Secure Quantum Network Code without Classical Communication

# Secure Quantum Network Code without Classical Communication

Seunghoan Song and Masahito Hayashi Graduate School of Mathematics, Nagoya University
Centre for Quantum Technologies, National University of Singapore
Email: m17021a@math.nagoya-u.ac.jp & masahito@math.nagoya-u.ac.jp
###### Abstract

We consider the secure quantum communication over a network with the presence of the malicious adversary who can eavesdrop and contaminate the states. As the main result, when the maximum number of the attacked edges is less than a half of network transmission rate (i.e., ), our protocol achieves secret and correctable quantum communication of rate by asymptotic uses of the network. Our protocol requires no classical communication and no knowledge of network structure, but instead, a node operation is limited to the application of an invertible matrix to bit basis states. Our protocol can be thought as a generalization of verifiable quantum secret sharing.

## I Introduction

Network coding is a coding method, addressed first by Ahlswede et al. [2], that allows network nodes to manipulate the information packets before forwarding. As a quantum analog, quantum network coding considers sending quantum states through a network which consists of quantum channels and nodes which perform quantum operations. Kobayashi et al. [10, 11] constructed quantum network codes based on classical network codes and many other papers [6, 7, 8, 9] studied quantum network codes.

In order for the secure communication over network, the security analysis of network codes is inevitable. The paper [3] started to discuss the secrecy of the classical network code and it was shown that the secrecy is improved by network coding. On the other hand, Jaggi et al. [5] showed that when transmission rate of network and the maximum rate of malicious injection satisfy , there exists an asymptotically correctable classical network code with rate by asymptotic uses of the network. Furthermore, Hayashi et al. [14] extended this result so that the secrecy is also guaranteed: when previously defined , and the information leakage rate satisfy , there exists a classical network code of rate which is asymptotically secret and correctable by uses of the network.

The security analysis of quantum network codes was initiated in [15, 16]. However, the protocol in [15, 16] only keeps secrecy from the malicious adversary but the correctness of the state is not guaranteed if there is an attack. Moreover, this protocol depends on the network structure and requires classical communication.

In this paper, to resolve these problems and as a natural quantum extension of the secure classical network codes [5, 14], we present a quantum network code which is secret and correctable. To take a similar method to [5, 14], we transmit a state by uses of the quantum network. When the network transmission rate is and the maximum number of the attacked edges is restricted by , our protocol correctly transmits quantum information of rate by asymptotic uses of the network. Since the correctness of the transmitted quantum state guarantees the secrecy of the quantum channel [1], the secrecy of our protocol is guaranteed.

There are notable properties in our protocol. First, our protocol can be implemented without any classical communication. We generate the negligible rate secret shared randomness needed for our code by negligible rate use of the quantum communication instead of the classical communication. Secondly, our protocol is secure from any malicious operation on edges as long as holds. That is, when , our protocol is safe from the strongest eavesdropper Eve who knows the network structure and the network operations, keeps the classical information extracted from the wiretapped states, and applies the quantum operations on the attacking edges adaptively by her information. Thirdly, our protocol transmits a quantum state without the knowledge of the quantum network structure.

However, unlike [15, 16] and like [5, 14], we place a constraint on our network that a node operation is the application of an invertible matrix to bit basis states.

Our protocol can be thought as a generalization of the verifiable quantum secret sharing [4] because verifiable quantum secret sharing corresponds to a special case of our protocol where the network consists of parallel quantum channels.

The rest of this paper is organized as follows. Section II gives the network structure and Section III formally states two main results of this paper. Based on the preliminaries in Section IV, our code is constructed in Section V. In Section VI, we suggest the transmission protocol with our code and show that the entanglement fidelity is upper bounded by the sum of the bit error probability and the phase error probability. In Section VII, we derive the bit error probability and the phase error probability. In Section VIII, by attaching the secure classical network code presented in [12] to our quantum network protocol, we show that the secure quantum network code without classical communication can be implemented.

## Ii Quantum Network and Attack Model

We give the formal description of our quantum network structure which is defined as a natural quantum extension of a classical network structure.

### Ii-a Classical Network Structure

We consider the network described by a directed graph where is the set of nodes (vertices) and is the set of channels (edges). The network has one source node which has outgoing edges and one sink node which has incoming edges. When a node is not source or sink, it is called an intermediate node and is distinctly numbered from to , which expresses the order of transmissions, is the number of intermediate nodes. The source node and the sink node are assigned to and , respectively. That is, the node makes information conversion at -th order. An intermediate node has the same number of incoming and outgoing edges where . At each time , we assign the numbers to the channels keeping the information after the conversion at the node . At the conversion in the node , the assigned numbers of channels are exchanged between incoming channels and outgoing channels. Hence, the input information is the information at time , and the output information is the information at time .

To explain our model of the quantum network, we consider the classical case. When we use the channel only once, each channel transmits one symbol of the finite field . Hence, the information is described by the vector space . We assume that the information conversion at each intermediate nodes is linear. That is, the information conversion at intermediate node is written as an invertible matrix acting on only the components of the vector space . Therefore, combining all the conversions, the relation between the information at time and the information at time can be characterized by an invertible matrix as

 xc=Kx0.

We extend the above discussion to the case of uses of the network, i.e., each channel has symbols of . We assume that intermediate node apply the matrix at times. When the information at time () is written as an matrix (), we have

 Xc=KX0. (1)

Next, we discuss the case when Eve attacks channels. We focus on the information on the channel, which is numbered to at time . Since the conversion from time to time is given as an invertible matrix, the information on the channel is written as a 1-dimensional subspace of when the information is considered at time . We denote the generating vector of the subspace by . We denote the generating vectors corresponding to the attacked channels by . When Eve adds the noise on the attacked channels, the relation (1) is changed to

 Xc=KX0+KWZ, (2)

where and . Even when Eve chooses the noise dependently of input information, the output is always written in the form (2) while might depend on . That is, using the subspace spanned by columns of , the noise is given by the subspace .

### Ii-B Quantum Network Structure

We consider a natural quantum extension of the above network structure. Each single-use quantum channel is given as the quantum system spanned by . To describe the operation on the quantum system spanned by , we focus on a general quantum system . For an invertible matrix and an invertible matrix we define two unitaries and as

 ˇA|X⟩b =|AX⟩b, (3) ^B|X⟩b =|XB⟩b.

In uses of the network, the whole system to be transmitted is written as spanned . Node converts the information on the subsystem by applying the unitary . When there is no attack, the operation of the whole network is the application of the unitary .

When Eve attacks channels, the attacked subspace is spanned by . Hence, Eve’s attack can be written as a TP-CP map on . That is, when the input state is given by a density matrix , the output state is given as

 ˇKΓ(ρ)ˇK†. (4)

Even when Eve’s operation is correlated among several attacked channels, the output state is always written in the form (4).

## Iii Main Results

Since the shared randomness between the encoder and the decoder plays a crucial role in decoding Section VII, our secure quantum network code needs secret shared randomness between the encoder and the decoder. First, we present the coding theorem with use of the secret shared randomness of negligible rate. In the following, we use the given quantum network times. That is, is the block-length of our code. The results are stated with respect to the entanglement fidelity for a quantum protocol and is a purification of the state . The completely mixed state is denoted as .

###### Theorem III.1 (Quantum Network Code with Negligible Rate Secret Shared Randomness)

Suppose that the sender and receiver share the secret shared randomness whose rate is negligible in comparison with the block-length . If and the operation of the whole network is the application of the unitary of an invertible matrix , there exists a quantum network code with rate which implements the quantum transmission whose entanglement fidelity satisfies

Notice that this code depends only on the ranks and , and does not depend on the detail structure of the network. We mention that the condition in Theorem III.1 guarantees the secrecy of the protocol. The leaked information of a quantum protocol is upper bounded by entropy exchange as follows, where is a purification of the state and is the channel to the environment. When the input state is generated subject to the distribution , the mutual information between the input system and the environment is given as , which is upper bounded by . By entanglement fidelity, the entropy exchange is upper bounded as [1]

 He(κ,ρ)≤h(F2e(ρ,κ))+(1−F2e(ρ,κ))log(d−1)2

where is the binary entropy defined as for and is the dimension of the input space. Hence, when the mixture distribution is the completely mixed state , because in our protocol (Section V), the condition in Theorem III.1 leads that entropy exchange of the protocol is asymptotically , i.e., there is no leakage in the protocol. Thus, the asymptotic correctability also guarantees the secrecy of the protocol in Theorem III.1.

Section V gives the code realizing the performance mentioned in Theorem III.1. In Sections VI and VII it is proved that the code given in Section V satisfies the performance mentioned in Theorem III.1.

Indeed, it is known that there exists a classical network code that transmits classical information securely when the number of attacked edges is less than the half of the rank of the transmitted information from the sender to the receiver [12]. Although Theorem III.1 requires secure transmission of classical information with negligible rate, the result [12] mentioned above guarantees that such secure transmission can be realized by using the negligible rate of our quantum network with bit basis states. Hence, the combination of the result [12] and Theorem III.1 yields the following theorem, whose detail will be given in Section VIII.

###### Theorem III.2 (Quantum Network Code without Classical Communication)

If and the operation of the whole network is the application of the unitary of an invertible matrix , there exists a quantum network code with rate which implements the quantum transmission whose entanglement fidelity satisfies

## Iv Preliminaries

### Iv-a Phase Basis

We discuss the operation on the phase basis. The phase basis is defined as [13, Section 8.1.2]

 |z⟩p:=1√q∑x∈Fqω−trxz|x⟩b,

where and for is where denotes the multiplication map with the identificiation of the finite field with the vector space .

Lemma IV.1 explains that the application of an invertible matrix to bit basis states is simultaneously that to phase basis states. The proof of Lemma IV.1 is in Appendix A.

###### Lemma IV.1

Let and be invertible matrices. For , we have

 ˇA|M⟩p=|(AT)−1M⟩p,^B|M⟩p=|M(BT)−1⟩p.

We use notation for an invertible matrix .

### Iv-B CSS code in our quantum network code

In our secure quantum network code, we employ CSS code described in this subsection.

For the description of the CSS code in our network code, we introduce the following definition and notations. Define a quantum system . We denote

 HC:= HC1⊗HC2⊗HC3, HC1:= H⊗m1×(n−2m0), HC2:= H⊗(m0−2m1)×(n−2m0), HC3:= H⊗m1×(n−2m0).

For states , and , the tensor product state in is denoted as

 ⎛⎜⎝|ϕ⟩|ψ⟩|φ⟩⎞⎟⎠:=|ϕ⟩⊗|ψ⟩⊗|φ⟩∈HC.

The bit or phase basis states are denoted with as

 ∣∣∣⎛⎜⎝XYZ⎞⎟⎠⟩b:=⎛⎜⎝|X⟩b|Y⟩b|Z⟩b⎞⎟⎠,∣∣∣⎛⎜⎝XYZ⎞⎟⎠⟩p:=⎛⎜⎝|X⟩p|Y⟩p|Z⟩p⎞⎟⎠.

Also, denotes the zero matrix in .

With the above notation, CSS code in our quantum network code is described as follows. Define two classical codes which satisfy as

 C1={ ⎛⎜⎝0m1,n−2m0X2X3⎞⎟⎠∈Fm0×(n−2m0)q∣∣∣ X2∈F(m0−2m1)×(n−2m0)q,X3∈Fm1×(n−2m0)q}, C2={ ⎛⎜⎝X1X20m1,n−2m0⎞⎟⎠∈Fm0×(n−2m0)q∣∣∣ X1∈Fm1×(n−2m0)q,X2∈F(m0−2m1)×(n−2m0)q}.

For and where , define quantum states by

 |[M1]⟩b:= 1√|C⊥2|∑Y∈C⊥2∣∣∣⎛⎜⎝0m1,n−2m0M10m1,n−2m0⎞⎟⎠+Y⟩b = ⎛⎜⎝|0m1,n−2m0⟩b|M1⟩b|0m1,n−2m0⟩p⎞⎟⎠, (5) |[M2]⟩p:= 1√|C⊥1|∑Y∈C⊥1∣∣∣⎛⎜⎝0m1,n−2m0M20m1,n−2m0⎞⎟⎠+Y⟩p = ⎛⎜⎝|0m1,n−2m0⟩b|M2⟩p|0m1,n−2m0⟩p⎞⎟⎠.

With the above definitions, the code space is given as , and a state is encoded as a superposition of (or that of ) by

 ⎛⎜⎝|0m1,n−2m0⟩b|ϕ⟩|0m1,n−2m0⟩p⎞⎟⎠∈HC. (6)

## V Code Construction with Negligible Rate Secret Shared Randomness

Now, we describe the quantum network code with the secret shared randomness of negligible rate. First, dependently of the block-length , we choose a power of to satisfy the conditions (e.g. ) where . We identify the system with the system spanned by . Then, uses of our quantum network can be regarded as uses of quantum network over the quantum system . Thus, we apply the notation given in Section IV to the case where , and are substituted into , and , respectively.

In our code, the encoder and the decoder are determined based on random variables. Therefore, we define random variables and . The random variable consists of two random matrices chosen uniformly and independently in all matrices of rank . The random variable consists of random variables chosen uniformly and independently. The random variable is chosen uniformly and randomly among all invertible matrices. These random variables are chosen before encoding and decoding so that the encoder and the decoder are determined. The random variable is shared between the encoder and the decoder and is owned by the encoder. Note that is negligible rate with respect to .

The code space is given as . In addition to the system for the CSS code given in Subsection IV-B, we use the ancilla and isomorphic to in our code and denote

 H′A:= H′A1⊗H′A2⊗H′A3 := H′⊗m1×m0⊗H′⊗(m0−2m1)×m0⊗H′⊗m1×m0, H′B:= H′B1⊗H′B2⊗H′B3 := H′⊗m1×m0⊗H′⊗(m0−2m1)×m0⊗H′⊗m1×m0.

The encoder is defined as an isometry quantum channel from to depending on the random variables and . The decoder is defined as a TP-CP map from to depending on the random variable . We give the details of the encoder and the decoder in the following subsections.

### V-a Encoder ESR,R0

Consider encoding a state .

{LaTeXdescription}

By embeding and as a bit state and a phase basis state , respectively, encode the state with an isometry map as

 |ϕ1⟩:= UR21|ϕ⟩ = ⎛⎜⎝|0m1,m0⟩b\omit\multirowsetup|R2,b⟩b\omit⎞⎟⎠⊗⎛⎜⎝\omit\multirowsetup|R2,p⟩p\omit|0m1,m0⟩p⎞⎟⎠⊗⎛⎜ ⎜⎝|0m1,n′−2m0⟩b|ϕ⟩|0m1,n′−2m0⟩p⎞⎟ ⎟⎠.

Encode with the unitary map as

 |ϕ2⟩ :=ˇR0|ϕ1⟩∈H′A⊗H′B⊗H′C.

Define matrices , for , , and , for and . With these matrices, define the random matrix as

 RV1:= ⎛⎜ ⎜⎝Im00m0,m00m0,n′−2m0QT3Q4Im00m0,n′−2m00n′−2m0,m00n′−2m0,m0In′−2m0⎞⎟ ⎟⎠ ⎛⎜ ⎜⎝Im00m0,m00m0,n′−2m00m0,m0Im0QT20n′−2m0,m00n′−2m0,m0In′−2m0⎞⎟ ⎟⎠ ⎛⎜ ⎜⎝Im00m0,m00m0,n′−2m00m0,m0Im00m0,n′−2m0Q10n′−2m0,m0In′−2m0⎞⎟ ⎟⎠,

where is the -dimensional identity matrix.

Encode with the unitary map as

 |ϕ3⟩ :=^R1V|ϕ2⟩∈H′A⊗H′B⊗H′C.

Therefore, the encoder is given as the isometry map and the encoded state from is

 ESR,R0(|ϕ⟩)=^R1VˇR0UR21|ϕ⟩∈H′A⊗H′B⊗H′C.

### V-B Decoder DSR

Consider decoding a state .

{LaTeXdescription}

Construct from as

 (RV1)−1:= ⎛⎜ ⎜⎝Im00m0,m00m0,n′−2m00m0,m0Im00m0,n′−2m0−Q10n′−2m0,m0In′−2m0⎞⎟ ⎟⎠ ⎛⎜ ⎜⎝Im00m0,m00m0,n′−2m00m0,m0Im0−QT20n′−2m0,m00n′−2m0,m0In′−2m0⎞⎟ ⎟⎠ ⎛⎜ ⎜⎝Im00m0,m00m0,n′−2m0−QT3Q4Im00m0,n′−2m00n′−2m0,m00n′−2m0,m0In′−2m0⎞⎟ ⎟⎠.

The unitary map is the decoder for the encoder . By applying , the state is decoded as

 |ψ1⟩ :=^R1V†|ψ⟩∈H′A⊗H′B⊗H′C.

Perform the bit and the phase basis measurements on the systems and , respectively. The measurement outcomes are denoted as . With these measurement outcomes, find the solution that are invertible and satisfy

 PWbDR2,Ob3,bOb =(0m1,m0R2,b), (7) PWpDR2,Op3,pOp =(R2,p0m1,m0), (8)

where and are projections to the subspaces whose -st, …, -th elements are and -st, …, -th elements are , respectively.

If the solution or does not exist, decoder applies no operation. Otherwise, apply the unitary maps and , which correspond to and , to the system (If the several solutions and exist, decide and deterministically depending on ). Then, Decode 2 outputs the state in the code space after the application of and .

The above process in Decode 2 is summarized as a TP-CP map from to by

 DR2(|ψ1⟩⟨ψ1|) :=TrC1,C3∑Xb,Xp∈Fm0×m0q′DR2,Xb,XpρXb,Xp,|ψ1⟩(DR2,Xb,Xp)†, ρXb,Xp,|ψ1⟩ :=TrA,B|ψ1⟩⟨ψ1|(|Xb⟩bb⟨Xb|⊗|Xp⟩pp⟨Xp|⊗IC), DR2,Xb,Xp:=ˇD3,pR2,XpˇD3,bR2,Xb.

Therefore, the decoder decodes the state as

 DSR(|ψ⟩⟨ψ|)=DR2(^R1V†|ψ⟩⟨ψ|^R1V).

Since the size of the shared randomness