Quantum Private Comparison of Equality Based on Five-Particle Cluster State∗

Yan Chang(昌燕),Wen-Bo Zhang(张文博),Shi-Bin Zhang(张仕斌),Hai-Chun Wang(王海春), Li-Li Yan(闫丽丽),Gui-Hua Han(韩桂华),Zhi-Wei Sheng(盛志伟),Yuan-Yuan Huang(黄源源), Wang Suo(索望),and Jin-Xin Xiong(熊金鑫)

1Department of Information Security Engineering,Chengdu University of Information Technology,Chengdu 610225,China

2School of Economics,Sichuan University,Chengdu 610065,China

1 Introduction

Thesedays,dataandcommunicationsareomnipresent.The problems of security and privacy have come to assume an unprecedented importance.Cryptography is the approach to protect data secrecy in public environment.Both classical cryptography and quantum cryptography can solve the problems of security.However,the latter has shown the advantage of higher security because of the strong security basis assured by physical principles.Therefore,quantum cryptography has attracted a great deal of attentions now.

In distributed computation,usually,a group of mutually distrustful players want to perform correct and distributed computations without leaking their respective secrets.That is,some users want to compute a function with private input of each party,but in the end only the evaluation result is known and the private input is not exposed.Secure multiparty computing(SMC)is an application for such circumstance.Millionaire problem proposed by Yao[1]is a typical secure two-party computation problem,in which two millionaires wish to know who is richer without revealing the precise amount of their fortunes.Later Boudot et al.[2]extended the problem of the millionaire and proposed a protocol to decide whether two millionaires are equally rich.Imagine that,two millionaires want to know whether they happen to be equally rich,but neither millionaire wants to simply disclose their wealth,which is called the problem of private comparison of equality(PCE),a branch of SMC has attracted much attention these days.However,Lo[3]indicated that the equality function used to determine this cannot be securely evaluated in a two-party scenario.Therefore,some additional assumptions such as a semi-honest third party(TP)should be considered to successfully achieve a private comparison.

Quantum private comparison of equality(QPCE)is the quantum scheme for PCE problem.In 2009,Yang et al.[4]first proposed QPCE schemes.Later,some QPC protocols based on different states were proposed.[5−18]Chen et al.[5]proposed a QPC protocol by using triplet GHZ(Greenberger–Horne–Zeilinger)states.However,Lin et al.[6]pointed out that one can retrieve other’s secret information by means of intercept-resend attack,[7]because the positions of checking particles or the measurement basis are determined by the participants in the eavesdropping check phase.Moreover,they gave two solutions to avoid this attack,i.e.,they let the third-party determine the positions and the measurement basis.Liu et al.presented QPC protocols based on triplet W states,[8]four-particle χ-Type states entanglement swapping,[9]Bell states[10]and triplet GHZ[11]respectively.The research about QPC in noise setting was first proposed by Li et al.in Refs.[14–15].Huang et al.[16]also considered QPCE protocols under noise environments.The difference of roles about TP was also discussed in Refs.[14,19].Summarily,the QPCE protocols presented previously have a semi-honest TP at least to help the two parties(Alice and Bob)accomplish the comparison.This kind of semi-honest TP is the first kind of TP in Ref.[19],which executes the protocol loyally and records all the results of its intermediate computations but he might try to steal the information from the records.This kind of TP(the first kind)was thought to be unreasonable by Yang et al.[13]They advised that the first kind of TP should be replaced by the implementation of a semi-honest TP(the second kind of TP[19]),which was allowed to misbehave on its own but can not conspire with either of two parties,which was the reasonable assumption for QPCE.In addition,there are also two principles should be satis fied for QPCE protocol.The first is,no matter whether TP will know the position of different bit value in the compared information or not,he/she will not be able to know the actual bit value of the information.The second is,all outsiders and the two players should only know the result of the comparison(i.e.,identical or different),but not the position of the different information.[16]

In most existing QPCE protocols,only two-user private comparison is implemented simultaneously. Few QPCE protocols compare private information more than two users’simultaneously.Chang et al.[20]proposed a pioneering QPCE protocol for n users which allowed n users’private information to be compared within one protocol execution,where TP was the first kind of semi-honest TP.However,we find that the protocol proposed by Chang et al.is insecure with the second kind of semi-honest TP.If TP measures the particles before he/she distributes them to the users,after the user announces Ci(the result of bitwise adding the secret of the user and a key obtained by measuring the particles TP sent to him)to TP,TP will know the secret of each user without being found.In our protocol, five-particle cluster state is used to implement QPCE scheme.Compared with other existing twouser QPCE protocols,our protocol is more flexible and efficient.Our protocol not only can compare two groups(each group has two private information)in one execution,but also compare just two private information.Compared with Chang’s multi-user protocol,our protocol is secure even with the second kind of semi-honest TP.Furthermore,our protocol can also be generalized to the case of 2N participants with one TP.The 2N-participant protocol can compare two groups(each group has N private information)in one execution or just N private information.

2 Description of Protocol

Step 1The third party(TP)randomly prepares some ordered five-particle cluster states inTP measures particle-4 sequence with Z-basis=basis=if he/she preparesand ob-orand “1”denotesBy rotating K right

on particle-1,particle-2,particle-3,and particle-5 sequence respectively.The rule is that,if the i-th bit of K(K1,K,K1)is“0” (“1”),she performs operation I(U)on the i-th particle-1(particle-2,particle-3,particle-5).

Step 2TP mixes some detecting photons(random in statesin particle-1,particle-2,particle-3 and particle-5 sequence respectively.Then TP sends particle-1 sequence to Alice,particle-2 sequence to Bob,particle-3 sequence to Charlie and particle-5 sequence to Dick.TP retains particle-4 sequence.After confirming that Alice,Bob,Charlie and Dick have received particles successfully,TP executes the first eavesdropping check process.TP announces the bases and positions of detecting photons.Alice,Bob,Charlie and Dick extract detecting photons and measure them.By comparing the initialstates and the measurement results of these particles,they can judge whether the channel between them is secure.If there is eavesdropper,they terminate the protocol;otherwise they go on the protocol.

Step 3To resist TP’s malicious behavior,Alice,Bob,Charlie and Dick execute the second eavesdropping check process.The detail is as follows.TP announces the initial states he/she preparedAlice(Bob,Charlie or Dick)chooses randomly some particles from particle-1 sequence(particle-2,particle-3,or particle-5 sequence).If the initial state isAlice(Bob,Charlie or Dick)measures the particle in X-basis;otherwise she(he)measures the particle in Z-basis.Alice(Bob,Charlie or Dick)informs the other participants the positions of the detecting particles and bases.The other participants measure the corresponding particles in their quantum sequence in the same bases.Finally,all the participants present their measurement outcomes to check the quantum channels.If their results are in one of the eight forms|0000>,|0011>,they think the channels are safe;Otherwise they discard these entangled particles and abort the protocol.Notice that,although in step 1,TP performs operation I(U)on particle-1(particle-2,particle-3,particle-5)sequence according to K,K1,K,K1,the individual measurement results of particles 1,2,3,5 in Z-basis or X-basis are still in one of the above eight forms.

Step 4Alice,Bob,Charlie and Dick measure the rest particles respectively,if the initial state isthey use Z-basis(X-basis).By measuring their particle sequences with Z-basis or X-basis,Alice,Bob,Charlie and Dick get binary key KA,KB,KC,and KDrespectively(the rule is that“0”denotesand “1” denotesEspecially,KA,KB,KC,and KDare real random number;TP can not infer KA,KB,KC,and KDbased on the measurement result of particle-4 sequence;Alice,Bob,Charlie and Dick can not infer others’keys according to their own keys.

Step 5Suppose that the secrets of Alice,Bob,Charlie and Dick are XA,XB,XC,and XDrespectively.Alice,Bob,Charlie and Dick compute XA⊕KA,XB⊕KB,XC⊕KC,and XD⊕KD,and getandrespectively.

Step 6Alice,Bob,Charlie and Dick announceandrespectively.TP compares the equality of their private information flexibly.TP can compare the equality of two private information XAand XBor XCand XDsimultaneously.

The detailed process is described next.

(i)Compare the equality of XAand XB

Here,r1denotes the measurement result of particle 1 and particle 2 in the originalstate. Because TP knows K1and K,TP obtains XB⊕XA=K1⊕K.If XB⊕XA=0,TP knows XB=XA.

(ii)Compare the equality of XCand XD

Here,r2denotes the measurement result of particle 3 and particle 5 in the originalstate. Because TP knows K1and K,TP obtains XC⊕XD=If XC⊕XD=0,TP knows XC=XD.

Step 7TP publishes the comparison results to the users.

3 Security Analysis

3.1 TP’s Attack

TP is assumed to be semi-honest,that is TP will not conspire with any other one.Therefore,we consider only the situation that TP performs attacks on his/her own.The possible attack TP may perform is that TP measures each particle before he/she sends them to Alice,Bob,Charlie and Dick.By doing so,TP can obtain KA,KB,KC,and KD.However,TP’s malicious behavior will be found in the second eavesdropping check process(Step 3).Therefore,even if TP is the second kind of semi-honest TP,TP can not obtain the secrets of the participants.

3.2 Conspiracy Attack Among Participants

Next,we verify the security of our protocol when any three users colluding together.Here,we take Alice colluding with Charlie and Dick for example.

For simple,we only consider a transmission from TP to Alice,Bob,Charlie and Dick with only fourorstates.KAis denoted as ka1,ka2,ka3,ka4.KBis denoted as kb1,kb2,kb3,kb4.KCis denoted as kc1,kc2,kc3,kc4.KDis denoted as kd1,kd2,kd3,kd4.K is denoted as x1,x2,x3,x4.Then,K1is denoted as x4,x1,x2,x3.We use ra1,ra2,ra3,ra4to denote the measurement results of particle 1 and particle 2 in the originalorstates;rc1,rc2,rc3,rc4to denote the measurement results of particle 3 and particle 5 in the originalorstates.We have:

According to Eq.(6),if Charlie tells Dick about kc1⊕kc2and kc2⊕kc3;Dick tells Charlie about kd1⊕kd2and kd2⊕kd3,Charlie and Dick can calculate x3⊕x1and x4⊕x2.

Our protocol is also secure when any two users colluding together.Next,we analyze the security about colluding between any two users.

If Alice colludes with Bob,Alice or Bob may want to know K,so that which can help them to obtain Charlie’s and Dick’s secret.In this case,Alice and Bob may exchange each other some information about KAand KB,which will not leak the secrets of themselves.If Alice tells Bob ka1⊕ka2(ka2⊕ka3)and Bob tells Alice kb1⊕kb2(kb2⊕kb3),Alice and Bob know x1⊕x3(x2⊕x4),as is shown follows.

Alice can calculate as follows:

Bob can calculate as follows:

From Eq.(8),we can see that except x1⊕x3and x2⊕x4,no more information about K can be obtained by Alice and Bob.From Eqs.(8)–(10),we find that Alice and Bob can not know any secret if they collude together.The same thing goes for Charlie and Dick.

As for cross group conspiracy,we take Alice colluding with Charlie for example to illustrate that the participants can not obtain any secret through cross group conspiracy.Alice and Charlie aim to obtain K by colluding with each other,however,they will not be at the expense of revealing their secrets.Therefore,Alice may tell Charlie about ka1⊕ka2⊕ka3,and Charlie may tell Alice about kc1⊕kc2⊕kc3,then by calculating Alice knows rc1⊕rc2⊕rc3,as is shown follows:

Similarly,Charlie knows ra1⊕ra2⊕ra3.we find that Alice and Charlie can not know any secret if they collude together.The same thing goes for Bob and Dick.

3.3 Individual Attacks of Participants

Individual attack means performing attack by their own without conspiring with others.

We denote K =k1,k2,...,ki,...,kn,then K1=kn,k1,...,ki−1,...,kn−1. To simplify the description,we suppose kiki−1=01 and the i-th state=1/2After TP performs operation I(U)on particle-1(particle-2,particle-3,particle-5)sequence according to K,K1,K,and K1respectively,the i-th statechanges to state=1/2TP sends particle-1 sequence to Alice,particle-2 sequence to Bob,particle-3 sequence to Charlie and particle-5 sequence to Dick.The reduced density matrix[21−22]of Alice’s,Bob’s,Charlie’s and Dick’s photon are the same:

That is,the reduced density matrix of each particle is completely the same and maximally mixed,therefore none participants can deduce the secrets of others by comparing the reduced density matrix of the particles their own between the initial states.

Furthermore,Bob(Alice)can not perform individual attack although he(she)knowsbecause he(she)does not know KA(KB).If Bob(Alice)intercepts and measures particles when TP sends particle-1 sequence(particle-2 sequence)to Alice(Bob),because the bases and positions of detecting photons in each particle sequence are controlled by TP,he(she)will be found by Alice(Bob)in eavesdropping detection,and the protocol will be stopped.The same thing goes for Charlie and Dick.

Although all the participants knowand,they can not deduce the secrets of others.They may attempt to find something by some calculating:

If CCA=CADor CBC=CDB,

From Eqs.(17)and(18)we find that,by deducing Alice,Bob,Charlie and Dick can only know the specific relations between XAand XBor XCand XD,under some specific conditions,such as CCA=CCB,CDA=CDB,CCA=CADand CBC=CDB.Although K,K1exist rotating right relation,without one of them anyone can not know the other.In our protocol,K,K1are known by TP only.Therefore,by deducing with known informationno one can deduce the secret of others.

3.4 Outside Attack

The outside eavesdropper Eve can not get the secret of the participants.Firstly,if Eve intercepts and measures particles when TP distributes particle sequences to the participants,Eve will be found by them in eavesdropping detection.Therefore,Eve can not get KA,KB,KCor KD.Secondly,Eve can not obtain any useful information from,,and,because KA,KB,KC,and KDare all real random numbers,andare the results of one-time pad ofandrespectively.

3.5 Efficiency Comparison

To estimate the efficiency of private comparison,we define the qubit efficiency as η=c/t,where c denotes the classical bits that can be compared,and t denotes the total particles transmitted for comparison.To simplify the computation,we suppose that n users want to do the equality comparisons with m-bit classical messages,TP uses l detecting photons to check the presence of eavesdropping for a communication between TP and each user,and each user uses l detecting photons to check the eavesdropping of TP.In Table 1,we compare the efficiency of the proposed protocol with Yang et al.’s[4]and Chang et al.’s[20]protocols.

Table 1 The comparison of our protocol to the other QPCE protocols.

In Yang et al.’s scheme,in order to complete the equality comparison with n users,TP has to execute the same protocol[n−1,n(n−1)/2]times,where n−1 denotes the optimal case that all users’information are the same,and n(n − 1)/2 denotes the worst case that each user’s information is different from the others’.In Yang et al.’s protocol,to do the equality comparison with m-bit classical messages one time,TP needs to transmit(m+l)/2 Bell states and l single particles for detecting outsider eavesdropper(totally transmitting(m+2l)particles),in which the m/2 Bell states used to encode secret information,and the other l/2 Bell states used to check the honesty of TP.Because after the users encode secret information on particles they need to transmit them back to TP,the users need to transmit 2(m+2l)particles totally.Since the roundtrip strategy(the same particles are sent back and forth)for particle transmission has been adopted in their scheme,extra filters such as single photon detectors and the photon number splitter(PNS)have to be used to avoid the Trojan horse attacks.If we assume that the number of the transmitted particles used to detect the delayed photons caused by Trojan horse attack is the same as that used to encode secret information,the total particles need to be transmitted are 4(m+l).Therefore,to do the equality comparisonswith m-bit classical messages with n users,the qubit efficiency is:m/4(m+l)(n−1)w 2m/4n(m+l)(n−1).

In Chang et al.’s scheme,to compare the private information of n users simultaneously(within one execution),TP needs to prepare m n-particle GHZ states or GHZ class states and n×l decoy particles.The total particles need to be transmitted is n(m+l).Therefore,to do the equality comparisons with m-bit classical messages with n users,the qubit efficiency is:m/n(m+l).However,TP may know the privacy of each user,if he/she measures the particles before he/she transmits them to each user.That is,Chang et al.’s scheme is insecure for the second kind of semi-honest TP.

In our protocol,only two kinds of statesneed to be prepared in the whole process.In Step 3 Alice,Bob,Charlie,and Dick execute the second eavesdropping check process,which protects the privacy of each user from being known by TP,especially the second kind of semihonest TP.Furthermore our protocol can compare two pairs of private information simultaneously or just two private information.Therefore,our protocol is more flexible and efficient than Yang et al.’s[4]protocol,and more secure than Chang et al.’s[20]protocol.Furthermore,in order to complete the equality comparison with n users,TP has to execute the same protocol[(n−1)/2,n(n−1)/4]times,where(n−1)/2 denotes the optimal case that all users’information are the same,and n(n −1)/4 denotes the worst case that each user’s information is different from the others’.In our protocol,to do the equality comparison with m-bit classical messages one time,TP needs to prepare m+l five-particle cluster statesin which the m five-particle cluster states used to generate secure KA,KB,KC,and KD,and the other l five-particle cluster states used to check the honesty of TP;at the same time to check the outsider eavesdropper,TP needs to prepare another 4l single particles random in stateTherefore,in one execution,5m+9l particles need to be transmitted.To compare the equality with n users,particles need to be transmitted.Therefore,to do the equality comparisons with m-bit classical messages with n users,the qubit efficiency is:

For the aspect of qubit efficiency,

学生思维发展能力的培育，可以通过多种形式进行，比如写作、阅读、实践活动等，在语言的综合运用当中，学生的思维能力能够得到有效发展。比如在进行《鸿门宴》的教学过程中，由于其中人物特色鲜明，故事情节生动紧张，非常有助于学生综合思维能力的培养。因此，可以采用让学生扮演角色的方式进行“鸿门宴”的重现。在此过程中，教师可以根据学生的学习水平和特点进行角色分派，在表现刘邦、项羽、樊哙、项庄等人的语言、神态的过程中，能够加强学生语言的运用能力，促进思维发展能力的提升。

when 3m>l.Generally speaking,the number of detecting particles will not exceed three times of encoding particles,thus 3m>l is satis fied.Therefore,our protocol has better qubit efficiency than Yang et al.’s[4]protocol(m/4(m+l)(n−1)∼ 2m/4n(m+l)(n−1)).Still,we have a higher quantum state generation cost compared with Yang et al.’s protocol.In Yang et al.’s protocol,Bell states need to be generated.However,in our protocol,five-particle cluster states need to be prepared,which is more difficult than the preparing of Bell state.

4 Discussion

4.1 The Protocol in Practical Conditions

Next we make some discussions about the protocol in practical conditions with noises.Here we give a solution using error correcting code.[14,23]

Suppose that the secrets of Alice,Bob,Charlie and Dick are XA,XB,XC,and XDrespectively,where XA=

Alice,Bob,Charlie,Dick and TP select the[n,s]errorcorrecting code[24]which uses n bits codeword to encode s bits word using generator matrix G(xs)and can correct t codeword error bits with the error-correcting function D(yn).

In Step 4,Alice chooses a bits wordand calculates the corresponding bits codeword

In Step 5,Bob chooses a bits word RB= (,,...,)and calculates the corresponding bits codewordi.e.,

In Step 6,TP obtains bit stringby calculatingHere,kianddenote the i-th bit of K and K1respectively.Then TP uses the check matrix H of the[n,s]errorcorrecting code to check whether the number of error bits exceeds the threshold t.If it does,TP aborts the protocol and restarts from Step 1.Otherwise,he obtains s bits string RTby decoding WTwith error-correcting functionD(WT)=WT·D.He obtainsby calculatingIf there is at least one bit is different between RTand,TP announcesOtherwise,he announces XA=XB.

In ideal condition,

Here,r1denotes the measurement results of particle 1 and particle 2 in the originalstate.

In practical scenario,noise might appear in all of quantum preparation setups,quantum channel and measurement equipment. We denote the noise appear in the courses of obtaining K as O=(o1,o2,...,on),where oi=0 or 1 representing error is existent or not in ki.So TP obtains bit string K∗andas

where O1=(on,o1,...,on−1).

From Eq.(26),we find that the present protocol is correct in practical scenario when noise has not exceeded the used ECC’s ability.

Charlie and Dick do the similar thing with Alice and Bob.Charlie announces PCand QCto TP.Dick announces PDand QDto TP.

4.2 Generalizing Protocol to 2N Participants with One TP

Our protocol can also be generalized to the case of 2N participants with one TP by employing cluster states similar as Eqs.(1)and(2).Here,to simplify the description,we take the case of 6 participants with one TP as an example to introduce the generalization of the protocol.

In Step 1,TP prepares seven-particle cluster stateswhere

In Step 2,TP measures particle-7 sequence with Z-basis=or X-basis=according to the state he/she prepares(|Ψ7>or|Φ7>)and obtains binary sequence K.By rotating K right with 3 and 5 bits,TP obtains K3and K5respectively.For example,if K=000001,after rotating K right with 3 bit,TP obtains K3=001000;after rotating K right with 5 bit,TP obtains K5=000010.Then,according to K,K3,K5,K,K3,K5,TP performs one of the two unitary operations I or U on particle-1,particle-2,particle-3,particle-4,particle-5,and particle-6 sequence respectively.The rule is that,if K(K3,K5,K,K3,K5)is “0” (“1”),she performs operation I(U)on particle-1(particle-2,particle-3,particle-4,particle-5,particle-6)sequence.

TP sends particle-1 sequence to Alice,particle-2 sequence to Bob,particle-3 sequence to Charlie,particle-4 sequence to Dick,particle-5 sequence to Tom,particle-6 sequence to Frank.TP retains particle-7 sequence.

In Step 4,by measuring their particle sequences with Z-basis or X-basis,Alice,Bob,Charlie,Dick,Tom and Frank get binary key KA,KB,KC,KD,KT,KFrespectively.

In Step 5,suppose that the secrets of Alice,Bob,Charlie,Dick,Tom,and Frank are XA,XB,XC,XD,XT,XFrespectively.Alice,Bob,Charlie,Dick,Tom and Frank compute XA⊕KA,XB⊕KB,XC⊕KC,XD⊕KD,XT⊕KT,XF⊕KF,and getandrespectively.

In Step 6,Alice,Bob,Charlie,Dick,Tom,and Frank announcerespectively.TP compares the equality of their private information flexibly.TP can compare the equality of two group of three private information XA,XB,and XCor XD,XT,and XFsimultaneously.

Next we describe the process of comparing the equality of XA,XB,and XC.

Here,r1denotes the measurement results of particle 1,particle 2 and particle 3 in the originalstate.Because TP knows K,K3,and K5,TP obtains

The process of comparing the equality of XD,XT,and XFis similar with the process of comparing the equality of XA,XB,and XC,we will not repeat them here.

As for the security analysis of generalizing protocol to 6 participants with one TP,because the analysis of TP’s attack,individual attacks of participants and outside attack are all similar with those in the case with 4 participants,we will not repeat them here.

We mainly introduce the analysis of conspiracy attack among participants.For simple,we only consider a transmission from TP to Alice,Bob,Charlie,Dick,Tom and Frank with only sixstates.K is denoted as x1,x2,x3,x4,x5,x6.We can easily obtain that:if Alice colludes with Bob,neither of them can obtain more useful information to deduce others’secret;if Alice colludes with Charlie,they can obtain x3⊕x1,x5⊕x1,x4⊕x6,x5⊕x3,x2⊕x4,however these data contribute nothing to deduce Bob’s secret;if Bob colludes with Charlie,they can obtain x2⊕x6,x3⊕x1,x5⊕x3,x2⊕x4,which contributes nothing to to deduce Alice’s secret.The cases that Dick,Tom and Frank collude each other are similar with Alice,Bob and Charlie,we will not repeat them here.

Obviously,in the 6-participant protocol,TP can compare the equality of two groups in one execution,each group has three private information XA,XBand XCor XD,XT,and XF.If the protocol is generalized to the case of 2N participants with one TP by employing(2N+1)-particle cluster states,the protocol can compare two groups(each group has N private information)in one execution.

5 Conclusion

We put forward a secure and flexible QPCE protocol based on five-particle cluster states.Our protocols have the following merits.Firstly,by utilizing five-particle cluster states and quantum one-time pad our protocol can not only compare two pairs of private information simultaneously,but also compare just two private information,therefore,our protocol is flexible and efficient.Secondly,the security of our protocol is guaranteed by laws of quantum mechanics and quantum one-time pad.Thirdly,our protocol has the more reasonable assumptions about TP(the second kind of TP).[19]Our protocol has bigger qubit efficiency than Yang et al.’s[4]protocol,but a higher quantum state generation cost,because five-particle cluster state is more difficult to prepare than Bell state.Furthermore,our protocol can also be generalized to the case of 2N participants with one TP by employing(2N+1)-particle cluster states similar as Eqs.(1)and(2).The 2N-participant protocol can compare two groups(each group has N private information)in one execution.

[1]C.Yao,in Proc.of 23rd IEEE Symposium on Foundations of Computer Science,Chicago(1982)160.

[2]F.Boudot,B.Schoenmakers,and J.Traore,Discrete Appl.Math.23(2001)111.

[3]H.K.Lo,Phys.Rev.A 56(1997)1154.

[4]Y.G.Yang and Q.Y.Wen,J.Phys.A:Math.Theor.42(2009)055305.

[5]X.B.Chen,G.Xu,X.X.Niu,Q.Y.Wen,and Y.X.Yang,Opt.Commun.283(2010)1561.

[6]J.Lin,H.Y.Tseng,and T.Hwang,Opt.Commun.284(2011)2412.

[7]F.Gao,F.Z.Guo,Q.Y.Wen,and F.C.Zhu,Phys.Rev.Lett.101(2008)208901.

[8]W.Liu,Y.B.Wang,and Z.T.Jiang,Opt.Commun.284(2011)3160.

[9]W.Liu,Y.B.Wang,Z.T.Jiang,and Y.Z.Cao,Int.J.Theor.Phys.51(2012)69.

[10]W.Liu,Y.B.Wang,and W.Cui,Commun.Theor.Phys.57(2012)583.

[11]W.Liu and Y.B.Wang,Int.J.Theor.Phys.51(2012)3596.

[12]Y.B.Li,S.J.Qin,Z.Yuan,W.Huang,and S.Ying,Quantum Inf.Process 12(2013)2191.

[13]Y.G.Yang,J.Xia,and X.Jia,Quantum Inf.Process 12(2013)877.

[14]Y.B.Li,S.J.Qin,Z.Yuan,W.Huang,and Y.Sun,Quantum Inf.Process 12(2013)2191.

[15]Y.B.Li,T.Y.Wang,H.Y.Chen,M.D.Li,and Y.T.Yang,Int.J.Theor.Phys.52(2013)2818.

[16]W.Huang,Q.Y.Wen,B.Liu,F.Gao,and Y.Sun,Sci.G-Phys.Meth.Astron.56(2013)1670.

[17]S.Lin,Y.Sun,X.F.Liu,and Z.Q.Yao,Quantum Inf.Process 12(2013)559.

[18]W.J.Liu,C.Liu,H.B.Wang,and T.T.Jia,IETE Tech.Rev.30(2013)439.

[19]W.W.Zhang and K.J.Zhang,Quant.Inf.Process 12(2013)1981.

[20]Y.J.Chang,C.W.Tsai,and T.Hwang,Quant.Inf.Process 12(2013)1077.

[21]Y.B.Li,Q.Y.Wen,F.Gao,H.Y.Jia,and Y.Sun,European Phys.J.D 66(2012)110.

[22]Y.B.Li,Q.Y.Wen,Z.C.Li,S.J.Qin,and Y.T.Yang,Quant.Inf.Processing 13(2014)141.

[23]Y.B.Li,Y.J.Ma,S.W.Xu,W.Huang,and Y.S.Zhang,Int.J.Theor.Phys.53(2014)3191.

[24]F.J.MacWilliams and N.J.A.Sloane,Mathematical Lib,North-Holland Publlishing Company,North-Holland(1977).