1 Introduction

Secure multi-party computation (SMC) [1,2,3] enables three or more clients to evaluate the function without disclosing any private information about their privacy information. Since it was proposed by Yao [25], SMC had attracted wide attention from the scholars, which was used in numerous scenarios such as information-sharing [19, 20] and privacy preserving [4, 5].

Private set intersection (PSI) [9, 21], a typical application of information-sharing, enables two parties with privates sets to participate in calculation of the intersection without revealing any private inputs information. however, in some higher privacy-preserving scenarios, such as in medical systems and social networks, private set intersection reveals too much private personal information which may be exposed in part or in whole. In this case, Private Set Intersection Cardinality (PSI-CA) [6, 7] was introduced, which can meet the requirements on prevention of revealing the specific content, and make the outputting be the cardinality. In addition, in network circumstances, PSI-CA has huge practical application value in safeguarding users’s privacy [22]. For example, in social networks, users can privately calculate the common hobbies and interesting by using the PSI-CA protocol, so that they can determine whether to become good friends or not [15]. In this situation, they use the elements of private sets on behalf of the hobbies and interesting. What’s more, users can also privately calculate the distance of two physically independent parties. i.e. the Hamming distance which was proposed in literature [23]. Furthermore, there are other applications, such as anonymous authentication [8], location privacy [26], and privacy-preserving data mining [24] etc.

Due to the extensive and important application, there were some secure private set intersection cardinality protocols had been proposed [11,12,13]. In these existed protocols, most of them are classical cryptography. However, the increasing capability of quantum computing or algorithms has posed huge challenge to the security of these classical PSI-CA protocols which depend on some unconfirmed arduous hypothesis [14]. It means that if there were not strict constraint condition, it is impossible for two-party computations to fulfill the unconditional security e.g., a large integer factoring problem, which can be easily got over by fast quantum algorithms [14]. In addition, with the advent of quantum computer, these classical PSI-CA protocols are vulnerable to attack by quantum computers. Therefore, quantum cryptography which is the combination of quantum computer and cryptography is draw attention to the scholars. For instance, quantum sealed auction protocol [27], quantum anonymous voting protocol [28], quantum signature [29] and identity-based quantum signature [30].

The quantum protocols of PSI-CA [7, 8, 10] with unconditional security was also proposed. Compared with classical cryptography, the most important advantage of quantum cryptography is that an eavesdropper can easily be identified by using the characteristics of quantum mechanics. To the best of our knowledge, these proposed quantum PSI-CA protocols are all about two-party computation [8,9,10]. In order to solve the data sharing among multi-party, we, based on the ideas of quantum PSI-CA [8] and quantum counting [16, 17], presented an unconditionally quantum secure multi-party set intersection cardinality (QSMS-IC) protocol, which is extended two parties to multi-party. Unlike the existed protocols, our proposed QSMS-IC protocols has two clear advantages: for classical protocols it has higher security, and for existed quantum protocols, it is a real multi-party protocol, has wider applications and more practical.

In this paper, we present a practical and feasible quantum secure multi-party set intersection cardinality protocol, which can privately compute the intersection cardinality. The organization of the paper is following, the second section is the basic knowledge about quantum and the definition of QSMS-IC. We present a quantum secure multi-party set intersection cardinality protocol in Section 3. In addition, the security analysis and correctness are shown in Section 4. Finally, in Section 5, we give the conclusion of the paper.

2 Preliminaries

2.1 Quantum Computing

Quantum computing [17], a theory of physics, can also be used in computer science. In this section we give the basics of quantum computing that we will use.

2.1.1 Quantum Bits

Quantum bit is just like the classical bit, 0 or 1 in classical computation are corresponding to the states |0〉 and |1〉 in quantum, and |0〉 and |1〉 are two orthogonal unit vectors in 2-dimensional Hilbert space, these two states form a perfect complete orthogonal basis, which is also called computational basis. The qubits also is a linear combination state, namely superpositions:

$$ |{\Psi}\rangle={\alpha}|0\rangle+{\beta}|1\rangle $$
(1)

Here, α,β are complex numbers, and |α2〉 + |β2〉 = 1. Similarly, multiple qubits can be expressed, such as n-qubit can be in any superposition of the 2n basis states

$$ \begin{array}{@{}rcl@{}} |{\Psi}\rangle&=&{\alpha}_{0}|00...00\rangle+{\alpha}_{1}|00...01\rangle+\dots\\ &&+{\alpha}_(2^{n}-1)|11...11\rangle \end{array} $$
(2)

where \({\sum }_{i=0}^{2^{n}-1}|{\alpha }_{i}|^{2}=1,|00...00\rangle ,|00...01\rangle ,\dots ,|11...11\rangle \) are a perfect orthogonal basis in n-dimensional Hilbert space.

2.1.2 Quantum Measurement

The measurement will use Hermitian operator, \(M={\sum }_{m}mP_{m}\), Pm is the projector onto the eigenspace of M with eigenvalue m. After measurement, we will get the state \(\frac {p_{m}|{\Psi }\rangle }{\sqrt {p(m)}}\) with probability p(m) = 〈Ψ|Pm|Ψ〉.

For instance, in 2-dimensional Hilbert space p0 = |0〉〈0| and p1 = |1〉〈1| are sets of projector operators

$$ \begin{array}{@{}rcl@{}} P_{0}|{\Psi}\rangle&=&|0\rangle\langle0|(\alpha|0\rangle+\beta|1\rangle)\\ &=&\alpha|0\rangle\langle0|0\rangle+\beta|0\rangle\langle0|1\rangle\\ &=&\alpha|0\rangle \end{array} $$
(3)
$$ \begin{array}{@{}rcl@{}} P_{1}|{\Psi}\rangle&=&|1\rangle\langle1|(\alpha|0\rangle+\beta|1\rangle)\\ &=&\alpha|1\rangle\langle1|0\rangle+\beta|1\rangle\langle1|1\rangle\\ &=&\beta|1\rangle \end{array} $$
(4)
$$ \begin{array}{@{}rcl@{}} p(0)&=&\langle{\Psi}|P_{0}|{\Psi}\rangle\\ &=&({\alpha}^{*}\langle0|+{\beta}^{*}\langle1|)P_{0}(\alpha|0\rangle+\beta|1\rangle)\\ &=&({\alpha}^{*}\langle0|+{\beta}^{*}\langle1|)\alpha|0\rangle\\ &=&{|\alpha|}^{2} \end{array} $$
(5)
$$ \begin{array}{@{}rcl@{}} p(1)&=&\langle{\Psi}|P_{1}|{\Psi}>\\ &=&({\alpha}^{*}\langle0|+{\beta}^{*}\langle1|)P_{1}(\alpha|0\rangle)+\beta|1\rangle)\\ &=&({\alpha}^{*}\langle0|+{\beta}^{*}\langle1|)\beta|1\rangle\\ &=&{|\beta|}^{2} \end{array} $$
(6)

So when making measurement on |Ψ〉 = α|0〉 + β|1〉, |Ψ〉 will be collapsed into the state |0〉 with probabilities |α|2 and state |1〉 with probabilities |β|2

Similarly, when measuring \({\alpha }_{0}|0\rangle +{\alpha }_{1}|1\rangle +\dots +{\alpha }_{2^{n}-1} |2^{n}-1\rangle \) in computational basis \(\{|0\rangle ,|1\rangle ,|2\rangle ,\dots ,|2^{n}-1\rangle \}\) we will get |i〉 with probability \({|\alpha _{i}|}^{2}\).

2.1.3 Quantum Transformation

In quantum mechanics, unitary transformation is used to describe the evolution of a closed system, |Ψ〉 = U|ϕ〉, (|ϕ〉 is the input state, U|ϕ〉 is the output state, |Ψ〉 is the final state that is using unitary transformation U, and U+U = I, I is the identity operator, U+ is the conjugate transpose of U. NOT gate is the simplest one-qubit quantum logical gate, it maps |0〉 to |1〉 and |1〉 to |0〉. The Hadamard gate is another one-qubit quantum logical gate, it is following,

$$ \begin{array}{@{}rcl@{}} H|0\rangle&=&\frac{1}{\sqrt{2}}{(|0\rangle+|1\rangle)}\\ H|1\rangle&=&\frac{1}{\sqrt{2}}{(|0\rangle-|1\rangle)} \end{array} $$
(7)

CNOT gate is multi-qubit quantum logic gate, CNOT gate: |00〉→|00〉, |01〉→|01〉, |10〉→|11〉 and |11〉→|10〉, the first qubit in CNOT gate is called control qubit, and the second qubit is called target qubit. In this regard, if the control qubit is 0, the target qubit remain unchanged, if the control qubit is 1, then the target qubit need change.

Besides, we also need to use the quantum Fourier transform which is the standard discrete Fourier transform. For \(x\in \{0,1,\dots M-1\}\), the definition of quantum Fourier transform and the inverse quantum Fourier transform is shown as follows [9]:

$$ QFT:|x\rangle\to\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}e^{2\pi{i}\frac{x}{M}y}|y\rangle $$
(8)
$$ QFT^{-1}:|x\rangle\to\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}e^{-2\pi{i}\frac{x}{M}y}|y\rangle $$
(9)
$$ \begin{array}{@{}rcl@{}} QFT^{-1}(QFT|x\rangle)&=&QFT^{-1}\left( \frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}e^{2\pi{i}\frac{x}{M}y}|y\rangle\right)\\ &=&\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}e^{2\pi{i}\frac{x}{M}y}QFT^{-1}|y\rangle\\ &=&\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}e^{2\pi{i}\frac{x}{M}y}\left( \frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}\right.\\ \end{array} $$
$$ \begin{array}{@{}rcl@{}} && \left. e^{-2\pi{i}\frac{x}{M}j}|j\rangle\right)\\ &=&\frac{1}{\sqrt{M}}\sum\limits_{j=0}^{M-1}\sum\limits_{y=0}^{M-1}e^{2\pi{i}\frac{x}{M}(x-j)}|j\rangle\\ &=&\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}|x>+\frac{1}{\sqrt{M}}\sum\limits_{j=0:j\ne}^{M-1}\\ &&\left( {\sum}_{y=0}^{M-1}e^{2\pi{i}\frac{x}{M}(x-j)}|j\rangle\right)\\ &=&|x\rangle \end{array} $$
(10)

2.1.4 Quantum Parallelism

Quantum parallelism allows quantum computers to perform multiple computations simultaneously. In classical computer, parallel computing means that there are some processors that do the different computation simultaneously. In quantum compute, multiple computations are realized by the superposition of multiple states with a single quantum processor. It means that a quantum computer has more computation ability than a classical computer.

For example, If there is a 2-qubit quantum circuit, then we can make a quantum transformation Uf on it, Uf is following:

$$ U_{f}:|x\rangle|y\rangle\to|x\rangle|y\oplus{f(x)}\rangle $$
(11)

f(x) : {0,1}→{0,1} is a function, ⊕ is the operator of module 2. When y = 0, the second qubit is just the value f(x). It means Uf : |x〉|0〉→|x〉|f(x)〉, Furthermore, when \(|x\rangle =\frac {|0\rangle +|1\rangle }{\sqrt {2}}\), then

$$ \begin{array}{@{}rcl@{}} U_{f}\frac{|0\rangle+|1\rangle}{\sqrt{2}}|0\rangle&=&U_{f}\frac{|0\rangle|0\rangle+|1\rangle|0\rangle}{\sqrt{2}}\\ &=&\frac{U_{f}|0\rangle|0\rangle+U_{f}|1\rangle|0\rangle}{\sqrt{2}}\\ &=&\frac{|0\rangle{f(0)}+|1\rangle{f(1)}}{\sqrt{2}} \end{array} $$
(12)

Uf computes f(0) and f(1) simultaneously. It can generalize a more general function, f(x) : {0,1}n →{0,1}, such that Uf|x〉|y〉 = |x〉|y ⊕ f(x)〉, the qubit lengths of |x〉 and |y〉are n and 1, respectively. Similarly, consider |x〉 = H⊗n and |y〉 = |0〉. Then

$$ \begin{array}{@{}rcl@{}} U_{f}|x\rangle|0\rangle&=&U_{f}H^{\otimes{n}}|0\rangle^{\otimes{n}}|0\rangle\\ &=&U_{f}\left[\frac{|0\rangle+|1\rangle}{\sqrt{2}}\right]^{\otimes{n}}|0\rangle\\ &=&U_{f}\left( \frac{1}{\sqrt{2^{n}}}\sum\limits_{i=0}^{2^{n-1}}|j\rangle\right)|0\rangle\\ &=&\frac{1}{\sqrt{2^{n}}}\sum\limits_{i=0}^{2^{n-1}}|i\rangle|f(i)\rangle \end{array} $$
(13)

So we know that the quantum transformation Uf can computes f(i) for all values of i simultaneously by (13).

2.2 quantum Secure Multi-Party Set Intersection Cardinality

Here, we give the definition of quantum secure multi-party set intersection cardinality (QSMS-IC).

Definition 1. QSMS-IC, there are n − 1 clients \(U_{i},i=2,\dots ,n\) with the input are private set \(A_{i},(i=2,3,\dots ,n)\) and a server U1 with the set \(A_{1}=\{1,\dots ,1\}\). After running QSMS-IC protocol, the clients Ui can get nothing except the cardinality of the intersection \(|A_{1}\cap {A_{2}}\cap \dots \cap {A_{n}}|\). In addition, QSMS-IC should meet the following privacy requirements:

Clients Ui privacy: The clients Ui learn no information about the sets of other clients except about the set size |Ai|.

Fairness: All the clients Ui are peer entities, and no one can get the private information by deceiving from the others. Finally, all the clients get the result of cardinality with equal chance.

3 Quantum Secure multi-party Set Intersection Cardinality

3.1 System Model

Based on the quantum parallelism, quantum PSI-CA [7, 8] and Grovers search algorithm [18], we proposed a new QSMS-IC protocol. First we assume that the system model has n entities which are one server and n − 1 clients, and the private set \(A_{i}=\{{a_{1}^{i}},{a_{2}^{i}},\dots ,a_{n_{c}}^{i}\}\) the elements in Ai lie in ZN, where \(Z_{N}=\{0,1,2,\dots ,N-1\},N=2^{n}\) (i.e.n = logN,). Moreover, assume that \({\sum }_{i=1}^{n}n_{c_{i}}<\frac {N}{2}\), N and \(n_{c_{i}}\) are public. Figure 1 is the system model of QSMS-IC protocol.

Fig. 1
figure 1

System model

Full size image

As shown in Fig. 1, there are n − 1 clients and a server. In the protocol, we suppose all the clients and server are semi-honest: they are curious with the privacy of others, but are honest to carry out the operations of the scheme.

3.2 Operation Steps

The protocol consists nine steps as follows(also show in Fig. 2).

Step1.:

The server U1 initializes the state |φ0〉 in |0〉⊗n, then applies H⊗n to |φ0〉, and gets the state |φ1〉, \(|\varphi _{1}\rangle =H^{\otimes {n}}|0\rangle ^{\otimes {n}}=\frac {1}{\sqrt {N}}{\sum }_{i=1}^{N-1}|x\rangle \).

Step2.:

Then the server U1 gives an ancillary state |r〉, r is a random number in set {0,1}, and does a transformation \(U_{f_{s}}\) on |φ1〉⊗|r〉, \(U_{f_{s}}\) is defined as follows:

$$ f_{A_{1}}(x)= \left\{\begin{array}{ll} 1&if{x\in{A_{1}}}\\ 0&if{x\notin{A_{1}}} \end{array}\right. $$
(14)
$$ U_{f_{s}}:\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|r\rangle\to\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|r\oplus{f_{A_{1}}(x)}\rangle $$
(15)
Fig. 2
figure 2

Sequence diagram

Full size image

Let \(|\varphi _{2}\rangle =\frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |r\oplus {f_{A_{1}}(x)}\rangle \). ⊕ is the operator of module 2. Then, we do the same transformation \(U_{f_{s}}\) on |φ2〉⊗|1〉, as follow:

$$ U_{f_{s}}:|\varphi_{2}\rangle|1\rangle\to\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|r\oplus{f_{A_{1}}(x)}\oplus{1}\rangle\\ $$
(16)

Let \(|\varphi _{2}^{\prime }\rangle =\frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |r\oplus {f_{A_{1}}(x)}\oplus {1}\rangle \). Then the server U1 sends |φ2〉, \(|\varphi _{2}^{\prime }\rangle \) to the client U2 through the quantum channel.

Step3.:

When the client U2 received the state |φ2〉, \(|\varphi _{2}^{\prime }\rangle \), then the client U2 will do another transformation \(U_{f_{c}}\) on state |φ2〉, the transformation \(U_{f_{c}}\)is defined as follow:

$$ f_{A_{2}}(x)= \left\{\begin{array}{ll} 1&if{x\in{A_{2}}}\\ 0&if{x\notin{A_{2}}} \end{array}\right. $$
(17)
$$ U_{f_{c}}:\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|r\otimes{f_{A_{1}}}(x)\rangle|f_{A_{2}}(x)\rangle\to\\ \frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|(r\oplus{f_{A_{1}}(x)})\times{f_{A_{2}}(x)}\rangle\\ $$
(18)

Here, Let \(|\varphi _{3}\rangle =\frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |(r\oplus {f_{A_{1}}(x)})\times {f_{A_{2}}(x)}\rangle ,\times \) is an operator that is logical multiplication. Then does the transformation \(U_{f_{c}}\) on \(|\varphi _{2}^{\prime }\rangle \) as follow:

$$ f_{A_{2}}(x)= \left\{\begin{array}{ll} 1&if{x\in{A_{2}}}\\ 0&if{x\notin{A_{2}}} \end{array}\right. $$
$$ \begin{array}{@{}rcl@{}} U_{f_{c}}:|\varphi_{2}^{\prime}\rangle|f_{A_{2}}(x)\rangle\to\\ \frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|(r\oplus{f_{A_{1}}(x)}\oplus1)\times{f_{A_{2}}(x)}\rangle \end{array} $$
(19)

Let \(|\varphi _{3}^{\prime }\rangle =\frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |(r\oplus {f_{A_{1}}(x)}\oplus 1)\times {f_{A_{2}}(x)}\rangle \). Then client U2 sends |φ3〉, \(|\varphi _{3}^{\prime }\rangle \) to the client U3 through the quantum channe2.

Step4.:

After client U3 receives \(|\varphi _{3}\rangle ,|\varphi _{3}^{\prime }\rangle \), the client U3 does the same transformation \(U_{f_{c}}\) on state |φ3〉. then we get the result:

$$ U_{f_{c}}(\varphi_{3}):\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|(r\oplus{f_{A_{1}}(x)})\times{f_{A_{2}}(x)}\times{f_{A_{3}}(x)}\rangle\\ $$
(20)

Here, we use state \(U_{f_{c}}(|\varphi _{3}\rangle )\) to expressed the results. Then the client U3 does \(U_{f_{c}}\) transformation on \(|\varphi _{3}^{\prime }\rangle \). The result is \(U_{f_{c}}(|\varphi _{3}^{\prime }\rangle )=\frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |(r\oplus {f_{A_{1}}(x)}\oplus 1) \times {f_{A_{2}}(x)}\times {f_{A_{3}}(x)}\rangle \)

Then send \(U_{f_{c}}(|\varphi _{3}\rangle )\), \(U_{f_{c}}(|\varphi _{3}^{\prime }\rangle )\) to the client U4 through the quantum channe3, after the client U4 receives \(U_{f_{c}}(|\varphi _{3}\rangle )\), \(U_{f_{c}}(|\varphi _{3}^{\prime }\rangle )\), and does \(U_{f_{c}}\) transformation on \(U_{f_{c}}(|\varphi _{3}\rangle )\), \(U_{f_{c}}(|\varphi _{3}^{\prime }\rangle )\) respectively, then send the results to the next client and until the last client Un, the last client Un does \(U_{f_{c}}\) transformation respectively, uses |φ〉, \(|\varphi ^{\prime }\rangle \) as the last results which will be sent to the server U1.

Step5::

when the server U1 receives the state |φ〉, it will do the transformation \(U_{f_{s}}\) on |φ〉×|r〉.

$$ \begin{array}{@{}rcl@{}} U_{f_{s}}(\varphi)&=&\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|(r\oplus{f_{A_{1}}(x)})\\ &&\times{f_{A_{2}}(x)} \times{\dots} \times{f_{A_{n}}(x)}\oplus{r}\rangle \end{array} $$
(21)

Then does \(U_{f_{c}}\) on state \(U_{f_{s}}(|\varphi \rangle )\)

$$ \begin{array}{@{}rcl@{}} U_{f_{c}}(U_{f_{s}}(\varphi))=\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle|[(r\oplus{f_{A_{1}}(x)})\\ \times{f_{A_{2}}(x)} \times\dots \times{f_{A_{n}}(x)}\oplus{r}]\times{f_{A_{1}}(x)}\rangle \end{array} $$
(22)

Let \(|\varphi _{4}\rangle =\frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |[(r\oplus {f_{A_{1}}(x)})\times {f_{A_{2}}(x)} \times \dots \times {f_{A_{n}}(x)}\oplus {r}]\times {f_{A_{1}}(x)}\rangle \) When the server U1 receives the state \(|\varphi ^{\prime }\rangle \), it will do two \(U_{f_{s}}\) transformation on \(|\varphi ^{\prime }\rangle \)

$$ \begin{array}{@{}rcl@{}} U_{f_{s}}(|\varphi^{\prime}\rangle\oplus|r\rangle)&=&\frac{1}{\sqrt{N}}{\sum}_{x=0}^{N-1}|x\rangle |(r\oplus{f_{A_{1}}(x)}\oplus1)\\ &&\times{f_{A_{2}}(x)} \times\dots \times{f_{A_{n}}(x)}\oplus{r}\rangle \end{array} $$
(23)
$$ \begin{array}{@{}rcl@{}} &&U_{f_{s}}\\ &=& \frac{1}{\sqrt{N}}{\sum}_{x=0}^{N-1}|x\rangle |(r\oplus{f_{A_{1}}(x)}\oplus1)\times{f_{A_{2}}(x)} \times\dots\\ &&\times{f_{A_{n}}(x)}\oplus{r}\oplus{f_{A_{1}}(x)}\rangle \end{array} $$
(24)

Let\(|\varphi _{4}^{\prime }\rangle =\frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |(r\oplus {f_{A_{1}}(x)}\oplus 1)\times {f_{A_{2}}(x)} \times \dots \times {f_{A_{n}}(x)}\oplus {r}\oplus {f_{A_{1}}(x)}\rangle \).

Step6::

Then the server U1 does Uf transformation on \(|\varphi _{4}^{\prime }\rangle \) and |φ4〉. Then get

$$ \begin{array}{@{}rcl@{}} |\varphi_{5}\rangle&=& \frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle |[(r\oplus{f_{A_{1}}(x)})\times{f_{A_{2}}(x)} \times\dots\\ &&\times{f_{A_{n}}(x)}\oplus{r}\oplus{f_{A_{1}}(x)}]\times\sim\rangle \end{array} $$
(25)

where \(\sim = |[(r\oplus {f_{A_{1}}(x)}\oplus 1)\times {f_{A_{2}}(x)} \times {\dots } \times {f_{A_{n}}(x)}\oplus {r}\oplus {f_{A_{1}}(x)}]\rangle \), and \(|[(r\oplus {f_{A_{1}}(x)})\times {f_{A_{2}}(x)} \times {\dots } \times {f_{A_{n}}(x)}\oplus {r}\oplus {f_{A_{1}}(x)}]\times \sim \rangle \) contains the classical information about the cardinality of their intersection.

Step7::

The state |φ5〉 carried the cardinality of their intersection, so we should extract the intersection cardinality from |φ5〉, the server U1 prepares quantum state \(\frac {1}{\sqrt {M}}{\sum }_{y=0}^{M-1}|y\rangle \), M is a big integer, so the value of \(\frac {2\pi }{\sqrt {t(N-t)}}+\frac {\pi ^{2}}{M^{2}}|N-2t|\) is very small (t is defined in Step8). Let \(|\varphi _{6}\rangle =\frac {1}{\sqrt {M}}{\sum }_{y=0}^{M-1}|y\rangle \otimes |\varphi _{5}\rangle \). Then, the server U1 does a quantum operator CF on |φ6〉, the result is state |φ7〉, CF is the following:

$$ C_{F}:|\varphi_{6}\rangle\to|\varphi_{7}\rangle $$
$$ C_{F}:\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}|y\rangle\otimes|\varphi_{5}\rangle\to \frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}|y\rangle\otimes{G^{y}}|\varphi_{5}\rangle $$
(26)
$$ \begin{array}{@{}rcl@{}} &&|\varphi_{7}\rangle= \frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}|y\rangle\otimes{G^{y}}|\varphi_{6}\rangle= \frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}|y\rangle\otimes{G^{y}}\\ &&\frac{1}{\sqrt{N}}\sum\limits_{x=0}^{N-1}|x\rangle |[(r\oplus{f_{A_{1}}(x)})\times{f_{A_{2}}(x)} \times\dots \times{f_{A_{n}}(x)}\\ &&\oplus{r}\oplus{f_{A_{1}}(x)}]\times\sim\rangle \end{array} $$
(27)

G is defined by \(G=U_{\varphi _{6}}U_{f_{r}}\), G is an operator of amplitude amplification .

$$ U_{f_{r}}|x\rangle|r\rangle= \left\{\begin{array}{ll} -|x\rangle|1\rangle&if {r=1}\\ |x\rangle|0\rangle&if {r=0} \end{array}\right. $$
(28)
$$ U_{\varphi_{6}}=2|\varphi_{6}\rangle\langle\varphi_{6}|-I $$
(29)

I is the identity operator.

Step8::

The server U1 does QFT− 1 on the first logM qubits of |φ7〉 and then measures the first logM qubits to obtain |x〉, and outputs \(Nsin^{2}(\frac {x}{M}\pi )\) as the estimation of t, t is the number of the items that the last one qubit of |φ6〉 is in |1〉, for example, just like |x〉|1〉 in |φ6〉. If \(t<\frac {N}{2}\), then server U1 outputs \(\frac {{\sum }_{i=1}^{n}n_{c_{i}}-t}{2}\), means, \(|A_{1}\cap {A_{2}}\cap \dots \cap {A_{n}}|=\frac {{\sum }_{i=1}^{n}n_{c_{i}}-t}{2}\); otherwise \(\frac {(n_{c}+n_{s}+t)-N}{2}\), means, \(|A_{1}\cap {A_{2}}\cap \dots \cap {A_{n}}|=\frac {(n_{c}+n_{s}+t)-N}{2}\).

Step9::

The server sends the result t to all the clients.

If we want to whether someone is intercepting in the channel, the bait technology can be used. That is, when qubit sequence are transmitted, the sender randomly inserts some bait particles which is prepared randomly with either Z-basis (i.e.,{|0〉,|1〉} or X-basis (i.e.,\(\{\frac {1}{\sqrt 2}+|1\rangle ,\frac {1}{\sqrt 2}-|1\rangle \}\). When the receiver received the sequence, the sender would public the bait particles positions and the measurement basis. Then the receiver’s measures the bait particles accord to the public and tells his measurement results to the sender. The sender compares the receiver results with the bait particles of the initial and then analyzes it. If the error is too much according to the channel noise, then drop the protocol and restart transmitting. Otherwise, it will continue to proceed next step.

4 Analysis

Let’s proof the correctness. Based on the state \(|\varphi _{5}\rangle = \frac {1}{\sqrt {N}}{\sum }_{x=0}^{N-1}|x\rangle |[(r\oplus {f_{A_{1}}(x)})\times {f_{A_{2}}(x)} \times \dots \times {f_{A_{n}}(x)}\oplus {r}\times {f_{A_{1}}(x)}]\times \sim \rangle \), \([(r\oplus {f_{A_{1}}(x)})\times {f_{A_{2}}(x)} \times \dots \times {f_{A_{n}}(x)}\oplus {r}\times {f_{A_{1}}(x)}]\times \sim \) is 0 or 1, so we define

$$ |\alpha\rangle=\frac{1}{\sqrt{t}}|x\rangle|1\rangle $$
(30)
$$ |\beta\rangle=\frac{1}{\sqrt{t}}|x\rangle|0\rangle $$
(31)

Then we know that the state |φ5〉 can be re-expressed by (32)

$$ |\varphi_{5}\rangle=\sqrt{\frac{N-t}{N}}|\beta\rangle+\sqrt{\frac{t}{N}}|\alpha\rangle $$
(32)

Equation (32) means that |φ5〉 is the uniform superposition of all product states, |α〉 is the uniform superposition of these product states satisfying \([(r\oplus {f_{A_{1}}(x)})\times {f_{A_{2}}(x)} \times {\dots } \times {f_{A_{n}}(x)}\oplus {r}\times {f_{A_{1}}(x)}]\times \sim =1\) and β is opposite of α, means \([(r\oplus {f_{A_{1}}(x)})\times {f_{A_{2}}(x)} \times {\dots } \times {f_{A_{n}}(x)}\oplus {r}\times {f_{A_{1}}(x)}]\times \sim =0\). Obviously, α ⊥ β. if we choose \(\theta \in (0,\frac {\pi }{2})\), \(sin^{2}\theta =\frac {t}{N}\). then \(sin\theta =\sqrt {\frac {t}{N}}\), \(cos\theta =\sqrt {\frac {N-t}{N}}\), and thus |φ4〉 = cos|β〉 + sin|α〉. Then , we can get the following equations:

$$ \begin{array}{@{}rcl@{}} G|\beta\rangle&=&U_{\varphi_{6}}U_{f_{r}}|\beta\rangle=U_{\varphi_{6}}|\beta|\rangle\\ &=&(2|\varphi_{6}\rangle\langle\varphi_{6}|-I)|\beta\rangle\\ &=&2|\varphi_{6}\rangle\langle\varphi_{6}|\beta\rangle-|\beta\rangle\\ &=&2cos\theta|\varphi_{6}\rangle-|\beta\rangle\\ &=&2cos\theta(cos\theta|\beta\rangle+sin\theta|\alpha\rangle)-|\beta\rangle\\ &=&(2cos^{2}\theta-1)|\beta\rangle+2sin\theta{cos\theta}|\alpha\rangle\\ &=&cos2\theta|\beta\rangle+sin2\theta|\alpha\rangle \end{array} $$
(33)
$$ \begin{array}{@{}rcl@{}} G|\alpha\rangle&=&U_{\varphi_{6}}U_{f_{r}}|\alpha\rangle=U_{\varphi_{6}}(-|\alpha|\rangle)\\ &=&(2|\varphi_{6}\rangle\langle\varphi_{6}|-I)(-|\alpha\rangle)\\ &=&2|\varphi_{6}\rangle\langle\varphi_{6}|\alpha\rangle+|\alpha\rangle\\ &=&-2sin\theta|\varphi_{6}\rangle+|\alpha\rangle\\ &=&-2sin\theta(cos\theta|\beta\rangle+sin\theta|\alpha\rangle)+|\alpha\rangle\\ &=&-2sin\theta{cos\theta}|\beta\rangle+(1-2sin^{2}\theta)|\alpha\rangle\\ &=&-sin2\theta|\beta\rangle+cos2\theta|\alpha\rangle \end{array} $$
(34)

In the two-dimensional subspace, G is a rotation operator of angle 2𝜃 oriented from |β〉 to |α〉 spanned by |α〉 and |β〉. From |φ6〉, apply G and rotate it toward |α〉 by 2𝜃. Reapply G and rotate it close to |α〉. Moreover, there are two orthogonal states defined in the following:

$$ |\phi_{+}\rangle=\frac{1}{\sqrt2}(|\beta\rangle-i|\alpha\rangle) $$
(35)
$$ |\phi_{-}\rangle=\frac{1}{\sqrt2}(|\beta\rangle+i|\alpha\rangle) $$
(36)
$$ \begin{array}{@{}rcl@{}} G|\phi_{+}\rangle&=&\frac{1}{\sqrt2}(G|\beta\rangle-iG|\alpha\rangle)\\ &=&\frac{1}{\sqrt2}(cos2\theta|\beta\rangle+sin2\theta|\alpha\rangle\\ &&+ isin2\theta|\beta-icos2\theta|\alpha\rangle) (by(33 and 34 ))\\ &=&\frac{e^{i2\theta}}{\sqrt2}(|\beta\rangle-i|\alpha\rangle) (by (e^{i2\theta}=cos2\theta+isin2\theta))\\ &=&e^{i2\theta}|\phi_{+}\rangle \end{array} $$
(37)
$$ \begin{array}{@{}rcl@{}} G|\phi_{-}\rangle&=&\frac{1}{\sqrt2}(G|\beta\rangle+iG|\alpha\rangle)\\ &=&\frac{1}{\sqrt2}(cos2\theta|\beta\rangle+sin2\theta|\alpha\rangle\\ &&- isin2\theta|\beta+icos2\theta|\alpha\rangle)(by 26 and 27)\\ &=&\frac{e^{-i2\theta}}{\sqrt2}(|\beta\rangle+i|\alpha\rangle) (by (e^{-i2\theta}=cos2\theta-isin2\theta))\\ &=&e^{-i2\theta}|\phi_{-}\rangle \end{array} $$
(38)

|ϕ+〉 and |ϕ−〉 are eigenvectors of G, ei2𝜃and e−i2𝜃 are eigenvalues, respectively. Let 𝜃 = πω, then \(|\varphi _{6}\rangle =cos|\beta \rangle +sin|\alpha \rangle = \frac {e^{i\pi \omega }}{\sqrt 2}|\phi _{+}\rangle +\frac {e^{-i\pi \omega }}{\sqrt 2}|\phi _{-}\rangle \).If we apply G rotation operator to |φ6 for y times, then

$$ G^{y}|\varphi_{6}\rangle=\frac{e^{i\pi(2y+1)\omega}}{\sqrt2}|\phi_{+}\rangle+\frac{e^{-i\pi(2y+1)\omega}}{\sqrt2}|\phi_{-}\rangle $$
(39)

Then, we can get

$$ \begin{array}{@{}rcl@{}} |\varphi_{8}\rangle&=&\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}|y\rangle\otimes{G^{y}}|\varphi_{5}\rangle\\ &=&\frac{1}{\sqrt{M}}\sum\limits_{y=0}^{M-1}[|y\rangle\otimes(\frac{e^{i\pi(2y+1)\omega}}{\sqrt2} |\phi_{+}\rangle+\frac{e^{-i\pi(2y+1)\omega}}{\sqrt2}|\phi_{-}\rangle)]\\ &=&\frac{e^{i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}\omega}|y\rangle|\phi_{+}\rangle+ \frac{e^{-i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{-i2\pi{y}\omega}|y\rangle|\phi_{-}\rangle\\ &=&\frac{e^{i\pi\omega}}{\sqrt{2M}}\sum\limits\limits_{y=0}^{M-1}e^{i2\pi{y}\omega}|y\rangle|\phi_{+}\rangle\\ &&+\frac{e^{-i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{-i2\pi{y}\omega(1-\omega)}|y\rangle|\phi_{-}\rangle \end{array} $$
(40)

then applying QFT− 1 to the first logM qubits of |φ8〉, we can get

$$ \begin{array}{@{}rcl@{}} QFT^{-1}|\varphi_{7}\rangle&=&QFT^{-1}\left[\frac{e^{i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}\omega}|y\rangle|\phi_{+}\rangle\right.\\ && \left. +\frac{e^{-i\pi\omega}}{\sqrt{2M}}\sum\limits\limits_{y=0}^{M-1}e^{i2\pi{y}(1-\omega})|y\rangle|\phi_{-}\rangle\right]\\ &=&\frac{e^{i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}\omega}(QFT^{-1}|y\rangle)|\phi_{+}\rangle\\ &&+\frac{e^{-i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}(1-\omega)}(QFT^{-1}|y\rangle)|\phi_{-}\rangle\\ &=&\frac{e^{i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}\omega}\left( \frac{1}{\sqrt{M}}\sum\limits_{x=0}^{M-1} e^{i2\pi\frac{y}{M}x}|x\rangle\right)\\ &&|\phi_{+}\rangle +\frac{e^{-i\pi\omega}}{\sqrt{2M}}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}(1-\omega)}\\ &&\left( \frac{1}{\sqrt{M}}\sum\limits_{x=0}^{M-1} e^{-i2\pi\frac{y}{M}x}|x\rangle\right)|\phi_{-}\rangle\\ &=&\frac{e^{i\pi\omega}}{\sqrt{2}}\sum\limits_{y=0}^{M-1}\left( \frac{1}{M}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}(\omega-\frac{x}{M})})|x\rangle\right)|\phi_{+}\rangle\\ &&+\frac{e^{-i\pi\omega}}{\sqrt{2}}\sum\limits_{y=0}^{M-1}\left( \frac{1}{M}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}[(1-\omega)-\frac{x}{M}]}|x\rangle\right)|\phi_{-}\rangle\\ \end{array} $$
$$ \begin{array}{@{}rcl@{}} &=&\frac{e^{i\pi\omega}}{\sqrt{2}}|\widetilde{x}_{+}\rangle|\phi_{+}\rangle+ \frac{e^{-i\pi\omega}}{\sqrt{2}}|\widetilde{x}_{-}\rangle|\phi_{-}\rangle \end{array} $$
(41)

with

$$ |\widetilde{x}_{+}\rangle=\sum\limits_{y=0}^{M-1}\left( \frac{1}{M}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}(\omega-\frac{x}{M})}\right)|x\rangle $$
(42)
$$ |\widetilde{x}_{-}\rangle=\sum\limits_{y=0}^{M-1}\left( \frac{1}{M}\sum\limits_{y=0}^{M-1}e^{i2\pi{y}(1-\omega-\frac{x}{M})}\right)|x\rangle $$
(43)

Make a measurement on \(|\widetilde {x}_{+}\rangle \) in the computational basis \(\{|0\rangle ,|1\rangle ,\dots ,|M-1\rangle \}\) then get |x〉 with the probability \(|\frac {1}{M}{\sum }_{y=0}^{M-1}e^{i2\pi {y}(\omega -\frac {x}{M})}|^{2}\). so,

$$ \begin{array}{@{}rcl@{}} &&P\left( |\frac{x}{M}-\omega|\le\frac{1}{M}\right)=P(|x-M\omega|\le1)\\ &=&P(x=\lfloor{M\omega}\rfloor)+P(x=\lceil{M\omega}\rceil)\\ &=&|\frac{1}{M}{\sum}_{y=0}^{M-1}e^{i2\pi{y}(\omega-\frac{\lfloor{M\omega}\rfloor}{M})}|^{2}\\ &&+|\frac{1}{M}{\sum}_{y=0}^{M-1}e^{i2\pi{y}(\omega-\frac{\lceil{M\omega}\rceil}{M})}|^{2}\\ &=&|\frac{1-e^{i2\pi{y}(\omega-\frac{\lfloor{M\omega}\rfloor}{M})}} {M(1-e^{i2\pi{y}(\omega-\frac{\lfloor{M\omega}\rfloor}{M})})}|^{2}\\ &&+|\frac{1-e^{i2\pi{y}(\omega-\frac{\lceil{M\omega}\rceil}{M})}} {M(1-e^{i2\pi{y}(\omega-\frac{\lceil{M\omega}\rceil}{M})})}|^{2}\\ &=&|\frac{sin[\pi{M}(\omega-\frac{\lfloor{M\omega}\rfloor}{M})]}{Msin[\pi(\omega-\frac{\lfloor{M\omega}\rfloor}{M})]}|^{2}\\ &&+|\frac{sin[\pi{M}(\omega-\frac{\lceil{M\omega}\rceil}{M})]}{Msin[\pi(\omega-\frac{\lceil{M\omega}\rceil}{M})]}|^{2}\\ &=&\frac{sin^{2}[\pi{M}(\omega-\frac{\lfloor{M\omega}\rfloor}{M})]}{M^{2}sin^{2}[\pi(\omega-\frac{\lfloor{M\omega}\rfloor}{M})]}\\ &&+\frac{sin^{2}[\pi{M}(\omega-\frac{\lceil{M\omega}\rceil}{M})]}{M^{2}sin^{2}[\pi(\omega-\frac{\lceil{M\omega}\rceil}{M})]}\\ &\ge&\frac{1}{M^{2}sin^{2}(\frac{\pi}{2M})}+\ge\frac{1}{M^{2}sin^{2}(\frac{\pi}{2M})}\\ &=&\ge\frac{2}{M^{2}sin^{2}(\frac{\pi}{2M})}\\ &>&\frac{2}{M^{2}(\frac{\pi}{2M})^{2}} =\frac{8}{\pi^{2}} \end{array} $$
(44)

After measuring, \(\frac {x}{M}\) is close to or equal to ω with high probability. In fact, when make a measurement on \(|\widetilde {x}_{+}\rangle \), the probability of getting either ⌊Mω⌋ or ⌈Mω⌉ is at least \(\frac {8}{\pi ^{2}}\), with the estimation ω within the error \(\frac {1}{M}\). Similarly, make a measurement on \(|\widetilde {x}_{-}\rangle \), the probability of getting either ⌊M(1 − ω)⌋ or ⌈M(1 − ω)⌉ is at least \(\frac {8}{\pi ^{2}}\), with the estimation 1 − ω within the error \(\frac {1}{M}\), so \(\frac {x}{M}\) is close to or equal to 1 − ω with high probability. For 𝜃 = πω and \(sin^{2}\theta =\frac {t}{N}\), t = Nsin2πω.For the first case (i.e.,\(|\widetilde {x}_{+}\rangle \) ), \(\omega =\frac {x}{M}\), so \(t=Nsin^{2}(\pi \frac {x}{M})\);for the second case (i.e,\(|\widetilde {x}_{-}\rangle \) ),\(\omega \approx 1-\frac {x}{M}\), so \(t=Nsin^{2}(\pi -\pi \frac {x}{M})=Nsin^{2}(\pi \frac {x}{M})\).For the two cases, get the same estimation t.

Theorem 1 [16]. For \(\forall {M}\in {Z},|t-\widetilde {t}|\le \frac {2\pi }{M}\sqrt {t(N-t)}+\frac {\pi ^{2}}{M^{2}}|N-2t|\), the least probability is \(\frac {8}{\pi ^{2}}\),so \(\widetilde {t}\) is an estimate of t. the error is \(\varepsilon \le \frac {2\pi }{M}\sqrt {t(N-t)}+\frac {\pi ^{2}}{M^{2}}|N-2t|\).

Then we know the relations between t and \(|A_{1}\cap {A_{2}}\cap \dots \cap {A_{n}}|\)

$$ |A_{1}\cap{A_{2}}\cap\dots\cap{A_{n}}|=t $$
(45)

In Step 8, we can get the estimation of t with the high probability p, and \(p\ge \frac {8}{\pi _{2}}\), error is ε, error is very small, and \(\varepsilon \le \frac {2\pi }{M}\sqrt {t(N-t)}+\frac {\pi ^{2}}{M^{2}}|N-2t|\); so the QSMS-IC protocol can get the estimation of \(|A_{1}\cap {A_{2}}\cap \dots \cap {A_{n}}|\) with high probability \(p\ge \frac {8}{\pi _{2}}\) and small error ε.

Then analyze the security.

Theorem 2 (client Privacy). In QSMS-IC protocol, the client Ui can not get the information about the elements of A1 except the set size, and the server U1 also can not get the information about the elements of Ai except the set size.

Proof. In QSMS-IC protocol, the server U1 sends a quantum state |φ2〉 to the server U2, without revealing the elements of the set. Though the state |φ2〉 including the information of \(f_{A_{1}}(x)\), the client U2 cannot extract \(f_{A_{1}}(x)\) from |φ2〉. Supposed that the quantum state |φ2〉 consists of two subsystems: the n-qubit system \(\widetilde {C}\) and the 1-qubit system \(\widetilde {S}\), \(\widetilde {S}\) is ancillary system. Suppose the clients are half a honest client which is curious about other client’s information and actually transmits personal information. The client makes a projective measurement on |φ2〉, it can get \(|x\rangle |r\oplus {f_{A_{1}}(x)}\rangle \) with probability\(\frac {1}{n}\). Thus, \(\widetilde {S}\) can be characterized by quantum ensemble \(\xi \equiv \{p_{x}, \rho _{\widetilde {S}}(x)\}\), and \(p_{x}=\frac {1}{n}\),

$$ \begin{array}{@{}rcl@{}} \rho_{\widetilde{S}}(x)&=&Tr_{\widetilde{c}}(|x\rangle|r\oplus{f_{A_{1}}(x)}\rangle\langle{r}\oplus{f_{A_{1}}(x)}|\langle{x}|)\\ &=&|r\oplus{f_{A_{1}}(x)}\rangle\langle{r}\oplus{f_{A_{1}}(x)}| \end{array} $$
(46)

For \(|\varphi _{2}\rangle =\frac {1}{N}{\sum }_{x=0}^{N-1}|x\rangle |r\oplus {f_{A_{1}}(x)}\rangle \), so \(\widetilde {S}\) can also be described by the following density operator,

$$ \begin{array}{@{}rcl@{}} \rho_{\widetilde{S}}(x)&=&Tr_{\widetilde{c}}|\varphi_{2}\rangle\langle\varphi_{2}|\\ &=&\langle{0}|\varphi_{2}\rangle\langle\varphi_{2}|0\rangle+\langle{1}|\varphi_{2}\rangle\langle\varphi_{2}|1\rangle+\dots\\ &&+\langle{N-1}|\varphi_{2}\rangle\langle\varphi_{2}|N-1\rangle\\ &=&\frac{N-t}{N}|0\rangle\langle0|+\frac{t}{N}|1\rangle\langle1| \end{array} $$
(47)

Thus, \(\rho _{\widetilde {S}}\) is the average state of \(\widetilde {S}\). based on Holevo bound [14], we can get

$$ \begin{array}{@{}rcl@{}} 1\le\chi(\xi)&=&S(\rho_{\widetilde{S}})-\frac{1}{N}\sum\limits_{x=0}^{N-1}S(\rho_{\widetilde{S}}(x))\\ &=&S(\rho_{\widetilde{S}})\\ &=&S(\frac{N-t}{N}|0\rangle\langle0|+\frac{t}{N}|1\rangle\langle1|) \end{array} $$
(48)

Get the maximum value at \(t=\frac {N}{2}\). namely

$$ I\le{S}\left( \frac{1}{2}|0\rangle\langle0|+\frac{1}{2}|1\rangle\langle1|\right)=1 $$
(49)

It is the upper bound that the clients can get from \(\widetilde {S}\) through the measurement. But the client U2 does not know the random r which is selected by the server U1, so H(r) = 1 (H(.)is Shannon entropy and S(.)is Von Neumann entropy). Namely, it encrypts \(f_{A_{1}}(x)\) by using the random R in one-time pad method. So, from |φ2〉, U2 cannot get the information of \(f_{A_{1}}(x)\).

In addition, if the client does not honestly execute this protocol, he can send a fake state |X〉to the server, instead of the state |φ1〉. Accordingly, the returned state from the server will be \(|x\rangle |r\oplus {f_{A_{1}}(x)}\rangle \), not |φ2〉. Due to the random number r obviously the client can still not get any information about \(f_{A_{1}}(x)\).

So, the client Ai can’t get the information of \(f_{A_{1}}(x)\), due to the random r. Therefore, in QSMS-IC protocol, the client Ai can’t get the set elements of A1 except the set size \(n_{c_{i}}\). similarly the client A1 also can’t get the information of the elements of Ai set except the set size.

5 Conclusion

In this paper, we proposed a protocol called Quantum Secure Multiparty Set Intersection Cardinality Protocol to privately compute the cardinality of set intersection. Unlike the classical PSI-CA protocols, the proposed QSMS-IC protocol achieves the unconditional security, because it is guaranteed by the basic principle of quantum mechanics; compared with quantum PSI-CA protocol for two-party set Intersection, the proposed protocol can achieve multi-party set intersection. In addition, our proposed scheme is very simple to deal with dynamic updating, because it only needs to compute some set operations if adding or deleting a new client. What’s more, the applications of the protocol is frequently used in large-scale social networks, for instance, users can privately calculate the common hobbies.