized in the `continuous variable' Gaussian state case~\cite{TS02}).
74:
75: In secret sharing, a dealer wishes to transmit a secret, which can be a bit string or a qubit string
76: and deals an encoded version of this secret to $n$ players such that some subsets
77: of players can collaborate to reconstruct the secret and all
78: other subsets are denied any information whatsoever
79: about the secret.
80: The access structure is the set of all subsets of players that can obtain the secret,
81: and the adversary structure is the set of all subsets of players that are completely denied the secret.
82:
83: In threshold secret sharing, each player receives precisely one equal
84: share of the encoded secret, and a threshold number of any players~$k$ can collaborate
85: to reconstruct the secret whereas every subset of fewer than~$k$ players is denied any
86: information at all: this scheme is referred to as $(k,n)$ threshold secret sharing and is
87: a primitive protocol by which any information-theoretic secret sharing protocol can be
88: achieved.
89:
90: In each case the channel can be classical or quantum depending on context.
91: A private channel is an authenticated channel that is impervious to eavesdropping.
92: A public channel is an authenticated channel that is open to eavesdropping.
93: Mathematically channels are described by completely positive trace-preserving mappings,
94: even for classical channels as classical information processing can be embedded into
95: a quantum framework.
96:
97: Our goals here are
98: \begin{itemize}
99: \item [(i)]
100: to formulate a secret sharing problem that allows both classical
101: and quantum channels, which can be private or public,
102: \item [(ii)]
103: to introduce three subproblems that
104: show how the original classical secret sharing and the two versions of quantum secret sharing
105: fit into the general problem and highlight the differences between these subproblems,
106: \item [(iii)]
107: develop a graph state formalism~\cite{HDERNB06}
108: that unites these subproblems into one elegant framework,
109: \item [(iv)]
110: extend one class of subproblems concerning classical secret sharing in insecure
111: public channels beyond the existing security proofs that require 100\% collaboration
112: by the players, and
113: \item [(v)]
114: introduce embedded secret sharing protocols for graph states within one-way
115: quantum computing, which could serve as a
116: first step towards implementing integrated secret sharing protocols within quantum computing,
117: e.g. distributed measurement-based quantum computation (MBQC)~\cite{RB01}.
118: \end{itemize}
119:
120:
121:
122: \section{Secret sharing problem and subproblems}
123: \label{sec:problem}
124:
125: To begin we formulate the general problem. The basic unit of classical information is
126: the bit, corresponding to~$\{0,1\}$, and the basic unit of quantum information is the
127: qubit, corresponding to ~$\mathcal{H}_2=\text{span}\{|0\rangle,|1\rangle\}$. Any
128: message can be encoded in a finite string of bits if the information is classical or
129: in a finite string of qubits (perhaps entangled and could be pure or mixed) if the
130: `information' is quantum.
131: \begin{quote}
132: \textbf{Secret Sharing Problem:} A dealer holds a secret~$S$, which is either
133: a bit or a qubit,
134: and must send this secret to $n$ players such any $k$ or more players
135: can reconstruct the secret, and all sets of fewer than~$k$ players as well
136: as eavesdroppers are denied any access whatsoever to the secret.
137: \end{quote}
138: \begin{remark}
139: A secret that is longer than one bit or one qubit can be shared by a distributed protocol
140: that shares the string one bit or qubit at a time.
141: \end{remark}
142: Our new and general formulation of the secret sharing problem is meant to be helpful in that
143: it incorporates various scenarios of secret sharing with quantum or classical
144: channels that can be public or private, and the three major secret sharing
145: areas of study~\cite{Sha79,HBB99,CGL99} are subproblems of this overarching problem.
146: \begin{enumerate}
147: \item [{\sf CC}]
148: \underline{C}lassical secret sharing with private
149: channels between the dealer and each player
150: and private \underline{C}lassical channels shared between each pair of players;
151: \item [{\sf CQ}]
152: \underline{C}lassical secret sharing with public channels between
153: the dealer and each player and either \underline{Q}uantum or classical channels
154: shared between each pair of players
155: \item [{\sf QQ}]
156: \underline{Q}uantum secret sharing wherein the dealer shares quantum channels with each player, and these
157: channels can be private or public, and the players share either \underline{Q}uantum or classical
158: private channels between each other.
159: \end{enumerate}
160:
161: As secret sharing is information-theoretically secure, the distribution of a classical secret message
162: is completely secure without the need for quantum information, in contrast to quantum key
163: distribution~\cite{BB84}, which catapults key distribution over public channels to information-theoretic
164: security from the classical limited computational-security guarantee.
165: Thus case~{\sf CC}~\cite{Sha79} is resolved fully by classical information processing,
166: but we embed {\sf CC} into a graph state description.
167:
168: Case~{\sf CQ} considers quantum-enhanced protection from eavesdropping over public
169: channels and was first studied for $(2,2)$ threshold secret sharing~\cite{HBB99,KKI99,Chen04}
170: and extended to $(n,n)$ threshold secret sharing~\cite{Xiao04}.
171: The quantum enhancement is achieved by random key distribution
172: enabled via quantum purification.
173:
174: The third case~{\sf QQ} deals with the sharing of quantum information~\cite{CGL99},
175: as opposed to classical information in the first two subproblems identified above.
176: To distinguish this case from the first two cases, the term `quantum state sharing'
177: is sometimes used~\cite{TS02}. In contrast to~{\sf CQ}, which is only solved
178: for the~$(n,n)$ threshold secret sharing case, this quantum information version in
179: private channels is fully general in the sense that the general $(k,n)$ case has
180: been solved as an application of quantum error correction.
181:
182: In summary our graph state formalism unifies known results concerning
183: $(n,n)$~{\sf CQ} plus~{\sf QQ} for higher-dimensional stabilizer states, and
184: adds new results, including $(3,5)$~{\sf CQ}.
185: We expect that our new approach to all forms of quantum secret sharing in
186: the literature will enable further advances because of the elegance and
187: unifying properties of this formalism.
188:
189: \section{Graph States}
190: \label{sec: graphstates}
191:
192:
193: Graph states provide a superb resource for secret sharing, as we show. The advantages of using graph states in this work are threefold. First, they are the most readily available multipartite resource states in the laboratory at present, with graph states of up to 6 qubits already built and used for information processing experimentally~\cite{WRRSWVAZ05,LGZGZYGYP05}, and many proposals for their implementation in various systems. Second, they are natural candidates for integration of different tasks, since they are the main state resource in almost all multipartite quantum information processing tasks, including measurement based quantum computation and error correction (hence the large effort to make them). Third, they allow for an elegant graphical representation which offers an intuitive picture of information flow, and also allow the possible use of graph theoretic results to aid proofs and understanding.
194:
195: In this work we employ graph states in the standard form~\cite{HDERNB06}
196: plus two extensions. These extensions are actually quite simple (modification via local unitaries) and are intended to allow intuitive graphical understanding of how information is encoded and spread over the graphs.
197: The idea is that the secret will be encoded onto classical labels placed on vertices of the graph representing local operations. The inherent entanglement of the graph states allows these labels to be shifted around, allowing us to see graphically which sets of players can access the secrets and which cannot (explicitly written as properties P1-P4, see e.g. Fig.~\ref{fig:GHZMexample}). We will give several examples along the way to make it clear.
198:
199: We will begin by defining these extended `labeled' graph states in Subsec.~\ref{subsec:labeled graph states}, followed by describing the graphical rules of how they are used to spread information and how it can be accessed in Subsec.~\ref{subsec:properties}, finishing with how they change under measurements in Subsec.~\ref{subsec:measurements}.
200:
201: \subsection{Labeled graph states}
202: \label{subsec:labeled graph states}
203:
204: A pure graph state is a state in the Hilbert space~$\mathcal{H}_2^{\otimes n}$,
205: i.e.\ a string of~$n$ qubits. For $|\pm\rangle=(|0\rangle\pm |1\rangle)/\sqrt{2}$
206: and an undirected graph $\mathsf{G}=(\mathsf{V},\mathsf{E})$ comprising $n$ vertices, with
207: \begin{equation}
208: \mathsf{V}=\{\mathsf{v}_i\},\
209: \mathsf{E}=\{\mathsf{e}_{ij}=(\mathsf{v}_i,\mathsf{v}_{j})\}
210: \end{equation}
211: the set of $n$~vertices and the set of edges, respectively.
212: \begin{definition}
213: Two players~$i$ and~$j$ are `neighbours' iff there exists an edge~$\mathsf{e}_{ij}$
214: that connects their respective vertices~$\mathsf{v}_i$ and~$\mathsf{v}_j$.
215: \end{definition}
216: \noindent The set of $i$'s neighbours is denoted~$N_i$.
217:
218: A graph state is created from an initial state
219: \begin{equation}
220: \label{eq:+n}
221: \left|+\right\rangle^{\otimes n}
222: =H^{\otimes n}\left|0\right\rangle^{\otimes n}, \,
223: H=\left|+\right\rangle\left\langle 0\right|
224: +\left|-\right\rangle\left\langle 1\right|,
225: \end{equation}
226: with~$H$ the Hadamard transformation,
227: by applying the two-qubit controlled-phase gate
228: \begin{equation}
229: \label{eq:CZ}
230: \text{CZ}|\epsilon\epsilon'\rangle=(-1)^{\epsilon\epsilon'}|\epsilon\epsilon'\rangle,\,
231: \epsilon,\epsilon'\in\{0,1\},\,|\epsilon\epsilon'\rangle\in\mathcal{H}_2^{\otimes 2}
232: \end{equation}
233: to all pairs of qubits whose corresponding vertices on the graph
234: are joined by an edge and not to any pair not connected by an edge.
235: The commutativity of all CZ operations implies that the
236: order of applying CZ gates is unimportant:
237: \begin{equation}
238: \label{eq:graphstate}
239: |\mathsf{G}\rangle
240: = \prod_{\mathsf{e}\in\mathsf{E}} \text{CZ}_\mathsf{e}|+\rangle^{\otimes n}.
241: \end{equation}
242:
243:
244: We now modify the graph labeling. The usual graph state has each node labeled by
245: its vertex index; in other words the label of vertex~$\mathsf{v}_i$ is the index~$i$, which
246: has a bit string length of $O(\log n$). We append to this label three more bits so the
247: label of vertex~$\mathsf{v}_i$ is $(i,\ell_{i1},\ell_{i2},\ell_{i3})$ for each $\ell_{ij}\in\{0,1\}$.
248:
249: The first two labels are used to describe classical information spread over the state.
250: Over all vertices, we define the vectors
251: $\vec{\ell}_{i\star}=(\ell_{i1},\ell_{i2})$ for the~$i^\text{th}$ vertex,
252: $\vec{\ell}_{\star j}=(\ell_{1j},\ell_{2j},\ldots,\ell_{nj})$ for the~$j^\text{th}$ bit over all~$n$ vertices,
253: and
254: \begin{equation}
255: \label{eq:vecell}
256: \vec{\ell}=(\vec{\ell}_{1\star},\vec{\ell}_{2\star},\ldots,\vec{\ell}_{n\star}).
257: \end{equation}
258: Graphically these labels will be attached to their vertices and used to represent the spreading of classical information. If a vertex $\mathsf{v}_i$ has no label, this is equivalent to setting $\vec{\ell}_{i\star}=(0,0)$.
259:
260: The third additional bit $\ell_{i3}$ occurs in the security of protocols, and is not relevant to the classical information transmitted. For the ease of graphical manipulation of the encoded information, we absorb this bit into the graph itself. Graphically the third bit~$\ell_{i3}$ is depicted as the vertex~$\mathsf{v}_i$
261: being either a $\ocircle$ (the set of which is denoted $\mathsf{V}^\ocircle$), for $\ell_{i3}=0$, or a $\square$ (the set of which is denoted $\mathsf{V}^\square$),
262: for $\ell_{i3}=1$.
263: The vertex set is thus a union of two types of vertices,
264: \begin{equation}
265: \mathsf{V}=\mathsf{V}^\ocircle \cup \mathsf{V}^\square.
266: \end{equation}
267: We thus have the extended graphs $\mathcal{G}=(\mathsf{V}^\ocircle, \mathsf{V}^\square, \mathsf{E})$.
268:
269: These extra labels imply the action of local unitary operations (hence maintaining entanglement properties) via the following definition.
270: \begin{definition}
271: \label{def:labeledgraphstate}
272: The `labeled graph state',
273: is obtained from the graph state~$|G\rangle$ by
274: \begin{align}
275: \label{eq:labeledgraphstate}
276: \left|\mathcal{G}_{\vec{\ell}}\right\rangle
277: =& \bigotimes_i \left( X_i^{\ell_{i1}} Z_i^{\ell_{i2}} \right) \left|\mathcal{G}\right\rangle \nonumber \\
278: \left|\mathcal{G}\right\rangle
279: =& \bigotimes_{j|\mathsf{v}_j\in V^\square}S_j \left|\mathsf{G}\right\rangle
280: \end{align}
281: for
282: \begin{align}
283: X=&|0\rangle\langle 1|+|1\rangle\langle 0|, \nonumber \\
284: Z=&|0\rangle\langle 0|-|1\rangle\langle 1|, \\
285: S=&|0\rangle\langle 0|-i|1\rangle\langle 1|. \nonumber
286: \end{align}
287: \end{definition}
288: \begin{remark}
289: The partial phase shift gate~$S$ is used to perform an $X \leftrightarrow Y$
290: basis transformation
291: for protection against eavesdropping, analogous to the BB84 strategy~\cite{BB84}.
292: \end{remark}
293: %Note that the overall state could be written $|\mathcal{G}_{\vec{\ell}}\rangle~=~\bigotimes_i~\left( X_i^{\ell_{i1}}Z_i^{\ell_{i2}}S_i^{\ell_{i3}}\right)~\left|\mathsf{G}\right\rangle $, without the need for the extended graph. However, putting the third bit into the extended graph suits our purposes much better.
294:
295: \bigskip
296:
297: For encoding purposes, only local $Z$ gates are required, so we introduce another
298: kind of graph state.
299: \begin{definition}
300: The `encoded graph state' is
301: \begin{equation}
302: \label{eq:InformationalState}
303: |\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle
304: = \bigotimes_i Z_i^{\ell_{i2}}|\mathcal{G}\rangle.
305: \end{equation}
306: \end{definition}
307: Thus the encoded graph state is also a labeled graph state with $\ell_{1i}=0$ for all $i$, $|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle~=~|\mathcal{G}_{\vec{\ell}
308: =(0,\ell_{12}, 0,\ell_{22},\ldots ,0,\ell_{n2}) }\rangle$.
309: Encoded graph states exhibit the orthonormality property
310: \begin{equation}
311: \label{eq:Gorthonormality}
312: \left\langle\mathcal{G}_{\vec{\ell}_{\star 2}}\big|\mathcal{G}_{\vec{\ell}'_{\star 2}}\right\rangle
313: =\delta_{\vec{\ell}_{\star 2}\vec{\ell}'_{\star 2}}.
314: \end{equation}
315:
316: % \begin{definition}
317: % \begin{align}
318: % \label{eq:EvenBits}
319: % \text{EvenBits}:&\{0,1\}^{2n}\rightarrow\{0,1\}^n:
320: % \nonumber \\
321: % \vec{\ell}=&\left(l_{11},l_{12},l_{21},l_{22},\ldots,l_{n1},l_{n2}\right)
322: % \nonumber \\ &
323: % \mapsto \vec{\ell}=\left(\ell_1,\ell_2,\ldots,\ell_n\right);
324: % \end{align}
325: % i.e.~ the second bit of each pair in $l_i$ is the bit $\ell_i=\left( 0,l_{i2}\right)$.
326: % \end{definition}
327:
328:
329:
330: \bigskip
331:
332: Encoded graph states~$|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle$
333: can be elegantly expressed in the stabilizer formalism.
334: For $Y=\text{i}XZ$ and stabilizer operators for any $i^\text{th}$ vertex denoted by
335: \begin{equation}
336: \label{eq:eigenoperators}
337: K_i^{\ocircle} = X_i\otimes_{\mathsf{e}_{i,j}\in\mathsf{E}}Z_j,\,
338: K_i^{\square} = Y_i\otimes_{\mathsf{e}_{i,j}\in\mathsf{E}}Z_j,
339: \end{equation}
340: (for circular and square vertices respectively) the encoded state $|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle$ is completely specified by eigenequations
341: \begin{equation}
342: \label{eq:eigenequations}
343: K_i^{\ocircle,\square} |\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle
344: = (-1)^{\ell_{i2}} |\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle\,
345: \forall i \in \mathsf{V}.
346: \end{equation}
347:
348:
349: \begin{figure}
350: \includegraphics[width=3.5cm]{3EG}
351: \caption{\label{fig:GHZConj}
352: % [ADD.. change labels to $\ell_i=(0,l_i)$]\\
353: (Color
354: online) Labeled graph with vertex~$\mathsf{v}_1$,
355: depicted as~1 inside a~$\square$, which indicates that~$S$ has been
356: applied to this vertex, and vertices~$\mathsf{v}_2$ and~$\mathsf{v}_3$,
357: depicted as the numerals~2 and~3 inside~$\ocircle$.
358: The labels $\vec{\ell}_{i\star}=(\ell_{i1},\ell_{i2})$ indicate that operation $X^{\ell_{i1}}Z^{\ell_{i2}}$ have
359: been applied to each qubit~$j$, respectively.
360: For $\vec{\ell}_{i\star}\equiv (0,\ell_{i2})\,\forall i$, this labeled graph state
361: corresponds to the encoded state $|\mathcal{G}_{\vec{\ell}_{\star2}}\rangle~=~Z_1^{\ell_{12}}\otimes~Z_2^{\ell_{22}}\otimes~Z_3^{\ell_{32}}\left(|0++\rangle+i|1--\rangle\right)/\sqrt{2}$ (Eqn.~(\ref{eq:3EG})).
362: }
363: \end{figure}
364: The following two examples, for three and for four qubits, respectively,
365: explain how the stabilizers define the encoded graph states.
366:
367: \begin{example}
368: The three-qubit labeled graph state presented in Fig.~\ref{fig:GHZConj}
369: is the encoded graph state
370: \begin{align} \label{eq:3EG}
371: |G_{\vec{\ell}_{\star 2}}\rangle = Z_1^{\ell_{12}} \otimes Z_2^{\ell_{22}} \otimes Z_3^{\ell_{32}}
372: \left(\frac{|0++\rangle +i|1--\rangle}{\sqrt{2}}\right),
373: \end{align}
374: and is the unique common eigenstate of
375: \begin{align}
376: K_1^\square=&Y_1 \otimes Z_2 \otimes Z_3 \nonumber \\
377: K_2^\ocircle =&Z_1 \otimes X_2 \otimes \openone_3 \nonumber \\
378: K_3^\ocircle =&Z_1 \otimes \openone_2 \otimes X_3,
379: \end{align}
380: with eigenvalues $\vec{\ell}_{\star 2}=(l_{12},l_{22},l_{32})$.
381: \end{example}
382:
383: A four-qubit encoded graph state is given in the following example.
384: First we define the~$n$-qubit Greenberger-Horne-Zeilinger-Mermin ($n$GHZM)
385: graph and corresponding $n$GHZM graph state.
386:
387: \begin{definition}
388: The \emph{$n$GHZM graph} for vertex~$\mathsf{v}_i$ is the degree~$n$ graph
389: \begin{equation}
390: \label{eq:nGHZMi}
391: \mathcal{G}_{n\text{GHZM}}=\left(\mathsf{V}=\{\mathsf{v}_j\},
392: \mathsf{E}=\{(\mathsf{v}_1,\mathsf{v}_{j\neq i})\}\right),
393: \end{equation}
394: and the \emph{$n$GHZM graph state} is the state corresponding to
395: $|\mathcal{G}_{n\text{GHZM}}\rangle$.
396: \end{definition}
397:
398:
399: \begin{example}
400: \label{ex:4GHZM}
401: The $4$GHZM graph is depicted in Fig.~\ref{fig:GHZMexample}(a),
402: and the corresponding encoded $4$GHZM graph state is
403: \begin{align}
404: \label{eq:4GHZMdependencyEG}
405: |\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle
406: =& Z^{\ell_{12}} \otimes Z^{\ell_{22}} \otimes Z^{\ell_{32}}
407: \otimes Z^{\ell_{42}}|\mathcal{G}\rangle, \\
408: |\mathcal{G}\rangle=&\frac{1}{\sqrt{2}}\left( |0+++\rangle + |1---\rangle \right),
409: \nonumber
410: \end{align}
411: and is fully defined by the four stabilizers
412: \begin{align}
413: \label{eq:4GHZMdependencyEG eigen-ops}
414: K_1^\ocircle =&X \otimes Z \otimes Z \otimes Z,\,
415: K_2^\ocircle =Z \otimes X \otimes \openone \otimes \openone, \nonumber \\
416: K_3^\ocircle =&Z \otimes \openone \otimes X \otimes \openone,\,
417: K_4^\ocircle =Z \otimes \openone \otimes \openone \otimes X,
418: \end{align}
419: with eigenvalues $\vec{\ell}_{\star 2}=(l_{12},l_{22},l_{32},l_{42})$.
420: \end{example}
421:
422:
423: \subsection{Dependence and Access}
424: \label{subsec:properties}
425:
426: We first consider sharing a classical secret;
427: sharing quantum secrets follows from this as we will see later.
428: Each qubit represented by a vertex in the graph
429: is held by one player, and the classical secret is encoded into the label~$\vec{\ell}_{\star 2}$.
430: A subset of players is represented by a vertex subset $\mathsf{V'}\subset\mathsf{V}$.
431:
432: For general labeled graph states, all accessible information for $\mathsf{V}'$ resides in the reduced state obtained
433: from the labeled graph state~(\ref{eq:labeledgraphstate}):
434: \begin{equation}
435: \label{eq;reducedstate}
436: \rho_{\mathsf{V'}\vec{\ell}}
437: = \text{Tr}_{\mathsf{V/V'}}|\mathcal{G}_{\vec{\ell}}\rangle \langle\mathcal{G}_{\vec{\ell}}|.
438: \end{equation}
439:
440: In the context of secret sharing, it is important to know what information about~$\vec{\ell}$
441: is contained in $\rho_{\mathsf{V'}\vec{\ell}}$. The information shared between $\rho_{\mathsf{V'}\vec{\ell}}$ and
442: $\vec{\ell}$ exhibits two important properties:
443: \begin{itemize}
444: \item [A1]
445: \emph{Bit dependence:--}
446: $\rho_{\mathsf{V'}\vec{\ell}}$ is \emph{dependent} on bit~$k$ if~$\rho_{\mathsf{V'}\vec{\ell}}$
447: is not invariant under a flip of the~$k^\text{th}$ bit.
448: \item [A2]
449: \emph{Bit access:--}
450: Bit~$k$ is \emph{accessible} if there exists a measurement protocol
451: such that one copy of $\rho_{\mathsf{V'}\vec{\ell}}$ reveals the value of bit~$k$
452: with certainty.
453: \end{itemize}
454: A2$\Rightarrow$A1, but A1$\nRightarrow$A2.
455: Given dependency on a bit, it is especially useful to know what information can be obtained
456: by $\mathsf{V}'$ via local operations and classical communication (LOCC) or via quantum channels.
457:
458: \begin{figure}
459: \scalebox{0.45}{\includegraphics*[0.5cm,8.5cm][21cm,21.5cm]{4GHZShuffle.eps}}
460: %\scalebox{0.7}{\includegraphics*[0.5cm,12cm][21cm,18cm]{4GHZShuffleb.eps}}
461: % \includegraphics[width=9cm]{4GHZShuffle}
462: \caption{\label{fig:GHZMexample}
463: (Color
464: online) Equivalence of labeled graph states depicting bit dependence for four players.
465: (a)~The initial four party encoded graph state corresponds to $\vec{\ell}_{i\star}=(0,l_{i2})$.
466: (b)~Equivalent state with~$\vec{\ell}_{1\star}=(0,0)$, $\vec{\ell}_{2\star}=(0,l_{22})$,
467: $\vec{\ell}_{3\star}=(0,l_{32})$, and $\vec{\ell}_{4\star}=(l_{12},l_{42})$ (see Eqn.~(\ref{eq:4GHZMdepEGb})):
468: bit $\ell_{12}$ has been shuffled from vertex~1 to vertex~4, which is indicated by the arrow in the figure.
469: (c)~Equivalent state with bit $\ell_{22}$ shuffled to the other parties:
470: $\vec{\ell}_{1\star}=(\ell_{22},l_{12})$, $\vec{\ell}_{2\star}=(0,0)$,
471: $\vec{\ell}_{3\star}=(0,\ell_{22}\oplus l_{32})$, and $\vec{\ell}_{4\star}=(0,l_{22}\oplus l_{42})$
472: as indicated by arrows and labels (see Eqn.~(\ref{eq:4GHZMdepEGc)})).
473: NOTE: vertex $\mathsf{v}_i$ without label is equivalent to setting $\vec{\ell}_{i\star}=(0,0)$. }
474: \end{figure}
475:
476:
477: Graphically we ascertain the dependancy of a set of players $\mathsf{V}'$ on the information by shuffling bits between neighbours: that is, exploiting
478: equivalences between labeled graph states with different labels~$\vec{\ell}$.
479: If a label does not occur on one of the vertices in the set $\mathsf{V}'$, that set has no dependency on it. This is obvious because the label would then represent a local unitary operation outside the set $\mathsf{V}'$, which cannot affect the reduced density matrix $\rho_{\mathsf{V}'\vec{\ell}}$. We thus look for equivalences between labeled graph states where labels can be shuffled outside $\mathsf{V}'$ as much as possible.
480: Of course different $\vec{\ell}_{\star 2}$-labeled graph states,
481: equivalently encoded graph states,
482: must be inequivalent because of the orthonormality relation~(\ref{eq:Gorthonormality});
483: indeed this is why we need the~$\vec{\ell}_{\star 1}$ labels.
484:
485:
486: Then the next step is to ascertain if the desired information can be accessed by~$\mathsf{V}'$, which
487: is effected by a measurement protocol corresponding to
488: appropriate combinations of $K_i$~(\ref{eq:eigenoperators}),
489: then exploiting the eigenequation relations~(\ref{eq:eigenequations}).
490:
491: Fortunately the graph readily reveals the appropriate way to do this.
492: Before giving the general rules, we begin with a four-qubit example.
493:
494: \begin{example}
495: \label{ex:4rules}
496: A dealer distributes the encoded graph state~(\ref{eq:4GHZMdependencyEG})
497: to all four players
498: $\mathsf{V}=\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3,\mathsf{v}_4\}$
499: depicted in Fig.~\ref{fig:GHZMexample}(a).
500: In this example we show that, if the three players in~$\mathsf{V}'=\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$ collaborate,
501: they learn two bits $(\ell_{22},\ell_{32})$ of the four-bit encoding and are entirely denied knowledge of
502: two other bits $(\ell_{12},\ell_{42})$, whether they use shared quantum channels or only LOCC.
503: We also see that just two players $\mathsf{V}''=\{\mathsf{v}_2,\mathsf{v}_3\}$ can (and can only) acquire $\ell_{22} \oplus \ell_{32}$ via LOCC,
504: where~$\oplus$ is summation $\mod 2$.
505: \end{example}
506:
507:
508: Acting upon the encoded graph state~(\ref{eq:4GHZMdependencyEG})
509: by the fourth stabilizer of
510: Eq.~(\ref{eq:4GHZMdependencyEG eigen-ops}) yields
511: \begin{align}
512: \label{eq:4GHZMdepEGb}
513: K_4^{\ocircle \ell_{12}}|\mathcal{G}_{\vec{\ell_{\star 2}}}\rangle
514: = & \openone_1 \otimes Z_2^{\ell_{22}} \otimes Z_3^{\ell_{32}}
515: \otimes X_4^{\ell_{12}}Z_4^{\ell_{42}}\left|\mathcal{G}\right\rangle \nonumber \\
516: = & \left|\mathcal{G}_{\vec{\ell}=(0,0,0,
517: \ell_{22},0,\ell_{32},\ell_{12},\ell_{42})}\right\rangle \nonumber \\
518: =& (-1)^{\ell_{12}\ell_{42}} |\mathcal{G}_{\vec{\ell_{\star 2}}}\rangle.
519: \end{align}
520: The player subset $\mathsf{V}'=\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$
521: is thus independent of $\ell_{12}$ because local unitary dependence on $\ell_{12}$
522: has been shuffled to player~$\mathsf{v}_4$'s two-bit label~$\vec{\ell}_{4\star}$.
523: In Fig.~\ref{fig:GHZMexample}(b), this $\ell_{12}$ bit shuffle is depicted
524: as a green arrow from vertex~$\mathsf{v}_1$ to vertex~$\mathsf{v}_4$.
525: Vertex~$\mathsf{v}_1$ is unlabeled because its bit value is now zero,
526: and vertex~$\mathsf{v}_4$ now has a two-bit label $\vec{\ell}_{4\star}=(\ell_{12},\ell_{42})$.
527: The graph states in Figs.~\ref{fig:GHZMexample}(a) and~\ref{fig:GHZMexample}(b)
528: are thus equivalent up to (an irrelevant) global phase.
529:
530: Players in~$\mathsf{V}'$ share a reduced state that is dependent on
531: bits~$\ell_{22},\ell_{32}$.
532: In fact they can perform measurements
533: corresponding to $K_2^\ocircle$ and~$K_3^\ocircle$ to learn
534: these two bits according to~(\ref{eq:eigenequations}).
535: With shared quantum channels, there is no problem in performing such a
536: joint measurement as $K_2^\ocircle$ and~$K_3^\ocircle$ commute and have
537: support only on operations by players in $\mathsf{V}'$.
538: However quantum channels are not required: the players can learn
539: $(\ell_{22},\ell_{32})$ by LOCC because the stabilizers commute locally.
540: In contradistinction a failure of local commutation would imply that
541: these bits could not be learned by LOCC.
542:
543:
544: In fact a smaller set of players can access information.
545: Consider the set of players $\mathsf{V}''=\{\mathsf{v}_2,\mathsf{v}_3\}$.
546: Applying eigenoperator~$K_1^{\ocircle {\ell_{22}}}$ yields
547: \begin{align}
548: \label{eq:4GHZMdepEGc)}
549: K_1^{\ocircle {\ell_{22}}} \left|\mathcal{G}_{\vec{\ell}_{\star 2}}\right\rangle
550: =& X^{\ell_{22}}Z^{\ell_{12}} \otimes \openone \nonumber \\ &
551: \otimes Z^{\ell_{22}+\ell_{32}} \otimes Z^{\ell_{22} + \ell_{42}}|\mathcal{G}\rangle
552: \nonumber \\
553: = & \left|\mathcal{G}_{\vec{\ell}
554: =(\ell_{22},\ell_{12},0,0,0,\ell_{22}\oplus \ell_{32},0,\ell_{22}\oplus \ell_{42})}\right\rangle \nonumber \\
555: =& (-1)^{\ell_{12}\ell_{22}} \left|\mathcal{G}_{\vec{\ell}_{\star 2}}\right\rangle
556: \end{align}
557: This implies that the reduced density matrix only depends on
558: $\ell_{22} \oplus \ell_{32}$. This information can be accessed by measuring
559: \begin{equation}
560: \label{eq:K2K3}
561: K_2^\ocircle K_3^\ocircle= \openone \otimes X \otimes X \otimes \openone.
562: \end{equation}
563: This can be done by LOCC. This shuffling is illustrated in Fig.~\ref{fig:GHZMexample}(c);
564: hence all graph states in Figs.~\ref{fig:GHZMexample}(a) to~\ref{fig:GHZMexample}(c) are equivalent.
565:
566: \begin{remark}
567: Stabilizer operators $K_i^\ocircle$ (and products thereof) are not directly measured by the players under LOCC;
568: rather players locally measure in the~$X_i$, $Y_i=\text{i}X_iZ_i$, or $Z_i$ bases
569: to obtain one-bit outcomes $s_i^X$, $s_i^Y$, and~$s_i^Z$, respectively,
570: where $s_i^\alpha$ is assigned the value~$0$ if the
571: measurement outcome is~$1$, and~$1$ if the measurement outcome is~$-1$.
572:
573: Then the bit value outcome for the measurement of $K_2^\ocircle$ and~$K_3^\ocircle$
574: in Example~\ref{ex:4rules} is
575: \begin{equation}
576: \ell_{22}=s_1^Z \oplus s_2^X, \,
577: \ell_{32}=s_1^Z \oplus s_3^X,
578: \end{equation}
579: respectively.
580: Henceforth when we say players can locally measure an operator,
581: we mean measurement in the sense that local Pauli measurements can be performed
582: and resultant bit outcomes combined to learn the same as if nonlocal
583: stabilizer measurements were performed.
584: \end{remark}
585:
586: For Example~\ref{ex:4rules}, each player's qubit corresponded to a $\ocircle$ vertex.
587: Extending to $\square$ vertices is straightforward
588: by using the $K_i^{\square}$ stabilizers~(\ref{eq:eigenoperators}).
589: Specifically if a vertex is modified by changing its graph representation
590: from a~$\ocircle$ to a~$\square$, in the stabilizers an~$X$ is changed to a~$Y$
591: and we have a corresponding change to the bit transfer.
592:
593: \begin{example}
594: \label{ex:4GHZMsquare}
595: For Examples~\ref{ex:4GHZM} and~\ref{ex:4rules}
596: let the~$\ocircle$ representation of vertex~$\mathsf{v}_1$
597: be changed to a~$\square$ in Fig.~\ref{fig:GHZMexample}(a).
598: Thus, in Fig.~\ref{fig:GHZMexample}(c),
599: the resultant bit pair on vertex~$\mathsf{v}_1$ is $\vec{\ell}_{1\star}=(\ell_{22},\ell_{12}\oplus \ell_{22})$
600: instead of~$\vec{\ell}_{1\star}=(\ell_{22},\ell_{12})$ because modifying $X\mapsto Y=\text{i}XZ$ in the revised
601: stabilizer $K_1^\ocircle \mapsto K_1^\square$ yields an extra $Z$
602: operation leading to~$\oplus 1$ on the second bit (via the appropriate change to Eq,~(\ref{eq:4GHZMdepEGc)})). The others remain the same $\vec{\ell}_{3 \star}=(0,\ell_2 \oplus \ell_3)$, $\vec{\ell}_{4\star}=(0, \ell_2 \oplus \ell_4)$.
603: \end{example}
604:
605: These examples for four qubits are generalizable to $n$ qubits with
606: $\ocircle$ or $\square$ vertices. Here are the general principles for accessibility and
607: dependence of information in an encoded graph state.
608:
609: \begin{proposition}
610: \label{prop:DepAcc}
611: The following principles hold for encoded graphs states $|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle$.
612: \begin{itemize}
613: \item [P1]
614: The encoded graph state $|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle$
615: with one-bit label~$l_{i2}$ on vertex~$\mathsf{v}_i$
616: is equivalent to the labeled graph state $|\mathcal{G}_{\vec{\ell}}\rangle$
617: where vertex~$\mathsf{v}_i$ is relabeled~$0$ and
618: a neighbouring vertex~$\mathsf{v}_j$ is relabeled either
619: $\vec{\ell}_{j\star}=(\ell_{i2},\ell_{j2})$ or $\vec{\ell}_{j \star}=(\ell_{i2},\ell_{j2}\oplus \ell_{i2})$, depending on whether
620: vertex~$\mathsf{v}_i$ is of the type~$\ocircle$ or~$\square$, respectively.
621: The remaining neighbours of $\mathsf{v}_j$, $\mathsf{v}_k \in N_i$
622: are relabeled $(0,\ell_{k2} \oplus \ell_{i2})$.
623: In this way any neighbour of $\mathsf{v}_i$ can shuffle the dependency of $\ell_{i2}$
624: to itself and to its remaining neighbours.
625: Bit shuffling is depicted as green arrows
626: and shows how dependence of the reduced state
627: on bit labels can be transferred from one player to another.
628: \item [P2]
629: \label{Rule: Access i}
630: The bit value $\ell_{i2}$ is accessible by players in set~$\mathsf{V}'$ if and only if
631: $\mathsf{v}_i$ and all its neighbours~$N_i$
632: are in the set~$\mathsf{V}'$.
633: \item [P3]
634: If the set $\mathsf{V}'$ comprises an even number of players, and all their external neighbours
635: (outside the set $\mathsf{V}'$) are neighbours of each and every player in $\mathsf{V}'$, then
636: the sum (mod 2) of all their one-bit labels~$\{\ell_{i2}\}$ is accessible, i.e.\ they can collaborate to find
637: $$\ell_{i2} \oplus \ell_{j2} ... \oplus \ell_{m2},\;\mathsf{v}_i, \mathsf{v}_j,...,\mathsf{v}_m \in \mathsf{V}' .$$
638: \item [P4]
639: If~P2 holds, and players in the set share quantum channels, all information
640: encoded in one-bit labels is accessible. If the set shares only classical channels,
641: and P2 holds, then information accessibility is limited because
642: neighbours $\mathsf{v}_i$ and~$\mathsf{v}_j$ in the set can only learn either $\ell_{i2}$ or $\ell_{j2}$ but not both,
643: but $\mathsf{v}_i$ and~$\mathsf{v}_j$ in the set can learn both~$\ell_{i2}$
644: and~$\ell_{j2}$ if they are not immediate neighbours.
645: \end{itemize}
646: NOTE: The bit shuffling in P1 is not active; rather it recognizes equivalence between labeled graph states.
647: \end{proposition}
648: \begin{proof}
649: All proofs are simply derived from eigenequations~(\ref{eq:eigenoperators}) and~(\ref{eq:eigenequations}), which shuffles bits between players, thereby revealing
650: actual dependence of reduced states on given bit labels~$\{\ell_{i2}\}$.
651:
652: For~P1, suppose vertex~$\mathsf{v}_i$ has a neighbouring vertex~$\mathsf{v}_j$ which is either
653: a~$\ocircle$ or a~$\square$.
654: Then
655: \begin{widetext}
656: \begin{align}
657: |\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle
658: =& (-1)^{\ell_{i2}\ell_{j2}}K_j^{\ocircle \ell_{i2}}|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle
659: = (-1)^{\ell_{i2}\ell_{j2}} \openone_i \otimes Z_j^{\ell_{j2}} X_j^{\ell_{i2}}
660: \otimes_{(\mathsf{v}_k,\mathsf{v}_j)\in\mathsf{E}}Z_k^{(\ell_{k2} + \ell_{j2})}
661: \otimes_{m\neq i,j ; (\mathsf{v}_m,\mathsf{v}_j)\notin\mathsf{E}} Z_m^{l_{m2}}|\mathcal{G}\rangle,
662: \nonumber \\
663: |\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle
664: =& (-1)^{\ell_{i2}\ell_{j2}}K_j^{\square \ell_{i2}}|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle
665: = (-1)^{\ell_{i2}\ell_{j2}} i \openone_i \otimes Z_j^{l_{i2} \oplus \ell_{j2}} X_j^{\ell_{i2}} \otimes_{(\mathsf{v}_k,\mathsf{v}_j)\in\mathsf{E}}Z_k^{(\ell_{k2} + \ell_{j2})}
666: \otimes_{m\neq i,j ; (\mathsf{v}_m,\mathsf{v}_j)\notin\mathsf{E}} Z_m^{\ell_{m2}}|\mathcal{G}\rangle,
667: \end{align}
668: \end{widetext}
669: respectively.
670: Evidently dependency on $\ell_{i2}$ is shuffled from neighbour~$\mathsf{v}_i$ to~$\mathsf{v}_j$,
671: and $\mathsf{v}_j$'s other neighbours are as described in P1.
672:
673: For~P2, players obtain~$\ell_{i2}$ by measuring $K_i^{\ocircle,\square}$ of~(\ref{eq:eigenoperators})
674: and~(\ref{eq:eigenequations}). Because
675: $K_i^{\ocircle, \square}$ is nontrivial on~$i$ and also on~$N_i$,
676: by~(\ref{eq:eigenoperators}), player~$i$
677: and all of~$N_i$ must collaborate to measure~$\ell_{i2}$, and this collaboration is sufficient.
678:
679: For~P3 we start by looking at the case $\mathsf{V}'$ contains only two players. By~(\ref{eq:eigenoperators}) if all neighbours
680: of pair $\mathsf{v}_i,\mathsf{v}_j\in \mathsf{V}'$ are either in the set, or shared outside the set,
681: $K_i^{\ocircle, \square} \cdot K_j^{\ocircle, \square}$ is nontrivial only inside the set, and thus
682: can be measured by the members of the set. This is true since all the~$Z$ from the~$K_i^{\ocircle, \square}$ cancel with the~$Z$ from $K_j^{\ocircle, \square}$ on their common neighbours.
683: Applying $K_i^{\ocircle, \square} \cdot K_j^{\ocircle, \square}$ to~(\ref{eq:eigenequations}), we see that this yields $\ell_{i2}
684: \oplus \ell_{j2}$. Similarly this holds for any even number of players.
685:
686: For the comparison of LOCC to the fully quantum case of~P4, by the above logic if properties
687: P2 and~P3 hold, then the dependency on the associated observables are
688: nontrivial only within the set. As all operators $K_i^{\ocircle, \square}$
689: commute, all observables commute
690: in the nontrivial set, and hence can be measured by global operations.
691:
692: For LOCC, it is clear from~(\ref{eq:eigenoperators})
693: that, if vertices~$\mathsf{v}_i$ and~$\mathsf{v}_j$ are neighbours, then~$K_i^{\ocircle, \square}$
694: and~$K_j^{\ocircle, \square}$ share different
695: local Pauli operators on $i$ and~$j$ hence cannot be simultaneously
696: measured locally;
697: therefore, even if P2 holds, one must choose one measurement or the other.
698: If vertices~$\mathsf{v}_i$ and~$\mathsf{v}_j$ are not neighbours,
699: they are indeed amenable to simultaneous local measurements. Similar statements can be made when P3 holds, but are more complicated graphically and must be taken case by case.
700: \end{proof}
701:
702: \subsection{Local $Z$ and~$Y$ measurements on encoded graph states}
703: \label{subsec:measurements}
704:
705: In our protocols encoded graph states with both $\square$ and $\ocircle$ vertices arise as
706: a result of performing either~$Y$ or~$Z$ measurements on qubits
707: identified by vertices of the labeled graph with only circular vertices.
708: Local Pauli measurements on graph states are described by a
709: simple set of rules, which readily yield the resultant states~\cite{HDERNB06}.
710: These rules were originally stated in terms of graph
711: states up to local unitary operations. For our purposes we would like to
712: incorporate also these local unitary operations into the labeled graph states. We now
713: represent these rules exactly graphically for the~$Z$ and~$Y$
714: measurements, using the labeled graphs above, with no local unitary
715: ambiguity.
716:
717: If a~$Z$ measurement is made on vertex~$\mathsf{v}_i$ of an encoded graph state with circular vertices,
718: the resultant state corresponds to a labeled graph state of the
719: original graph but with vertex $\mathsf{v}_i$ and its edges deleted.
720: For outcome $s_i^Z$, the labels of all vertices in~$N_i$ change to
721: $\vec{\ell}_j\star \mapsto(0,\ell_{j2}\oplus s_i^Z)$.
722: We denote the resultant graph by $g$.
723:
724:
725: If a~$Y$ measurement is made on vertex~$\mathsf{v}_i$ of an encoded graph state with circular vertices,
726: the resultant state is a labeled graph state
727: obtained by applying the following four steps to the original graph;
728: the new graph is denoted $g'$.
729: \begin{itemize}
730: \item [S1] Perform local complementation on~$\mathsf{v}_i$: all existing edges between elements in $N_i$ are removed, and where they did not exist, they are added.
731: \item [S2] Each $\ocircle$ vertex in $N_i$
732: is changed to $\square$.
733: \item [S3] For outcome $s_i^Y$, the labels on the neighbours of $i$ change to $\ell_{j \star} =(0,\ell_{j2}) \rightarrow (0,\ell_{j2}\oplus \ell_{i2} \oplus s_i^Y)$
734: \item [S4] Remove vertex $i$ and all its edges.
735: \end{itemize}
736: \begin{example}
737: \label{ex:ZY}
738: A~$Z$ and a~$Y$ measurement on vertex $\mathsf{v}_1$ of a square graph state with circular vertices
739: changes the graphs as depicted in Fig.~\ref{fig:measurements on a square}.
740: \end{example}
741:
742: \begin{figure}
743: \scalebox{0.45}{\includegraphics*[0.5cm,7.5cm][21cm,22cm]{SquareMeas.eps}}
744: % \includegraphics[width=9cm]{SquareMeas.eps}
745: \caption{\label{fig:measurements on a square}
746: (Color
747: online) When Pauli $Z$ and~$Y$ measurements are made on vertex $\mathsf{v}_1$, graphs~(a)
748: and~(b) metamorphose into~(a$'$) and~(b$'$), respectively.
749: Outcomes $S_i^{\alpha}=0,1$ correspond to measurement eigenvalues $-1,+1$ respectively, and are incorporated into the labels in~(a$'$) and~(b$'$).}
750: \end{figure}
751:
752: These rules can easily be understood by the fact that any encoded graph state with labels $\ell_{i2}=0$ $\forall i$
753: can be written in the form
754: \begin{align}
755: \label{eq:conjugate meas}
756: |\mathcal{G}_{\left(\vec{0}\right)}\rangle
757: =& \frac{1}{\sqrt2} \bigg( |0\rangle_1 |g_{(0\cdots 0)}\rangle_{2,\ldots,n} +
758: |1\rangle_1 |g_{(\underbrace{1\cdots 1}_{\in N_1}0\cdots
759: 0)}\rangle_{2,\ldots,n} \bigg) \nonumber \\
760: =& \frac{\text{e}^{i\pi/4}}{\sqrt2}
761: \bigg( |0'\rangle_1 |g'_{(0\cdots 0})\rangle_{2,\ldots,n}
762: \nonumber \\ &
763: - i |1'\rangle_1 |g'_{(\underbrace{1\cdots 1}_{\in N_1}0
764: \cdots 0)}\rangle_{2,\ldots,n} \bigg),
765: \end{align}
766: with $\{ |0\rangle , |1\rangle\}$ and
767: $$\{|0'\rangle=1/\sqrt{2}(|0\rangle-i|1\rangle), |1'\rangle =1/\sqrt{2} (|0\rangle+i|1\rangle)\}$$
768: the eigenstates of the~$Z$ and~$Y$ Pauli operators, and the corresponding
769: eigenvalues are $+1$ and~$-1$, respectively.
770: Adding labels $\vec{\ell}_{\star 2}$ indicates the application of local $Z$s. This commutes with measuring Pauli $Z$, so the labels carry forward only with the addition of the correction from the measurement itself, e.g. Fig.~\ref{fig:measurements on a square}(a),(a'). However, local $Z$ does not commute with a $Y$ measurement, hence the bit $\ell_{12}$ carries on to the measured graph (S3), e.g. Fig.~\ref{fig:measurements on a square}(b),(b').
771:
772:
773: %The validity of Eq.~(\ref{eq:conjugate meas}) can be proven directly from the definitions of the states~(\ref{eq:graphstate}),~(\ref{eq:labeled graph states}) \ref{} without great difficulty.
774:
775: The following definition follows naturally.
776: \begin{definition}
777: Given a graph~$\mathcal{G}$ with only circular vertices, and associated encoded graph state
778: $|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle$, the graph of the state given by measuring Pauli $Y$ on vertex
779: $i\in \{1,\ldots,n\}$ is called the \emph{conjugate~graph} denoted $g'$, with \emph{conjugate~graph~state} denoted
780: $|g'\rangle_{1,\ldots,n/i}$ and can be found explicitly by following the rules
781: \begin{itemize}
782: \item [R1] Perform local complementation on~$\mathsf{v}_i$.
783: \item [R2] Replace all neighbours of~$i$ with $\square$ vertices.
784: \item [R3] Remove~$\mathsf{v}_i$ and all its edges.
785: \end{itemize}
786: \end{definition}
787:
788:
789: It can easily be shown that encoded conjugate graph states can be written as
790: \begin{align}
791: \label{eq:conjugate graph states}
792: \left|g'_{(0\cdots 0)}\right\rangle =& \frac{e^{-i\pi/4}}{\sqrt2} \bigg( |g_{(0\cdots 0)}\rangle +
793: |g_{(\underbrace{1\cdots 1}_{\in N_1}0\cdots
794: 0)}\rangle \bigg) \nonumber \\
795: \bigg|g'_{(\underbrace{1\cdots 1}_{\in N_1}0
796: \cdots 0)}\bigg\rangle =& \frac{e^{-i\pi/4}}{\sqrt2} \bigg( |g_{(0\cdots 0)}\rangle -i
797: |g_{(\underbrace{1\cdots 1}_{\in N_1}0\cdots
798: 0)}\rangle \bigg)
799: \end{align}
800: so are effectively conjugate to the encoded graph states
801: $$\{\left|g_{(0\cdots 0)}\right\rangle, |g_{(\underbrace{1\cdots 1}_{\in N_1}0\cdots 0)}\rangle \}.$$
802:
803: The following definitions are useful for Sec. \ref{sec: embedded}.
804:
805: %\begin{definition}
806: % The \emph{$i^\text{th}$ subgraph} $\mathcal{G}_i$ of graph~$\mathcal{G}$
807: % is the subgraph $\{\mathsf{v}_i\}\cup N_i$,
808: % and the \emph{$i^\text{th}$ complementary subgraph}
809: % is $\mathcal{G}\backslash\mathcal{G}_i$.
810: %\end{definition}
811:
812: \begin{definition}
813: The $n$GHZM graph $\mathcal{G}_{n\text{GHZM}_i}$
814: is \emph{embedded} in~$\mathcal{G}$ if~$\mathcal{G}_{n\text{GHZM}_i}\subset\mathcal{G}$ and
815: $N_i\cap \mathcal{G}\backslash\mathcal{G}_{n\text{GHZM}_i}=\emptyset$.
816: \end{definition}
817: \begin{definition}
818: The \emph{$n$GHZM graph state} is \emph{embedded}
819: into state $|\mathcal{G}\rangle$ if~$\mathcal{G}_{n\text{GHZM}_i}$
820: is embedded in $\mathcal{G}$.
821: \end{definition}
822:
823: We now have the necessary formalism to develop the various secret sharing
824: protocols.
825:
826: \section{Secret Sharing Protocols}
827: \label{sec:protocols}
828:
829: In this section we introduce our three secret sharing protocols
830: beginning with {\sf CC} for sharing classical secrets in Subsec.~\ref{subsec:direct}.
831: Using our graph state approach, we construct solutions for
832: each of $(n,n)$, $(3,4)$ and~$(3,5)$ threshold secret sharing.
833: These results provide a foundation for our subsequent protocols:
834: {\sf CQ} in Subsec.~\ref{subsec:CQ} and {\sf QQ} in Subsec.~\ref{subsec:QQ}.
835:
836: \subsection{{\sf CC}}
837: \label{subsec:direct}
838:
839: In the {\sf CC} protocol,
840: classical information is directly encoded into the bit string~$\vec{\ell}_{\star 2}$,
841: i.e.~onto the encoded graph state~$\{|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle \}$ in a manner
842: that enables certain sets of collaborating players to access concealed information
843: according to the principles of the
844: secret sharing protocol.
845:
846: Mathematically our protocol is similar to Gottesman's~\cite{Got00} wherein
847: stabilizers are used to share classical secrets in quantum states. A difference between
848: our scheme and Gottesman's is that he uses mixed high-dimensional states
849: whereas our graph state approach enables use of pure states on qubits.
850: Another difference with Gottesman's approach is that our method is not as general:
851: our scheme works for a limited number of $(k,n)$ scenarios whereas
852: Gottesman's method works for any $(k,n)$.
853: Although our scheme is more restrictive, it is applicable to a restricted set of
854: cases and importantly provides a foundation for the protocols discussed in subsequent subsections.
855:
856: The {\sf CC} protocol steps are as follows:
857: \begin{itemize}
858: \item [{\sf CC}1]The dealer encodes the
859: secret bit string~$S$ into the classical information $\vec{\ell}_{\star 2}$ and encodes this onto the
860: $n$-qubit state $\{|\mathcal{G}_{\vec{\ell}_{\star 2}}\rangle \}$.
861: \item [{\sf CC}2] The dealer sends each player one qubit.
862: \item [{\sf CC}3] An authorized set of players
863: accesses the secret bit by measuring appropriate stabilizer operators
864: (prescribed explicitly in each case).
865: \end{itemize}
866: Here we analyze the ability of sets of players to access this
867: information for two cases: using LOCC and using full quantum communication (FQC).
868: We will see that each graph represents a different sharing structure, and that
869: the rules of access are simple in graph terms, and show that some
870: graphs can be used as secret sharing schemes as set out in the introduction.
871: In particular we present schemes for $(n,n)$, $(3,4)$ and~$(3,5)$.
872:
873:
874:
875: \begin{figure}
876: \scalebox{0.46}{\includegraphics*[0.5cm,11cm][21.6cm,19cm]{nGHZShuffle.eps}}
877: %\includegraphics[width=9cm]{nGHZShuggle.eps}
878: \caption{\label{fig:GHZ Dependency}
879: (Color
880: online) Distribution and access of information
881: $\{l_{12},\ldots,l_{n2}\}$ for the n-GHZM state. The green arrows represent uses of dependency Property P1.
882: In~(a) the dependency on $l_{12}$ is taken out of the set, and in~(b) the
883: dependency on $l_{22}$ is shared across the whole set.
884: This encoded graph state gives an $(n,n)$ secret sharing scheme by setting $l_{12}=S$ and
885: the other bits can be set arbitrarily.}
886: \end{figure}
887:
888: We now proceed to give explicit examples of how the dependence and access properties in
889: Sec.~\ref{subsec:properties} can be applied to give secret
890: sharing via the above protocol.
891: We begin by looking at the case of $n$GHZM$_i$ states.
892: Using Property P1, we can see in Fig.~\ref{fig:GHZ Dependency}(a) that
893: the player set $\{\mathsf{v}_1,\ldots,\mathsf{v}_m\}$ depends only on bits $\ell_{22},\ldots,\ell_{m2}$;
894: i.e., the dependency on $\ell_{12}$ has been removed.
895: From P2 it is possible for the same player set to recover all $\ell_{22}\ldots ,\ell_{m2}$, and,
896: by P4, this can be done by LOCC.
897:
898: Explicitly this would be done by
899: player~$1$ measuring $Z_1$ and the remaining players $\{\mathsf{v}_2,\ldots,\mathsf{v}_m\}$ measuring $X_i$ and comparing results to measure $K_2^\ocircle,\ldots,K^\ocircle_m$, yielding $\ell_{22},\ldots,\ell_{m2}$ via
900: eigenequations~(\ref{eq:eigenequations}).
901: Hence, in this case, LOCC is sufficient for all possible information access.
902:
903: Similarly Fig.~\ref{fig:GHZ Dependency}(b) shows how P1 implies that
904: the player subset $\{\mathsf{v}_2,\ldots,\mathsf{v}_m\}$ depends on bits
905: $$l_{22} \oplus \ell_{32}, \ell_{22} \oplus \ell_{42}, \ldots , \ell_{22} \oplus \ell_{m2}$$
906: only and, by~P3 and~P4, they can be accessed simultaneously by LOCC alone.
907: Explicitly this
908: would be done by all players measuring $X_i$.
909: The players in this set then compare results to measure
910: \begin{equation}
911: K_2^\ocircle \cdot K_3^\ocircle, K_2^\ocircle \cdot K_4^\ocircle, \ldots K_2^\ocircle \cdot K_m^\ocircle.
912: \end{equation}
913: Only in the case that all players collaborate would there be a difference between the LOCC and FQ cases;
914: in this case P4 implies that,
915: by LOCC, the players can either access $\ell_{22},\ldots ,\ell_{n2}$ \emph{or} $\ell_{12}$.
916: Obviously, for FQC, all information is simultaneously accessible.
917:
918: We see above that bit $\ell_{12}$ is only accessible when all players act together.
919: By choosing the secret bit
920: $S$ as $S=\ell_{12}$ and fixing all other $\ell_{i2}$ arbitrarily, we obtain the following
921: proposition.
922: \begin{proposition}
923: \label{prop:(n,n)}
924: An encoded $n$GHZM state with $\ell_{12}=S$ and all other $\ell_{i2}$ set to zero
925: enables a~$(n,n)$ direct secret sharing scheme that can be accessed via LOCC.
926: \end{proposition}
927: \noindent
928: This case is depicted in Fig.~\ref{fig:GHZ Dependency}.
929: \begin{figure*}
930: \scalebox{0.7}{\includegraphics*[0.5cm,12cm][21cm,18cm]{SquareShuffle.eps}}
931: % \includegraphics[width=14cm]{SquareShuffle.eps}
932: \caption{\label{fig:square}
933: (Color
934: online) Application of P1 to the square encoded graph state. This
935: graph gives a~$(3,4)$ secret sharing scheme setting $\ell_1=~\ell_2=~\ell_3=~\ell_4=~S$ (see proposition \ref{prop:(3,4)}).}
936: \end{figure*}
937:
938: Now we see that $(3,4)$ threshold secret sharing is attainable with encoded graph states.
939: \begin{proposition}
940: \label{prop:(3,4)}
941: The $4$-qubit ring encoded graph state with $\ell_{12}=\ell_{22}=\ell_{32}=\ell_{42}=S$ enables a~$(3,4)$ direct secret sharing
942: scheme, and LOCC between players suffices for decoding.
943: \end{proposition}
944: \begin{proof}
945: The $4$-qubit ring state is depicted in~Fig.~\ref{fig:square}.
946: We see in Fig.~\ref{fig:square}(a) that P1 shows that pairs
947: $\{\mathsf{v}_1,\mathsf{v}_2\}$, $\{\mathsf{v}_2,\mathsf{v}_3\}$, $\{\mathsf{v}_3,\mathsf{v}_4\}$ and~$\{\mathsf{v}_1,\mathsf{v}_4\}$ are denied any information whatsoever.
948:
949: Figure~\ref{fig:square}(b) shows that the player pair $\{\mathsf{v}_1,\mathsf{v}_3\}$
950: can obtain, and moreover can only obtain, $\ell_{12} \oplus \ell_{32}$.
951: Similarly $\{\mathsf{v}_2,\mathsf{v}_4\}$ obtain,
952: and only obtain, $\ell_{22} \oplus \ell_{42}$.
953: Fig.~\ref{fig:square}(c) reveals that players~$\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$ obtain, and only obtain, $\ell_{22}$ and/or
954: (by using FQC/LOCC) $\ell_{12} \oplus \ell_{32}$.
955:
956: Similarly, players $\{\mathsf{v}_2,\mathsf{v}_3,\mathsf{v}_4\}$ obtain, and only obtain, $\ell_{32}$ and/or (via FQC/LOCC) $\ell_{22} \oplus \ell_{42}$.
957: The remaining triplets obtain, and only obtain,
958: $\ell_{12}$ and/or (via FQC/LOCC) $\ell_{22} \oplus \ell_{42}$ in the case of $\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_4\}$,
959: and~$\ell_{42}$ and/or (FQC/LOCC) $\ell_{12} \oplus \ell_{32}$ in the case of $\{\mathsf{v}_1,\mathsf{v}_3,\mathsf{v}_4\}$.
960:
961: We see that this graph gives a (3,4) threshold scheme by setting
962: \begin{equation}
963: \ell_{12}=\ell_{22}=\ell_{32}=\ell_{42}=S.
964: \end{equation}
965: \end{proof}
966:
967: \begin{figure*}
968: \scalebox{0.8}{\includegraphics*[0.5cm,12cm][21cm,17.5cm]{PentagonShuffle.eps}}
969: % \includegraphics[width=14cm]{PentagonShuffle.eps}
970: \caption{\label{fig:pentagon}
971: (Color
972: online) Application of~P1 to the~$5$-qubit ring encoded graph state to obtain
973: a~$(3,5)$ direct secret sharing scheme by setting $\ell_{12}=~\ell_{22}=~\ell_{32}=~\ell_{42}=~\ell_{52}=~S$.}
974: \end{figure*}
975:
976: Our final result in this subsection concerns the~$(3,5)$ threshold scheme, given by a
977: $5$-qubit ring depicted in Fig.~\ref{fig:pentagon}.
978: \begin{proposition}
979: \label{prop:(3,5)}
980: The five-qubit encoded RING graph state enables $(3,5)$ threshold secret sharing
981: for the {\sf CC} protocol provided that $\ell_{12}=\ell_{22} = \ell_{32} = \ell_{42} = \ell_{52} = S$,
982: with LOCC between players being sufficient for decoding.
983: \end{proposition}
984:
985: \begin{proof}
986: Fig.~\ref{fig:pentagon}(a)
987: shows how P1 implies that players~$1$ and~$2$ cannot access any
988: information because the dependency can be taken away from them.
989: Similarly it is easy to see that no pair of players can access any information by application of~P1.
990: On the other hand if three cyclic neighbours $\{\mathsf{v}_i,\mathsf{v}_j,\mathsf{v}_k\}$ form a set,
991: P1 implies the set only depends on $\ell_{j2}$; this is clear
992: from the case for the player set $\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$ in Fig.~\ref{fig:pentagon}(b).
993: P2 implies the bit can be accessed, and P4 says this access can be achieved via LOCC.
994: Accessing would be accomplished by measuring $K_j^\ocircle$,
995: which is done by locally measuring $Z_i$, $X_j$, $Z_k$.
996:
997: The remaining possible sets of three players are all similar to the~$T$
998: shape in Fig.~\ref{fig:pentagon}(c);
999: in this case the set $\{\mathsf{v}_i,\mathsf{v}_j,\mathsf{v}_k\}$
1000: depends only on $\ell_{i2} \oplus \ell_{j2} \oplus \ell_{k2}$ by property P1.
1001: This is seen for the example $\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_4\}$ in Fig.~\ref{fig:pentagon}(c). By properties P2 and~P4 the players can access the secret by LOCC.
1002: Their procedure is effected by measuring $K_i^\ocircle \cdot K_j^\ocircle \cdot K_k^\ocircle$,
1003: which is accomplished locally by measuring $Y_i$, $Y_j$, $X_k$.
1004:
1005: Any set of more than three players contains at least one of these possibilities,
1006: and the players can therefore access the same information.
1007: By choosing to encode the bit secret~$S$ as
1008: \begin{equation}
1009: \ell_{12}=\ell_{22}=\ell_{32}=\ell_{24}=\ell_{52}=S,
1010: \end{equation}
1011: the proposition is proved.
1012: \end{proof}
1013:
1014: Here we established three examples that use graph states for secret sharing.
1015: These three examples demonstrate the simple properties of our approach,
1016: and more examples of graph states for secret sharing could be found.
1017: In the next two subsections, we extend these results and techniques to secret key distillation
1018: and to sharing a quantum secret.
1019:
1020:
1021: \subsection{\sf CQ}
1022: \label{subsec:CQ}
1023:
1024: In this subsection we address case~{\sf CQ}, which corresponds to the protocol expounded
1025: by Hillery, Bu\v{z}ek, and Berthiaume (HBB) for sending a classical secret with insecure quantum channels between the dealer and players~\cite{HBB99}.
1026: Actually this problem can instead be solved by combining the classical secret sharing
1027: protocol of Shamir~\cite{Sha79} via standard quantum key distribution (QKD)~\cite{BB84}
1028: to assure secure classical channels between the dealer and each of the players.
1029: In the QKD approach, the dealer would first establish a random key with each of the players individually by using QKD. This would enable perfectly secure classical communication between the dealer and each player (as a one time pad), which can then be used to perform the Shamir protocol safely.
1030: However, QKD may not afford the most efficient approach hence the interest in alternative schemes.
1031:
1032: HBB~\cite{HBB99} combine secret sharing protocols with QKD:
1033: the dealer distributes multipartite states to share a secret key,
1034: which can only be distilled by or shared with authorized sets of players.
1035: This key can then be used to send any classical message the dealer would wish to send to the authorized players, without any unauthorized parties having access to it.
1036: The HBB approach can be more efficient in the number of uses of quantum channels between dealer and players,
1037: which is comparable to the greater efficiency achieved by direct distillation of multipartite entanglement
1038: rather than distillation of pairs of maximally entangled states
1039: and complicated sequences of teleportations~\cite{MJPV99}).
1040:
1041: Another benefit is that the HBB approach can be extended to sharing quantum secrets ({\sf QQ}) as we see
1042: in the next subsection.
1043: HBB~\cite{HBB99} created a classical threshold scheme for $(2,2)$ and~$(3,3)$ cases, and this
1044: has been extended to the~$(n,n)$ case in~\cite{Xiao04}.
1045:
1046: We note that, as an extension of HBB, our protocol shares the same drawbacks.
1047: %First, our approach does not give a complete analysis of security, which is beyond the scope of this paper.
1048: The HBB protocol, hence ours, protects against intercept-resend attacks
1049: but is not guaranteed to be secure against other attacks~\cite{KKI99}.
1050: %{\sc [Chinese new one on the archive]},
1051: %and the security of secret sharing protocols continues to be an active research area [] [].
1052: Second, it only works for a noiseless channel:
1053: In the case of a noisy channel, the HBB protocol can not establish a key
1054: (as the noise will be mistaken for an eavesdropper).
1055: This problem is likely not fatal, as approaches involving entanglement distillation or alternatives
1056: could help to overcome the effects of noise in the channel~\cite{Chen04}.
1057:
1058: Our protocol employs graph states to generalize the HBB scheme~\cite{HBB99}.
1059: By using graph states our scheme could build on
1060: current experimental research for generating graph states for
1061: measurement-based quantum computing~\cite{WRRSWVAZ05}.
1062: Further, encoding onto graph states allows us to use the properties developed Sec.~\ref{sec: graphstates} to generalize to other access structures.
1063:
1064: As an example we show how this approach generalizes HBB's protocol to the~$(3,5)$ case, together with the~$(n,n)$ case.
1065: Although other examples are not provided here,
1066: the properties given in Sec.~\ref{subsec:properties} allow further exploration.
1067: In addition, our graph state shows how the HBB protocol can be thought of as an extension to Gottesman's results~\cite{Got00},
1068: in the sense that HBB's protocol can be regarded as a purification of Gottesman's.
1069:
1070: \bigskip
1071:
1072: The underlying concept for the protocol is simple. We use an entangled state as the channel between the dealer~$D$ and~$n$ players. This will be a graph state; hence we can always write
1073: in the following way (c.f.\ Sec.~\ref{subsec:measurements})
1074: \begin{align}
1075: \label{eq:conjugate meas SS}
1076: |\mathcal{G}_{(\vec{0})}\rangle =& \frac{1}{\sqrt2} \Big( |0\rangle_D |
1077: g_{(0\cdots 0)}\rangle_{1,\ldots,n}
1078: \nonumber \\ &
1079: +|1\rangle_D |g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots
1080: 0)}\rangle_{1,\ldots,n}\Big) \nonumber \\
1081: =& \frac{\text{e}^{i\pi/4}}{\sqrt2}\Big( |0'\rangle_D |g'_{(0\cdots 0)}\rangle_{1,\ldots,n}
1082: \nonumber \\ &
1083: - i |1'\rangle_D |g'_{(\underbrace{1\cdots 1}_{\in N_D}0
1084: \ldots 0)}\rangle_{1,\ldots,n} \Big).
1085: \end{align}
1086: The dealer measures randomly in either the~$\{|0\rangle_D,|1\rangle_D\}$ or the~$\{|0'\rangle_D,|1'\rangle_D\}$ basis.
1087: The dealer's measurement outcomes provide the random key.
1088:
1089: Through the entanglement, the players can access the key by making the correct measurement. If the dealer measures in $\{|0\rangle_D,|1\rangle_D\}$, the results are then correlated to the states
1090: $$\{|g_{(0\cdots 0)}\rangle_{1,\ldots,n}, |g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n}\}$$ held by the players. If any set of players can discriminate these states perfectly, they can find out what the measurement result of the dealer was, and thereby obtain the random key.
1091:
1092: The dealer may instead choose to measure in the~$\{|0'\rangle_D,|1'\rangle_D\}$ basis,
1093: and then the player's qubits will end up in either of the associated conjugate states
1094: $$\{|g'_{(0\cdots 0)}\rangle_{1,\ldots,n},
1095: |g'_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n}\}$$
1096: correlated to the measurement result.
1097: The ability to discriminate (or in other words, to access the information $\vec{\ell}_{\star 2}$ and hence get the key) is then determined by the conjugate graph $g'$, which must be checked to have the correct access structure also (if we want to do secret sharing). We see that this works for the GHZ and the 5-qubit ring encoded graph states, but it does not work for the 4-qubit ring encoded graph state. This is why we cannot extend the~$(3,4)$ {\sf CC}
1098: protocol to key distribution in this way.
1099:
1100: In the case of only one player, this corresponds to Ekert's protocol~\cite{Eke91}.
1101: In our case there is the added structure given by the graph~$g$.
1102: Discriminating these states is the same as accessing either the information
1103: $\vec{\ell}_{\star 2} = \vec{0}$ or $\vec{\ell}_{\star 2} = (1,\ldots,1,0,\ldots,0)$.
1104: By choosing the right graph, only the authorized players can access the information, or discriminate the states and access this key. In this first instance we use exactly the graphs of the last protocols to do this. In this way these entangled states~(\ref{eq:conjugate meas SS}) are a purification of the protocols of the last section - taking a random choice of the two graph states (which can be viewed as a mixed state) to an entangled pure state by adding an auxiliary system, which is the dealer in this case.
1105:
1106:
1107:
1108: The players also measure randomly to either discriminate states
1109:
1110: $$\{|g_{(0\cdots 0)}\rangle_{1,\ldots,n},
1111: |g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n}\},$$
1112: or the conjugate states
1113: $$\{|g'_{(0\cdots 0)}\rangle_{1,\ldots,n}, |g'_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n}\}.$$
1114: As seen in Sec.~\ref{subsec:measurements} these states are conjugate in the sense that discriminating the states
1115: $$\{|g_{(0\cdots 0)}\rangle_{1,\ldots,n}, |g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n}\}$$
1116: provides no information about whether we have
1117: $$|g'_{(0\cdots 0)}\rangle_{1,\ldots,n}$$
1118: or
1119: $$|g'_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n}.$$
1120: Thus, the players cannot discriminate both bases simultaneously, so even if a set of players is authorized and can discriminate perfectly, 50\% of the time they will measure in a basis in which they gain no information about the dealer's measurement result, hence will not access the key.
1121: To accommodate this at some point in the protocol,
1122: the dealer or players must announce which basis they measure. Results where the bases match are kept, and those that do not match are discarded.
1123: The remaining results should be perfectly correlated and provide a random key,
1124: often referred to as the `sifted key'.
1125: By standard classical security protocols~\cite{GRTZ02},
1126: this can be distilled to a secret key by the dealer and authorised players sacrificing part of the sifted key.
1127:
1128: In this way our protocols are protected against a large class of attacks, namely the so-called intercept-resend attacks.
1129: For such attacks we imagine an eavesdropper (traditionally called Eve)
1130: who tries to gain information about the secret key by intercepting the qubits before they reach the players, and either measuring them directly or entangling them to some ancilla `spy'-qubits of her own and then sending them on to the players.
1131: (In fact, this eavesdropper could instead be some unauthorized players.)
1132: At any point in the protocol Eve may measure her entangled ancilla spy-qubits to attempt access to the key.
1133: She will try to do this in a way that is not detectable by the dealer and authorized players.
1134:
1135: Measuring in two conjugate bases serves two complementary purposes to counter this particular class of attacks. First the measurements in conjugate bases is decided randomly,
1136: which protects against any intercept-resend eavesdropping strategy:
1137: if Eve knows which measurement the players will make, she can make the same measurement herself and thus be undetected, but, if she does not know the measurement basis, then any intrusion by her will affect the statistics of subsequent measurements and thus be detectable.
1138: Second, measurement in conjugate bases allows checking of correlations to verify that
1139: the global state indeed corresponds to the correct form~(\ref{eq:conjugate meas}), which proves that
1140: Eve has not entangled the state to ancilla during its transit.
1141:
1142: If the measurements are truly random,
1143: we can view them as a kind of tomography of the state shared between the dealer and players, and suppose that all results represent this state faithfully.
1144: In fact these two purposes are not independent and are related to the long history of using entanglement distillation to prove security for key distribution (e.g.~\cite{GRTZ02}). In both cases, the appropriate measurements are the stabilisers of the state.
1145:
1146: %For the case of just one player, we would have an intended shared state
1147: %(prior to the measurement to establish the key) of a maximally entangled pair,
1148: %with one share held by the dealer and one share by the player.
1149: %If Eve measures the flying qubit, this action would be evident in the statistics of the subsequent measurement results.
1150: %By sacrificing some of the sifted key. the dealer and the players can check these statistics to see if Eve intruded.
1151: %Indeed, if Eve entangled any ancilla at all with the propagating qubit,
1152: %this action would affect the statistics
1153: %because by looking at both bases we are essentially checking exactly the entanglement itself - i.e.\ if the measurement results of the dealer and the player are perfectly correlated as they are supposed to be, there is no way that any other system - including that of any Eve - can be entangled. Thus we check exactly that the state is the state we want. Thus, any intercept resend attack can be detected by sacrificing a section of the sifted key.
1154: %
1155: %Generally the key criterion is that an eavesdropper cannot correlate her measurements
1156: %with those of the dealer and authorized players so she cannot then access the key.
1157: %Denial of correlations between the eavesdropper's results with those of the dealer and authorized
1158: %players is possible by verifying that the state lives in a subspace that only has support of the dealer and authorized players, this implies that the dealer's measurements will not be correlated to any eavesdropper or extended environment. The measurements of the dealer and the authorized players will be stabilizers of the overall entangled graph states (i.e.\~(\ref{eq:conjugate meas SS})).
1159: %These ({\sc these what?}) will simultaneously discriminate the states in the right way to give a shared random key, and provide the means to check that the overall state is in a useful form (either completely disentangled to any eavesdropper, or just not correlated) and thus imply security.
1160:
1161: Our protocol runs as follows
1162: \begin{itemize}
1163: \item [{\sf CQ}1] the dealer first prepares the state
1164: $|g_{(0\cdots 0)}\rangle_{1 \ldots n}$ associated to the corresponding CC secret sharing protocol, then entangles extra qubits (known as the dealer's qubits) to each of the qubits upon which the secret is independently distributed (see
1165: Figs.~\ref{fig:purificationnn}a) and~\ref{fig:purification35}a)).
1166: \item [{\sf CQ}2] The dealer distributes to the players their qubits (and keeps the dealer's qubits).
1167: \item [{\sf CQ}3] The dealer and the set of authorized players $\mathsf{V}'$ measure randomly one of a
1168: set of conjugate bases on their qubits and announce they have measured on a public
1169: classical channel.
1170: \item [{\sf CQ}4] The set of players $\mathsf{V}'$ trying to access the secret announce their
1171: measurement basis.
1172: \item [{\sf CQ}5] The dealer announces her measurement basis.
1173: \item [{\sf CQ}6] Classical security protocols follow establishing a secret key between dealer and authorized set of players.
1174: \item [{\sf CQ}7] The secret key is used to send the secret message.
1175: \end{itemize}
1176:
1177:
1178: \begin{figure}
1179: \scalebox{0.45}{\includegraphics*[0.5cm,11cm][21cm,19cm]{nGHZMeas.eps}}
1180: %\includegraphics[width=8cm]{purificationnn}
1181: \caption{\label{fig:purificationnn}
1182: (Color
1183: online) {\sf CQ} for (n,n).
1184: The dealer's qubit is attached so as to encode on the first qubit in
1185: the~$(n,n)$ scheme. As Eqs.~(\ref{eq:conjugate meas}) and~(\ref{eq:nGHZkeydistillation}) indicate,
1186: if the authority measures the control
1187: qubit in $X$ the resulting graphs are those of Fig.~\ref{fig:GHZ Dependency}.
1188: In the case of~$Y$ measurements, the graphs transform to the right graph (b) (see
1189: text for explanation).}
1190: \end{figure}
1191:
1192:
1193: Now we see how this works for the~$(n,n)$ case.
1194: The state prepared by the dealer is that of the~$n$GHZM state with an extra vertex attached to player~1's qubit ({\sf CQ}1);
1195: this extra vertex corresponds to a qubit that is retained by the dealer
1196: as shown in Fig.~\ref{fig:purificationnn}(a).
1197: \begin{align}
1198: \label{eq:nGHZkeydistillation}
1199: |\mathcal{G}_{(\vec{0})}\rangle_{D,1,\ldots,n}
1200: =& \big(|0\rangle_D | g_{(0\cdots 0)}\rangle_{1,\ldots,n} \nonumber \\ &
1201: + |1\rangle_D |g_{(10\cdots 0)}\rangle_{1,\ldots,n}\big)/\sqrt{2} \nonumber \\
1202: =& (|0'\rangle_D | g_{(0\cdots 0)}'\rangle_{1,\ldots,n} \nonumber \\ &
1203: -i|1'\rangle_D |g_{(10\cdots 0)}'\rangle_{1,\ldots,n})/\sqrt{2}.
1204: \end{align}
1205: The stabilizers for state~(\ref{eq:nGHZkeydistillation}) are
1206: \begin{align}
1207: \label{eq:nGHZkeydistillation stabilizers}
1208: K_D^\ocircle =& X_D \otimes Z_1 \otimes \openone_2 \otimes \openone_3 \cdots \otimes \openone_n, \nonumber \\
1209: K_1^\ocircle =& Z_D \otimes X_1 \otimes Z_2 \otimes Z_3 \cdots \otimes Z_n, \nonumber \\
1210: K_2^\ocircle =& \openone_D \otimes Z_1 \otimes X_2 \otimes \openone_3 \cdots \otimes \openone_n, \nonumber \\
1211: K_3^\ocircle =& \openone_D \otimes Z_1 \otimes \openone_2 \otimes X_3 \cdots \otimes \openone_n, \nonumber \\
1212: \vdots & \nonumber \\
1213: K_n^\ocircle =& \openone_D \otimes Z_1 \otimes \openone_2 \otimes \openone_3 \cdots \otimes X_n.
1214: \end{align}
1215:
1216: The qubit corresponding to vertex~$D$ is retained by the the dealer,
1217: and the others qubits are sent to the players ({\sf CQ}2).
1218: As prescribed by the protocol, the dealer measures in the~$Z$ basis $\{|0\rangle_D, |1\rangle_D\}$ or in the~$Y$ basis $\{|0'\rangle_D, |1'\rangle_D\}$,
1219: and the players perform appropriate measurements to distinguish
1220: $|g_{(0\cdots 0)}\rangle_{1,\ldots,n}$ from $|g_{(10\cdots 0)}\rangle_{1,\ldots,n}$, or $|g'_{(0\cdots 0)}\rangle_{1,\ldots,n}$ from $|g'_{(10\cdots 0)}\rangle_{1\ldots n}$, respectively.
1221: Our arguments from the {\sf CC} case show that discriminating $|g_{(0\cdots 0)}\rangle_{1,\ldots,n}$ from $|g_{(10\cdots 0)}\rangle_{1,\ldots,n}$ cannot be done by a subset of fewer than $n$ players.
1222:
1223: Similarly, we can apply properties P1-P4 from Sec.~\ref{subsec:properties} to the conjugate graphs
1224: as shown in Fig.~\ref{fig:purificationnn}(b), to see that the same holds trying to discriminate
1225: $|g'_{(0\cdots 0)}\rangle_{1,\ldots,n}$ from $|g'_{(10\cdots 0)}\rangle_{1,\ldots,n}$.
1226: The players have various choices of how to perform both sets of discriminating measurements. Importantly, the measurements for $g$ will be conjugate to those for $g'$.
1227:
1228: We choose the following measurement strategy. The dealer chooses $Z_D$ or $Y_D$ randomly, player one chooses $X_1$ or $Y_1$ randomly and the other players choose $Z_i$ or $Y_i$ randomly. We will see that 50\% of the time their measurements will coincide to allow a shared key. That is, on half of the cases the randomly chosen combination will be equivalent to performing a suitable stabilzer measurement for which the dealer and players will share a perfect key, and also be able to check statistics for security ({\sf CQ}3).
1229: After the announcements of the measurement bases,
1230: the dealer and the players can discard any results where the bases do not match and are left with the sifted key ({\sf CQ}4,5).
1231:
1232: To see this, first suppose that the dealer measures in the~$Z_D$ basis.
1233: The players can then obtain a secret key (i.e. discriminate $|g_{(0\cdots 0)}\rangle_{1,\ldots,n}$ from $|g_{(10\cdots 0)}\rangle_{1,\ldots,n}$) by measuring any combination of a product of stabilizers for the subgraph~$g$ as long as they include that of player~1's vertex, which we denote $k_1^\ocircle$
1234: (with lowercase for $k$ indicating a stabilizer for the subgraph rather than the graph).
1235:
1236: As we can see by comparing the global state's stabilizers~(\ref{eq:nGHZkeydistillation stabilizers}) and the stabilizers of the subgraph (which can be imagined by extending those of Eq.~(\ref{eq:4GHZMdependencyEG eigen-ops}) to
1237: $n$ parties), including the~$Z_D$ measurement of the dealer, the dealer plus the players are effectively measuring
1238: $K^\ocircle_1$ or any combination of the total graph's stabilizers,
1239: including $K^\ocircle_1$ such as $K^\ocircle_1 \cdot K^\ocircle_i \cdots K^\ocircle_n$.
1240: Such stabilizer products corresponds to local measurements where player~1 measures $X_1$ and the remaining players measure $Z_i$ or $Y_i$ with an even number of those who measure $Y_i$; or player~1 measures $Y_1$ and the remaining players measure $Z_i$ or $Y_i$ with an odd number measuring $Y_i$.
1241:
1242: Similarly, if the dealer measures in the~$Y_D$ basis,
1243: the players can obtain a secret key
1244: by measuring the stabilizers of the conjugate graph depicted in Fig.~\ref{fig:purificationnn}(b),
1245: $k_1^\square$, or any product including this stabilizer:
1246: $k_1^\square \cdot k_i^\ocircle \cdots k_n^\ocircle$ (discriminating
1247: $|g'_{(0\cdots 0)}\rangle_{1,\ldots,n}$ from $|g'_{(10\cdots 0)}\rangle_{1,\ldots,n}$).
1248: Including the measurement by the dealer in the~$Y$ basis,
1249: this set of measurements corresponds to the dealer plus the players measuring stabilizers $K^\ocircle_D \cdot K^\ocircle_1$ or any combination of the graph's stabilizers including $K^\ocircle_D \cdot K^\ocircle_1$, such as $K^\ocircle_D \cdot K^\ocircle_1 \cdot K^\ocircle_i \cdots K^\ocircle_n$. This set of stabilizer measurements corresponds to local measurements where player~1 measures $X_1$ and the remaining players measure $Z_i$ or $Y_i$, as long as there is an odd number of those who measure $Y_i$, or where player~1 measures $Y_1$ and the remaining players measure $Z_i$ or $Y_i$ with an even number of those who measure $Y_i$.
1250:
1251: Thus each combination of measurements $X_1$ or $Y_1$ by player one, and~$Z_i$ or $Y_i$ by the other players corresponds to the correct measurement to discriminate the appropriate encoded graph states either for the dealer measuring $Z_D$ or $Y_D$. The dealer chooses randomly so, $50\%$ of the time the measurements will coincide and results be correlated. After checking the bases match they throw away the cases they don't to give a sifted key.
1252:
1253: As discussed above, the randomness of the measurement bases ensures that any eavesdropper cannot know which measurement to make, and so any interference she introduces will be noticed by standard security checks (step {\sf CQ}4,5,6) of the protocol.
1254: In this case, the dealer and authorized players should randomly choose a part of the sifted key (for example the dealer picks randomly and announces to all the players), and both the dealer and the authorized players announce their results.
1255:
1256: They can then check that the results match those expected. If they do, they are sure there has been no eavesdropper, and that the key is secure. If the correlations do not match, they are forced to throw away the key and start again. As in HBB~\cite{HBB99} the players announce their measurement results ({\sf CQ}4) before the dealer ({\sf CQ}5) to prevent the players from cheating.
1257:
1258: That matching results imply security is evident from the fact that the random measurements can be seen as checking the state as mentioned above.
1259: In this case, if measurements are made randomly as described, each choice measures a different set of stabilizers. Doing this asymptotically builds statistics that give the expectation of all the stabilizer operators.
1260: If we obtain the expected results, i.e.\ that the state is a~$+1$ eigenstate of operators $K^\ocircle_D\cdots K^\ocircle_n$ in~(\ref{eq:nGHZkeydistillation stabilizers}), then the state is by definition that of~(\ref{eq:nGHZkeydistillation}) and hence not entangled to any possible eavesdropper so an eavesdropper is denied any information about the key.
1261: We thus have the following proposition.
1262: \begin{proposition} The {\sf CC}~$(n,n)$ scheme can be extended
1263: as above to give secure distribution of shared random keys with the
1264: same secrecy access structure. The secret key can be accessed by LOCC.
1265: \end{proposition}
1266:
1267: Let us now see how the~$(3,5)$ can be extended to a secret key distribution protocol. In this case, the state prepared by the dealer is that of Fig.~\ref{fig:purification35}(a):
1268: \begin{align}\label{eq:(3,5) key distilation}
1269: |\mathcal{G}_{(\vec{0})}\rangle_{D12345}
1270: =& (|0\rangle_D | g_{(00000)}\rangle_{12345} \nonumber \\ &
1271: + |1\rangle_D |g_{(11111)}\rangle_{12345})/\sqrt{2} \nonumber \\
1272: =& (|0'\rangle_D | g_{(00000)}'\rangle_{12345} \nonumber \\ &
1273: -i|1'\rangle_D |g_{(11111)}'\rangle_{12345})/\sqrt{2}.
1274: \end{align}
1275:
1276: The stabilizers of this total state are
1277: \begin{align}
1278: \label{eq:(3,5) key distilation stabilizers}
1279: K_D^\ocircle =& X_D \otimes Z_1 \otimes Z_2 \otimes Z_3 \otimes Z_4 \otimes Z_5, \nonumber \\
1280: K_1^\ocircle =& Z_D \otimes X_1 \otimes Z_2 \otimes \openone_3 \otimes \openone_4 \otimes Z_5, \nonumber \\
1281: K_2^\ocircle =& Z_D \otimes Z_1 \otimes X_2 \otimes Z_3 \otimes \openone_4 \otimes \openone_5, \nonumber \\
1282: K_3^\ocircle =& Z_D \otimes \openone_1 \otimes Z_2 \otimes X_3 \otimes Z_4 \otimes \openone_5, \nonumber \\
1283: K_4^\ocircle =& Z_D \otimes \openone_1 \otimes \openone_2 \otimes Z_3 \otimes X_4 \otimes Z_5, \nonumber \\
1284: K_5^\ocircle =& Z_D \otimes Z_1 \otimes \openone_2 \otimes \openone_3 \otimes Z_4 \otimes X_5.
1285: \end{align}
1286:
1287: As before, when the dealer measures in the~$Z$ basis, the fact that the graph $g$ is a~$(3,5)$ direct threshold scheme means that any pair of players cannot reveal the dealer's results, hence cannot access the key;
1288: in contrast any three collaborating players can reveal the key.
1289: As the conjugate $g'$ graph given by the dealer measuring in the~$Y$ basis (see Fig.~\ref{fig:purification35}(b)) is just a reordering of the original ring and replacing $\ocircle\rightarrow\square$ vertices,
1290: it is also a~$(3,5)$ direct thresold scheme, so the same conclusions hold.
1291:
1292: Consider first the subset $\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$:
1293: as the dealer measures $Z_D$,
1294: the players' appropriate measurements correspond to the direct $(3,5)$ protocol of the previous subsection.
1295: That is, player~1 measures $Z_1$, player~2 measures $X_2$, and player~3 measures $Z_3$.
1296: This protocol corresponds to players measuring stabilizer $k_2^\ocircle$ of the induced subgraph (which is the ring of Fig.~\ref{fig:pentagon}),
1297: or the dealer plus the players measuring $K_2^\ocircle$ of the total graph (Fig.~\ref{fig:purification35}(a)).
1298: If the dealer measures $Y_D$, the players' appropriate measurements correspond to the direct $(3,5)$ protocol of the previous section, but changed slightly for the fact that it is the conjugate graph.
1299:
1300: By applying the properties of Sec.~\ref{subsec:properties},
1301: we can see this can be done by player~1 measuring $X_1$, player~2 measuring $Y_2$, and player~3 measuring $X_3$.
1302: This corresponds to measuring stabilizer
1303: $k_1^\square \cdot k_2^\square \cdot k_3^\square$ of the induced conjugate graph, which is the ring of Fig.~\ref{fig:purification35}(b), or the dealer plus the players measuring $K_D^\ocircle \cdot K_1^\ocircle \cdot K_2^\ocircle \cdot K_3^\ocircle$ of the total graph
1304: shown in Fig.~\ref{fig:purification35}(a)).
1305:
1306: We then have the dealer randomly measuring $Z_D$ or $Y_D$, and the players randomly measuring in $Z_1$, $X_2$, $Z_3$ or $X_1$, $Y_2$, $X_3$.
1307: As before, they communicate to get the sifted key first
1308: (steps~{\sf CQ}4 and~{\sf CQ}5) in the protocol), and then follow the security steps after that.
1309:
1310: To observe that the protocol is secure, we study what these measurements imply about the total state of the dealer and the players $\{\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$.
1311: In step~{\sf CQ}5 of the protocol, some of the sifted key is sacrificed to verify that the measurement results are those we expected, and if not we throw the key away. If the expectation value of $K_2^\ocircle$ is $+1$, and of $K_D^\ocircle \cdot K_1^\ocircle \cdot K_2^\ocircle \cdot K_3^\ocircle$ is also $+1$, as can be verified by the players, this means that the state of $\{\mathsf{v}_D,\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$ is in the subspace of graph states
1312: $$\left\{|g_{(0000)}\rangle_{D123},|g_{(1100)}\rangle_{D123}, |g_{(1001)}\rangle_{D123},
1313: |g_{(0101)}\rangle_{D123} \right\},$$
1314: of the subgraph $\{\mathsf{v}_D,\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$ given by erasing all other vertices and edges. This also means that there are no correlations between the dealer and any possible eavesdropper. This can be seen as follows.
1315:
1316: Given the established subspace, any global state of $\{\mathsf{v}_D,\mathsf{v}_1,\mathsf{v}_2,\mathsf{v}_3\}$ and the environment~$E$
1317: (which may include any eavesdropper) can be written
1318: \begin{align}
1319: \alpha& |0\rangle_{E}|g_{(0000)}\rangle_{D123} + \beta |1\rangle_{E}|g_{(1100)}\rangle_{D123} \nonumber \\
1320: & + \delta |2\rangle_{E}|g_{(1001)}\rangle_{D123} + \gamma |3\rangle_{E}|g_{(0101)}\rangle_{D123}. \nonumber \\
1321: \end{align}
1322: The reduced density matrix of the environment and the dealer can be easily calculated,
1323: using Eq.~(\ref{eq:conjugate meas}),
1324: thereby giving
1325: \begin{equation}
1326: \rho_{\rm E}\otimes \openone/2_D,
1327: \end{equation}
1328: where $\rho_{\rm E}$ is the reduced density matrix of the environment.
1329: Thus we see that the mutual information between the environment and the dealer is zero;
1330: hence any environment, including a possible eavesdropper, can have no information about the key.
1331:
1332: Now consider players $\{\mathsf{v}_1,\mathsf{v}_3,\mathsf{v}_4\}$.
1333: If the dealer measures $Z_D$, the direct $(3,5)$ protocol tells us that the players should measure $X_1$, $Y_3$, $Y_4$, which corresponds to the players measuring the stabilizer product $k_1^\ocircle \cdot k_3^\ocircle \cdot k_4^\ocircle$ of the subgraph (Fig.~\ref{fig:pentagon}), or the dealer plus the players measuring $K_1^\ocircle \cdot K_3^\ocircle \cdot K_4^\ocircle$ of the total graph Fig.~\ref{fig:purification35}(a). If the dealer measures in the~$Y_D$ basis, by considering the discrimination of the conjugate graph states Fig.~\ref{fig:purification35}(b),
1334: the players should measure $Y_1$, $Z_3$, $Z_4$.
1335: Such a measurement protocol corresponds to measuring the stabilizer $k_1^\square$ of the conjugate graph Fig.~\ref{fig:purification35}(b), for the dealer plus the players measuring $K_D^\ocircle \cdot K_1^\ocircle$ of the total graph Fig.~\ref{fig:purification35}(a).
1336:
1337: Again the players and the dealer should follow steps {\sf CQ}4 and {\sf CQ}5 to obtain the sifted key
1338: and then compare some results for the security analysis in step {\sf CQ}6.
1339: If the expectation value of $K_1^\ocircle \cdot K_D^\ocircle$ is $+1$, and of $K_1^\ocircle \cdot K_3^\ocircle \cdot K_4^\ocircle$ is $+1$, the state of $\{\mathsf{v}_D,\mathsf{v}_1,\mathsf{v}_3,\mathsf{v}_4\}$ is in the subspace
1340: $$\{|g_{(0000)}\rangle_{D134},|g_{(0011)}\rangle_{D134},
1341: |g_{(1110)}\rangle_{D134}, |g_{(1101)}\rangle_{D134} \}$$
1342: of the subgraph $\{\mathsf{v}_D,\mathsf{v}_1,\mathsf{v}_3,\mathsf{v}_4\}$ given by erasing all other vertices and edges. Again, any state between the environment and the dealer and players $\{\mathsf{v}_1,\mathsf{v}_3,\mathsf{v}_4\}$,
1343: which has support only in this subspace,
1344: necessarily has no correlations between the dealer and the environment.
1345: Thus again the environment can not get any information about the secret key.
1346:
1347: Any set of three players can be covered by these two cases, simply by relabeling the players. We thus have the following proposition.
1348:
1349: \begin{figure}
1350: \scalebox{0.45}{\includegraphics*[0.5cm,11.5cm][21cm,18.5cm]{PentagonMeas.eps}}
1351: %\includegraphics[width=8cm]{purification35}
1352: \caption{ \label{fig:purification35}
1353: (Color
1354: online) {\sf CQ} for $(3,5)$.
1355: The dealer's qubit is attached so as to encode on all five qubits
1356: correlated for the~$(3,5)$ scheme. As Eq.~(\ref{eq:(3,5) key distilation}) indicates, if the dealer
1357: measures her qubit in $X$ the resulting graph is that of
1358: Fig.~\ref{fig:pentagon}(a).
1359: In the case of $Y$ measurements the graph transform to the
1360: right graph (b).}
1361: \end{figure}
1362:
1363: \begin{proposition} The {\sf CC}~$(3,5)$ scheme can be extended
1364: as above to give secure distribution of shared random keys with the
1365: same secrecy access structure. The secret key can be accessed by LOCC.
1366: \end{proposition}
1367:
1368: \begin{remark}
1369: As it stands, this protocol is not resilient to noise. Since noise (for example in the channel between the dealer and players) could interfere with the results of the measurement results in the sifted key, any noise would be seen as a potential eavesdropper and so the sifted key would be discarded.
1370: In fact this is a problem of the original HBB protocol also, and was resolved in~\cite{Chen04} by relating the problem to the distillation of the initial entangled state between the dealer and the players. We expect that the same approach would work for our generalized protocol. In the case of $(n,n)$
1371: this seems a simple extension.
1372: However, for the~$(3,5)$ case and possible further graph state bases secret sharing schemes, it would be more subtle and the distillation would be to subspaces with guaranteed security rather than to specific states, reflecting the more complicated security analysis. The large body of work on distilling graph states should prove very useful to this aim (see for example~\cite{HDERNB06} and references therein).
1373: This is a topic of ongoing work.
1374: \end{remark}
1375:
1376:
1377: \subsection{\sf QQ}
1378: \label{subsec:QQ}
1379:
1380: We now see how one more extension can be made to allow for the
1381: sharing of quantum secrets.
1382: Here we are addressing the third scenario presented in the introduction {\sf QQ},
1383: namely sending a quantum secret in the possible presence of an eavesdropper. Our approach will be to use the same entangled state as for the key distribution protocol to teleport the secret quantum state across from the dealer to the set of players, where the structure of the graph will again imply the secrecy structure. This teleportation extension is also that used in~\cite{HBB99}, but here we extend it to general graph state protocols and explicitly show it for the~$(n,n)$ and the~$(3,5)$ threshold schemes.
1384:
1385: Although we do not present as general a result as those in~\cite{CGL99}, where any $(k,n)$ scheme is shown to be possible, our graph state cases are nevertheless interesting for several reasons.
1386: First, they represent a unification of secret sharing schemes of~\cite{Got00,HBB99,CGL99} via the graph state formalism, second they use only qubits rather than higher dimensional systems as in~\cite{CGL99},
1387: which has advantages in that they are more easily implementable at present.
1388: Third the schemes here are explicitly written and easy to understand and finally they are written in terms of graph states which are of particular practical interest across quantum information and will be extendible to the embedded protocols of the next section.
1389:
1390: Here we should note that because we are sending a quantum secret (that is, a secret quantum state), all players cannot simultaneously obtain the secret if only one is provided, since this would violate no-cloning~\cite{CGL99}.
1391: We say a set of players can access the secret if it sits coherently within the space of their qubits, in a way they know. In this way with access to full quantum channels it can be localised to wherever they choose.
1392:
1393: In the case of only classical channels between the players, it may not be possible to localise information at all, and if it is we must choose a site to which they will localise the secret. In each case we discuss where it can be localised if possible by LOCC only.
1394:
1395: The protocol operates as follows
1396: \begin{itemize}
1397: \item [{\sf QQ}1]
1398: The dealer prepares a secrecy graph state as in the {\sf CQ} key
1399: distribution protocol.
1400: \item [{\sf QQ}2]
1401: The dealer performs a Bell measurement on the qubit $D$ and her input
1402: secret qubit $|S\rangle_{in}$, and performs the appropriate correction operation.
1403: \item [{\sf QQ}3]
1404: The dealer distributes to the players their qubits.
1405: \item [{\sf QQ}4]
1406: Authorised sets of players access the secret by making prescribed measurements and corrections to focus down the information to one of the authorized parties. This may require global operations by authorized players (requiring quantum channels).
1407: \end{itemize}
1408:
1409: Let us see how this works. After step~{\sf QQ}1 the dealer possesses the encoded graph state $|\mathcal{G}_{(\vec{0})}\rangle_{D,1,\ldots,n}$ and the input quantum secret $|S\rangle_{\rm in} = \alpha |0\rangle_{\rm in} + \beta |1\rangle_{\rm in}$. We can see what the resultant state of the players will be after step~{\sf QQ}2 by rewritting the state in the Bell basis
1410: \begin{align}
1411: |B_{00}\rangle:=&(|00\rangle+|11\rangle)/\sqrt{2}, \nonumber \\
1412: |B_{01}\rangle:=&(|00\rangle-|11\rangle)/\sqrt{2}, \nonumber \\
1413: |B_{10}\rangle:=&(|01\rangle+|10\rangle)/\sqrt{2}, \nonumber \\
1414: |B_{11}\rangle:=&(|01\rangle-|10\rangle)/\sqrt{2},
1415: \end{align}
1416: as follows.
1417: \begin{widetext}
1418: \begin{align}
1419: |S\rangle_{\rm in} |\mathcal{G}_{(\vec{0})}\rangle_{D,1,\ldots,n}
1420: =& 1/4 (|B_{00}\rangle_{\text{in},D} (\alpha|g_{(0\cdots 0)}\rangle_{1,\ldots,n}
1421: + \beta|g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n}
1422: \nonumber \\ &
1423: + |B_{01}\rangle_{\text{in},D} (\alpha|g_{(0\cdots 0)}\rangle_{1,\ldots,n}
1424: - \beta|g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n} \nonumber \\ &
1425: + |B_{10}\rangle_{\text{in},D} (\alpha|g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n} +
1426: \beta|g_{(0\cdots 0)}\rangle_{1,\ldots,n}
1427: \nonumber \\ &
1428: + |B_{11}\rangle_{\text{in},D} (\alpha|g_{(\underbrace{1\cdots 1}_{\in N_D}0\cdots 0)}\rangle_{1,\ldots,n} -
1429: \beta|g_{(0\cdots 0)}\rangle_{1,\ldots,n}).
1430: \end{align}
1431: \end{widetext}
1432: This can be seen using Eq.~(\ref{eq:conjugate meas}).
1433: After obtaining result $B_{ij}$ corresponding to Bell state $|B_{ij}\rangle$, the correction operator
1434: \begin{equation}
1435: U(i,j)_{1,\ldots,n}:= \otimes_{a\in N_c}Z_i^i \cdot K_{a\in N_c}^{\ocircle j},
1436: \end{equation}
1437: brings the resultant state to the desired encoded secret state
1438: \begin{equation}
1439: \label{eq:qsecret}
1440: |S_g\rangle = \alpha|g_{(0\cdots 0)}\rangle_{1,\ldots,n} + \beta|g_{(\underbrace{1\cdots 1}_{\in N_C}0\cdots 0)}\rangle_{1,\ldots,n}.
1441: \end{equation}
1442:
1443: In fact, Eq.~(\ref{eq:qsecret}) is analogous to the direct encoding approach of
1444: \cite{CGL99,Got00}, where a state is encoded directly onto a stabilizer space, or codespace. Again~\cite{CGL99,Got00} is more general than ours in that it covers all $(k,n)$, but again our scheme has the advantage of being set on qubits and explicilty and simply written down (where as in~\cite{CGL99,Got00} it is done with high dimensional stabilizer codes via error correction codes and is not readily understandable in terms of states).
1445:
1446: From Eq.~(\ref{eq:qsecret}), it is clear that our dependency property (c.f. Sec.~\ref{subsec:properties}) can be used to show
1447: whether subsets of users have any dependence on the secret qubit $|S\rangle$ (if the two graph states in the equation are
1448: identical for some set of users, obviously there is no chance they could extract the quantum secret).
1449: However, the access properties now fails, and we have to check if the subset of players can access the
1450: quantum secret.
1451: In other words, we have to check whether the quantum secret state is coherently placed within the reduced density matrix, and if it is, whether it can be localised by LOCC.
1452:
1453: This illustrates the difference between sharing classical and quantum secrets as discussed in detail in
1454: \cite{Got00}. Although we do not have a general method at present to decide when a quantum secret
1455: can be extracted also, for the~$(n,n)$ and~$(3,5)$ threshold schemes we can see that the access structure
1456: remains the same. For a more general approach, links to the flow conditions for determinism in measurement based quantum computation~\cite{Dan06} seem very useful, as we see in our example below. We leave this to later work and for now concentrate on these two examples.
1457:
1458: In the~$(n,n)$ case the initial state prepared by the dealer is the same as that for the key distilation protocol, shown in Fig.~\ref{fig:purificationnn}(a).
1459: After the teleportation steps~{\sf QQ}2 and~{\sf QQ}3,
1460: the players share the state
1461: \begin{equation}
1462: \label{eq:qsecretnn}
1463: |S_{g}\rangle_{1,\ldots,n}
1464: = \alpha |g_{(0\cdots 0)}\rangle_{1,\ldots,n} + \beta|g_{(10\cdots 0)}\rangle_{1,\ldots,n},
1465: \end{equation}
1466: encoding the quantum secret.
1467: The fact that any set of $n~-~1$ players has no dependency on the secret follows from the dependency property from Sec.~\ref{subsec:properties} applied to the graph $g$, which, as in the case of the key distribution protocol, means the states $|g_{(\vec{0})}\rangle$ and~$|g_{(10\cdots 0)}\rangle$ appear locally identical to any such set, and thus implies they cannot read the secret.
1468:
1469: On the other hand by teleportation the secret state is coherently shared by all players, hence if acting all together, the players can access the secret perfectly, and can certainly localise it to any chosen player by using quantum channels. If restricted to LOCC, they can in fact, also localise the secret onto any player. First we consider localising it to any player other than player~1.
1470: We can see this explicitly if rewrite the corresponding state~(\ref{eq:qsecret}) using~(\ref{eq:conjugate meas}) in the following way
1471: \begin{align}
1472: |S_{g}\rangle_{1,\ldots,n}
1473: =& \alpha |g_{(0\cdots 0)}\rangle_{1,\ldots,n}
1474: + \beta|g_{(10\cdots 0)}\rangle_{1,\ldots,n} \nonumber \\
1475: =& |g_{(0\cdots 0)}\rangle_{1,\ldots,n / i} (\alpha |0\rangle_i +\beta |1\rangle_i) \\ \nonumber
1476: & + |g_{(10\cdots 0)}\rangle_{1,\ldots,n/i} (\beta |0\rangle_i +\alpha |1\rangle_i);
1477: \end{align}
1478: thus if player~1 measures $X$ and the remaining players except player $i$ measure $Z$, they can push the quantum state onto player $i$'s qubit. To push the secret state onto player~1, it is enough for the remaining players to measure in the~$Z$ basis (and of course communicate their result to player~1),
1479: as can be seen by rewriting the state as
1480: \begin{widetext}
1481: \begin{align}
1482: |S_{g}\rangle_{1,\ldots,n}
1483: =& \alpha |g_{(0\cdots 0)}\rangle_{1,\ldots,n}
1484: + \beta|g_{(10\cdots 0)}\rangle_{1,\ldots,n} \nonumber \\
1485: =& \sum_{m_2 \oplus\ldots \oplus m_n=0}|m_2 \ldots m_n\rangle_{2,\ldots,n} (\alpha |+\rangle_1
1486: +\beta |-\rangle_1)
1487: + \sum_{m_2\oplus \ldots \oplus m_n=1}|m_2 \ldots m_n\rangle_{2,\ldots,n} (\alpha |-\rangle_1
1488: +\beta |+\rangle_1),
1489: \end{align}
1490: \end{widetext}
1491: where $m_i$ is a bit and $|m_2 \ldots m_n\rangle_{2,\ldots,n}$ is a product of Pauli $Z$ eigenstates.
1492:
1493: We can see this another way, which may give hints of a possible way to check accessibility in more general cases. This starts from noting that Eq.~(\ref{eq:qsecret}) as having arisen from another scheme, not teleportation, analogous to the error correcting schemes in~\cite{Schlingemann01}, uniting these approaches. To do this the dealer entangles the secret state $|S\rangle$ onto vertex $1$ of the~$n$GHZM state directly and measures it in the~$Z$ basis. By making the appropriate correction (based on the measurement outcome), the resultant state is that of~(\ref{eq:qsecret}).
1494:
1495: Incidently, we notice that our five party scheme is the same graph as the 5-qubit code in
1496: \cite{Schlingemann01}, which is perhaps not so surprising, since sharing a threshold scheme for quantum secrets is
1497: necessarily an error correcting scheme (though not the other way round) as pointed out in~\cite{CGL99,Got00}. Indeed this example appears in~\cite{CGL99,Got00} (although established in a different way).
1498:
1499: Viewing Eq.~(\ref{eq:qsecretnn}) as having arisen in this way, we can imagine the state of the secret qubit entangled to the~$n$GHZM state as the start of a measurement based computation with the secret qubit as the input. We then choose any one player as an output and application of the Flow conditions~\cite{Dan06,BKMP07} give an explicit way to direct the secret onto any one of the players' qubits by LOCC.
1500:
1501:
1502: We thus have the following proposition.
1503:
1504: \begin{proposition} The direct~$(n,n)$ scheme can be extended
1505: as above to give quantum secret sharing schemes with the same
1506: secrecy access structure. The secret can be localised onto any one of the authorized players by LOCC.
1507: \end{proposition}
1508:
1509: In the~$(3,5)$ threshold case, the dealer starts with the state of Fig.~\ref{fig:purification35}(a). After teleportation steps ii) and iii) in the protocol, the players have the state
1510: \begin{equation}
1511: |S_g\rangle_{12345} = \alpha |g_{(00000)}\rangle_{12345}+ \beta|g_{(11111)}\rangle_{12345}.
1512: \end{equation}
1513: Again, the dependency property applied to the states $|g_{(00000)}\rangle$ and~$|g_{(11111)}\rangle$ for the pentagon graph as in Fig.~\ref{fig:pentagon} imply that to any two players these states are identical, hence they have no dependency on the quantum secret, and so cannot access it.
1514:
1515: The ability for three users to access the secret qubit can be seen to follow from the
1516: fact that it is also a two qubit erasure error correcting scheme~\cite{Schlingemann01}. In general this
1517: is not LOCC. We can see how this works explicitly writing the state,
1518: \begin{align}
1519: |S_g\rangle_{12345} =& \alpha |g_{(00000)}\rangle_{12345}+ \beta|g_{(11111)}\rangle_{12345} \nonumber \\
1520: =& 1/4 ( |B_{00}\rangle_{13}(\alpha|+\rangle_2 + \beta|-\rangle_2)|B_{01}\rangle_{45}
1521: \nonumber \\ &
1522: + |B_{01}\rangle_{13}(\alpha|+\rangle_2 - \beta|-\rangle_2)|B_{10}\rangle_{45}
1523: \nonumber \\ &
1524: + |B_{10}\rangle_{13}(\alpha|-\rangle_2 - \beta|+\rangle_2)|B_{00}\rangle_{45}
1525: \nonumber \\ &
1526: + |B_{11}\rangle_{13}(\alpha|-\rangle_2 + \beta|+\rangle_2)|B_{11}\rangle_{45}),
1527: \end{align}
1528: where $|\pm\rangle = 1/\sqrt{2}(|0\rangle \pm |1\rangle)$. It is clear that if either pair, $\{\mathsf{v}_1,\mathsf{v}_3\}$ or $\{\mathsf{v}_4,\mathsf{v}_5\}$ measure in the Bell basis, they can localize the quantum secret onto player~2's qubit by telling her the result. After the Bell measurements, player~2's qubit will be projected into one of four possible states as seen above, which can be brought to $|S\rangle_2$ by the appropriate correction operation depending on the result (this will consist of a local Hadamard and possibly local $X$ and~$Z$ flips). Similarly any set of three players can localize the secret onto one of their number by two getting together and performing a Bell measure. This leads to the following proposition.
1529:
1530:
1531: \begin{proposition} The direct~$(3,5)$ scheme can be extended
1532: as above to give quantum secret sharing schemes with the same
1533: secrecy access structure. The secret can be localised onto one of the players in an authorized set using quantum channels.
1534: \end{proposition}
1535:
1536:
1537:
1538: In~\cite{CGL99} it is shown that there can exist no (3,4) QSS scheme
1539: using pure states - hence it is clear there is no way to extend the~$(3,4)$ scheme in this way.
1540: This intriguingly coincides with the fact that we cannot see how to do a {\sf CQ} for $(3,4)$ and may indicate a more fundamental connection.
1541:
1542:
1543: \section{Embedded protocols}
1544: \label{sec: embedded}
1545:
1546: We now present an example of an embedded protocol. That is, we embed the~$(n,n)$ protocols of the previous section into a larger graph, taking advantage of the fact that graph states are extremely useful for various quantum information tasks. The setting we imagine is where a quantum network is envisaged comprising of graph states, and we would like to do secret sharing on some sub-network of the total network. This may occur as a protocol in its own right or as part of a more involved protocol, possibly involving error correction and or MBQC.
1547:
1548:
1549: We do this via a simple extension of a~$n$-party GHZ
1550: states, which we call a {\it $n$-GHZ tree} state, depicted in Fig.~\ref{fig:Tree}.
1551: \begin{definition}
1552: A~$n$-GHZ tree state is any state where there is an $n$GHZM state
1553: embedded inside another graph, attached by any of the vertices
1554: except $\mathsf{v}_1$.
1555: \end{definition}
1556:
1557: We now imagine a situation where the dealer hands out this state to be shared by the players $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$ and the rest of the network, in this case the neighours $\mathcal{N}_2,\ldots,\mathcal{N}_n$ (which may overlap). We then ask, can we still use this state to do the secret sharing protocols of the last three sections. We find that we can, starting with the following proposition.
1558:
1559: \begin{proposition} \label{prop:Tree direct}
1560: For all $n$-GHZ trees of (see Fig.~\ref{fig:Tree}),
1561: the bit $S=l_{12}$ forms an embedded $(n,n)$
1562: direct {\sf CC} classical secret sharing scheme (within the subgroup of players $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$). This is true
1563: independent of the form of all possible sets of neighbours $\mathcal{N}_i$
1564: (including overlapping).
1565: \end{proposition}
1566:
1567: The protocol would run as in the case of Sec.~\ref{subsec:direct},
1568: with the secret being encoded onto the bit $S=l_{12}$ on the~$n$-GHZ tree. The validity of the proposition above can be seen since $l_{12}$ can, and only can, be read by all $n$ of the subset of $ \{ 1,\ldots,n \} $ players together.
1569: This requirement is implied by simple application of the dependency and access properties, which are unaffected by the addition of neighbours in this case.
1570: However, there is a subtlety introduced if the neighbours of one of the players may help.
1571:
1572: For example, if a neighbour of player~2, say $\mathsf{v}_j\in \mathcal{N}_2$, who, for simplicity's sake we say only neighbours $2$ and no one else, the secret $S=l_{12}$ can be read by the players
1573: $$\{\mathsf{v}_1,\mathsf{v}_3,\mathsf{v}_4,..,\mathsf{v}_n,\mathsf{v}_j\}$$
1574: since they can measure $K_1^\ocircle \cdot K^\ocircle_{j \in \mathcal{N}_2}$ (as it is nontrivial only on those players' systems). Thus they can find $l_{12}\oplus l_{j2} = S$ without player~2. However, when not allowing for the help of the neighbours, and only allowing players in the set $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$ to act together, all $n$ must co-operate to find the secret, hence it acts as an $(n,n)$ threshold scheme.
1575:
1576: This would not work for the square $(3,4)$ or $(3,5)$ schemes since the secret is shared amongst all the players, so attaching neighbours to any would spread it out and hence it could not be found without measuring the neighbours also, by P2.
1577:
1578:
1579: \begin{figure}
1580: \scalebox{0.43}{\includegraphics*[0cm,9cm][21cm,20.5cm]{nGHZTree.eps}}
1581: %\includegraphics[width=5cm]{Tree}
1582: \caption{\label{fig:Tree}
1583: (Color
1584: online) $n$-GHZ tree state. $\mathcal{N}_i$ represents the neighbours of qubit $\mathsf{v}_i$ (minus $\mathsf{v}_1$), and they are allowed to overlap. This state gives a~$(n,n)$ secret sharing schemes for qubits $1$ to $n$
1585: (see propositions \ref{prop:Tree direct}, \ref{prop:Tree key distribution} and \ref{prop:Tree QSS}).}
1586: \end{figure}
1587:
1588:
1589:
1590: This embedded structure can also be extended to key distribution and quantum secret sharing. As in the~$(n,n)$ key distribution case the total state is made by taking the {\sf CC} case and attaching a vertex to player~1, which is kept by the dealer. In the case of the~$n$-GHZ tree state, the total state of dealer, players and neighbours is given by
1591: \begin{align}
1592: \label{eq:embedded key distilation}
1593: |\mathcal{G}_{(\vec{0})}\rangle&_{D,1,\ldots,n,N_2..N_n} \nonumber \\
1594: =&( |0\rangle_D |g_{(0\cdots 0)}\rangle_{1,\ldots,n\mathcal{N}_2..\mathcal{N}_n} \nonumber \\ &
1595: + |1\rangle_D |g_{(10\cdots 0)}\rangle_{1,\ldots,n \mathcal{N}_2..\mathcal{N}_n}) \nonumber \\
1596: =& \frac{e^{i\pi/4}}{\sqrt{2}}( |0^{'}\rangle_D |g_{(0\cdots 0)}^{'}\rangle_{1,\ldots,n\mathcal{N}_2..\mathcal{N}_n} \nonumber \\
1597: &
1598: -i |1^{'}\rangle_D |g_{(10\cdots 0)}^{'}\rangle_{1,\ldots,n\mathcal{N}_2..\mathcal{N}_n}).
1599: \end{align}
1600:
1601: The protocol would then run as in Sec.~\ref{subsec:CQ}, using this state. As explained above, if players $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$ work together,
1602: they can discriminate
1603: $$|g_{(0\cdots 0)}^{(')}\rangle_{1,\ldots,n\mathcal{N}_2..\mathcal{N}_n}$$ and
1604: $$|g_{(10\cdots 0)}^{(')}\rangle_{1,\ldots,n\mathcal{N}_2..\mathcal{N}_n}$$
1605: because they can measure $k_1^{\ocircle,\square}$ as they only have support on $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$. Hence they can access the key.
1606: With the dealer and the players these measurements correspond to measuring stabilizers $K_1^\ocircle$ and~$K_D^\ocircle \cdot K_1^\ocircle$ of the total graph (that of Fig.~\ref{fig:Tree} with the dealer attached to vertex 1). Again, from the dependency arguments P1 any subset of $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$ cannot, though again, the same subtleties hold regarding the help of the neighbours.
1607:
1608: With regards to security against an eavesdropper, unfortunately we cannot check all stabilizers in here as we did in the~$(n,n)$ case, since the remaining stabilizers have support outside qubits $\{1,\ldots,n\}$. However, we can check that it remains in a secure subspace, as for the $(3,5)$ case in Sec.~\ref{subsec:CQ}.
1609:
1610: Let $h$ denote the subgraph induced by removing all neighbouring sets $\{\mathcal{N}_i\}$ from Fig.~\ref{fig:Tree} plus a dealer vertex attached to $\mathsf{v}_1$ (giving the graph as in Fig.~\ref{fig:purificationnn}(a)), and $|h_{\vec{\ell}_{\star 2}}\rangle$ the associated encoded graph state. If the expectation values of $K_1^\ocircle$ and~$K_D^\ocircle \cdot K_1^\ocircle$ are both $+1$ (as can be checked be sacrificing part of the sifted key), then we can be sure that the state of the dealer and players $\{\mathsf{v}_1\ldots \mathsf{v}_n\}$ are in the subspace
1611: $$\{|h_{00\vec{\eta}_{\star2}^{(2,\ldots,n)}}\rangle_{D 1,\ldots,n}\}.$$
1612: That is, in the subspace such that the first two entries of the bit string are zero, and the remaining $n-1$ elements are free,
1613: which we denote with bit string $$\vec{\eta}_{\star2}^{(2,\ldots,n)}$$
1614: (i.e., the subspace spanned by all such bit strings).
1615:
1616: If we now call $p$ the graph after also removing the dealer's qubit (i.e. the $nGHZM$ graph), the complete state of the dealer, players $\{\mathsf{v}_1\ldots \mathsf{v}_n\}$, and any environment $E$
1617: (including the neighbours and possible eavesdropper) can therefore be written as
1618: \begin{align}
1619: |\Psi\rangle_{ED1,\ldots,n}=&
1620: 2^{-1/2} \sum_{\vec{\eta}_{\star2}^{(2,\ldots,n)}} \alpha_{\vec{\eta}_{\star2}^{(2,\ldots,n)}}
1621: \big(|0\rangle_D|
1622: p_{0\vec{\eta}_{\star2}^{(2,\ldots,n)}}\rangle_{1,\ldots,n}
1623: \nonumber \\ &
1624: + |1\rangle_D|p_{1\vec{\eta}_{\star2}^{(2,\ldots,n)}}
1625: \rangle_1,\ldots,n\big)|\vec{\eta}_{\star2}^{(2,\ldots,n)}\rangle_E,
1626: \end{align}
1627: where the summation is over the bit string $\vec{\eta}_{\star2}^{(2,\ldots,n)}$.
1628: Tracing out all the players, we have that the state of the dealer and the environment is
1629: $\rho_{\rm E}\otimes \openone/2_D$;
1630: thus we see that the mutual information between the environment and the dealer is zero.
1631:
1632: Hence, on the condition that the value of $K_1^\ocircle$ and~$K_D^\ocircle \cdot K_1^\ocircle$ are both found to be $+1$, any environment, including a possible eavesdropper, can have no information about the key. If the measurement results do not satisfy this condition,
1633: they should be discarded as in Sec.~\ref{subsec:CQ}. Thus, we thus have the following proposition.
1634:
1635: \begin{proposition}
1636: \label{prop:Tree key distribution}
1637: For all $n$-GHZ trees of $n$ qubits (see Fig.~\ref{fig:Tree}),
1638: the bit $l_1$ forms an embedded $(n,n)$
1639: key distribution {\sf QC} secret sharing scheme (within the subgroup of players $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$). This is true
1640: independent of the form of all possible sets of neighbours $\mathcal{N}_i$
1641: (including overlapping).
1642: \end{proposition}
1643:
1644: We can also see how to extend this embedded protocol to sharing a quantum secret. As in Sec.~\ref{subsec:QQ}, the dealer uses the state of the key distillation protocol, in this case~(\ref{eq:embedded key distilation}), to teleport the secret qubit onto the player's qubits
1645: giving the encoded state dealt to the players and their neighbours
1646: \begin{widetext}
1647: \begin{align}
1648: |S_{g}\rangle_{1,\ldots,n, \mathcal{N}_2..\mathcal{N}_n}
1649: =& \alpha |g_{(0\cdots 0)}\rangle_{1,\ldots,n, \mathcal{N}_2,\ldots,n_n}
1650: + \beta |g_{(10\cdots 0)}\rangle_{1,\ldots,n, \mathcal{N}_2,\ldots,n_n} \nonumber \\
1651: =& \sum_{m_2 \oplus \cdots \oplus m_n=0}|m_2 \ldots m_n\rangle_{2,\ldots,n}
1652: |\mathcal{N}_{\vec{m}_{\star 2}}\rangle_{\mathcal{N}_2 \ldots \mathcal{N}_n}
1653: \left(\alpha |+\rangle_1 +\beta |-\rangle_1\right) \nonumber \\
1654: & + \sum_{m_2 \oplus \cdots \oplus m_n=1}|m_2 \ldots m_n\rangle_{2,\ldots,n} |\mathcal{N}_{\vec{m}_{\star 2}}\rangle_{\mathcal{N}_2 \ldots \mathcal{N}_n} \left(\alpha |-\rangle_1 +\beta |+\rangle_1\right),
1655: \end{align}
1656: \end{widetext}
1657: with $\mathcal{N}$ the subgraph of the set $\{\mathcal{N}_2 \ldots \mathcal{N}_n\}$,
1658: $|\mathcal{N}_{\vec{m}_{\star 2}}\rangle_{\mathcal{N}_2 \ldots \mathcal{N}_n}$ the associated encoded graph state, and bit string $\vec{m}_{\star2}$ is a function of bit values $\{m_2, \ldots, m_n\}$.
1659:
1660: From this it is clear that if players $\{\mathsf{v}_2,\ldots,\mathsf{v}_n\}$ measure in the~$Z$ basis, they project the state of player~1's qubit onto either $\alpha |+\rangle_1 +\beta |-\rangle_1$ or $\alpha |-\rangle_1 +\beta |+\rangle_1$ if the total parity is odd or even respectively. These can be taken to the original secret state $|S\rangle_1$ by the action of correction operator $U^\text{even}_1= H_1$ for even parity, and~$U^\text{odd}_1=H_1 Z_1$ for odd parity. Again the dependency rules used in the {\sf CC} mean that any less than complete set in the set of players $\mathsf{v}_1,\ldots,\mathsf{v}_n$ can not access the secret. Thus we have the following proposition.
1661:
1662: \begin{proposition} \label{prop:Tree QSS}
1663: For all $n$-GHZ trees of $n$ qubits (see Fig.~\ref{fig:Tree}),
1664: the bit $l_1$ is forms an embedded $(n,n)$
1665: {\sf QQ} quantum secret sharing scheme (within the subgroup of players $\{\mathsf{v}_1,\ldots,\mathsf{v}_n\}$). This is true
1666: independent of the form of all possible sets of neighbours $\mathcal{N}_i$
1667: (including overlapping).
1668: \end{proposition}
1669:
1670: The {\sf QQ} is perhaps the most useful of the embedded protocols as it could readily be seen as part of an extended network, for example, the input to our protocol could occur as an output of some previous MBQC, and the output of our protocol could be the input to a subsequent computation.
1671:
1672: \section{Conclusions}
1673: \label{sec: conclusions}
1674: We have seen that graph states are a good resource giving a unified approach to secret sharing of both quantum and classical secrets, in the presence of an eavesdropper. The protocols presented can be clearly understood from simple properties of classical information on graph states we have showed. In particular this gives a new way to generate protocols of addressing the second situation, that of sharing a quantum secret in the presence of eavesdropper, beyond $(n,n)$ for the first time. Explicilty we have presented the case of a~$(3,5)$ secret sharing protocol for such a setting. Further we have introduced so-called embedded secret sharing protocols as a first step to integrated quantum networks.
1675:
1676: A natural question to ask next is how far can these ideas be pushed and which $(k,n)$ can be covered. This then becomes a graph theoretic relabeling
1677: problem - where the labels are the secrets (more precisely the encoding of the secrets), and their access given by our rules. We expect that this way will result in many cases. However, we know that directly not all $(k,n)$ cases can be solved. We can see for example that it is impossible to do a~$(3,2)$ direct secret sharing scheme with a graph state using our protocol. This can be seen easily, firstly by noticing that demanding single individuals get no information means all three must be entangled. Then we have two options, either the~$3$-GHZM, or the fully connected graph. In both cases it is easy to see that there is no way to choose an encoding of secret~$S$ onto the~$\ell_{i2}$ such that all three pairings depend on it simultaneously (thus, they cannot all access it). The application of the graphical properties presented to this problem is an ongoing area of investigation.
1678:
1679: We can also ask is it possible to extend the protocols in this work somehow to cover these cases which currently cause difficulty.
1680: One such extension may be possible via the connection between the sharing of quantum and classical secrets we have seen in our protocols. In~\cite{CGL99} solutions to the general $(k,n)$ sharing of a quantum secret were provided via connections made to error correction.
1681:
1682: Although we arrived at our {\sf QQ} from a different approach,not related to error correction, they can be thought of as stabilizer codes, so relating to those of~\cite{CGL99}, since all stabilizer codes can be thought of as graph codes~\cite{Schlingemann01}. A benefit of our approach is that we have been able to use intuitive graphical ideas to prove which players can access which information. Perhaps extending to higher dimensional graph states, we would be able to recapture the results of~\cite{CGL99} for the most general case seems likely to be possible for sharing quantum secrets. The next step would be to translate this to the key distribution protocol, which would be possible via the connections shown here.
1683:
1684: As we have mentioned, there is also the outstanding questions of security for these protocols.
1685: Here we have seen security against certain classes of attacks, as in HBB~\cite{HBB99}. The question of security for secret sharing is a large problem of current interest~\cite{Demkowicz-Dobranski08,MatsumotoR07,SS05}. Another problem raised was that of noisy channels as it stands our protocol is not resilient to noise. This was also a problem for HBB, and it seems likely that the same approach used in~\cite{Chen04} can be used to address both these problems, that is via connection with entanglement distillation. To this end the wealth of results on entanglement distillation for graph states~\cite{HDERNB06} will help push this direction further.
1686:
1687: We hope that this work will enable the integration of different quantum information protocols, for example secret computing.
1688: perhaps the most interesting property of these schemes is their integratability.
1689: As quantum technologies become more accessible in the real world, it is likely that in a real network setting we would like to do combinations of tasks, without having to change and swap hardware. The embedded protocols here are a first step towards this goal, and we hope these ideas can pave the way for more integrated schemes.
1690:
1691: \acknowledgments
1692: DM acknowledges financial support from QICS,
1693: and BCS acknowledges financial support from CIFAR, MITACS, iCORE, and NSERC.
1694: BCS appreciates valuable, seminal discussions with Anirban Roy and
1695: Somshubhro Bandyopadhyay in the early stages of this work and
1696: recent discussions with Vlad Gheorghiu and Robert B. Griffiths, who are engaged in
1697: related research.
1698: DM acknowledges enlightening discussions with Francesco Buscemi,
1699: Peter van Loock, Mehdi Mhalla, and Elham Kashefi.
1700:
1701: \begin{references}
1702: \bibitem{Sha79}
1703: A. Shamir, Commun. ACM \textbf{22}, 612 (1979).
1704: \bibitem{HBB99}
1705: M. Hillery, V. Bu\v{z}ek, and A. Berthiaume,
1706: \pra \textbf{59}, 1829 (1999).
1707: \bibitem{GRTZ02}
1708: N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden.
1709: \rmp \textbf{74}, 145 (2002).
1710: \bibitem{CGL99}
1711: R. Cleve, D. Gottesman, and H-K. Lo,
1712: \prl \textbf{83}, 648 (1999).
1713: \bibitem{TS02}
1714: T. Tyc and B. C. Sanders,
1715: \pra \textbf{65}, 042310 (2002);
1716: T. Tyc, D. J. Rowe and B. C. Sanders, J. Phys A: Math. Gen. \textbf{36}, 7625 (2003);
1717: A. M. Lance, T. Symul, W. P. Bowen, T. Tyc, B. C. Sanders and P. K. Lam,
1718: New J. Phys. \textbf{5}, 4 (2003);
1719: A. M. Lance, T. Symul, W. Bowen, B. C. Sanders, and P. K. Lam.
1720: \prl \textbf{92}, 177903 (2004);
1721: A. M. Lance, T. Symul, W. P. Bowen, B. C. Sanders~T. Tyc, T. C. Ralph, and P. K. Lam,
1722: \pra \textbf{71}, 033814 (2005).
1723: \bibitem{HDERNB06}
1724: M. Hein, W. D{\"{u}}r, J. Eisert, R. Raussendorf, M. van den Nest, and H. J. Briegel,
1725: quant-ph/0602096 (2006).
1726: \bibitem{RB01}
1727: R. Raussendorf and H. J. Briegel, \prl \textbf{86}, 5188 (2001).
1728: \bibitem{BB84}
1729: C. H. Bennett and G. Brassard,
1730: in Proc. IEEE International Conference on Computers, Systems, and
1731: Signal Processing, Bangalore, India (IEEE, New York, 1984), 175.
1732: \bibitem{KKI99}
1733: A. Karlsson, M. Koashi, and N. Imoto, \pra \textbf{59}, 162 (1999).
1734: \bibitem{Chen04}
1735: K. Chen and H-K. Lo, Quant. Info. Comp. \textbf{7}, 689 (2007).
1736: \bibitem{Xiao04}
1737: L. Xiao, G. L. Long, F-G. Deng, and J-W. Pan,
1738: \pra \textbf{69}, 052307 (2004).
1739: \bibitem{WRRSWVAZ05}
1740: P. Walther, K. J. Resch, T. Rudolph, E. Schenk, H. Weinfurter, V. Vedral,
1741: M. Aspelmeyet, and A. Zeilinger,
1742: Nature (Lond.) \textbf{434}, 169 (2005).
1743: \bibitem{LGZGZYGYP05}
1744: C.-Y. Lu, O. Ghune X.-Q. Zhang, W.-B. Gao, J. Zhang, Z. S. Yuan, A. Goebel,
1745: T. Yang, and J.-W. Pan,
1746: Nature Phys. \textbf{3}, 91 (2007).
1747: \bibitem{Got00}
1748: D. Gottesman, \pra \textbf{61}, 042311 (2000).
1749: \bibitem{MJPV99}
1750: M. Murao, D. Jonathan, M. B. Plenio, and V. Vedral,
1751: \pra \textbf{59}, 156 (1999).
1752: \bibitem{Eke91}
1753: A. Ekert, \prl \textbf{67}, 661 (1991).
1754: \bibitem{Dan06}
1755: V. Danos and E. Kashefi, \pra \textbf{74}, 052310 (2006).
1756: \bibitem{Schlingemann01}
1757: D. Schlingemann and R. F. Werner, \pra \textbf{65}, 012308 (2001).
1758: \bibitem{BKMP07}
1759: D. E. Browne, E. Kashefi, M. Mhalla, and S. Perdix,
1760: New J. Phys. \textbf{9}, 250 (2007).
1761: \bibitem{Demkowicz-Dobranski08}
1762: R. Demkowicz-Dobrzanski, A. Sen De, U. Sen, M. Lewenstein quant-ph/0802.1811 (2008).
1763: \bibitem{MatsumotoR07}
1764: R. Matsumoto, \pra \textbf{76}, 062316 (2007).
1765: \bibitem{SS05}
1766: S. K. Singh and R. Srikanth, \pra \textbf{71}, 012328 (2005).
1767: \end{references}
1768:
1769: \end{document}
1770: