{'fraction_non_alphanumeric': 0.03155154616040573, 'fraction_numerical': 0.010502221623805036, 'mean_word_length': 4.632457027300303, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Multiparty Mediated Quantum Secret Sharing Protocol

This study proposes a multiparty mediated quantum secret sharing (MQSS) protocol that allows n restricted quantum users to share a secret via the assistance of a dishonest third-party (TP) with full quantum capabilities. Under the premise that a restricted quantum user can only perform the Hadamard transformation and the Z-basis measurement, the proposed MQSS protocol has addressed two common challenges in the existing semi-quantum secret sharing protocols: (1) the dealer must have full quantum capability, and (2) the classical users must equip with the wavelength quantum filter and the photon number splitters (PNS) to detect the Trojan horse attacks. The security analysis has also delivered proof to show that the proposed MQSS protocol can avoid the collective attack, the collusion attack, and the Trojan horse attacks. In addition, the proposed MQSS protocol is more efficient than the existing SQSS protocols due to the restricted quantum users can only equip with two quantum operations, and the qubits are transmitted within a shorter distance.


Introduction
Secret sharing is an important research branch in conventional cryptography. The fundamental concept is that a dealer splits his/her secret message into several secret shadows, and then distributes them to multiple agents, respectively. Only when a sufficient number of agents cooperate using their secret shadows can the dealer's secret be recovered. In 1979, Shamir [1] proposed the first secret sharing protocol based on the idea that a polynomial of degree − 1 requires points to fit. Some other classical secret sharing (CSS) protocols have been proposed [2,3] using different mathematical properties such as geometry plane [2] and Chinese remainder theorem [3]. However, the security of these CSS protocols lies on the computational complexity of some mathematical problems using classical computer systems. Therefore, they are not suitable for the computing scenario using quantum mechanics. In 1999, Hillery et al. [4] proposed the first quantum secret sharing (QSS) protocol using Greenberger-Horne-Zeilinger (GHZ) states. After that, many QSS protocols  have been proposed based on different properties of quantum states. These QSS protocols always assume that both the dealer and agents have been equipped with complete quantum devices (e.g., quantum memory, quantum measurement device, and the generator for various quantum states). It is relatively unrealistic since some quantum devices are of high cost and difficult to implement. Hence, it is an interesting research issue in QSS to discuss whether all participants should have full quantum capabilities to execute the protocol. To address this issue, Boyer et al. [47] proposed a novel environment called semiquantum environment with two kinds of users: the quantum users and the classical users. The quantum user has the complete quantum capabilities, but the classical user only equips with the limited quantum devices. According to the classical user's quantum capabilities, the semi-quantum environments can be classified into four types of semi-quantum environment which have been summarized in Table 1. The first semi-quantum key distribution (SQKD) protocol was also proposed by Boyer et al. [47] in 2007. After that, various cryptographic protocols have been proposed under the semi-quantum environment. Among these semi-quantum cryptographic protocols, the semi-quantum secret sharing (SQSS) [48][49][50][51][52][53][54][55][56][57][58][59][60][61][62] is considered as one of the important research branches. In 2011, Li et al. [48] proposed the first SQSS protocol that allows a quantum dealer Alice to share her secrets with two classical agents, Bob, and Charlie, by using GHZ-type states. For three-particle quantum states, a more recent work was proposed by Tsai et al. [62] using W states. To expand the three-party idea into a more generalized scenario, Li et al. [50] further proposed a multiparty SQSS protocol using the product states. Their protocol was later improved by Yang and Hwang [51]. On the other hand, Xie et al. [52] proposed another multiparty SQSS protocol let the dealer can share his/her secret with the agents without additionally transmitting the additional ciphertext of the dealer's secret to the agents. For less particle entangled states, Wang et al. [49] and Gao et al. [50] proposed their multiparty SQSS scheme with The general form of the GHZ state and the Hadamard operation is expressed in Eq. (1) and Eq.
Assume that each particle of a GHZ state can perform either identity operator or Hadamard operation. With the above operations, the GHZ state will project to one of the following four properties.

Property 1:
Since an identity operator will not change the state of a vector, it is obvious that the GHZ state will remain invariant if all particles have been multiplied with the identity operators.

Property 2:
If all particles of the GHZ state have been passed through the logic gate of the Hadamard operation, the state will convert to the GHZ-like state as shown in the following expression: ,

Property 3:
If any − 1 particles of a GHZ state have been performed with the Hadamard operation, the GHZ state will convert to the following state.

Property 4:
If particles of GHZ state where 1≤ ≤ − 2 have been performed with the Hadamard operation, the GHZ state will result in the following state.
Here, we also take the 4-particle GHZ state |Ψ (000',0) - as an example to demonstrate the property. Suppose that the Hadamard operations are perform on either the 1 st and 2 nd particles or only the 1 st particle of the GHZ states. After the transformation, the state of the original entanglement system will change to the followings: , , and Taking Eq. (16) and (17) as the examples, compared with the phase of the initial GHZ state, the remaining entanglement state (2 nd , 3 rd and 4 th particles) will be changed from positive to negative when the Hamming weight of the measurement result for the 1 st particle is odd; otherwise, the phase of the remaining entanglement state will remain invariant.

Proposed MQSS Protocol
In this section, some initial assumptions on the quantum capabilities are given to better illustrate the procedure of the proposed MQSS protocol with the ( , ) threshold. The restricted quantum participants (i.e., the dealer and the agents) only has two quantum capabilities: (1) the Hadamard operation, and (2) the Z-basis measurement (|0⟩, |1⟩); TP can generate the GHZ states and store these states using the quantum memory. To be more realistic in practice, the security level of TP is set to allow dishonesty. That is, TP may perform any possible attacks such as colluding with other insiders to learn the information of the dealer's secret and/or the other agents' secret shadows. For qubit transmission, quantum channels only exist between TP and each restricted quantum participant with a predefined noise rate . All the restricted quantum participants have mutually owned an authenticated classical channel between each other in which the messages can be eavesdropped but cannot be modified. For the procedure of the protocol, this study will first deliver its general form and then demonstrates a five-party communication scenario as an example.
Suppose that a dealer Alice wants to share a -bit secret with agents (i.e., Bob1, Bob2, …, Bobn) via the help of a third-party server TP. The step-by-step process of the proposed MQSS protocol are depicted as follows.
Step 1. TP generates any GHZ state ;' , and sends the 1 st particle to Alice and keeps the remaining particles in quantum memory.
Step 2. After Alice receiving the qubit, she randomly selects Check or Share mode. If Alice selects Share modes, she will perform Hadamard operation on the received qubit and then measure it with Z-basis; otherwise, she will directly measure the received qubit in Z-basis. Alice stores the measurement result Step 3. After receiving the ACK signal from Alice, TP will then send the remaining particles to each agent, respectively.
Step 4. Each agent also randomly selects Check or Share mode. If the agent selects Share modes, he will perform the Hadamard operation on the received qubit and then measure it with Zbasis. Otherwise, he will directly perform the Z-basis measurement on the received qubit.
After the measurement, all agents will store the results C' Repeat Step 1 to Step 4 several times with a suggestion of at least × 2 );' times due to the following reasons.
• In each qubit transmission between TP and the restricted quantum participant, about half of the qubits will be used for eavesdropping check, so only half of the measurement results will become candidates of a potential shared secret key.
• The measurement results possessed by each restricted quantum participant will have about half of them either discard or used for eavesdropping check. Therefore, the qubit efficiency used for the shared one-bit secret will be calculated as Step 5. TP announces all initial states of those GHZ states generated in Step 1. Then, Alice requests the agents to disclose the information of their mode selections in Step 4. Table 2 summarizes the three possible cases that will happen according to the modes selected by Alice and the three agents.
From the selected modes in Step 4, Alice will ask the agents to announce their corresponding measurement results in Case 2 and Case 3 of Table 2 to execute the public discussion for security checking of TP and eavesdroppers. If the error rate exceeds the noise rate of the quantum channel, the participants will abort the session and restart the protocol. Otherwise, the participants will share the raw key bits as depicted in Case 1 of Table 2. Here, Alice and the agents should share 2 -bit raw key bits because the participants repeat Step 1 to Step 4 × 2 );' times and each participant selects Share mode with the probability of 50%.
Step 6. Alice selects m-bit of raw secret key as the check bits . If the error rate exceeds the preset threshold , the current session will be aborted for relaunching the protocol.
Step 7. Alice and the agents will take the remaining m-bit raw shadow bits as the shared secret key: . }, respectively. Then, Alice announces her secret via the result of Step 8. Only when all agents collaborate with each other can they recover Alice's shared secret bits (i.e., ⊕ B ⊕ "/' ) C" = ). Alice and all agents first collect each corresponding measurement result as the raw keys respectively. Then, they take a portion of the raw key bits to perform a security check of TP and eavesdroppers in Step 6 of the proposed protocol.

2
All participants select Check mode in which they all perform identity operators on their corresponding qubits.
The corresponding measurement results will be used to perform a security check of TP and eavesdroppers in Step 5 of the proposed protocol. 3 The number of participants that select Check mode is greater than or equal to 2.
The participants who select Check mode will take their measurement results to perform a security check of TP and eavesdroppers in Step 5 of the proposed protocol, while the other participants who select Share mode will discard their measurement results.
This study takes a five-party communication scenario as an example to further demonstrate the idea of the proposed MQSS protocol. In the example scenario, assume that the dealer Alice wants to share a m-bit secret with the three agents: Bob, Charlie, and David, via the help of a third-party server TP. The process of the proposed MQSS protocol is depicted as follows (also shown in Figure 1).
Step 2. After Alice receiving the qubit, she randomly selects Check or Share mode. If Alice selects Share modes, she will perform Hadamard operation on the received qubit and then measure it with Z-basis; otherwise, she will directly measure the received qubit in Z-basis. Alice stores the measurement result B + and returns the ACK signal to TP.
Step 3. After receiving the ACK signal from Alice, TP will then send the 2 nd , 3 rd , and 4 th particles to Bob, Charlie, and David, respectively.
Step 4. Each agent also randomly selects Check or Share mode, performs the corresponding operations, and the Z-basis measurement on each of the received qubits. Here, Bob, Charlie, and David store the measurement results C + , D + , and E + , respectively. Alice and the agents will then repeat Step 1 to Step 4 32 ( × 2 2;' ) times.
Step 5. TP announces all initial states of those GHZ states generated in Step 1. Then, Alice requests the agents to disclose the information of their mode selections in Step 4.

From the selected modes in
Step 4, Alice executes the public discussions with all the agents for security checking of TP and eavesdroppers in Case 2 and Case 3 of Table 2. If the error rate exceeds the preset noise rate of the quantum channel, they will abort the protocol and restart it again. Otherwise, the participants will obtain the raw key bits as depicted in Case 1 of Table 2.
Step If the error rate exceeds the preset threshold , the current session will be aborted and relaunch the protocol.
Step 7. Alice, Bob, Charlie, and David will take the remaining raw shadow bits as the shared secret key: B C , D , and E , respectively. Then, Alice announces her secret via the result of ⊕ B .
Step 8. Only when all three classical agents Bob, Charlie, and David collaborate together can they recover Alice's shared secret bit (i.e., ⊕ B ⊕ C ⊕ D ⊕ E = ).

Security Analysis
In this section, we analyze the security of the proposed MQSS protocol. For these quantum protocols, there are three attack modes including an individual attack, a collective attack, and a coherence attack [65,66]. The individual attack and the coherence attack have the most and the least restrictions, respectively. To date, no research work has pointed out that an attacker can obtain more advantages by using the coherence attack over the collective attack which is the most common attack in SQSS protocols [64,[67][68][69]. Therefore, we take the proposed MQSS protocol with 5 participants as an example, give a complete analysis of the collective attack to prove the proposed MQSS protocol is robust under the attack intention of TP, and then the collusion attack is discussed to prove that the protocol is still secure if any insider has been compromised to collaborate with an attacker.
Furthermore, an illustration of why the proposed MQSS protocol is congenitally free from the Trojan horse attacks will be given at the end of this section.

4-1 Collective Attack
In the proposed MQSS protocol, TP has many advantages over the other internal and external communicating parties to obtain the information of Alice's secret and/or the other agents' secret shadows. To prove that the proposed MQSS is robust under the collective attack, we must show TP's malicious behavior can be detected by the security check of the legitimate participants. Here, we take the five-party MQSS protocol as an example to analyze collective attack.
Theorem 1: TP performs the collective attack on the qubit that sent to Alice and the other agents. In order to do so, TP applies a unitary operation F on the qubit that complies with the theorems of quantum mechanics. However, no unitary operation exists in the collective attack that allows TP to obtain the information of the participants' secret without being detected.
Proof: Before TP sends the photons of GHZ states to Alice and the other agents, TP performs a unitary operation F on each GHZ state with an attached probe qubit | +where 1 ≤ ≤ 32 . TP will keep the probe qubits in its quantum memory, and then measure the probe qubits with the corresponding basis to extract the information of Alice's secret and/or the agents' secret shadows after the completion of the protocol. For simplicity, we take one kind of GHZ state, |Ψ ; ⟩ '(12 = ' √( (|0000⟩ + |1111⟩) '(1 , as an example to demonstrate the proof. Note that other GHZ states can apply the same approach to prove its robustness. According to the theorems of quantum mechanics, the entanglement system will convert to the following form after performing F on the GHZ state with the probe qubit | + -.
If TP attempts to pass the security check in Case 2 of Table 2, it needs to adjust F to make Eq.
(18) conforms to the measurement results of GHZ state. Here, TP can set = = 0 for ∀ ∈ {2, … ,14} to convert the system to the following state: According to the Property 3 in Section 2, it shows that TP can also pass the security check in Case 3 of Table 2 when using the same settings of F . To further pass the security check in Case 1 of After all agents perform the Hadamard operations, the states of Eq. (20) and Eq. (21) will become Eq. (22) and Eq. (23), respectively.
From Eq. (22) and Eq. (23), although TP can try to pass the security check in Case 1 of Table 2 by setting 0 | 0 + -= 'G | 'G + -, it cannot obtain any information from its probe qubits using this setting of F . Hence, no unitary operation can be performed by TP in the collective attack to obtain information of the shared secret without being detected.

4-2 Collusion Attack
In the proposed MQSS protocol, TP can collude with some of the agents to obtain Alice's secret bits. Assume that the dishonest agents are Bob and Charlie, and they want to collaborate with TP to steal David's secret shadows. If they adopt the measure-resend attack on the qubits sent to David, their malicious actions will be detected by the security check in Step 6 of the proposed protocol with a probability of where the detection rate will approach to 1 if is large enough. While the collective attack can be applied along with the collusion attack, by using similar proof in Section 4-1, there is no unitary operation that allows TP and the dishonest agents to obtain information of David's secret shadow. Therefore, the proposed MQSS protocol is secure against the collusion attack.

4-3 Trojan horse attack
Trojan horse attacks [70,71] happened pretty often in terms of implementation-dependent attacks. This paper discusses two types of Trojan horse attacks. The first type of Trojan horse attacks is by the use of a so-called delayed photon. In this attack, an attacker intercepts a qubit transmitted to a participant and then inserts a probing photon in the qubit with a delay time that is shorter than the original time window. In this method, a participant cannot detect the fake photon because it does not register on their detector. After a participant performs the corresponding operation and returns the qubit, the attacker intercepts the qubit again and separates the probing photon. In this case, the attacker can obtain full information regarding to a participant's operation by measuring the probing photon. The second type of Trojan horse attacks uses an invisible photon. The main strategy of this attack is to attach an invisible photon on each qubit sent to the participant. Since the participants cannot detect this fake photon, the attacker can steal information regarding the participant's operations in a manner similar to the use of a delay photon. That is, when the participant performs a unitary operation on the qubit, the invisible photon that attached to it will also receive the same operation simultaneously.
In the attack methods mentioned above, the attacker can only extract information regarding participant operations when they retrieve the Trojan horse photons. A two-way or circular communication protocol gives the attacker a chance to retrieve malicious photons triggered by the Trojan horse attacks. Therefore, the protocols are considered vulnerable to Trojan horse attacks if they adopt two-way or circular communication. In contrast, in a one-way communication protocol, the attacker has no chance to collect the malicious photons from the Trojan horse attacks because no qubit is returned by the participant. In other words, the protocol will be robust to Trojan horse attacks if it is a one-way communication protocol.
In the proposed MQSS protocol, the qubit transmission applies a one-way transmission strategy in which the qubits are sent only from TP to the restricted quantum participants. Although the attacker can insert probing photons into each transmitted qubit, the information of the participants' secret shadow bits cannot be obtained due to the probing photons will not be sent out after they received by the restricted quantum participants. Thus, the proposed MQSS is congenitally free from the Trojan horse attacks and all restricted quantum participants do not have to install the costly special optical devices such as the photon number splitter and the optical wavelength filter.

Conclusions
This study presents a multiparty mediated quantum secret sharing (MQSS) protocol that allows a restricted number of quantum participants to share their secret with the other restricted quantum participants via the help of a dishonest third-party (TP). Each restricted quantum participant allowed only two quantum capabilities (i.e., performing the Hadamard operation and the Z-basis measurement) and does not have to equip with any special quantum device to avoid the Trojan horse attack. In terms of quantum capabilities, the proposed MQSS is better than the existing SQSS protocols. Under the premise that a classical user owns the capability of performing the unitary operations, the proposed MQSS protocol breaks the two hard restrictions that existed in all current SQSS protocols, which are (1) the secret dealer must have full quantum capabilities, and (2) all classical quantum participants must equip with the Trojan horse detectors. There are several interesting and challenging issues can be further explored in the near future. To elaborate a few, it is worth to know that whether it is possible to improving the qubit efficiency of our MQSS protocol without any additional device and assumption. On the other hand, one can also pursue the extension the proposed MQSS protocol to a ( , )-threshold QSS scheme to allow more cryptographic applications. Last but not least, the channel noises and the fault tolerance communication in quantum protocol could be another crucial issue in practice.