A verifiable quantum homomorphic encryption method for a specific set of universal quantum gates

Abstract

This invention proposes a verifiable quantum homomorphic encryption (QHE) method applicable to the universal quantum gate set {H, P, Toffoli}. The method includes: a user first generates a classical public-private key pair and a computational key, prepares quantum inputs for the real computational circuit and test circuit, and prepares a gadget required to eliminate specific byproducts; the user performs a quantum one-time pad on the quantum input of each quantum circuit and encrypts the Pauli key and gadget using the classical public key; the user randomly selects to execute either the real computational circuit or the test circuit, and uses the corresponding gadget to resolve the corresponding byproduct when executing a specific gate; the server sends the computational results of each circuit to the user; the user measures the test circuit output using the corresponding measurement basis and verifies the server's honesty based on the measurement results. If the test circuit's measurement results meet expectations, the user decrypts the real circuit's computational results to obtain the computational output. This invention designs a verifiable method for QHE based on the universal quantum gate set {H, P, Toffoli}, enhancing the practicality of QHE.

Description

Technical Field

[0001] The present invention relates to a verifiable quantum homomorphic encryption method applicable to a universal quantum gate set {H, P, Toffoli}, and belongs to the field of quantum computing and quantum cryptography. Background Art

[0002] Quantum computing is a revolutionary computing paradigm that can surpass classical computing in certain areas. For example, Shor's algorithm can solve large integer factorization and discrete logarithm problems in polynomial time, while Grover's algorithm can achieve square root acceleration when performing unordered database searches compared to classical algorithms. Quantum computing is currently being considered for applications in a variety of fields, including cryptography, artificial intelligence, and combinatorial optimization. Although various physical systems, such as superconducting qubits, trapped ions, and photons, have been considered for building quantum computers, their costs are extremely high, and building large-scale quantum computers remains challenging for the foreseeable future. Therefore, customers with limited quantum capabilities are likely to perform quantum computing tasks through cloud-based models, namely, delegated quantum computing.

[0003] Quantum homomorphic encryption (QHE) is an important method for delegated quantum computing that allows quantum computations to be performed directly on encrypted quantum states without prior decryption. The server sends the computed quantum ciphertext state to the user, who then decrypts it to obtain the computational result. Furthermore, quantum homomorphic encryption requires only a single interaction between the user and the server. In 2012, Rohde et al. proposed the first QHE scheme for implementing quantum walks on encrypted data (PP Rohde, JF Fitzsimons, A. Gilchrist, Quantum walks with encrypted data. Physical Review Letters, 2012, 109:150501). In 2013, Liang constructed a general framework for QHE and quantum fully homomorphic encryption (QFHE), and proposed four QHE schemes and one QFHE scheme based on quantum one-time pads (M. Liang, Symmetric quantum fully homomorphic encryption with perfect security. Quantum Information Processing, 2013, 12:3675-3687). Then in 2014, Liang proposed another QFHE scheme based on universal quantum circuits (M. Liang, Quantum fully homomorphic encryption scheme based on universal quantum circuit. Quantum Information Processing, 2014, 14: 2749-2759). In 2015, Broadbent and Jeffery proposed two QHE schemes that can homomorphically implement the universal gate set {H, T, CNOT}, but both can only homomorphically compute a constant number of non-Clifford T gates (A. Broadbent, J. Stacey, Quantum homomorphic encryption for circuits of low T-gate complexity. Advances in Cryptology-CRYPTO 2015, Springer, 2015: 609-629).In 2016, Dulek et al. designed a quantum gadget to correct the byproducts generated by T-gates in a proposed quantum QHE scheme (called the TP scheme) (Y. Dulek, C. Schaffner, F. Speelman, Quantum homomorphic encryption for polynomial-size circuits. Advances in Cryptology-CRYPTO 2016, Springer, 2016: 3-32). This scheme allows a client to homomorphically execute a polynomial number of T-gates on an encrypted quantum state. In 2017, Alagic et al. introduced the first verifiable QFHE scheme, also based on the set of {H, T, CNOT} gates. In this QFHE scheme, the client applies quantum error correction code technology and trapped quantum bits to detect dishonest behavior of the server during homomorphic computation (G.Alagic, Y.Dulek, C.Schaffner, F.Speelman, Quantum fully homomorphic encryption with verification. Advances in Cryptology-ASIACRYPT2017, Springer, 2017: 438-467). In 2018, Mahadev et al. constructed an encrypted CNOT operation by adopting a pair of trap-gate clawless functions to homomorphically compute non-CliffordToffoli gates, and then proposed a new QHE scheme based on another universal gate set {H, P, Toffoli} (Mahadev U. Classical homomorphic encryption for quantum circuits. SIAM Journal on Computing, 2020, 52(6): FOCS18-189-FOCS18-215). In 2024, He Renke et al. proposed a verifiable QFHE scheme based on the universal quantum gate set {H, T, CNOT} based on the garbled circuit technology (He R, Chen L, Li Q, et al. Verifiable quantum homomorphic encryption based on garbled evaluation. Quantum Science and Technology, 2024, 9(4): 045051). Compared with the scheme of Alagic et al., this scheme does not require a complex encoding process.

[0004] However, most of the aforementioned QHE schemes fail to consider the verifiability property, namely, whether users can verify the correctness of the computation results returned by the server. In reality, during the delegated computation, the server may deviate from the computational process and return erroneous results. Although Alagic et al. and He Renke et al. proposed verifiable QFHE schemes based on the universal quantum gate set {H, T, CNOT} based on different quantum technologies, neither approach is applicable to QHE schemes based on the universal gate set {H, P, Toffoli}. Quantum algorithms and quantum circuits, such as the Grover algorithm, use the universal gate set {H, P, Toffoli} for homomorphic implementation, consuming fewer quantum gates and fewer quantum resources than the {H, T, CNOT} gate set. Therefore, designing a verifiability strategy for QHE schemes based on {H, P, Toffoli} that allows users to verify dishonest server behavior is of great significance. Summary of the Invention

[0005] This paper proposes a verifiable quantum homomorphic encryption method for the universal quantum gate set {H, P, Toffoli}. In this method, users can not only non-interactively resolve the byproducts of non-CliffordToffoli gates during homomorphic computation using a designed gadget, but also verify the correctness of the computation results returned by the server. The core method of this invention consists of five stages: preparation, encryption, computation, verification, and decryption.

[0006] Preparation phase: The user generates the classical key sets required for the real computing circuit and two types of test circuits, including the public key set Private key collection and compute key sets where c p , c h and c t are the number of P gates, H gates, and Toffoli gates in the quantum circuit respectively; for P gates and H gates, the user generates c for the real computation circuit. p +3c h A gadget implements the identity gate and generates C for two types of test circuits. p +3c h Gadget test Eliminate P gates; for Toffoli gates, users generate 3c for each type of circuit t Gadget CZ Used to eliminate possible side products of the Toffoli gate; users generate the n-qubit input quantum state |ψ> of the real computing circuit and the input quantum states of two types of test circuits and The user randomly generates Pauli keys a,b,c,d,e,f∈{0,1}n and encrypts the generated Pauli keys using the public key pk0.

[0007] Encryption phase: The user encrypts the input quantum state of each type of quantum circuit with the Pauli key and obtains and The user uses the public key pk1 to encrypt the Pauli key and the classical information of the gadget generated for each type of circuit; the user sends the encrypted input quantum state, gadget and encrypted Pauli key to the server.

[0008] Calculation phase: If the quantum gate is an H gate or a P gate, the server will directly apply the corresponding quantum gate to the input quantum state of each type of quantum circuit; the server will generate the Gadget and Gadget in the preparation phase. test Implement the identity gate on the real computing circuit and two types of test circuits respectively If the quantum gate is a Toffoli gate, the server passes the Gadget CZ Eliminate the possible byproducts of each type of quantum circuit due to the Toffoli gate; the server updates the encrypted Pauli key of each type of quantum circuit based on the gadget; then the server sends the encrypted input quantum bits and the encrypted Pauli key to the user.

[0009] Decryption phase: The user decrypts the encrypted Pauli key returned by the server and uses the decryption result to apply the X gate and Z gate to obtain the output result |ψ>, and The user measures the output results of two types of test circuits using the calculation basis and the X basis respectively and Obtain corresponding measurement results;

[0010] Verification phase: If the measurement results of both types of test circuits meet expectations, the user accepts the output result |ψ> of the real computing circuit returned by the server as the final output quantum state.

[0011] The present invention is a gadget designed by CZThis paper can non-interactively resolve the potential byproduct issues associated with Toffoli gates in homomorphic computations, and based on this, designs a verifiable method for quantum homomorphic encryption computations based on the universal gate set {H, P, Toffoli}. In this designed verifiable method, the server cannot distinguish between the real computation circuit and the two types of test circuits. The user measures the output quantum state of the test circuit returned by the server using the corresponding basis. If the measurement result meets expectations, the user accepts the computation result of the real computation circuit. This invention implements homomorphic computations based on the universal gate set {H, P, Toffoli} and provides verifiable properties for the corresponding quantum homomorphic encryption method, further enhancing the practicality of quantum homomorphic encryption in future quantum networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly describes the drawings required for use in the embodiments. The following drawings illustrate only certain embodiments of the present invention and should not be construed as limiting the scope of the present invention. Persons skilled in the art will be able to derive other relevant drawings based on these drawings without inventive effort.

[0013] Figure 1 It is a schematic diagram of the main process of the present invention.

[0014] Figure 2 Schematic diagram of interaction between two parties in an example of the present invention.

[0015] Figure 3 The present invention constructs Gadget by performing Bell measurement test process.

[0016] Figure 4 This is the process of constructing a Gadget by performing Bell measurement in the present invention.

[0017] Figure 5 The present invention constructs Gadget by performing Bell measurement CZ process. DETAILED DESCRIPTION

[0018] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0019] A verifiable quantum homomorphic encryption method based on the universal quantum gate set {H, P, Toffoli}, Figure 1 The main flow chart of the present invention is shown. Figure 2 The following diagram shows the interaction between two parties in an example of the present invention. In the specific implementation, assuming Alice is the user and Bob is the quantum cloud server, the specific steps are as follows:

[0020] 1. Preparation

[0021] (1a) Alice executes the key generation algorithm for the real computing circuit and two types of test circuits Test1 and Test2 respectively. Generate a public key set Private key collection and compute key sets where c p , c h and c t are the number of P-gates, H-gates and Toffoli gates in the quantum circuit respectively, and κ is the security parameter.

[0022] (1b) Alice prepares quantum inputs for the real computation circuit and two types of test circuits Test1 and Test2, which are the states of n qubits |ψ〉, and

[0023] (1c) Alice randomly generates Pauli keys a,b,c,d,e,f∈{0,1} n Used to encrypt quantum inputs for each class of quantum circuits.

[0024] (1d) For P gates and H gates, Alice generates c for the real computation circuit and two types of test circuits Test1 and Test2, respectively. p +3c h Gadget and Gadget test Used to implement identity gates and eliminate P-gate errors; for Toffoli gates, Alice generates 3c for each type of circuit t Gadget CZ Eliminate CNOT and CZ gate errors that may occur during homomorphic computation of Toffoli gate.

[0025] (1e) Specifically, the gadget prepared in the test circuit test , which is used to eliminate the P gate on the input quantum bit to keep the output quantum bit in the form of and (Ignore Pauli encryption), thereby verifying Bob's dishonesty through Z-based and X-based measurements. test It contains classical part and quantum part. The quantum part contains n pairs of EPR pairs and they can be connected by {(s1,t1),(s2,t2),...,(sn ,t n )} is represented. The classical part is based on the private key sk0 and can be defined as {(s1, t1), (s2, t2),..., (s n ,t n ), q, sk0)}, where q ∈ {0, 1} n represents The gate acts on the position of s i . For example, if n = 3 and q = 100, then the gate acts on s1. In addition, the value of n depends on the security parameter κ. According to the classical part of Gadget test , the quantum part can be defined as where x, z ∈ {0, 1} n . Since x and z are randomly selected by Alice, Gadget test is a completely mixed state for Bob Therefore, as long as x and z are encrypted by a secure classical homomorphic encryption method, the private key sk will not be leaked to Bob. The role of the gadget Gadget prepared in the real circuit is to implement the identity gate on the input qubits. Except for the identity gate implemented on s i , the composition of the gadget Gadget is similar to that of Gadget test . Gadget is also a completely mixed state for Bob Therefore, Bob cannot distinguish between the real computing circuit and the two types of test circuits.

[0026] The construction methods of the gadget Gadget and Gadget test are similar to those in the TP scheme. Alice and Bob pre-share 2n EPR pairs. Then Alice performs the gate on the l-th (0 < l < n) entangled particle she owns and performs the corresponding Bell measurement on the entangled particles owned by Alice. The measurement order is determined by the private key sk0 generated by Alice. Therefore, Bob cannot know the connection method of the EPR pairs in the final gadget. Similarly Figure 3 , Alice and Bob pre-share 6 EPR pairs, numbered 1, 2,..., 6, where Alice owns the first qubits {e1,..., e6} of these EPR pairs. Alice performs the corresponding Bell measurement on these e i (1 ≤ i ≤ 6) to obtain the Figure 3 gadget Gadget in test . Because Alice performs measurements on the e she owns i(1 ≤ i ≤ 6) A Bell measurement is performed, and the second qubit of the EPR pair will be correspondingly entangled according to entanglement swapping. For example, the second qubits of the EPR pairs numbered 2 and 5 will form a new EPR pair. In the generated Gadget test , for specific EPR pairs such as those numbered 1 and 3, etc., carry operations. This is because when generating Gadget test , Alice performed a Bell measurement with operations on the corresponding EPR pairs. Except that Alice performs an identity gate instead of gate on the l-th (0 < l < n) entangled particle she owns, the construction of Gadget is similar to Gadget test . Alice can generate Gadget i in Figure 4 by performing a Bell measurement on the e i (1 ≤ i ≤ 6) she owns.

[0027] The purpose of Gadget CZ is to eliminate possible CZ gate errors on the input qubits. It also contains a classical part and a quantum part. The quantum part contains 2n pairs of EPR pairs, and their connection method is represented by {(s1, t1), (s2, t2),..., (s 2n , t 2n )}. The classical part is based on the private key sk0 and can be defined as {(s1, t1), (s2, t2),..., (s 2n , t 2n ), r, sk0}, where r ∈ {0, 1} 2n represents that the CZ gate acts on the position of s i . For example, assuming n = 3 and q = 110000, the CZ gate acts on s1 and s2. According to the classical part of Gadget CZ , the quantum part is defined as where x, z ∈ {0, 1} 2n . And because x and z are randomly selected by Alice, Gadget CZ is a completely mixed state for Bob The construction of Gadget CZ is different from the previous two gadgets. It is for quantum inputs containing two qubits, so Alice and Bob need to pre-share 4n pairs of EPR pairs. Then Alice performs a CZ gate on the l-th (0 < l < 2n) entangled particle she owns and performs a corresponding Bell measurement on the entangled particles owned by Alice. The measurement order is still determined by the private key sk0 generated by Alice. Similarly Figure 5 In the example, Alice and Bob pre-share 12 EPR pairs, numbered 1, 2, ..., 12, where Alice owns the first qubit {e1, ..., e 12 Alice has some e i (1≤i≤12) performs CZ gate operation, and then these e i (1≤i≤12) Perform the corresponding Bell measurement to obtain Figure 5 Gadget CZ .

[0028] (1f) Since the H gate changes the input qubits in the test circuit, if it works together with other gates, it is impossible to maintain the form of the qubits in the test circuit |0> and |+>. or Effect on and This will change the states of the two qubits to Then, if Bob uses the CNOT gate, the two quantum bits will be entangled and generate a state. Therefore, Alice cannot verify Bob's dishonest behavior through the corresponding Z and X basis measurements. In this method, the H gate is implemented by HPHPHPH=H on the real computing circuit, while the identity gate operation on the test circuit is implemented by HIHIHIH=I.

[0029] 2. Encryption phase

[0030] (2a) Alice uses the Pauli key to encrypt the quantum input of each quantum circuit to generate X a Z b |ψ>、

[0031] (2b) Alice uses the public key pk1 to encrypt the Pauli keys a,b,c,d,e,f → a',b',c',d',e',f'.

[0032] (2c) Alice uses the public key pk1 to encrypt the classical information of each gadget in the quantum circuit.

[0033] (2d) Specifically, gadgets, gadgets test The classical information contains g(sk)(f(sk)) and the key x used by QOTP, z∈{0,1} n Gadget and Gadget test The gadgets can be represented as

[0034]

[0035] and

[0036]

[0037] Gadget CZ The classical information includes the key x, z ∈ {0, 1} used by f(sk) and QOTP 2n . Gadget CZ can be expressed as

[0038]

[0039] where ρ(X) is the density matrix corresponding to X. If X is a random variable corresponding to a possible basis state B of a quantum system, then ρ(X) = Σ b∈B Pr[X = B]|b><b|. For example, X = {00, 11}

[0040] 3. Computation stage

[0041] (3a) Bob performs the corresponding gate operations in the set {H, P, Toffoli} on each quantum circuit using the gadget generated in the preparation stage.

[0042] (3b) Specifically, the process of performing the P gate and the H gate in the real computation circuit and the identity gate in the two types of test circuits Test1 and Test2 is as follows:

[0043] Bob first needs to input X a Z b |ψ> and perform the P gate in the real computation circuit, the identity gate in PX a Z b |ψ> using the Gadget. When using the Gadget, Bob determines the measurement order of the EPR pairs and the input qubits in the Gadget according to the randomly selected by Alice. The measurement order is determined by the classical algorithm in the TP scheme where classical algorithm will generate a measurement list M containing 2n elements, M = {(h1, l1),..., (h n , l n )|h i ∈ {s0, s1,..., s n}, l i ∈ {t1,..., t n}}, s0 represents the position of the input quantum bit. Use Gadget on two types of test circuits Test1 and Test2 test When using a gadget, the process is similar. Finally, after the measurement list M is completed, the state of the quantum bit in each type of quantum circuit becomes X A Z B P|ψ>, Among them, A, B, C, D, E, and F are new Pauli keys obtained based on the gadget measurement results and the updates of a, b, c, d, e, and f.

[0044] The H gate is executed as described in the preparation stage. For the actual calculation circuit, HPHPHPH=H is executed. The P gate execution method is executed according to the process of step (3b) above. For the two types of test circuits Test1 and Test2, HIHIHIH=I is executed.

[0045] (3c) The process of executing the Toffoli gate in the real computing circuit and the identity gate in the two types of test circuits Test1 and Test2 is as follows:

[0046] Bob first needs to compare the input X between the real computing circuit and the two types of test circuits Test1 and Test2 a Z b |ψ>、 Execute the Toffoli gate. Because the Toffoli gate is a non-Clifford gate, additional CZ gates and CNOT gates will appear for each type of quantum circuit. The following is an example of three qubits. If the input Executing the Toffoli gate on the

[0047]

[0048] Among them a1,b1,c1,d1,e1,f1∈{0,1}. At the same time, because and Therefore, for the real calculation circuit and the two types of test circuits Test1 and Test2, the additional CZ gate and CNOT gate byproducts are corrected. Since Bob does not know the values a, c, and f that determine the byproducts, he cannot distinguish the three types of circuits. CZ When using the gadget, Bob selects Alice randomly Determine the measurement order of the EPR pairs and input qubits in the Gadget. The measurement order can also be determined by the classical algorithm in the TP scheme. OK, among them or The difference is that the input qubits here are two qubits, so the EPR pairs in the original measurement order need to be expanded to 2 EPR pairs and then measured according to the measurement list. Classical algorithm A measurement list M containing 4n elements is generated, M={(h1,l1),...,(h 2n ,l 2n )|h i ∈{i0,i1,s1,...,s 2n},l i ∈{t1,...,t 2n}}, i0, i1 represent the positions of the two input qubits. After the measurement is completed according to the measurement list M, the state of the qubit in each type of quantum circuit becomes X A Z B P|ψ>, Where A, B, C, D, E, and F are new Pauli keys obtained based on the gadget measurement results and a, b, c, d, e, and f.

[0049] (3d) Bob performs the calculations required for the H-gate, T-gate, and Toffoli gate according to steps (3b) and (3c), and then Bob updates the encrypted Pauli key based on the classical information and measurement results of all gadgets used. Assume that the final encrypted Pauli keys are

[0050] (3e) Bob sends the output qubit X a' Z b' |ψ>、 and and encrypt the Pauli key to Alice.

[0051] 4. Decryption phase

[0052] (4a) Alice decrypts the encrypted Pauli key sent by Bob and obtains a', b', c', d', e', f'.

[0053] (4b) Alice outputs the result X for the real computation circuit and the test circuit a' Z b' |ψ>、 and Execute decryption operation Z respectively b' X a' 、Z d' X c' and Z f' X e' .

[0054] 5. Verification phase

[0055] (5a) For the output quantum state of the test circuit Test1 Alice performs Z-based measurement to obtain the corresponding measurement result. If the measurement result is not Then the result |ψ> obtained in the real calculation circuit is rejected.

[0056] (5b) For the output quantum state of the test circuit Test2 Alice performs X-based measurement to obtain the corresponding measurement result. If the measurement result is not Then reject the result |ψ> obtained in the calculation circuit.

[0057] (5c) If Bob performs a malicious operation, the decrypted state of the test circuit will no longer be and Alice can then determine whether Bob has honestly performed the corresponding operations during the homomorphic computation based on the corresponding measurement results. If all measurement results are as expected, Alice accepts the output quantum state of the real computation circuit returned by Bob as the final output result.

[0058] The above embodiments are intended only to illustrate the implementation of the present invention and are not intended to limit the scope of the present invention. Under the design principles of the present invention, modifications, transformations, and replacements that are simple and intuitive for professionals in the field and do not deviate from the technical solutions of the design principles of the present invention will still fall within the scope of protection of the present invention.

Claims

1. A verifiable quantum homomorphic encryption method for the universal quantum gate set {H, P, Toffoli}, characterized in that: It includes the following five stages: Preparation phase: The user generates the classical key sets required for the real computing circuit and two types of test circuits, including the public key set Private key collection and compute key sets where c p , c h and c t are the number of P gates, H gates, and Toffoli gates in the quantum circuit respectively; for P gates and H gates, the user generates c for the real computation circuit. p +3 c h gadgets implement the identity gate and generate c for two types of test circuits p +3c h Gadget test Eliminate P gates; for Toffoli gates, users generate 3c for each type of circuit t Gadget CZ Used to eliminate possible byproducts of the Toffoli gate; users generate the n-qubit input quantum state |ψ> of the real computing circuit and the input quantum states of two types of test circuits and The user randomly generates Pauli keys a,b,c,d,e,f∈{0,1} n ; Encryption phase: The user encrypts the input quantum state of each type of quantum circuit using the Pauli keys a, b, c, d, e, and f randomly generated in the preparation phase and obtains X a Z b |ψ>、 and The user encrypts the classical information of the gadget and the Pauli keys a, b, c, d, e, f generated in the preparation phase using the public key pk0; the user sends the encrypted input quantum state, gadget, and encrypted Pauli keys to the server; Calculation phase: If the quantum gate is an H gate or a P gate, the server will directly apply the corresponding quantum gate to the input quantum state of each type of quantum circuit; the server will generate the Gadget and Gadget in the preparation phase. test Implement the identity gate on the real computing circuit and two types of test circuits respectively Gate; if the quantum gate is a Toffoli gate, the server passes the Gadget CZ Eliminate the possible byproducts of the Toffoli gate for each type of quantum circuit; the server updates the encrypted Pauli key for each type of quantum circuit based on the gadget; then the server sends the encrypted input qubits and the encrypted Pauli key to the user; Decryption phase: The user decrypts the encrypted Pauli keys a′, b′, c′, d′, e′, f′ sent by the server, and uses the decrypted Pauli keys to calculate the output results X of each quantum circuit returned by the server. a′ Z b′ |ψ>、 and Perform the corresponding X or Z operation and obtain the output qubit |ψ〉, The user measures the output results of two types of test circuits using Z-basis and X-basis respectively and Obtain corresponding measurement results; Verification phase: Based on the measurement results of the two types of test circuits Test1 and Test2, the user determines whether the server has performed malicious operations during the homomorphic computation process. If all measurement results are as expected, the user accepts the output result |ψ> in the real computation circuit returned by the server as the output quantum state.

2. The verifiable quantum homomorphic encryption method for the universal quantum gate set {H, P, Toffoli} according to claim 1 is characterized in that: During the preparation phase: The user generates quantum inputs |ψ> for real computational circuits and two types of test circuits. and Prepare the gadgets required for calculation test and Gadget CZ , where Gadget is used to execute identity gates and Gadget in real computing circuits test Used for two types of test circuits to eliminate P-gate errors and Gadgets CZ For each type of quantum circuit, eliminate possible CZ and CNOT gate byproducts after executing Toffoli; Specifically, Gadget test It contains classical part and quantum part; the quantum part contains n pairs of EPR pairs and they are connected by {(s1,t1),(s2,t2),...,(s n ,t n )} represents the classical part; the classical part is based on the private key sk0 and is defined as {(s1,t1),(s2,t2),...,(s n ,t n ),q,sk0)}; where q∈{0,1} n express The gate acts on s i Location; according to Gadget test The classical part of the quantum part is defined as where x,z∈{0,1} n ; The function of the gadget is to implement the identity gate on the input quantum bit, except for i The above implementation is the identity gate, which is composed of the same test Similar to Gadget CZ It also contains classical and quantum parts; the quantum part contains 2n pairs of EPR pairs and they are connected by {(s1,t1),(s2,t2),...,(s 2n ,t 2n )} represents the classical part; the classical part is based on the private key sk0 and is defined as {(s1,t1),(s2,t2),...,(s 2n ,t 2n ),r,sk0)}; where r∈{0,1} 2n Indicates that the CZ gate acts on s i location; In addition, the user prepares the set of classical keys required for computation, including the public key set Private key collection and compute key sets where c p , c h and c t are the number of P-gates, H-gates, and Toffoli gates in the quantum circuit respectively; the user also prepares the Pauli keys a,b,c,d,e,f∈{0,1} for quantum one-time pads n .

3. The verifiable quantum homomorphic encryption method for the universal quantum gate set {H, P, Toffoli} according to claim 1 is characterized in that: During the calculation phase: If the quantum gate executed by the server is a P gate or a Toffoli gate, the server directly acts on the corresponding gate to the input quantum bit of the three types of quantum circuits, and then the server uses the gadget prepared in the preparation stage, Gadget test and Gadget CZ Eliminate errors in each quantum circuit; specifically, Gadget is used to implement the identity gate on the real computing circuit. test For implementation on test circuits Door, Gadget CZ Used to eliminate CNOT and CZ errors on real computing circuits and test circuits; if the quantum gate executed by the server is an H gate, then the H gate is implemented on the real computing circuit according to HPHPHPH=H, and the identity gate is implemented on the test circuit according to HIHIHIH=I, where the P gate and the identity gate are implemented through the corresponding gadgets Gadget and Gadget test Assisted implementation.

Images