A New Quantum Private Protocol for Set Intersection Cardinality Based on a Quantum Homomorphic Encryption Scheme for Toffoli Gate

Abstract

Set Intersection Cardinality (SI-CA) computes the intersection cardinality of two parties’ sets, which has many important and practical applications such as data mining and data analysis. However, in the face of big data sets, it is difficult for two parties to execute the SI-CA protocol repeatedly. In order to reduce the execution pressure, a Private Set Intersection Cardinality (PSI-CA) protocol based on a quantum homomorphic encryption scheme for the Toffoli gate is proposed. Two parties encode their private sets into two quantum sequences and encrypt their sequences by way of a quantum homomorphic encryption scheme. After receiving the encrypted results, the semi-honest third party (TP) can determine the equality of two quantum sequences with the Toffoli gate and decrypted keys. The simulation of the quantum homomorphic encryption scheme for the Toffoli gate on two quantum bits is given by the IBM Quantum Experience platform. The simulation results show that the scheme can also realize the corresponding function on two quantum sequences.

1. Introduction

Secure multiparty computation (SMC) [1,2,3] is a crucial cryptographic primitive which fits the following description: Assume that there is a function typically specified by a map $\mathcal{F}:{\left({\{0,1\}}^{\ast }\right)}^n\to {\left({\{0,1\}}^{\ast }\right)}^n$ and a set of n parties, $\mathcal{P}=\{P_1,...,P_n\}$, who want to compute values of this function with respect to their private data. Each party $P_i$ has its input $x_i\in {\{0,1\}}^{\ast }$ and output $y_i\in {\{0,1\}}^{\ast }$, following correspondence $y_i=\mathcal{F}\left(x_i\right)$. Our target is to ensure that all parties in a subset $\mathcal{C}\subset \mathcal{P}$ receive correct outputs from others while no information related to the input can be accessed. SMC has raised widespread concerns and has wide applications in electronic voting, cloud computing, online auction, etc.

A typical SMC [4] application is Private Set Intersection (PSI), which also known as Private Matching (PM). Specifically, PSI permits two parties, $P_1$ and $P_2$, who respectively have a private set $x_1$ and $x_2$. Without disclosing any information that does not belong to this intersection, they seek to find the intersection $x_1\cap x_2$. There have been many applications of PSI, such as privacy-preserving data mining [5], data outsourcing on cloud [6], location-based privacy-preserving sharing [7], testing of fully-sequenced human genomes [8], proximity testing [9], and other online services [10].

Due to the extensive and important applications, there have been many suggestions for PSI protocols. In 2004, Freedman et al. [4] first gave the definition of PSI and presented several PSI protocols by using homomorphic encryption and balanced hashing. Homomorphic encryption was first proposed by Rivest et al. in 1978 [11]. A new symmetric homomorphic functional encryption using modular multiplications over a hidden ring was proposed [12]. Then, some PSI protocols were proposed based on classical cryptography [13,14,15,16]. However, PSI reveals too much private information and it cannot meet the higher privacy requirements in some scenarios. In this case, Private Set Intersection Cardinality (PSI-CA) [17] was introduced, which can securely determine the size of set intersection and can be used to generate association rules. In [18], a PSI-CA protocol was the first to achieve security in the standard model under the Quadratic Residuosity QR assumption with linear complexities, which can hide the size of the client’s private set. In [19], a PSI-CA protocol was proposed, which had linear computation and communication complexities and was the most efficient PSI-CA protocol in previously proposed PSI-CA protocols [18,19]. PSI-CA only outputs the intersection cardinality and does not reveal the specific content of the intersection. The security of classical PSI-CA protocols is based on the computational complexity assumptions, which are vulnerable to attack by the quantum algorithms [20,21,22].

On the other hand, scholars began to seek a quantum approach to solving the PSI-CA problem. In [23], Shi et al. presented two quantum protocols to solve the Oblivious Set-member Decision problem. These protocols can be used to privately compute multi-party set intersection and union in the quantum domain. In [24], Shi et al. informally gave a definition of PSI first. Then they presented a quantum scheme for PSI based on n encoded states, n quantum operators, and n von Neumann measurements. In [25], Arpita gave a two-party protocol for computing set intersection securely in the quantum domain in a rational setting, where the players are trying to maximize their utilities. However, PSI reveals too much private personal information in some scenarios. In order to prevent revealing the specific content, Shi et al. proposed some quantum protocols of PSI-CA [26,27,28]. PSI-CA and PSU-CA enable two parties, each with a private set, to jointly compute the cardinality of their intersection or union without disclosing any private information about their respective sets. These protocols are useful in social networks and for privacy-preserving data mining.

In this paper, following the idea in [26], we propose a PSI-CA protocol based on a quantum homomorphic encryption scheme for the Toffoli gate. With the help of a semi-honest TP, two parties can use this protocol to privately obtain the number of all their private sets’ common elements. When the amount of data is large, two parties, which do not have strong quantum computing capabilities, only prepare and encrypt quantum single-particle states. The role of semi-honest TP is to execute the protocol loyally and record all the results of its intermediate computations. However, the TP cannot learn anything about the private information. In our protocol, the semi-honest third party (TP) can be used to perform Toffoli gate and decryption operations. It will keep a record of all its intermediate results and might try to infer the private inputs from the record. Our protocol is simpler and easier to implement.

This paper is organized as follows: we introduce some correlative preliminaries in Section 2; we propose a quantum PSI-CA protocol in Section 3; in Section 4, we analyze the correctness and security of our protocol and describe the implementation of our protocols on the IBM Quantum Experience platform. A brief discussion and the concluding summary are given in Section 5.

2. Preliminary

2.1. Pauli Gates

Some operators are introduced first. Four single-qubit operators $I,X,Y,Z$ are shown as follows:

$$I=\left[\begin{array}{cc}1& 0\\ 0& 1\end{array}\right],X=\left[\begin{array}{cc}0& 1\\ 1& 0\end{array}\right],Y=\left[\begin{array}{cc}0& -i\\ i& 0\end{array}\right],Z=\left[\begin{array}{cc}1& 0\\ 0& -1\end{array}\right]$$

(1)

The circuit symbols for the four single-qubit gates $I,X,Y,Z$ are shown in Figure 1.

2.2. Quantum Toffoli Gate

The quantum Toffoli gate (called the T gate) is seen as an important component in the theory of quantum computation. The unitary transform matrix of the T gate is as follows:

$$T=\left[\begin{array}{cccccccc}1& 0& 0& 0& 0& 0& 0& 0\\ 0& 1& 0& 0& 0& 0& 0& 0\\ 0& 0& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 1& 0& 0& 0& 0\\ 0& 0& 0& 0& 1& 0& 0& 0\\ 0& 0& 0& 0& 0& 1& 0& 0\\ 0& 0& 0& 0& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 0& 1& 0\end{array}\right]$$

(2)

The T gate has three input bits and three output bits. For a three-qubit quantum system, $\left|a\right.〉\left|b\right.〉\left|c\right.〉$, the quantum T gate will act as:

$$T\left|a\right.〉\left|b\right.〉\left|c\right.〉=\left|a\right.〉\left|b\right.〉\left|c\oplus (a·b)\right.〉.$$

(3)

The circuit symbol for the T gate is shown in Figure 2.

2.3. Information-Theoretic Security

In [23], the conception of mixed states is introduced and a quantum information-theoretic security criterion for a quantum protocol is given as follows:

The protocol is informationally secure for every input state ${\phi }_{in}$ if the output state ${\phi }_{out}$ is the totally mixed state. The relation of the input state ${\phi }_{in}$ and the output state ${\phi }_{out}$ is as follows:

$${\phi }_{out}=\sum _k\frac{1}{2^{2n}}{U}_k{\phi }_{in}{\left(U_k^{}\right)}^{†}=\frac{1}{2^n}{I}_{2^n},$$

(4)

where ${\phi }_{in}$ is the density operator of all possible n-qubit input states and $U_k$ are the corresponding unitary operations applied on input state.

3. Quantum Private Computation Protocol for Set Intersection Cardinality

We use the definition of PSI-CA [19]. Suppose that there are two parties, Alice and Bob. They input a private set $S_A=\{a_1,a_2,...,a_{n_1}\}$ and $S_B=\{b_1,b_2,...,b_{n_2}\}$, respectively. S is a complete set $\{x_1,x_2,...,x_n\}$ and $S_A,S_B\subset S$. After running the PSI-CA protocol with a help of the semi-honest third party, Calvin, Alice and Bob output the cardinality of the intersection of their private sets, i.e., $\left|S_A\cap S_B\right|$, without leaking any information about their sets. The quantum scheme for PSI-CA is described as follows:

(1) Alice and Bob each prepare a $(n+n^{\prime })$-photon sequence, denoted by $S{q}_A=(\left|{\psi }_1^A\right.〉,\left|{\psi }_2^A\right.〉,...,\left|{\psi }_{n+n{}^{\prime }}^A\right.〉),S{q}_B=(\left|{\psi }_1^B\right.〉\left|{\psi }_2^B\right.〉,...,\left|{\psi }_{n+n{}^{\prime }}^B\right.〉)$. The first n particles of $S{q}_A,S{q}_B$ are prepared according to Alice’s and Bob’s private sets $S_A,S_B$:

$$\left\{\begin{array}{c} \left|{\psi }_i^A\right.〉=\left|1\right.〉,if{x}_i\in S_A\hfill \\ \left|{\psi }_i^A\right.〉=\left|0\right.〉,if{x}_i\notin S_A\hfill \end{array}\left\{\begin{array}{c} \left|{\psi }_i^B\right.〉=\left|1\right.〉,if{x}_i\in S_B\hfill \\ \left|{\psi }_i^B\right.〉=\left|0\right.〉,if{x}_i\notin S_B\hfill \end{array}\right.\right.$$

(5)

The last $n^{\prime }$ particles of $S{q}_A,S{q}_B$ are dummy photons, which are randomly chosen from $\{\left|0\right.〉,\left|1\right.〉\}$.

(2) Alice and Bob work together to find the number of $\left|{\psi }_i^A\right.〉=\left|{\psi }_i^B\right.〉=\left|1\right.〉(i=n+1,...,n+n^{{}^{\prime }})$, denoted by $N_{CA}^{{}^{\prime }}$, which means how many bits are equal and equal to $\left|1\right.〉$ in the last $n^{\prime }$ particles of $S{q}_A,S{q}_B$.

They also permutate $S{q}_A,S{q}_B$ using the same permutation regulation $\pi$. The new sequences are denoted by $S{q}_A^{{}^{\prime }}=(\left|{\psi }_1^{A^{\prime }}\right.〉,\left|{\psi }_2^{A^{\prime }}\right.〉,...,\left|{\psi }_{n+n{}^{\prime }}^{A^{\prime }}\right.〉),S{q}_B^{{}^{\prime }}=(\left|{\psi }_1^{B^{\prime }}\right.〉,\left|{\psi }_2^{B^{\prime }}\right.〉,...,\left|{\psi }_{n+n{}^{\prime }}^{B^{\prime }}\right.〉)$.

Each of them chooses a sequence, $L_A=(l_1^A,l_2^A,l_3^A,l_4^A,...,l_{2(n+n^{\prime })-1}^A,$ $l_{2(n+n^{\prime })}^A)(L_B=(l_1^B,l_2^B,l_3^B,l_4^B,...,l_{2(n+n^{\prime })-1}^B,l_{2(n+n^{\prime })}^B))$, where $l_{2k-1}^B,l_{2k}^B$ are randomly chosen from $\{0,1\}$. Then, she(he) uses the Quantum One-time Pad algorithm (QOTP) [25] to encrypt the kth particle of $S{q}_A^{{}^{\prime }}\left(S{q}_B^{{}^{\prime }}\right)$ and get $Z^{l_{2k-1}^A}{X}^{l_{2k}^A}\left|{\psi }_k^A\right.〉$ $\left(Z^{l_{2k-1}^B}{X}^{l_{2k}^B}\left|{\psi }_k^B\right.〉\right)$. The new particles sequence is denoted by $S_A^{{}^{″}}=(Z^{l_1^A}{X}^{l_2^A}\left|{\psi }_1^{A^{\prime }}\right.〉,$ $...,Z^{l_{2(n+n^{\prime })-1}^A}{X}^{l_{2(n+n^{\prime })}^A}\left|{\psi }_{n+n{}^{\prime }}^{A^{\prime }}\right.〉\left)\right(S_B^{{}^{″}}=(Z^{l_1^B}{X}^{l_2^B}\left|{\psi }_1^{B^{\prime }}\right.〉,$$...,Z^{l_{2(n+n^{\prime })-1}^B}{X}^{l_{2(n+n^{\prime })}^B}$$\left|{\psi }_{n+n{}^{\prime }}^{B^{\prime }}\right.〉\left)\right)$.

Alice (Bob) also inserts some checking particles, which are randomly chosen from $\{\left|0\right.〉,\left|1\right.〉,$ $\left|+\right.〉,\left|-\right.〉\}$, into $S_A^{{}^{″}}\left(S_B^{{}^{″}}\right)$ and sends the new sequence $S_A^{{}^{″\prime }}\left(S_B^{{}^{″\prime }}\right)$ to the third party Calvin.

After that, Alice(Bob) transmits the insert positions $P{o}_A\left(P{o}_B\right)$ and $L_A\left(L_B\right)$ to Calvin using the quantum secure direct communication (QSDC) protocol. QSDC is one of the most important branches of quantum communication and it directly transmits secret messages.

(3) After receiving $S_A^{{}^{″\prime }},S_B^{{}^{″\prime }}$, Alice, Bob, and Calvin perform the eavesdropping check using the insert positions $P{o}_A,P{o}_B$ and the measuring bases of checking particles. If the error rate exceeds the threshold they preset, they abort the scheme. Otherwise, they discard the measured photons in $S_A^{{}^{″\prime }},S_B^{{}^{″\prime }}$ and Calvin gets two sequences $S_A^{{}^{″}}=(Z^{l_1^A}{X}^{l_2^A}\left|{\psi }_1^{A^{\prime }}\right.〉,...,Z^{l_{2(n+n^{\prime })-1}^A}{X}^{l_{2(n+n^{\prime })}^A}\left|{\psi }_{(}n+n^{\prime }{)}^{A^{\prime }}\right.〉),S_B^{{}^{″}}=(Z^{l_1^B}{X}^{l_2^B}\left|{\psi }_1^{B^{\prime }}\right.〉,...,Z^{l_{2(n+n^{\prime })-1}^B}{X}^{l_{2(n+n^{\prime })}^B}$$\left|{\psi }_{(}n+n^{\prime }{)}^{B^{\prime }}\right.〉)$.

Calvin prepares a sequence $S_C=(\left|{\psi }_1^C\right.〉,\left|{\psi }_2^C\right.〉,...,\left|{\psi }_{n+n^{\prime }}^C\right.〉)$, where $\left|{\psi }_i^C\right.〉$ is randomly chosen from $\{\left|0\right.〉,\left|1\right.〉\}$.

(4) Calvin executes some operations on the ith quantum bits of $S_A^{{}^{″}},S_B^{{}^{″}},S_C$ and gets:

$$\begin{array}{c}{\left|{\psi }_i^{A^{\prime \prime }}\right.〉}_1{\left|{\psi }_i^{B^{\prime \prime }}\right.〉}_2{\left|{\psi }_i^{C^{\prime }}\right.〉}_3\hfill \\ =(CNO{T}_{1,3}^{l_{2i}^B}\otimes I_2)(I_1\otimes CNO{T}_{2,3}^{l_{2i}^A})(Z^{l_{2i-1}^A}{X}^{l_{2i}^A}\otimes Z^{l_{2i-1}^B}{X}^{l_{2i}^B}\otimes X^{l_{2i}^A{l}_{2i}^B})T(Z^{l_{2i-1}^A}{X}^{l_{2i}^A}\otimes Z^{l_{2i-1}^B}{X}^{l_{2i}^B}\otimes I){\left|{\psi }_i^{A^{\prime }}\right.〉}_1{\left|{\psi }_i^{B^{\prime }}\right.〉}_2{\left|{\psi }_i^C\right.〉}_3\hfill \\ ={\left|{\psi }_i^{A^{\prime }}\right.〉}_1{\left|{\psi }_i^{B^{\prime }}\right.〉}_2{\left|{\psi }_i^C\oplus {\psi }_i^{A^{\prime }}{\psi }_i^{B^{\prime }}\right.〉}_3.\hfill \end{array}$$

(6)

Calvin measures $\left|{\psi }_i^{C^{\prime }}\right.〉$ using the X basis and compares the measurement result with $\left|{\psi }_i^C\right.〉$. He also counts how many quantum bits $\left|{\psi }_i^{C^{\prime }}\right.〉,\left|{\psi }_i^C\right.〉$ are different and the number is denoted by $N_{C{A}^{″}}$. It is obvious that the intersection cardinality of $S_A,S_B$ is equal to $N_{C{A}^{″}}-N_{C{A}^{\prime }}$.

We have to point out that if Alice and Bob apply a $NOT$ gate on each particle of $S{q}_A,S{q}_B$ in step(1), the private set union cardinality of $S_A,S_B$ is equal to $\left|S\right|-(N_{C{A}^{″}}-N_{C{A}^{\prime }})$ using the PSI-CA quantum protocol.

4. Analysis and Comparison

4.1. Correctness Analysis

In this section, we illustrate the correctness of our protocol. Figure 3 describes the circuit U used to privately apply the T gate on $\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉$, where $l_{2i-1}^A,l_{2i}^A,l_{2i-1}^B,l_{2i}^B\in \{0,1\}$. For $i=1,2,...,n+n^{\prime }$, Alice, Bob and Calvin can use the circuit U to privately calculate $T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉$. If $\left|{\psi }_i^C\right.〉$ is reversed, they can determine $\left|{\psi }_k^A\right.〉=\left|{\psi }_k^B\right.〉=\left|1\right.〉$.

According to the circuit U, it can be verified that

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^0{X}^0\otimes Z^0{X}^0\otimes X^0)T(Z^0{X}^0\otimes Z^0{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉.\hfill \end{array}$$

(7)

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^0{X}^0\otimes Z^1{X}^0\otimes X^0)T(Z^0{X}^0\otimes Z^1{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉.\hfill \end{array}$$

(8)

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^1{X}^0\otimes Z^0{X}^0\otimes X^0)T(Z^1{X}^0\otimes Z^0{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(9)

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^1{X}^0\otimes Z^1{X}^0\otimes X^0)T(Z^1{X}^0\otimes Z^1{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉.\hfill \end{array}$$

(10)

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^0{X}^1\otimes Z^0{X}^0\otimes X^0)T(Z^0{X}^1\otimes Z^0{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^{B^{\prime }}\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(11)

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^0{X}^1\otimes Z^1{X}^0\otimes X^0)T(Z^0{X}^1\otimes Z^1{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(12)

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^1{X}^1\otimes Z^0{X}^0\otimes X^0)T(Z^1{X}^1\otimes Z^0{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(13)

$$\begin{array}{c}(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^1{X}^1\otimes Z^1{X}^0\otimes X^0)T(Z^1{X}^1\otimes Z^1{X}^0\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(14)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^0{X}^0\otimes Z^0{X}^1\otimes X^0)T(Z^0{X}^0\otimes Z^0{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(15)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^0{X}^0\otimes Z^1{X}^1\otimes X^0)T(Z^0{X}^0\otimes Z^1{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(16)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^1{X}^0\otimes Z^0{X}^1\otimes X^0)T(Z^1{X}^0\otimes Z^0{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(17)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)(Z^1{X}^0\otimes Z^1{X}^1\otimes X^0)T(Z^1{X}^0\otimes Z^1{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(18)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^0{X}^1\otimes Z^0{X}^1\otimes X^1)T(Z^0{X}^1\otimes Z^0{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^{B^{\prime }}\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(19)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^0{X}^1\otimes Z^1{X}^1\otimes X^1)T(Z^0{X}^1\otimes Z^1{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(20)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^1{X}^1\otimes Z^0{X}^1\otimes X^1)T(Z^1{X}^1\otimes Z^0{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =-T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \end{array}$$

(21)

$$\begin{array}{c}(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^1{X}^1\otimes Z^1{X}^1\otimes X^1)T(Z^1{X}^1\otimes Z^1{X}^1\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉.\hfill \end{array}$$

(22)

According to Equations (7)–(22), we can obtain

$$\begin{array}{c}(CNO{T}_{1,3}^{l_{2i}^B}\otimes I_2)(I_1\otimes CNO{T}_{2,3}^{l_{2i}^A})(Z^{l_{2i-1}^A}{X}^{l_{2i}^A}\otimes Z^{l_{2i-1}^B}{X}^{l_{2i}^B}\otimes X^{l_{2i}^A{l}_{2i}^B})T(Z^{l_{2i-1}^A}{X}^{l_{2i}^A}\otimes Z^{l_{2i-1}^B}{X}^{l_{2i}^B}\otimes I)\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =T\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\right.〉\hfill \\ =\left|{\psi }_i^A\right.〉\left|{\psi }_i^B\right.〉\left|{\psi }_i^C\oplus \left({\psi }_i^A·{\psi }_i^B\right)\right.〉.\hfill \end{array}$$

(23)

Calvin measures $\left|{\psi }_i^C\oplus \left({\psi }_i^{A^{{}^{\prime }}}·{\psi }_i^{B^{{}^{\prime }}}\right)\right.〉$. If $\left|{\psi }_i^C\oplus \left({\psi }_i^{A^{{}^{\prime }}}·{\psi }_i^{B^{{}^{\prime }}}\right)\right.〉$ is different from $\left|{\psi }_i^C\right.〉$, we can know $\left|{\psi }_i^{A^{{}^{\prime }}}\right.〉=\left|{\psi }_i^{B^{{}^{\prime }}}\right.〉=\left|1\right.〉$. Alice and Bob have a common element in $S_A,S_B$.

Suppose that the private set of Alice is $S_A=\{2,4\}$ and the private set of Bob is $S_B=\{3,4\}$ where a complete set is $S=\{2,3,4\}$. The photon sequence of Alice is $S_{q_A}=\{\left|1\right.〉,\left|0\right.〉,\left|1\right.〉\}$ and the photon sequence of Bob is $S_{q_B}=\{\left|0\right.〉,\left|1\right.〉,\left|1\right.〉\}$. Calvin prepares a sequence $S_{q_C}=\{\left|1\right.〉,\left|0\right.〉,\left|0\right.〉\}$. Alice chooses a sequence $L_A=(0,1,1,1,1,0)$ and Bob chooses a sequence $L_B=(0,0,1,1,0,1)$. Alice, Bob and Calvin perform some operations on $\{\left|1\right.〉,\left|0\right.〉,\left|1\right.〉\},\{\left|0\right.〉,\left|1\right.〉,\left|1\right.〉\},\{\left|1\right.〉,\left|0\right.〉,\left|0\right.〉\}$ using $L_A,L_B$ and get $(CNO{T}_{1,3}^0\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^0{X}^1\otimes Z^0{X}^0\otimes X^0)T(Z^0{X}^1\otimes Z^0{X}^0\otimes I)\left|1\right.〉\left|0\right.〉\left|1\right.〉,(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^1)(Z^1{X}^1\otimes Z^1{X}^1\otimes X^1)T(Z^1{X}^1\otimes Z^1{X}^1\otimes I)\left|0\right.〉\left|1\right.〉\left|0\right.〉,$$(CNO{T}_{1,3}^1\otimes I_2)(I_1\otimes CNO{T}_{2,3}^0)$$(Z^1{X}^0\otimes Z^0{X}^1\otimes X^0)T(Z^1{X}^0\otimes Z^0{X}^1\otimes I)\left|1\right.〉\left|1\right.〉\left|0\right.〉$. Then they can get $T\left(\left|1\right.〉\left|0\right.〉\left|1\right.〉\right),T(\left|0\right.〉$$\left|1\right.〉\left|0\right.〉),T\left(\left|1\right.〉\left|1\right.〉\left|0\right.〉\right)$ and the new photon sequence of Calvin is $\left|1\oplus (1·0)\right.〉\left|0\oplus (0·1)\right.〉$$\left|0\oplus (1·1)\right.〉$. Only the third photon in Calvin’s new sequence $\left|0\oplus (1·1)\right.〉=\left|1\right.〉\}$ is different from the third photon of his original sequence $\left|0\right.〉\}$. So we can get that Alice and Bob have only one common element in $S_A,S_B$.

4.2. Implementation of Quantum PSI-CA Protocols on IBM Quantum Experience Platform

Now, we move forward through a similar approach to experimentally realize our PSI-CA protocol on the IBM Quantum Experience platform. Let us say the two parties, Alice and Bob, have a private set $S_A$ and $S_B$, respectively, where S is a complete set and $S_A,S_B\in S$. For the encoding procedure, $S_A$ and $S_B$ are encoded into two $(n+n^{\prime })$-particle sequences. Alice, Bob, and Calvin can privately apply the T gate on their corresponding position particles using the IBM Quantum Experience platform. The measuring results of Calvin’s particle are related to the PSI-CA of $S_A,S_B$.

The circuit on the IBM Quantum Experience platform for privately computing for eight cases of $T\left|{\psi }_{A0}\right.〉\left|{\psi }_{B0}\right.〉\left|{\psi }_{C0}\right.〉$ and the experiment results with 1024 shots for eight cases on the quantum circuit are shown in Figure 4, Figure 5, Figure 6, Figure 7, Figure 8, Figure 9, Figure 10 and Figure 11. In the experiment results’ figures, the x-axis represents 16 measurement results, and each of them includes the $T\left|{\psi }_{A0}\right.〉\left|{\psi }_{B0}\right.〉\left|{\psi }_{C0}\right.〉$ and the information of $l_{A0},l_{A1},l_{B0},l_{B1}$.The y-axis represents the frequency of each measurement result. The first three binary bits in the x-axis correspond to the output of $T\left|{\psi }_{A0}\right.〉\left|{\psi }_{B0}\right.〉\left|{\psi }_{C0}\right.〉$ and the following four binary bits in the x-axis are $l_{A0},l_{A1},l_{B0},l_{B2}$.

In Figure 4, $\left|{\psi }_{A0}\right.〉=\left|1\right.〉,\left|{\psi }_{B0}\right.〉=\left|1\right.〉,\left|{\psi }_{C0}\right.〉=\left|1\right.〉$. Take the measurement results “1101010”, for example, in Figure 4, the last four bits 1010 represent the measurement results of $l_{A0},l_{A1},l_{B0},l_{B1}$, which are used to control the gates in the quantum circuit. The first three bits 110 represent the new measurement result of $\left|{\psi }_{A0}\right.〉,\left|{\psi }_{B0}\right.〉,\left|{\psi }_{C0}\right.〉$ after operating the gates in the quantum circuit. From the frequency of each measurement result in Figure 4, it can be verified that no matter what the $l_{A0},l_{A1},l_{B0},l_{B1}$ is, the circuit will act as a T gate on $\left|{\psi }_{A0}\right.〉=\left|1\right.〉,\left|{\psi }_{B0}\right.〉=\left|1\right.〉,\left|{\psi }_{C0}\right.〉=\left|1\right.〉$. Using the same analysis method, we can reach the same conclusion from the frequency of each measurement result in Figure 5, Figure 6, Figure 7, Figure 8, Figure 9, Figure 10 and Figure 11.

4.3. Security Analysis

In this section, we verify the security of our quantum PSI-CA scheme by analyzing an external outside attack and a participant attack, respectively.

4.3.1. Outside Attacks

In terms of outside attacks, this protocol allows for outside eavesdroppers to attack the quantum channel and obtain Alice and Bob’s particle sequences in step (2). Checking particles are introduced to to defend against it. With several checking particles inserted, the security checking procedure in Step (3) can detect the intercept–resend attack, the measurement–resend attack, the entanglement–measure attack, and the denial-of-service (DOS) attack with a nonzero probability.

In addition to this naive attack, there are some special forms of attack such as the delay photon Trojan horse attack, the invisible photon eavesdropping (IPE) Trojan horse attack, and the photon-number-splitting (PNS) attack, which are also available to outside eavesdroppers. In response to these attacks, we use several defenses. To defeat the delay-photon Trojan horse attack, we can use a photon-number splitter. To defeat the IPE attack, we can insert filters in front of their devices to filter out the photon signal with an illegitimate wavelength. To defeat the PNS attack, we can use the technology of beam splitters to split the sampling signals and judge whether these received photons are single photons or multiple photons. Therefore, the outside attacks are invalid to our protocol.

4.3.2. Participant Attack

Gao et al. proposed the term “participant attack” in Ref. [29], which has attracted much attention in the cryptanalysis of quantum cryptography. It underlines that malicious user attacks are typically more potent and should be given more consideration. We analyze the possibility that Alice, Bob, and Calvin could use participant attacks to learn knowledge about the private binary strings in our protocol. Since both Alice and Bob’s sequences are sent to Calvin after processing, it is most critical to consider Calvin’s behavior.

In our protocol, Calvin only gets two-particle sequences $S_A^{{}^{\prime \prime }},S_B^{{}^{\prime \prime }}$. Calvin applies the T gate on each sequence in step (3).

According to the definition of information-theoretic security given in Section 2.3, we can know that the output state of step (2) in our protocol can be described as follows:

$$\begin{array}{c}\frac{1}{2^2}\sum _{l_{2i-1}^A,l_{2i}^A\in \{0,1\}}{Z}^{l_{2i-1}^A}{X}^{l_{2i}^A}\left|{\psi }_i^A\right.〉{\left(Z^{l_{2i-1}^A}{X}^{l_{2i}^A}\right)}^{†}\hfill \\ =\frac{1}{4}{Z}^0{X}^0(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^0{X}^0\right)}^{†}+\frac{1}{4}{Z}^0{X}^1(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^0{X}^1\right)}^{†}[+2ex]\hfill \\ +\frac{1}{4}{Z}^1{X}^0(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^1{X}^0\right)}^{†}+\frac{1}{4}{Z}^1{X}^1(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^1{X}^1\right)}^{†}[+2ex]\hfill \\ =\frac{1}{2}\left[\begin{array}{cc}1& 0\\ 0& 1\end{array}\right]\hfill \end{array}$$

(24)

$$\begin{array}{c}\frac{1}{2^2}\sum _{l_{2i-1}^B,l_{2i}^B\in \{0,1\}}{Z}^{l_{2i-1}^B}{X}^{l_{2i}^B}\left|{\psi }_i^B\right.〉{\left(Z^{l_{2i-1}^B}{X}^{l_{2i}^B}\right)}^{†}\hfill \\ =\frac{1}{4}{Z}^0{X}^0(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^0{X}^0\right)}^{†}+\frac{1}{4}{Z}^0{X}^1(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^0{X}^1\right)}^{†}\hfill \\ +\frac{1}{4}{Z}^1{X}^0(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^1{X}^0\right)}^{†}+\frac{1}{4}{Z}^1{X}^1(\frac{1}{2}\left|0\right.〉\left.〈0\right|+\frac{1}{2}\left|1\right.〉\left.〈1\right|){\left(Z^1{X}^1\right)}^{†}\hfill \\ =\frac{1}{2}\left[\begin{array}{cc}1& 0\\ 0& 1.\end{array}\right]\hfill \end{array}$$

(25)

These calculations indicate that all the states obtained by Calvin are just totally mixed states. So Calvin cannot learn Alice’s and Bob’s private binary strings from the particle sequences he obtained.

4.4. Comparison

The related quantum PSI-CA protocols in [27,28] required entangled states, other complicated oracle operators and measurements in high dimensional Hilbert space, hence it is more feasible with the current technologies than those proposed with entangled states. Compared with some recently proposed protocols [27,28], our proposed quantum PSI-CA protocol has the following advantages. First, it only needs to take single photons as quantum resources and to apply single operators and measurements. Obviously, it is more feasible to prepare these resources and implement these operators and measurements. Second, our new protocol is more robust and can easily use the fault tolerant technologies due to single photons. Therefore, our new quantum protocol for PSI-CA is more practical and feasible compared with the existing protocols.

5. Discussion and Conclusions

In summary, we give a novel quantum solution for PSI-CA. With the help of the quantum operators X, Z, and T, Calvin can help Alice and Bob obtain the PSI-CA results of their private sets after performing. Moreover, we provide a theoretical correctness study and use the Qiskit package to verify the scheme on the IBM Quantum Experience platform by way of a simulation experiment. In the end, we provide a security analysis of our protocol, which demonstrates that our protocol can resist various outside attacks, such as the disturbance attack, the Trojan horse attack, the intercept–resend attack, the entanglement-and-measure attack, and the man-in-the-middle attack. Additionally, it can also overcome the problem of information leakage with acceptable efficiency. Furthermore, we hope to extend our protocol for a generic case such as an n-qubit Toffoli gate and we also hope that our methods can provide some new ideas to solve more secure multi-party computations in the future.