Multipartite quantum cryptography based on the violation of Svetlichny's inequality

TL;DR

This paper proposes a multipartite quantum key distribution scheme utilizing Svetlichny's inequality violation, ensuring security even against strong eavesdroppers, and analyzes the secret-key rate under non-maximal entanglement conditions.

Contribution

It introduces a secure multipartite quantum key distribution protocol based on Svetlichny's inequality and extends it to N-party scenarios with device-independent security guarantees.

Findings

Violation of Svetlichny's inequality tests for eavesdropping.

Secret-key rate approaches 1 as Werner state entanglement increases.

Protocol remains secure even if an eavesdropper controls two participants' outcomes.

Abstract

Multipartite cryptography is useful for some particular missions. In this paper, we present a quantum key distribution scheme in which three separated observers can securely share a set of keys by using a sequence of $3$-particle GHZ states. We prove that the violation of Svetlichny's inequality can be utilized to test for eavesdropping, and even when the eavesdropper can completely control the outcomes of two participants' measurements, our scheme still ensures the security of the keys distribution. This scheme can be easily extended to the case of $N$-party keys distribution, and the violation of $N$-partite Svetlichny's inequality guarantees the security of the generalized scheme. Since the GHZ state has maximum entanglement, its perfect monogamy guarantee the device-independent security of our protocol. However quantum entanglement is a vulnerable resource which is often decayed during transmission, so we need here to derive the secret-key rate of our protocol under the condition of using quantum states with non-maximal entanglement. We then calculate the extractable secret-key rate of the three-party key distribution protocol for the Werner state in the device-independent scenario. We find that the value of the extractable secret-key rate monotonously approaches $1$ as the value of the visibility of the Werner state increases, and it reaches its maximum value $1$ when the Werner state becomes the GHZ state.

Equations

$$(i){\sigma }_x\otimes {\sigma }_y\otimes {\sigma }_y{|\Psi ⟩}_{GHZ}=-{|\Psi ⟩}_{GHZ}$$

$$(ii){\sigma }_y\otimes {\sigma }_x\otimes {\sigma }_y{|\Psi ⟩}_{GHZ}=-{|\Psi ⟩}_{GHZ}$$

$$(iii){\sigma }_y\otimes {\sigma }_y\otimes {\sigma }_x{|\Psi ⟩}_{GHZ}=-{|\Psi ⟩}_{GHZ}$$

$$(iv){\sigma }_x\otimes {\sigma }_x\otimes {\sigma }_x{|\Psi ⟩}_{GHZ}={|\Psi ⟩}_{GHZ}.$$

$$\displaystyle\big{|}\langle A_{0}B_{0}C_{0}\rangle+\langle A_{0}B_{0}C_{1}\rangle+\langle A_{0}B_{1}C_{0}\rangle+\langle A_{1}B_{0}C_{0}\rangle$$

$$\displaystyle-\langle A_{0}B_{1}C_{1}\rangle-\langle A_{1}B_{0}C_{1}\rangle-\langle A_{1}B_{1}C_{0}\rangle-\langle A_{1}B_{1}C_{1}\rangle\big{|}$$

$$\le 4.$$

$$\left({\alpha }_0,{\beta }_0,{\gamma }_0\right)=\left(-\frac{\pi }{4},0,0\right),$$

$$\left({\alpha }_1,{\beta }_1,{\gamma }_1\right)=\left(\frac{\pi }{4},\frac{\pi }{2},\frac{\pi }{2}\right),$$

$$\displaystyle\big{|}\langle(A_{0}B_{0}+A_{0}B_{1}+A_{1}B_{0}-A_{1}B_{1})C_{0}$$

$$\displaystyle-(A_{0}B_{1}+A_{1}B_{0}+A_{1}B_{1}-A_{0}B_{0})C_{1}\rangle\big{|}$$

$$\displaystyle\leq\big{|}\langle(A_{0}B_{0}+A_{0}B_{1}+A_{1}B_{0}-A_{1}B_{1})C_{0}\rangle\big{|}$$

$$\displaystyle+\big{|}\langle(A_{0}B_{1}+A_{1}B_{0}+A_{1}B_{1}-A_{0}B_{0})C_{1}\rangle\big{|}.$$

$$\displaystyle\big{|}\langle(A_{0}B_{0}+A_{0}B_{1}+A_{1}B_{0}-A_{1}B_{1})C_{0}\rangle\big{|}$$

$$\displaystyle=\Big{|}\int\rho(\mathbf{n}_{a},\mathbf{n}_{b},\mathbf{n}_{c})d\mathbf{n}_{a}d\mathbf{n}_{b}d\mathbf{n}_{c}[(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})$$

$$+({\mathbf{a}}_0\cdot {\mathbf{n}}_a)({\mathbf{b}}_1\cdot {\mathbf{n}}_b)+({\mathbf{a}}_1\cdot {\mathbf{n}}_a)({\mathbf{b}}_0\cdot {\mathbf{n}}_b)$$

$$\displaystyle-(\mathbf{a}_{1}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})](\mathbf{c}_{0}\cdot\mathbf{n}_{c})\Big{|}$$

$$\displaystyle\leq\int\rho^{\prime}(\mathbf{n}_{a},\mathbf{n}_{b})d\mathbf{n}_{a}d\mathbf{n}_{b}\Big{|}[(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})$$

$$+({\mathbf{a}}_0\cdot {\mathbf{n}}_a)({\mathbf{b}}_1\cdot {\mathbf{n}}_b)+({\mathbf{a}}_1\cdot {\mathbf{n}}_a)({\mathbf{b}}_0\cdot {\mathbf{n}}_b)$$

$$\displaystyle-(\mathbf{a}_{1}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})]\Big{|}.$$

$$\displaystyle\Big{|}[(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})+(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})$$

$$\displaystyle+(\mathbf{a}_{1}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})-(\mathbf{a}_{1}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})]\Big{|}$$

$$\displaystyle=\Big{|}(\mathbf{a}_{0}\cdot\mathbf{n}_{a})[(\mathbf{b}_{0}+\mathbf{b}_{1})\cdot\mathbf{n}_{b}]+(\mathbf{a}_{1}\cdot\mathbf{n}_{a})[(\mathbf{b}_{0}-\mathbf{b}_{1})\cdot\mathbf{n}_{b}]\Big{|}$$

$$\displaystyle=\bigg{|}(\mathbf{a}_{0}\cdot\mathbf{n}_{a})\bigg{[}(\hat{x}+\hat{y})\cdot\mathbf{n}_{b}\bigg{]}+(\mathbf{a}_{1}\cdot\mathbf{n}_{a})\bigg{[}(\hat{x}-\hat{y})\cdot\mathbf{n}_{b}\bigg{]}\bigg{|}$$

$$\displaystyle=\sqrt{2}\bigg{|}\bigg{[}\frac{\hat{x}-\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{a}\bigg{]}\bigg{[}\frac{\hat{x}+\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{b}\bigg{]}$$

$$\displaystyle+\bigg{[}\frac{\hat{x}+\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{a}\bigg{]}\bigg{[}\frac{\hat{x}-\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{b}\bigg{]}\bigg{|}$$

$$\displaystyle=\sqrt{2}\big{|}-\big{[}\cos{\theta_{a}}\sin{\theta_{b}}-\sin{\theta_{a}}\cos{\theta_{b}}\big{]}\big{|}$$

$$\displaystyle=\sqrt{2}\big{|}\sin{(\theta_{a}+\theta_{b})}\big{|}.$$

$$\left|⟨(A_0{B}_1+A_1{B}_0+A_1{B}_1-A_0{B}_0)C_1⟩\right|$$

$$\displaystyle=\Big{|}\int\rho(\mathbf{n}_{a},\mathbf{n}_{b},\mathbf{n}_{c})d\mathbf{n}_{a}d\mathbf{n}_{b}d\mathbf{n}_{c}[(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})$$

$$+({\mathbf{a}}_1\cdot {\mathbf{n}}_a)({\mathbf{b}}_0\cdot {\mathbf{n}}_b)+({\mathbf{a}}_1\cdot {\mathbf{n}}_a)({\mathbf{b}}_1\cdot {\mathbf{n}}_b)$$

$$\displaystyle-(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})](\mathbf{c}_{1}\cdot\mathbf{n}_{c})\Big{|}$$

$$\displaystyle\leq\int\rho^{\prime}(\mathbf{n}_{a},\mathbf{n}_{b})d\mathbf{n}_{a}d\mathbf{n}_{b}\Big{|}[(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})$$

$$+({\mathbf{a}}_1\cdot {\mathbf{n}}_a)({\mathbf{b}}_0\cdot {\mathbf{n}}_b)+({\mathbf{a}}_1\cdot {\mathbf{n}}_a)({\mathbf{b}}_1\cdot {\mathbf{n}}_b)$$

$$\displaystyle-(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})]\Big{|},$$

$$\displaystyle\Big{|}[(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})+(\mathbf{a}_{1}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})$$

$$\displaystyle+(\mathbf{a}_{1}\cdot\mathbf{n}_{a})(\mathbf{b}_{1}\cdot\mathbf{n}_{b})-(\mathbf{a}_{0}\cdot\mathbf{n}_{a})(\mathbf{b}_{0}\cdot\mathbf{n}_{b})]\Big{|}$$

$$\displaystyle=\Big{|}(\mathbf{a}_{0}\cdot\mathbf{n}_{a})[(-\mathbf{b}_{0}+\mathbf{b}_{1})\cdot\mathbf{n}_{b}]+(\mathbf{a}_{1}\cdot\mathbf{n}_{a})[(\mathbf{b}_{0}+\mathbf{b}_{1})\cdot\mathbf{n}_{b}]\Big{|}$$

$$\displaystyle=\bigg{|}(\mathbf{a}_{0}\cdot\mathbf{n}_{a})\bigg{[}(-\hat{x}+\hat{y})\cdot\mathbf{n}_{b}\bigg{]}+(\mathbf{a}_{1}\cdot\mathbf{n}_{a})\bigg{[}(\hat{x}+\hat{y})\cdot\mathbf{n}_{b}\bigg{]}\bigg{|}$$

$$\displaystyle=\sqrt{2}\bigg{|}\bigg{[}\frac{\hat{x}-\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{a}\bigg{]}\bigg{[}\frac{-\hat{x}+\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{b}\bigg{]}$$

$$\displaystyle+\bigg{[}\frac{\hat{x}+\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{a}\bigg{]}\bigg{[}\frac{\hat{x}+\hat{y}}{\sqrt{2}}\cdot\mathbf{n}_{b}\bigg{]}\bigg{|}$$

$$\displaystyle=\sqrt{2}\big{|}-\cos{\theta_{a}}\cos{\theta_{b}}+\sin{\theta_{a}}\sin{\theta_{b}}\big{|}$$

$$\displaystyle=\sqrt{2}\big{|}\cos{(\theta_{a}+\theta_{b})}\big{|}.$$

$$\displaystyle\Big{|}\langle A_{0}B_{0}C_{0}\rangle+\langle A_{0}B_{0}C_{1}\rangle+\langle A_{0}B_{1}C_{0}\rangle+\langle A_{1}B_{0}C_{0}\rangle$$

$$\displaystyle-\langle A_{0}B_{1}C_{1}\rangle-\langle A_{1}B_{0}C_{1}\rangle-\langle A_{1}B_{1}C_{0}\rangle-\langle A_{1}B_{1}C_{1}\rangle\Big{|}$$

$$\displaystyle\leq\Big{|}\langle(A_{0}B_{0}+A_{0}B_{1}+A_{1}B_{0}-A_{1}B_{1})C_{0}\rangle\Big{|}$$

$$\displaystyle+\Big{|}\langle(A_{0}B_{1}+A_{1}B_{0}+A_{1}B_{1}-A_{0}B_{0})C_{1}\rangle\Big{|}$$

$$\displaystyle\leq\int\rho^{\prime}(\mathbf{n}_{a},\mathbf{n}_{b})d\mathbf{n}_{a}d\mathbf{n}_{b}\sqrt{2}\bigg{[}\big{|}\sin{(\theta_{a}+\theta_{b})}\big{|}$$

$$\displaystyle+\big{|}\cos{(\theta_{a}+\theta_{b})}\big{|}\bigg{]}$$

$$\displaystyle\leq 2\int\rho^{\prime}(\mathbf{n}_{a},\mathbf{n}_{b})d\mathbf{n}_{a}d\mathbf{n}_{b}\bigg{|}\pm\sin{(\theta_{a}+\theta_{b}\pm\frac{\pi}{2})}\bigg{|}$$

$$\le 2\int {\rho }^{\prime }({\mathbf{n}}_a,{\mathbf{n}}_b)d{\mathbf{n}}_{a}d{\mathbf{n}}_b=2.$$

Full text

Multipartite cryptography, genuine multipartite quantum correlations, Svetlichny’s inequality, quantum key distribution, device-independent quantum key distribution

I Introduction

The simplest private keys are two identical or opposite strings of random bits, which are shared by sender and receiver and can be employed to secure communication between them. The security of communication is based entirely on the privacy of keys, while the latter is built on the secure distribution of it. Quantum cryptography or quantum key distribution (QKD) is a procedure which exploits quantum principles to secure the distribution of keys. In $1984$, Bennett and Brassard [1] presented the first protocol of QKD (BB$84$). In $1991$, Ekert [2] proposed a scheme of QKD in which Bell’s inequality [3, 4, 5] had been used to test for eavesdropping. In the same year, Bennett, Brassard and Mermin [6] proposed a simpler but conceptually equivalent version of Ekert’s scheme, in which they use Einstein-Podolsky-Rosen correlations [7] both to construct key strings and to test for eavesdropping. Since then numerous QKD protocols have been presented [8, 9, 10, 11, 12, 13, 14, 15, 16, 17], quantum cryptography is one of the fastest growing areas in quantum information science[18, 19, 20, 21, 22, 23, 24] and many research results have been applied to commercial applications[25, 26, 27, 28].

In addition to the fully studied two-party keys, there are private keys that involve multipartite communications. Analogous to bipartite private keys, multipartite private keys consist of strings of random bits that shared by multiple parties, but in this case these strings have collective correlations rather than pairwise correlations (Fig.1). Multipartite private keys can apply to some tasks that bipartite private keys cannot accomplish. For example, the situation in Fig.2, Alice has a file to pass to Bob and Carol, she requires that Bob and Carol can only open this file together, and neither of them can open the file alone. If these three people have shared tripartite private keys in advance, Alice can encrypt this file by using her keys and then send it to Bob and Carol. Since for the case of tripartite private keys, no one can infer the keys of either of the other two from the keys in their own hands, Bob and Carol definitely can’t decrypt the file alone. We can also design a lot of tasks in which multi-party keys are applicable but two-party keys are not competent.

In the secure distributions of two-party keys, one use the bipartite quantum correlations, while in the secure distributions of multi-party keys, as the illustration of Fig.1 we need to use the genuine multipartite quantum correlations (GMQC)[29, 30, 31, 32, 33, 34]. GMQC is a collective correlation which involve all subsystems, so it cannot be reduced to mixtures of states in which a smaller number of subsystems are entangled. There exist many inequivalent types of GMQC[35], and its structure is much richer than that of bipartite correlations[36, 37]. Svetlichny proposed the first method to detect GMQC, Svetlichny’s inequality (SI) [38, 39] is a Bell-like inequality, the violation of which can be used to confirm the existence of GMQC. GHZ states is a quantum state with GMQC[40, 41], by using it and proper measurement settings one can result in maximal violation of SI [39].

There has been a lot of theoretical and experimental works on multi-party key distribution. For example, in [42] the authors introduced an $N$-party version of the BB$84$ protocol, and in [43] the same authors introduced a new multi-party QKD protocol that exploits $N$-partite W state to establish a secret multi-party key among the $N$ users. In [44] and [45], some experimentally feasible schemes have been proposed which manifest the possibility for practical realization of multi-party key distribution over long-distance. In addition, there are already some multi-party QKD protocols whose security can be guaranteed by violations of different quantum nonlocality inequalities[46, 47, 48].

In this paper, we present a scheme for secure distributions of multipartite keys by using GHZ states (Fig.1), in this scheme the violation of SI can be used to test for eavesdropping. We first discuss tripartite keys. In this case after receiving their particles, Alice, Bob, and Carol can randomly choose measurements from their own sets of alternative measurement settings respectively. After all particles have been measured, Alice, Bob, and Carol announce their measurement choices publicly. In all measurement setting options, the outcomes of about $1/4$ of them can be used to construct tripartite keys, the outcomes of about $1/2$ of them can be used to calculate whether the SI inequality will be violated, and only the outcomes of about $1/4$ of them are useless. We then extend this scheme to the case of $N$-party keys. In this case we find that the violation of N-partite SI still guarantees the security of the generalized scheme, and also only a quarter of the measurement options are useless. In particular, we prove that in an extreme case, where the eavesdropper can completely control $N-1$-party’s measurement outcomes, the violation of SI still ensures the security of the keys distribution. Since GHZ states is a maximum entanglement state, whose perfect monogamy guarantee the device-independent security of our protocol. However quantum entanglement is a vulnerable resource which is often decayed during transmission, so we need here to derive the secret-key rate of our protocol under the condition of using quantum states with non-maximal entanglement. We then calculate the extractable secret-key rate of our three-party QKD protocol for the Werner state in the device-independent scenario. We find that the value of the extractable secret-key rate monotonously approaches $1$ as the value of the visibility of the Werner state increases, and it reaches its maximum value $1$ when the Werner state becomes the GHZ state.

II Three-party key distribution

Our scheme uses a series of 3-particle GHZ states. We can assume there exist a particle source which can generate a sequence of $3$-particle in GHZ states $\left|\Psi\right\rangle_{GHZ}=\frac{1}{\sqrt{2}}\left(\left|\uparrow\uparrow\uparrow\right\rangle+\left|\downarrow\downarrow\downarrow\right\rangle\right)$ and then these particles are sent to Alice, Bob, and Carol respectively. After receive his (her) particle, Alice, Bob, and Carol can perform spin measurements on their own particles along some directions, we use unit vectors $\mathbf{a}_{i}$, $\mathbf{b}_{j}$, and $\mathbf{c}_{k}$ to stand for their directions of spin measurements. For simplicity, we require all $\mathbf{a}_{i}$, $\mathbf{b}_{j}$, and $\mathbf{c}_{k}$ lie in the $x-y$ plane, and all vectors are characterized by their azimuthal angles: $\alpha_{i}$, $\beta_{j}$, and $\gamma_{k}$. We also use these azimuthal angles to represent their spin measurements, for example Alice’s spin measurements are $\hat{A}_{i}=\mathbf{a}_{i}\cdot\mathbf{\sigma}=\cos{\alpha_{i}}\sigma_{x}+\sin{\alpha_{i}}\sigma_{y}$, and similarly $\hat{B}_{j}=\cos{\beta_{j}}\sigma_{x}+\sin{\beta_{j}}\sigma_{y}$ ($\hat{C}_{k}=\cos{\gamma_{k}}\sigma_{x}+\sin{\gamma_{k}}\sigma_{y}$) for Bob’s (Carol’s). Now we assume that for every particle she received Alice randomly choose a measurement from {$\alpha_{0}=-\frac{\pi}{4},\alpha_{1}=\frac{\pi}{4},\alpha_{2}=0,\alpha_{3}=\frac{\pi}{2}$}, Bob randomly choose a measurement from {${\beta_{0}=0,\beta_{1}=\frac{\pi}{2}}$}, and similarly Carol randomly choose a measurement from {${\gamma_{0}=0,\gamma_{1}=\frac{\pi}{2}}$}. It’s obvious that there are a total of $16$ measurement options for a $3$-particle GHZ state, we will see that outcomes of four measurement options can be used to construct three-party private keys. From $\sigma_{x}\left|\uparrow\right\rangle=\left|\downarrow\right\rangle$, $\sigma_{x}\left|\downarrow\right\rangle=\left|\uparrow\right\rangle$, $\sigma_{y}\left|\uparrow\right\rangle=i\left|\downarrow\right\rangle$, and $\sigma_{y}\left|\downarrow\right\rangle=-i\left|\uparrow\right\rangle$, we can get the following equations,

[TABLE]

From above equations, we find that for some certain measurement settings their measurement outcomes have definite collective correlations. So for these four measurement settings of $(0,0,0)$, $(0,\frac{\pi}{2},\frac{\pi}{2})$, $(\frac{\pi}{2},0,\frac{\pi}{2})$, and $(\frac{\pi}{2},\frac{\pi}{2},0)$, their outcomes can be used as tripartite keys.

We briefly introduce SI which will be used to test for eavesdropping. Tripartite SI can expressed as the following equation,

[TABLE]

Where all $\langle A_{i}B_{j}C_{k}\rangle$’s represent average values of $A_{i}B_{j}C_{k}$’s, $A_{0}$ and $A_{1}$ are Alice’s outcomes for corresponding measurements $\hat{A}_{0}$ and $\hat{A}_{1}$, and similarly $B_{0}$ and $B_{1}$ ($C_{0}$ and $C_{1}$) for Bob’s (Carol’s). As mentioned above, we use unit vector $\mathbf{a}_{i}$, $\mathbf{b}_{j}$, and $\mathbf{c}_{k}$ to stand for directions of spin measurements $\hat{A}_{i}$, $\hat{B}_{j}$, and $\hat{C}_{k}$ respectively, and restrict them lie in the $x-y$ plane. As above we use their azimuthal angles $\alpha_{i}$, $\beta_{j}$, and $\gamma_{k}$ to represent these measurements $\hat{A}_{i}$, $\hat{B}_{j}$, and $\hat{C}_{k}$ respectively. For $3$-particle in GHZ state of $\left|\Psi\right\rangle_{GHZ}=\frac{1}{\sqrt{2}}\left(\left|\uparrow\uparrow\uparrow\right\rangle+\left|\downarrow\downarrow\downarrow\right\rangle\right)$, we choose the measurement protocol [39]

[TABLE]

then we can achieve the maximal value $4\sqrt{2}$ of Eq. (2), i.e. the maximal violation of SI [39]. So we find that in above all $16$ measurement options there are these eight measurement settings of $(\pm\frac{\pi}{4},0,0)$, $(\pm\frac{\pi}{4},0,\frac{\pi}{2})$, $(\pm\frac{\pi}{4},\frac{\pi}{2},0)$, and $(\pm\frac{\pi}{4},\frac{\pi}{2},\frac{\pi}{2})$, whose outcomes can be used to calculate the value of SI.

Therefore, our scheme is as follows:

$(1)$. There is a particle source which can generate a sequence of $3$-particle in GHZ states and then send these particles to Alice, Bob, and Carol respectively.

$(2)$. After receiving their particles, for every particle Alice randomly choose to perform a measurement from {${\alpha_{0}=-\frac{\pi}{4},\alpha_{1}=\frac{\pi}{4},\alpha_{2}=0,\alpha_{3}=\frac{\pi}{2}}$}, Bob randomly choose a measurement from {${\beta_{0}=0,\beta_{1}=\frac{\pi}{2}}$}, and similarly Carol randomly choose a measurement from {${\gamma_{0}=0,\gamma_{1}=\frac{\pi}{2}}$}. After all particles have been measured, Alice, Bob, and Carol announce their all measurement choices publicly.

$(3)$. They reveal publicly the outcomes of the eight measurement settings of $(\pm\frac{\pi}{4},0,0)$, $(\pm\frac{\pi}{4},0,\frac{\pi}{2})$, $(\pm\frac{\pi}{4},\frac{\pi}{2},0)$, and $(\pm\frac{\pi}{4},\frac{\pi}{2},\frac{\pi}{2})$ that involving calculation of the value of SI.They use the outcomes of the four measurement settings of $(0,0,0)$, $(0,\frac{\pi}{2},\frac{\pi}{2})$, $(\frac{\pi}{2},0,\frac{\pi}{2})$, and $(\frac{\pi}{2},\frac{\pi}{2},0)$ as tripartite keys.

$(4)$. If they find the violation of SI, they can ensure the security of the key distribution.

Below we prove that the violation of SI can be used to test for eavesdropping. We first consider a mild case in which the eavesdropper disturb the particles in their transmissions from the source to the legitimate users. And then we’ll consider an extreme situation. If the eavesdropper disturb (measure) the particles in their transmissions, their quantum states will collapse to the eigenstates of spin in some certain directions. We use unit vectors $\mathbf{n}_{a}$, $\mathbf{n}_{b}$, $\mathbf{n}_{c}$ to denote the directions of the collapsed spin eigenstates of particles a, b, and c that have been sent to Alice, Bob, and Carol respectively. The normalized probability measure $\rho(\mathbf{n}_{a},\mathbf{n}_{b},\mathbf{n}_{c})$ exactly reflects the eavesdropper’s measurement strategy, and it also determines the correlations of the measurement results of the legitimate users’, i.e. $\langle A_{i}B_{j}C_{k}\rangle=\int\rho(\mathbf{n}_{a},\mathbf{n}_{b},\mathbf{n}_{c})d\mathbf{n}_{a}d\mathbf{n}_{b}d\mathbf{n}_{c}(\mathbf{a}_{i}\cdot\mathbf{n}_{a})(\mathbf{b}_{j}\cdot\mathbf{n}_{b})(\mathbf{c}_{k}\cdot\mathbf{n}_{c})$. Since all $\mathbf{a}_{i}$, $\mathbf{b}_{j}$, and $\mathbf{c}_{k}$ lie in the $x-y$ plane, it’s obvious that all unit vectors $\mathbf{n}_{a}$, $\mathbf{n}_{b}$, $\mathbf{n}_{c}$ should also lie in the $x-y$ plane in order to increase the possibility of violation of SI, i.e. the eavesdropper should measure particles along the directions in the $x-y$ plane. We find that the left-hand side of Eq. (2) can be expressed as

[TABLE]

We now calculate both terms on the right-hand side of the above inequality, and prove that the sum of them is less than $2$. The first term

[TABLE]

Where $\mathbf{a}_{0},\mathbf{b}_{0},\mathbf{c}_{0}$ ($\mathbf{a}_{1},\mathbf{b}_{1},\mathbf{c}_{1}$) stand for the directions of spin measurements, they all lie in the $x-y$ plane and their azimuthal angles can be see in Eq. (3). The normalized probability measure $\rho^{\prime}(\mathbf{n}_{a},\mathbf{n}_{b})=\int\rho(\mathbf{n}_{a},\mathbf{n}_{b},\mathbf{n}_{c})d\mathbf{n}_{c}$. We calculate the integrand in Eq. (5),

[TABLE]

Where $\hat{x}$ and $\hat{y}$ represent the coordinate directions of the x-axis and the y-axis, $\theta_{a}$ and $\theta_{b}$ are the angles between the vector $\frac{\hat{x}-\hat{y}}{\sqrt{2}}$ and $\mathbf{n}_{a}$ and $\mathbf{n}_{b}$ respectively. Substitute the result of Eq. (6) into Eq. (5), we get a upper bound of $\mid\langle(A_{0}B_{0}+A_{0}B_{1}+A_{1}B_{0}-A_{1}B_{1})C_{0}\rangle\mid$.

In a similar way we calculate $\mid\langle(A_{0}B_{1}+A_{1}B_{0}+A_{1}B_{1}-A_{0}B_{0})C_{1}\rangle\mid$.

[TABLE]

as in Eq. (5), $\mathbf{a}_{0},\mathbf{b}_{0},\mathbf{c}_{0}$ ($\mathbf{a}_{1},\mathbf{b}_{1},\mathbf{c}_{1}$) all lie in the $x-y$ plane and their azimuthal angles can be see in Eq. (3), they stand for the directions of spin measurements. The normalized probability measure $\rho^{\prime}(\mathbf{n}_{a},\mathbf{n}_{b})=\int\rho(\mathbf{n}_{a},\mathbf{n}_{b},\mathbf{n}_{c})d\mathbf{n}_{c}$. We also calculate the integrand in Eq. (7),

[TABLE]

As in Eq. (6), $\theta_{a}$ and $\theta_{b}$ are still the angles between the vector $\frac{\hat{x}-\hat{y}}{\sqrt{2}}$ and $\mathbf{n}_{a}$ and $\mathbf{n}_{b}$ respectively. Substitute the result of Eq. (8) into Eq. (7), we get a upper bound of $\mid\langle(A_{0}B_{1}+A_{1}B_{0}+A_{1}B_{1}-A_{0}B_{0})C_{1}\rangle\mid$.

Based on the above calculation, we finally obtain

[TABLE]

We can see that there is no violation of SI in this case. So if the eavesdropper disturb the particles, the legitimate users always find that key distribution fails.

Now we consider an extreme situation in that the eavesdropper has the ability to control the measurement results of two participants, we want to know whether the eavesdropper is thus capable of creating the illusion of successful key distribution, i.e. a violation of SI. Without loss of generality we assume that the eavesdropper can completely control the measurement results of Alice and Bob. We notice that these two functions $(A_{0}B_{0}+A_{0}B_{1}+A_{1}B_{0}-A_{1}B_{1})$ and $(A_{0}B_{1}+A_{1}B_{0}+A_{1}B_{1}-A_{0}B_{0})$ are not independent since they consist of the same four quantities, whenever one of the two functions reaches its maximum absolute value $4$, the other one will be [math]. If we change one quantity of all $A_{i}B_{j}$’s to its opposite number, the value of the function with maximum absolute value $4$ will become $\pm 2$, and the value of the other function will become $\pm 2$ too. The discussion shows that in no case can the sum of the absolute values of these two functions exceed $4$. So even if the eavesdropper can control the measurement results of two participants, the right-hand side of Eq. (4) cannot be greater than $4$.

III $N$-party key distribution

We will use a series of $N$-particle GHZ state of $\left|\Psi\right\rangle^{N}_{GHZ}=\frac{1}{\sqrt{2}}\left(\left|\uparrow\right\rangle^{\otimes N}_{z}+\left|\downarrow\right\rangle^{\otimes N}_{z}\right)$ in the distribution of $N$-party key. We use $A^{(i)}_{x_{i}}$ to stand for the outcomes of the measurement operator $\hat{A}^{(i)}_{x_{i}}$ of the i-th participant, where ${x_{i}}$ represents the measurement choices of the i-th participant. In $N$-partite SI each person has two measurement options, so every ${x_{i}}$ takes the value [math] or $1$. Note, however, that one participant in our protocol of the $N$-party key distribution had four measurement options. As in the three-party case, we use unit vectors $\mathbf{a}^{(i)}_{x_{i}}$ to represent the directions of spin measurements $\hat{A}^{(i)}_{x_{i}}$. For simplicity, we require all $\mathbf{a}^{(i)}_{x_{i}}$’s lie in the $x-y$ plane, and all vectors are characterized by their azimuthal angles $\alpha^{(i)}_{x_{i}}$. We can use these azimuthal angles to represent these measurements $\hat{A}^{(i)}_{x_{i}}=\mathbf{a}^{(i)}_{x_{i}}\cdot\mathbf{\sigma}=\cos{\alpha^{(i)}_{x_{i}}}\sigma_{x}+\sin{\alpha^{(i)}_{x_{i}}}\sigma_{y}$.

$N$-partite SI. We can express $N$-partite SI as

[TABLE]

where $S^{\pm}_{N}$ is the $N$-partite Svetlichny’s operator, $\{x_{i}\}$ stands for an $N$-tuple $x_{1},...,x_{N}$, the sum is over all these tuples. The $v^{\pm}_{k}$ is the sign function of the corresponding term $A^{(1)}_{x_{1}}A^{(2)}_{x_{2}}\cdot\cdot\cdot A^{(N)}_{x_{N}}$, it is given by $v^{\pm}_{k}=(-1)^{[k(k\pm 1)/2]}$, where $k$ is the number of times index $1$ appears in $(x_{1},x_{2},...,x_{N})$. For $N$-particle GHZ state $\frac{1}{\sqrt{2}}\left(\left|\uparrow\right\rangle^{\otimes N}_{z}+\left|\downarrow\right\rangle^{\otimes N}_{z}\right)$, by using the following measurement protocol [39] one can achieve the maximal violation $2^{N-1}\sqrt{2}$ of Eq. (10)

[TABLE]

The scheme of $N$-party key distribution. There are $N$ participants in this scheme, in every trial these participants randomly choose a measurement from their own measurement option sets respectively, we use the azimuthal angles $\alpha^{(i)}_{x_{i}}$ to express these measurement options and list them below

[TABLE]

The first participant have four measurement options and other participants have only two, there are a total of $4\times 2^{N-1}$ measurement options for a $N$-particle GHZ state. For every trial, when all participants only measure along $\hat{x}$ or $\hat{y}$ direction and the number of the participants who measure along the $\hat{y}$ direction is even, the following equation holds

[TABLE]

Where $\sigma^{(i)}_{k_{i}}$ is pauli operator $\sigma^{(i)}_{x}$ or $\sigma^{(i)}_{y}$, when the number of index $y$ appears in $(k_{1},k_{2},...,k_{N})$ is a multiple of $4$ the right-hand side of Eq (13) takes $\left|\Psi\right\rangle^{N}_{GHZ}$. So we can use the outcomes of these measurement options as $N$-party private keys, the number of these measurement options is $2^{N-1}$. The number of the measurement options that involved the calculation of $N$-partite SI (Eq. (11)) is $2^{N}$, the outcomes of the remaining $2^{N-1}$ measurement options are useless.

Test for eavesdropping. As in three-party case, we first consider a mild case where the eavesdropper measures the particles in their transmissions. We notice that the $N$-partite Svetlichny’s operator $S^{\pm}_{N}$ can be expressed as

[TABLE]

By using the result of three-party case and the mathematical induction, it is obvious that $\left|\langle S^{\pm}_{N}\rangle\right|\leq 2^{N-2}$ in this case, i.e. the SI cannot be violated.

Finally, we prove that even if the eavesdropper has the ability to control the measurement results of $N-1$ participants, the SI of Eq. (10) still cannot be violated. We first study the value of $v^{\pm}_{k}=(-1)^{[k(k\pm 1)/2]}$. We assume $k=4l+m$, $m$ is the remainder of $k$ divided by $4$, so

[TABLE]

[TABLE]

We now study the relation between the values of $S^{+}_{N-1}$ and $S^{-}_{N-1}$, they are not independent since they consist of the same quantities of $A^{(1)}_{x_{1}}A^{(2)}_{x_{2}}\cdot\cdot\cdot A^{(N-1)}_{x_{N-1}}$. From Eq. (15) we know, if we want $S^{+}_{N-1}$ to takes its maximum value of $2^{N-1}$, we must let the quantities of $A^{(1)}_{x_{1}}A^{(2)}_{x_{2}}\cdot\cdot\cdot A^{(N-1)}_{x_{N-1}}$ corresponding to $m=0,3$ take the value $1$, and let the quantities of $A^{(1)}_{x_{1}}A^{(2)}_{x_{2}}\cdot\cdot\cdot A^{(N-1)}_{x_{N-1}}$ corresponding to $m=1,2$ take the value $-1$. We assume that in $S^{\pm}_{N-1}$, the numbers of quantities of $A^{(1)}_{x_{1}}A^{(2)}_{x_{2}}\cdot\cdot\cdot A^{(N-1)}_{x_{N-1}}$ corresponding to $m=0,1,2,3$ are $M_{0}$, $M_{1}$, $M_{2}$, $M_{3}$ respectively. So if $S^{+}_{N-1}$ takes its maximum value of $2^{N-1}$, from Eq. (16) we find the value of $S^{-}_{N-1}$ is

[TABLE]

If we change one quantity of all $A^{(1)}_{x_{1}}A^{(2)}_{x_{2}}\cdot\cdot\cdot A^{(N-1)}_{x_{N-1}}$’s to its opposite number, the value of $S^{+}_{N-1}$ becomes $2^{N-1}-2$ and the value of $S^{-}_{N-1}$ becomes $\pm 2$. We can repeat this process until $S^{+}_{N-1}$ equals [math] and $S^{-}_{N-1}$ equals $\pm 2^{N-1}$. Given all of that, we finally conclude

[TABLE]

So even if the eavesdropper can control the measurement results of $N-1$ participants, he still unable to create a violation of SI. It also means that the eavesdropper is unable to deceive the legitimate users into believing that the key has been successfully distributed.

IV Secret key rate

Different from the usual QKD, device-independent quantum key distribution (DIQKD) protocols aim at establishing the security of key distribution based on the most fundamental assumptions. In DIQKD, legitimate users can not only completely ignore the internal working of the quantum measurement apparatuses used in the protocol, but also do not have to have any information about the particles in their hands. In addition to other fundamental assumptions, the security proof of a DIQKD protocol can be based entirely on the correctness of quantum theory and observable data. The aim of DIQKD is to design protocols secure against more powerful eavesdroppers than that in usual QKD, so from the perspective of DIQKD many usual QKD protocols are not secure. For example, if Alice and Bob actually share four-dimensional particles and the eavesdropper Eve can tamper their quantum measurement apparatuses so that their actual measurements not correspond to their expected ones, the BB$84$ [1] protocol is not secure [49].

Quantum nonlocality is a necessary condition to the security of DIQKD. The first quantitative relation between secret-key rate and the violation of CHSH inequality was derived by Acín et al [50, 49], this initial result was only considered under the collective attacks condition, and it was later extended to the most powerful coherent attacks condition [51]. After that, many secret-key rates were obtained along with different proposed DIQKD protocols whose securities are guaranteed by violations of different quantum nonlocality inequalities [46, 47, 48], and many moderate improvements were achieved by considering actual noisy processing [52, 53, 54] and imperfect detection efficiency [55, 56]. Since quantum nonlocality is a vulnerable resource and the entanglement of quantum states is often decayed during transmission, we need here to derive the secret-key rate of our proposed protocol under the condition of using quantum states with non-maximal entanglement. Next we will calculate the secret-key rate in the three-party scenario, we consider eavesdropper applying the convex combination (CC) attack [57, 58, 59], and the non-maximal entanglement state we consider is the Werner state [60].

We now give a brief introduction to CC attack. Since we assume the source of particles is under the control of the eavesdropper Eve and three legitimate users announce their measurement choices for every round, Eve has the ability to mimic the legitimate users’ correlation as the following equation

[TABLE]

Where $q_{L}\in[0,1]$, we call it the local weight. These $\hat{A}_{x}$, $\hat{B}_{y}$, and $\hat{C}_{z}$ denote the measurement choices of Alice, Bob, and Carol respectively, and $A_{x}$, $B_{y}$, $C_{z}$ are their outcomes. We call $P_{ABC}(A_{x},B_{y},C_{z}|\hat{A}_{x},\hat{B}_{y},\hat{C}_{z})$ is the legitimate users’ observed correlation, $P^{L}_{ABC}(A_{x},B_{y},C_{z}|\hat{A}_{x},\hat{B}_{y},\hat{C}_{z})$ is local correlation (in our case of three-party key distribution we require it to be Svetlichny local, i.e., it cannot result in the violation of SI), $P^{NL}_{ABC}(A_{x},B_{y},C_{z}|\hat{A}_{x},\hat{B}_{y},\hat{C}_{z})$ is a judiciously chosen nonlocal quantum correlation. From Eq. (19) we see that in order to mimic legitimate users’ correlation Eve distributes local deterministic correlations with probability $q_{L}$, and she distributes nonlocal quantum correlation with probability $1-q_{L}$. Since in those cases of distribution of local deterministic correlations Eve can have complete information of outcomes of legitimate users’ measurements, she certainly wants to maximize $q_{L}$. This is CC attack.

We assume that the targeted state $\left|\Psi\right\rangle_{GHZ}$ is affected by white noise during transmission, and it is transformed into the three-qubit Werner state

[TABLE]

we call $v\in[0,1]$ the visibility, only when $v>\frac{1}{\sqrt{2}}$ the measurement protocol Eq.(3) can result in the violation of SI, we denote $v_{L}=\frac{1}{\sqrt{2}}$. We denote the correlation which is given rise to by the Werner state $\rho^{v}_{ABC}$ as $P^{v}_{ABC}$. So if the Werner state $\rho^{v}_{ABC}$ give rise to the legitimate users’ observed correlation $P_{ABC}(A_{x},B_{y},C_{z}|\hat{A}_{x},\hat{B}_{y},\hat{C}_{z})$ in Eq.(19), it is intuitive that in order to maximize $q_{L}$, Eve should use nonlocal correlation $P^{NL}_{ABC}(A_{x},B_{y},C_{z}|\hat{A}_{x},\hat{B}_{y},\hat{C}_{z})=P^{v=1}_{ABC}$ and local correlation $P^{L}_{ABC}(A_{x},B_{y},C_{z}|\hat{A}_{x},\hat{B}_{y},\hat{C}_{z})=P^{v_{L}}_{ABC}$. It’s easy to find the maximum $q_{L}$,

[TABLE]

we can obtain $q_{L}=\frac{1-v}{1-v_{L}}$ by comparing Eq.(20) and Eq.(21).

Finally we calculate the secret-key rate of our protocol for the Werner state. In our three-party key distribution protocol, the raw keys are extracted from the following measurement settings

[TABLE]

We assume that the probability that the legitimate users choose to make each measurement is equal, and it’s obvious that the secret-key rate calculated from each measurement setting is the same, so we will only calculate the secret-key rate of the first measurement setting \big{(}\hat{A}_{2},\hat{B}_{0},\hat{C}_{0}\big{)}. We use the Devetak-Winter formula [61] to calculate the lower bound of the secret-key rate

[TABLE]

Where $E$ denote measurement result of Eve, $H(A_{2}|E)$ and $H(A_{2}|B_{0},C_{0})$ both are the conditional Shannon entropy, $H(A_{2}|E)$ quantifies the correlation between Alice and Eve, and $H(A_{2}|B_{0},C_{0})$ quantifies the correlation between Alice and Bob and Carol. Since three-party key strings have collective correlations rather than pairwise correlations in the two-party case, Eq.(23) is slightly different from its standard form for the two-party case. If the three legitimate users actually share the Werner state Eq.(20) which will give rise to correlation $P^{v}_{ABC}$, from Eq.(21) we can get $P^{v}_{ABC}=q_{L}P^{v_{L}}_{ABC}+(1-q_{L})P^{v=1}_{ABC}$. Since $P^{v=1}_{ABC}$ is the correlation generated by the maximum entanglement quantum state $\left|\Psi\right\rangle_{GHZ}$, the perfect monogamy force that Eve has no information about $A_{2}$ in this case. We assume that Eve has the power to get complete information about Alice’s outcome $A_{2}$ in the case of distribution of local correlation $P^{v_{L}}_{ABC}$. So for every measurement result $E$ of Eve, we have conditional probability $P(A_{2}=E|E)=\frac{1+q_{L}}{2}$ ($P(A_{2}\neq E|E)=\frac{1-q_{L}}{2}$), and

[TABLE]

where $h$ is the binary entropy. Then we calculate $H(A_{2}|B_{0},C_{0})$. From the fourth equation of Eq.(1) and Eq.(20), we can obtain $P(A_{2}=B_{0}C_{0}|B_{0},C_{0})=\frac{1+v}{2}$ ($P(A_{2}\neq B_{0}C_{0}|B_{0},C_{0})=\frac{1-v}{2}$) for every outcomes $B_{0}$ and $C_{0}$, and then

[TABLE]

Substituting these results into Eq.(23), we obtain

[TABLE]

Only when $v>\frac{1}{2-v_{L}}\approx 0.773459$ the lower bound of the secret-key rate is greater than zero. We depict the extractable secret-key rate $r_{DW}$ in Fig.3, and it manifests that as the value of visibility $v$ increases the value of $r_{DW}$ monotonously approaches $1$ and $r_{DW}=1$ when $v=1$.

We notice that the threshold visibility $v=\frac{1}{2-v_{L}}$ for the positive secret-key rate of DIQKD protocols is greater than the threshold visibility $v_{L}=\frac{1}{\sqrt{2}}$ for the violation of SI, and we have two comments on this result. First, in our protocol we assume that Eve has the power to get complete information about Alice’s outcomes in the case of distribution of local correlation $P^{v_{L}}_{ABC}$, so if, in fact Eve does not have such a powerful ability we will get a less threshold visibility for the positive secret-key rate, which should be closer to $v_{L}$. Second, even if there exists such a powerful Eve, we can still get a secure DIQKD protocol as long as $v>\frac{1}{2-v_{L}}$.

V Conclusion

Multipartite private keys have collective correlations rather than pairwise correlations, so no participant can infer the keys of others from the keys in his own hands. Because of this property, there are a lot of tasks in which multipartite keys are applicable but two-partite keys are not competent. In this paper, we present a QKD scheme in which participants can securely share a set of multipartite keys by using a sequence of multi-particle GHZ states. We prove that the violation of SI can be utilized to test for eavesdropping, and even when the eavesdropper can completely control the outcomes of many participants’ measurements, our scheme still ensures the device-independent security of the keys distribution. In the ideal case, the perfect monogamy of the GHZ state guarantee the device-independent security of our protocol, however quantum entanglement is a vulnerable resource which is often decayed during transmission. So we need to derive the secret-key rate of our protocol under the condition of using quantum states with non-maximal entanglement. We then calculate the extractable secret-key rate of our three-party key distribution protocol for the Werner state in the device-independent scenario. We find that the value of the extractable secret-key rate monotonously approaches $1$ as the value of the visibility of the Werner state increases, and it reaches its maximum value $1$ when the Werner state becomes the GHZ state.

In the two-party case, if each party has only two inputs and two outputs, there is only one non-trivial quantum nonlocality inequality (CHSH inequality) which can be used to guarantee the security of two-party QKD. Unlike that in the two-party case, there exist many kinds of quantum multipartite correlations. For example, in the case of three-party, there exist $53856$ extremal no-signaling correlations which belong to $46$ inequivalent classes in the case of that each party has two inputs and two outputs [62]. So for the multi-party QKD, there exist many different quantum nonlocality inequalities that all can be used to guarantee the security. There are already some multi-party QKD protocols whose security are guaranteed by violations of different quantum nonlocality inequalities [46, 47, 48]. In my view, since violations of different quantum nonlocality inequalities display different kinds of quantum multipartite correlations, each inequality has its own advantages as the security guarantee of QKD.

Acknowledgments

The author is grateful to the anonymous referees for their valuable comments and suggestions to improve the quality of the paper. This work is supported by the National Natural Science Foundation of China under Grant No. 11005031.

Data Availability Statement

This manuscript has no associated data or the data will not be deposited. [Author’s comments: All relevant data are in the paper itself.]