Secure delegated quantum computing allows a computationally weak client to outsource an arbitrary quantum computation to an untrusted quantum server in a privacy-preserving manner. One of the promising candidates to achieve classical delegation of quantum computation is classical-client remote state preparation ($RSP_{CC}$), where a client remotely prepares a quantum state using a classical channel. However, the privacy loss incurred by employing $RSP_{CC}$ as a sub-module is unclear.
In this work, we investigate this question using the Constructive Cryptography framework by Maurer and Renner (ICS'11). We first identify the goal of $RSP_{CC}$ as the construction of ideal RSP resources from classical channels and then reveal the security limitations of using $RSP_{CC}$. First, we uncover a fundamental relationship between constructing ideal RSP resources (from classical channels) and the task of cloning quantum states. Any classically constructed ideal RSP resource must leak to the server the full classical description (possibly in an encoded form) of the generated quantum state, even if we target computational security only. As a consequence, we find that the realization of common RSP resources, without weakening their guarantees drastically, is impossible due to the no-cloning theorem. Second, the above result does not rule out that a specific $RSP_{CC}$ protocol can replace the quantum channel at least in some contexts, such as the Universal Blind Quantum Computing (UBQC) protocol of Broadbent et al. (FOCS '09). However, we show that the resulting UBQC protocol cannot maintain its proven composable security as soon as $RSP_{CC}$ is used as a subroutine. Third, we show that replacing the quantum channel of the above UBQC protocol by the $RSP_{CC}$ protocol QFactory of Cojocaru et al. (Asiacrypt '19), preserves the weaker, game-based, security of UBQC.
The engineering challenges involved in building large scale quantum computers, and the associated infrastructure requirements, mean that when such devices become available it is likely that this will be in limited numbers and in limited geographic locations. It is likely that many users will need to rely on remote access to delegate their computation to the available hardware. In such a scenario, the privacy and reliability of the delegated computations are important concerns. On the other hand, the distributed nature of modern computations has led to a widespread class of applications in whic…
Variational quantum algorithms (VQAs) are considered as one of the most promising candidates for achieving quantum advantages on quantum devices in the noisy intermediate-scale quantum (NISQ) era. They have been developed for numerous applications such as image processing and solving linear systems of equations. The application of VQAs can be greatly enlarged if users with limited quantum capabilities can run them on remote powerful quantum computers. But the private data of clients may be leaked to quantum servers in such a quantum cloud model. To solve the problem, a novel quantum homomorphi…
Blind quantum computing protocols enable a client, who can generate or measure single-qubit states, to delegate quantum computing to a remote quantum server protecting the client's privacy (i.e., input, output, and program). With current technologies, generations or measurements of single-qubit states are not too much burden for the client. In other words, secure delegated quantum computing is possible for "almost classical" clients. However, is it possible for a "completely classical" client? Here we consider a one-round perfectly-secure delegated quantum computing, and show that the protocol…
We define the functionality of delegated pseudo-secret random qubit generator (PSRQG), where a classical client can instruct the preparation of a sequence of random qubits at some distant party. Their classical description is (computationally) unknown to any other party (including the distant party preparing them) but known to the client. We emphasize the unique feature that no quantum communication is required to implement PSRQG. This enables classical clients to perform a class of quantum communication protocols with only a public classical channel with a quantum server. A key such example i…
A long-standing question is whether it is possible to delegate computational tasks securely. Recently, both a classical and a quantum solution to this problem were found. Here, we study the interplay of classical and quantum approaches and show how coherence can be used as a tool for secure delegated classical computation. We show that a client with limited computational capacity - restricted to an XOR gate - can perform universal classical computation by manipulating information carriers that may occupy superpositions of two states. Using single photonic qubits or coherent light, we experimen…
We present a quantumly-enhanced protocol to achieve unconditionally secure delegated classical computation where the client and the server have both limited classical and quantum computing capacity. We prove the same task cannot be achieved using only classical protocols. This extends the work of Anders and Browne on the computational power of correlations to a security setting. Concretely, we present how a client with access to a non-universal classical gate such as a parity gate could achieve unconditionally secure delegated universal classical computation by exploiting minimal quantum gadge…
Delegating difficult computations to remote large computation facilities, with appropriate security guarantees, is a possible solution for the ever-growing needs of personal computing power. For delegated computation protocols to be usable in a larger context---or simply to securely run two protocols in parallel---the security definitions need to be composable. Here, we define composable security for delegated quantum computation. We distinguish between protocols which provide only blindness---the computation is hidden from the server---and those that are also verifiable---the client can check…
We introduce a secure hardware device named a QEnclave that can secure the remote execution of quantum operations while only using classical controls. This device extends to quantum computing the classical concept of a secure enclave which isolates a computation from its environment to provide privacy and tamper-resistance. Remarkably, our QEnclave only performs single-qubit rotations, but can nevertheless be used to secure an arbitrary quantum computation even if the qubit source is controlled by an adversary. More precisely, attaching a QEnclave to a quantum computer, a remote client control…
Delegated quantum computing enables a client with weak computational power to delegate quantum computing to a remote quantum server in such a way that the integrity of the server can be efficiently verified by the client. Recently, a new model of delegated quantum computing has been proposed, namely, rational delegated quantum computing. In this model, after the client interacts with the server, the client pays a reward to the server. The rational server sends messages that maximize the expected value of the reward. It is known that the classical client can delegate universal quantum computing…
Blind delegation protocols allow a client to delegate a computation to a server so that the server learns nothing about the input to the computation apart from its size. For the specific case of quantum computation we know that blind delegation protocols can achieve information-theoretic security. In this paper we prove, provided certain complexity-theoretic conjectures are true, that the power of information-theoretically secure blind delegation protocols for quantum computation (ITS-BQC protocols) is in a number of ways constrained. In the first part of our paper we provide some indication t…
Private set intersection is an important problem with implications in many areas, ranging from remote diagnostics to private contact discovery. In this work, we consider the case of two-party PSI in the honest-but-curious setting. We propose a protocol that solves the server-aided PSI problem using delegated blind quantum computing. More specifically, the proposed protocol allows Alice and Bob (who do not have any quantum computational resources or quantum memory) to interact with Steve (who has a quantum computer) in order for Alice and Bob to obtain set intersection such that privacy is pres…
A quantum metrology scheme can be decomposed into three quantum tasks: state preparation, parameter encoding and measurements. Consequently, it is imperative to have access to the technologies which can execute the aforementioned tasks to fully implement a quantum metrology scheme. In the absence of one or more of these technologies, one can proceed by delegating the tasks to a third party. However, doing so has security ramifications: the third party can bias the result or leak information. In this article, we outline different scenarios where one or more tasks are delegated to an untrusted (…
Recently, major progress has been made towards the realisation of quantum internet to enable a broad range of classically intractable applications. These applications such as delegated quantum computation require running a secure identification protocol between a low-resource and a high-resource party to provide secure communication. In this work, we propose two identification protocols based on the emerging hardware secure solutions, the quantum Physical Unclonable Functions (qPUFs). The first protocol allows a low-resource party to prove its identity to a high-resource party and in the secon…
Verifiable blind quantum computing is a secure delegated quantum computing where a client with a limited quantum technology delegates her quantum computing to a server who has a universal quantum computer. The client's privacy is protected (blindness) and the correctness of the computation is verifiable by the client in spite of her limited quantum technology (verifiability). There are mainly two types of protocols for verifiable blind quantum computing: the protocol where the client has only to generate single-qubit states, and the protocol where the client needs only the ability of single-qu…
Quantum computers promise not only to outperform classical machines for certain important tasks, but also to preserve privacy of computation. For example, the blind quantum computing protocol enables secure delegated quantum computation, where a client can protect the privacy of their data and algorithms from a quantum server assigned to run the computation. However, this security comes at the expense of interaction: the client and server must communicate after each step of the computation. Homomorphic encryption, on the other hand, avoids this limitation. In this scenario, the server specifie…
It is an open problem whether a classical client can delegate quantum computing to an efficient remote quantum server in such a way that the correctness of quantum computing is somehow guaranteed. Several protocols for verifiable delegated quantum computing have been proposed, but the client is not completely free from any quantum technology: the client has to generate or measure single-qubit states. In this paper, we show that the client can be completely classical if the server is rational (i.e., economically motivated), following the "rational proofs" framework of Azar and Micali. More prec…
We introduce a protocol between a classical polynomial-time verifier and a quantum polynomial-time prover that allows the verifier to securely delegate to the prover the preparation of certain single-qubit quantum states. The protocol realizes the following functionality, with computational security: the verifier chooses one of the observables $Z$, $X$, $Y$, $(X+Y)/\sqrt{2}$, $(X-Y)/\sqrt{2}$; the prover receives a uniformly random eigenstate of the observable chosen by the verifier; the verifier receives a classical description of that state. The prover is unaware of which state he received a…
Homomorphic encryption is a form of encryption which allows computation to be carried out on the encrypted data without the need for decryption. The success of quantum approaches to related tasks in a delegated computation setting has raised the question of whether quantum mechanics may be used to achieve information theoretically secure fully homomorphic encryption. Here we show, via an information localisation argument, that deterministic fully homomorphic encryption necessarily incurs exponential overhead if perfect security is required.
Typically, the aim of quantum metrology is to sense target fields with high precision utilizing quantum properties. Unlike the typical aim, in this paper, we use quantum properties for adding a new functionality to quantum sensors. More concretely, we propose a delegated quantum sensor (a client-server model) with security inbuilt. Suppose that a client wants to measure some target fields with high precision, but he/she does not have any high-precision sensor. This leads the client to delegate the sensing to a remote server who possesses a high-precision sensor. The client gives the server ins…
Quantum computers, besides offering substantial computational speedups, are also expected to provide the possibility of preserving the privacy of a computation. Here we show the first such experimental demonstration of blind quantum computation where the input, computation, and output all remain unknown to the computer. We exploit the conceptual framework of measurement-based quantum computation that enables a client to delegate a computation to a quantum server. We demonstrate various blind delegated computations, including one- and two-qubit gates and the Deutsch and Grover algorithms. Remar…
The importance of being able to verify quantum computation delegated to remote servers increases with recent development of quantum technologies. In some of the proposed protocols for this task, a client delegates her quantum computation to non-communicating servers in multiple rounds of communication. In this work, we propose the first protocol where the client delegates her quantum computation to two servers in one-round of communication. Another advantage of our protocol is that it is conceptually simpler than previous protocols. The parameters of our protocol also make it possible to prove…
The recently proposed Universal Blind Quantum Computation (UBQC) protocol allows a client to perform an arbitrary quantum computation on a remote server such that perfect privacy is guaranteed if the client is capable of producing random separable single qubit states. While from a theoretical point of view, this arguably constitutes the lowest possible quantum requirement, from a pragmatic point of view, generation of random single qubits which can be sent along long distances without loss is quite challenging and can never be achieved perfectly. In analogy to the concept of approximate securi…
A delegation scheme allows a computationally weak client to use a server's resources to help it evaluate a complex circuit without leaking any information about the input (other than its length) to the server. In this paper, we consider delegation schemes for quantum circuits, where we try to minimize the quantum operations needed by the client. We construct a new scheme for delegating a large circuit family, which we call "C+P circuits". "C+P" circuits are the circuits composed of Toffoli gates and diagonal gates. Our scheme is non-interactive, requires very little quantum computation from th…
Future quantum computers are likely to be expensive and affordable outright by few, motivating client/server models for outsourced computation. However, the applications for quantum computing will often involve sensitive data, and the client would like to keep her data secret, both from eavesdroppers and the server itself. Homomorphic encryption is an approach for encrypted, outsourced quantum computation, where the client's data remains secret, even during execution of the computation. We present a scheme for the homomorphic encryption of arbitrary quantum states of light with no more than a …
Blind quantum computation (BQC) protocol allows a client having partial quantum ability to delegate his quantum computation to a remote quantum server without leaking any information about the input, the output and the intended computation to the server. Several BQC protocols have been proposed, e.g., Li et al. in [1] proposed a triple-server BQC protocol and Xu et al. in [2] proposed a single-server BQC protocol. Though both papers claimed that their protocols can satisfy the requirement of privacy, this paper points out a security loophole in their protocols. With that the server can reveal …
Verifiable blind quantum computing: Comparative analysis and design considerations for client architectures
QuTech, Delft University of Technology（代尔夫特理工大学 QuTech）；Kavli Institute of Nanoscience, Delft University of Technology（代尔夫特理工大学 卡弗里纳米科学研究所）；Quantum Computer Science, EEMCS, Delft University of Technology（代尔夫特理工大学 EEMCS 量子计算机科学）
Optimizing Resource Costs: A Practical Guide to Achieving Target Security in Verifiable Blind Quantum Computing
QuTech, Delft University of Technology（代尔夫特理工大学 QuTech）；Kavli Institute of Nanoscience, Delft University of Technology（代尔夫特理工大学 卡弗里纳米科学研究所）；Quantum Computer Science, EEMCS, Delft University of Technology（代尔夫特理工大学 EEMCS 量子计算机科学）
Measurement Device Independent Quantum Private Query (MDI QPQ) with qutrits is presented. We compare the database security and client's privacy in MDI QPQ for qubits with qutrits. For some instances, we observe that qutrit will provide better security for database than qubit. However, when it comes to the question of client's privacy we have to take additional measures in case of qutrit. Hence we conclude that though in case of Quantum Key Distribution (QKD) higher dimension provides better security but in case of QPQ this is not obvious.
Blind quantum computing [A. Broadbent, J. Fitzsimons, and E. Kashefi, Proceedings of the 50th Annual IEEE Symposium on Foundations of Computer Science 517 (2009)] is a secure cloud quantum computing protocol which enables a client (who does not have enough quantum technology at her disposal) to delegate her quantum computation to a server (who has a universal quantum computer) without leaking any relevant information to the server. In [T. Morimae and K. Fujii, Phys. Rev. A {\bf87}, 050301(R) (2013)], a new blind quantum computing protocol, so called the measuring-Alice protocol, was proposed. …
With the development of delegated quantum computation, clients will want to ensure confidentiality of their data and algorithms, and the integrity of their computations. While protocols for blind and verifiable quantum computation exist, they suffer from high overheads and from over-sensitivity: When running on noisy devices, imperfections trigger the same detection mechanisms as malicious attacks, resulting in perpetually aborted computations. We introduce the first blind and verifiable protocol for delegating BQP computations to a powerful server with repetition as the only overhead. It is c…
In the standard oracle model, an oracle efficiently evaluates an unknown classical function independent of the quantum algorithm itself. Quantum algorithms have a complex interrelationship to their oracles; for example the possibility of quantum speedup is affected by the manner by which oracles are implemented. Therefore, it is physically meaningful to separate oracles from their quantum algorithms, and we introduce one such separation here. We define the Blind Oracular Quantum Computation (BOQC) scheme, in which the oracle is a distinct node in a quantum network. Our work augments the client…
Variational quantum algorithms (VQAs) have been considered to be useful applications of noisy intermediate-scale quantum (NISQ) devices. Typically, in the VQAs, a parametrized ansatz circuit is used to generate a trial wave function, and the parameters are optimized to minimize a cost function. On the other hand, blind quantum computing (BQC) has been studied in order to provide the quantum algorithm with security by using cloud networks. A client with a limited ability to perform quantum operations hopes to have access to a quantum computer of a server, and BQC allows the client to use the se…
