# Negative thermal expansion coefficient and amorphization in defective 4H-SiC

Christopher Grome

(September 2023)

###### Abstract

Silicon Carbide (SiC) is a wide bandgap semiconductor material recently being
used in replacement of traditional semiconductors for high-voltage power
device applications. Radiation environments induce the defects through
displacement damage in the lattice that can saturate over periods of high
energy particle exposure at varous concentrations, which include the formation
of vacancies, interstitials and Frenkel pairs. Using molecular dynamics
software we calculate thermal expansion coefficient (TEC) over and specific
heat capacity at constant volume ($c_{v}$) values over a temperature range
varying defect concentrations in single crystal 4H-SiC. At a discovered
critical defect density amorphous defect clusters form in the lattice
triggering macroscopic negative thermal expansion across the entire
temperature range. Exponential $c_{v}$ loss is observed as defect density
increases until the isothermal process becomes completely adiabatic at a
identified critical frenkel pair concentration. Providing insight to the
degradation of SiC from displacement damage effects can ultimately assist the
development of radiation-hardened electronics.

##  1 Introduction

Silicon Carbide (SiC) is a wide bandgap semiconductor material recently being
used in replacement of traditional semiconductors for high-voltage power
device applications [1, 2, 3]. Radiation environments that exist terrestrially
and in outer space pose a noticeable risk to electronics which can lead to
cumulative degradation effects within the material known as displacement
damage (DD) [4, 5, 6]. DD characterizes the defects in the lattice that can
accumulate over periods of high energy particle exposure, which include the
formation of vacancies, interstitials and Frenkel pairs. Although the
recombination rates for point defects in SiC are recorded to be between 46.29%
and 62.16% for a given radiation strike [7], 4H-SiC has observed amorphous
transformations when exposed to high enough ion fluxes [8]. Experimental Raman
spectra analysis has shown that SiC exposed to neutron doses of .11
displacement per atom (dpa) saturate defects at an average distance of 0.6 nm
yielding defect concentrations at considerable percentages [9].

Displacement damage effects are have been known to cause a variety of device
malfunction. Effects on device’s majority carrier density, carrier mobility,
carrier lifetimes and other electronic properties have been well documented
[10, 11, 12, 13, 14]. However, The irradiation induced point defects affect on
the macroscopic thermal and mechanical properties of 4H-SiC are not very
clear.

To answer questions that are difficult to observe on-line during experiments,
a theoretical study at a fundamental atomic level is employed. Molecular
Dynamics (MD) is a very appropriate simulation approach for understanding
material processes as it provides high fidelity studying capability of atomic-
level events. MD has also been most notably employed for addressing a number
of key problems in semiconductor thermal [15, 16], mechanical [17, 18] and
electrical [19] properties.

In this paper, artificially produced point defects (vacancy, interstitial and
Frenkel pairs) are stochastically generated in bulk 4H-SiC. The thermal
expansion coefficient (TEC) and specific heat capacity ($c_{v}$) are
investigated over a temperature range of 200K to 1200K.The effects of defect
type and concentration are quantified and an advancement in the understanding
of the thermal mechanics of defected systems is made.

Studying the TEC is important for semiconductor materials. Compatible TECs are
required between substrates and at bonded material interfaces to minimize
thermal stress and optimize device performance [20]. Variation in the TEC can
result in incompatible thermal stresses that can cause permanent damage in
semiconductor devices [21, 22]. Specific heat capacity is an imperative
parameter for conductance and thermal management of semiconductor materials
[23]. Deviations in the specific heat can lead to premature changes in the
temperature of power devices consequently effecting all temperature dependent
electronic parameters leading to performance degradation. Additionally,
specific heat has been shown to effect the susceptibility of devices to
radiation effects. Simulation work in [24, 25, 26], shows heat capacity
critically effects thermal modulation in power devices during single event
effects (SEE). Changes to this parameter leave power electronics more prone to
reaching its sublimation point during high voltage stress or radiation
strikes, resulting in permanent degradation or catastrophic failure.

The goal and motivation behind this research is to provide insight to the
degradation of the material in extreme environments to ultimately assist the
development of radiation-hardened electronics with applications in nuclear
reactor monitoring, aerospace, and deep space exploration.

(a) Pure 4H-SiC supercell

(b) with vacancies

(c) with interstitials

(d) with Frenkel Pairs

Figure 1: Modeling of 4H-SiC supercells a) pure system b) vacancy defects in
red c) Interstitial defects in blue d) Frenkel pairs

##  2 Computational Methods

Modeling the displacement damage defects on single crystal 4H-SiC and its
effect on the materials thermal and mechanical properties requires the use of
a toolkit and a simulator. Displacement damage and non-ionizing energy loss
mechanisms are inherently atomistic-scale events. To comprehensively map the
physical movements of atoms and observe the evolution of the system after DD
defects are imposed, a molecular dynamics (MD) simulator was employed. A
compatible toolkit was developed to provide the MD software with atomic models
of defected 4H-SiC.

The MD simulations carried out in this work are with the software LAMMPS
(Large-scale Atomic/Molecular Massively Parallel Simulator). The Modified
Embedded Atom Method (MEAM) potential is the first semi-empirical interatomic
potential formalism that demonstrated the possibility that a single formalism
can be applied to a wide range of structured elements [27]. The MEAM potential
proposed by Kang _et al._ is used in this work to describe inter-atomic and
point defect interactions. For modeling the body interactions, LAMMPS uses the
notation Si-C. The MEAM library and SiC parameter files used for MD are taken
from [28, 29] and can be found in the Appendix. Using the .dat file generated
from the modeling toolkit, LAMMPS can compute thermal simulations of interest.

###  2.1 4H-SiC Models

The super cell of pure 4H-SiC is generated with dimension 8a $\times$ 8b
$\times$ 8c consists of 8192 atoms, developed using known lattice constants,
dimensional properties given in Table 1 and stacking sequence ABCB. This
structure has a space group 186 (P 63 m c) and point group 6mm ($C_{6V}$) one
6 fold rotation, six mirror planes and no inversion [30, 31].

Lattice Constant | Dimension
---|---
a | 3.079 Å
b | 3.079 $\sqrt{3}$ Å
c | 10.053 Å
$\alpha$ | 90°
$\beta$ | 90°
$\gamma$ | 120°
Table 1: Lattice constants for 4H-SiC unit cell

It has been documented that defects from displacement damage are inherently
stochastic in nature [11, 13, 17]. Ergo, our modeling techniques introduce
point defects into the system randomly and uniformly. For vacancy defects
atoms are randomly removed, interstitial defects randomly add atoms to the
system and Frenkel pairs randomly add and remove atoms in the system. In this
work, the defects are introduced separately and uniformly at concentrations of
2%, 4%, 6%, 8% and 10% (as percentages of the total atom count) to investigate
the role the defect type and density have on the materials properties. The
defected models used in this with their respective atom counts are listed in
Table 2 and are visualized in Figure 1

Defect Density: | 2% | 4% | 6% | 8% | 10%
---|---|---|---|---|---
Vacancy Models (# of atoms) | 8028 | 7864 | 7701 | 7537 | 7373
Interstitial Models (# of atoms) | 8356 | 8520 | 8683 | 8847 | 9011
Frenkel Pair Models (# of atoms) | 8192 | 8192 | 8192 | 8192 | 8192
Table 2: Atomic counts for defected models

###  2.2 Thermal Simulation Modeling

The energy data of these samples is calculated with LAMMPS to study the effect
on the thermal properties. In these simulations, we initially relax the system
by applying a conjugate gradient minimizer to dissipate residual stress.
Following, we assign random velocity distributions to the atoms to represent
1K. We then apply a Noose-Hoover thermostat to raise the system to the target
temperature over a period of 5ns with a time step of 1 fs. The pressure
damping coefficient in the NPT ensemble simulation were tailored for each
temperature simulation to converge to the experimental and literature data. A
breakdown of the damping coefficient parameters is provided in Table 3.
Periodic boundary conditions are applied along the [111] direction and the
supercells orthogonal sides are bounded by the planes with normal directions
along the [111], $[1\,\overline{1}\,0]$ and $[1\,1\,\overline{2}]$ directions.
For structure analysis, Open Visualization Tool (OVITO) is employed.

Temperature (K) | Pdamp (fs)
---|---
200 | 320.0
300 | 245.0
400 | 199.3
600 | 285.9
800 | 250.0
1000 | 490.0
1200 | 396.0
Table 3: Pressure damping coefficients (Pdamp) for TEC conversion at different
temperatures

##  3 Thermal Simulation Results

A number of papers have been reported on the TEC of SiC. Work in [32] showed
anisotropic dependence, where the a-axis TEC was larger than the TEC measured
on the c-axis. However in more recent study using both laser interferometry
and dilatometry techniques, Nakabayashi et al. shows there is an isotropic
relationship. A review in [33] recorded more than 30 published thermal
expansion measurements had no reported anisotropy for various silicon carbide
materials. Our directional dependence study in Figure 2 shows our MD
simulations also are isotropic. The TEC values between the c-axis
($\alpha_{33}$) direction and the a-axis ($\alpha_{11}$) direction were
exactly the same to six decimal places.

Figure 2: Directional dependence of TECs calculated along a and c axes

The linear thermal expansion coefficients were taken along the
$\langle$11-20$\rangle$ direction and were dynamically compared at both low
and high temperatures to literature. Using the ensemble bond length at
equilibrium, we calculate the temperature dependent linear thermal expansion
coefficient ($\alpha$) along the a-axis from Equation 1.

$\alpha=\biggl{(}\frac{dln(L)}{dT}\biggr{)}_{p}$ (1)

The low temperatures were ran every 25K from 200K to 400K and were compared to
an adopted analytical TEC polynomial from [34] that fit the experimental data
from 123K to 473K in their work. The polynomial for the TEC along the a-axis
is

$\alpha_{11}=-2.0404+1.9374\times 10^{-8}\cdot T+1.1385\times 10^{-11}\cdot
T^{2}(K^{-1})$ (2)

and is plotted in comparison to the results from our MD in Figure 3(a). As
illustrated our MD shows very good agreement with the literature results and
can attribute fidelity to our simulation. At higher temperatures, our MD
values are compared to individual experimental values every 200K from 400K to
1200K in Figure 3(a).

(a)

(b)

Figure 3: a) Linear Thermal Expansion Coefficient for low temperatures
comparing MD simulations to analytical polynomial b) LTEC for high
temperatures compared to experimental data

Our MD simulation agreement with analytical and experimental results indicates
the second nearest neighbor distance dominates the LTEC behavior due to the
MEAM potentials inherent nearest-neighbor model. The results for the pure
structure show positive and values and a square root relationship to
temperature. As temperature increases the potential energy decreases which
represents the stiffening and softening of the state of the bond. The kinetic
energy of the system is increased and the bond lengths between the atoms
expand. At high temperatures, our simulation continued to show good agreement
with literature and allows for defect analysis. Specific heat capacity for SiC
has also been well studied and is very useful for quantifying internal energy
changes within a system. Work in [33] shows the change in 4H-SiC $c_{v}$ as
temperature increases is due to more phonon modes being made available. As
these modes become available and occupied, the internal energy increases at a
faster rate. Ergo, the lattice structure needs more energy to increase the
temperature by a degree in higher temperature environments. An analytical
4H-SiC $c_{v}$ model was developed in [33] from experimental measurements of
the specific heat up to its sublimation temperature and is used to validate
our MD results at T=300K.

$c_{v}=\biggl{(}\frac{dE}{dT}\biggr{)}_{V}$ (3)

The TEC MD simulations gives us the internal energy data needed to compute
$c_{v}$. Using Equation 3, our MD at T = 300K gives us a $c_{v}$ of 2.568
[inter-unit-product = ${}\cdot{}$]. Using the polynomial developed in [47] at
T = 300K, the analytical $c_{v}$ is 2.628 [inter-unit-product = ${}\cdot{}$],
showing good agreement with our simulation. Using our simulation value as a
baseline, the analysis explored will be looking at the $c_{v}$ dependency on
defect density at T = 300K.

###  3.1 TEC of Defected 4H-SiC

Linear thermal expansion coefficient curves for 4H-SiC supercells with
vacancies, interstitials and Frenkel pairs at varied concentrations are
calculated at 7 different temperatures ranging from 200 to 1200K. Using the
bond length at equilibrium, we calculate TEC along the a-axis using Equation
1. We consider defect concentrations from 2 to 10% and observe the LTEC defect
density dependence. Due to the stochastic algorithm used to employ We model 5
iterations of each defect concentration

Observations on the effect of vacancy defects are first discussed. The
$\alpha_{11}$ for all vacancy defect densities ($\rho_{vd}$) are obtained and
compared to the baseline pure SiC. The results presented in Figure 4(a)
suggest a number of important features in vacancy defected 4H-SiC: (1)
$\alpha_{11}$ is not highly vacancy density dependent until $\rho_{vd}>6\%$;
(2) for $\rho_{vd}$ $\leq{6\%}$ the square root temperature dependence is
followed until higher temperatures T $>$ 600K, for 800K$<$T$<$ 1200K a decline
in $\alpha_{11}$ is observed; (3) for $\rho_{vd}$ = 8% a negative
$\alpha_{11}$ is observed during T $<$ 400K, then showing $\alpha_{11}$
temperature independence for T $\geq$ 400K; (5) there exist a critical vacancy
defect value 8% $<$ $\rho_{vd}$ $<$ 10% that triggers a complete thermal
contraction in the material.

(a) Vacancies

(b) Interstitials

(c) Frenkel Pairs

Figure 4: TEC of (a) vacancy (b) interstitial and (c) defected 4H-SiC at
various concentrations in comparison to the non-defected material

The TEC data at various interstitial defect densities $\rho_{id}$ provided in
Figure 4(b) suggests several important features in interstitial defected
4H-SiC: (1) $\alpha_{11}$ is not highly interstitial density dependent until
$\rho_{id}\>6\%$; (2) for $\rho_{id}<6\%$ the systems under-expand the
baseline case; (3) for $\rho_{id}\geq 6\%$ the systems over expand the
baseline case; (4) for $\rho_{id}<8\%$, increases in temperature lead to
closer agreement with the pure SiC $\alpha_{11}$; (5) interstitials trigger an
inherent over-expansion phenomena in the system that increases in magnitude
with respect to $\rho_{id}$.

Lastly, observations on the effect of Frenkel pairs are discussed. Figure 4(c)
suggests: (1) the largest TEC deviations per defect density are caused by
frenkel pairs; (2) increasing $\rho_{fp}$ exclusively underexpands the
baseline case; (3) square root temperature dependence seen in $\rho_{fp}\leq
4\%$, uniform dip at 600K in remaining defected cases; (4) for $T\leq 400K$
negative thermal expansion (NTE) is observed in all, but $\rho_{fp}$ = 2%
case; (5) exclusive NTE observed for $\rho_{fp}$ = 10% case.

(a)

(b)

(c)

(d)

(e)

(f)

Figure 5: a) Vacancy, (c) interstitial and (e) Frenkel pair defect density
dependence on change in systems potential energy per atom during thermal
expansion. Comparison of (b) vacancy, (d) interstital and (e) Frenkel pair of
structures magnitude of deviation in potential energy (PE) per atom from the
baseline case

###  3.2 $C_{v}$ of Defected 4H-SiC

To quantify the effect defects have on the energy required to raise the
temperature on the material, the specific heat capacity at constant volume is
calculated in comparison to the baseline case at 300K. Figure 6 suggests some
interesting characteristics: (1) $c_{v}$ decreases in an exponential fashion
with increased defect density; (2) Frenkel pairs have the highest decreasing
rate amongst the defect types, dropping 63% by $\rho_{fp}$ = 6%; (3) vacancies
show the least rapid decrease in energy modulation, dropping 21.2% of the
baseline when $\rho_{vd}$ = 10%; (4) Frenkel pairs have a critical defect
value between 6% and 8% that causes the system to not require energy to raise
the temperature of the material. The specific heat capacity for $\rho_{fp}\geq
8\%$ suggests an amorphous effect compromises the materials thermal stability.

Figure 6: Specific heat capacity dependency on defect type and defect density
at 300K.

Extrapolating, there exists critical concentrations for all defect types that
will compromise the enthalpy yielding no material stability at moderate
temperatures. It is acknowledged that reaching a defect concentration for
interstitials and vacancies alone to achieve that level of criticality would
require such extreme environment exposure that would not be within the scope
of electronic applications. Overall, the data suggests that defected systems
do not behave like typical lattice solids. As defects increase in
concentration less energy is required to raise the temperature of the
material. This is a very important parameter in radiation hardening, as
defected systems with significantly impacted heat capacity will be much more
susceptible to reaching melting/sublimation temperatures and premature
burnout.

###  3.3 Dynamics of Defected 4H-SiC

The dependency of $\alpha_{11}$ on defect density can be explained by
exploring the potential energy (PE) of the system during thermal expansion. As
temperature is introduced into the statically equilibrated pure 4H-SiC
structure, the potential energy increases, but since PE is inherently a
negative value the magnitude decreases. Note that the change in the potential
energy during thermal expansion is the equivalent of the kinetic energy added
into the system. The PE of the system is calculated by summing the bond
energies within the system, so when adding and removing atoms in the system by
introducing defects, changes in PE are anticipated. In order to quantify the
effect the defects have on the material, the system energy data is normalized
by calculating the PE per atom. The relationship of the potential energy per
atom during thermal expansion for defected systems is displayed in Figure
5(a),5(c) and 5(e). To elucidate the relationship between defect density and
PE deviation from the baseline, the magnitude of the difference in defected
potential energies to the pure 4H-SiC are taken in Figures 5(b), 5(d) and
5(f). Figure 5 provides some additional features: (1) magnitude of PE
deviation for frenkel pair concentrations are an order of magnitude higher
than the other defect types; (2) the rate of PE deviation and TEC deviation
increases at an increasing rate with respect to $\rho_{vd}$, rate of increase
for other defect types are uniform; (3) deviation in PE from the baseline is a
function of temperature; (4) Figure 5(e) shows for $T\leq 1000K$ PE per atom
for $\rho_{fp}\geq 8\%$ is negative during thermal expansion, showing largest
magnitude at T = 600K.

The potential energies are calculated by the pair and bond energies between
atoms which directly affects the enthalpy (H) of the system. In turn, these
potentials provide internal energy contributions to the Gibbs free energy (G)
equation in Equation 4, which describes the thermodynamic process to reach
system equilibration as a function of internal energy (U), pressure (p),
temperature (T), volume (V) and entropy (S) after point defect formation.

$\Delta{G}=\Delta{H}-T\Delta{S}=\Delta{U}+p\Delta{V}-T\Delta{S}$ (4)

As the enthalpy changes within the system, the volumetric response does as
well. The deviation observed in $\alpha_{11}$ with respect to defect density
is caused by the first law of thermodynamics. At constant temperature and
constant pressure, the thermal-dynamic potential represented in Gibbs free
energy changes causing variation in the volumetric expansion, directly
effecting $\alpha_{11}$. When $\rho_{vd}$ $\geq 8\%$ and $\rho_{fp}$ $\geq
6\%$, the change in energy per atom surpasses a threshold in the thermal
dynamic potential causing a contracting effect on the system yielding negative
thermal expansion (NTE). Rather than expanding with increased temperatures,
these defected systems expand with decreased temperatures. The increase of
deviation in potential energy per atom suggests that increased vacancy
concentrations change the anaharmonicity associated with the interatomic
distances. The vibrational properties in the $\rho_{vd}\geq 8\%$ cases are
quite different. The interatomic potentials yield transverse motion
perpendicular to the directions of the atomic chains, creating a shortening
phenomenon. The transverse phonon amplitudes outweigh the expansion effects of
the longitudinal modes resulting in systematic NTE. Additionally, the
nonlinear rate of increased PE and TEC deviation suggests that the defects are
interacting with each other at higher concentrations to trigger more rapid
thermal degeneration of the material.

In the positive thermal expansion (PTE) cases, the interatomic potential is
not disrupted enough to have a the contracting effect. The anaharmonicity
leads to an increase in average interatomic distances as higher vibrational
states become more populated as temperature rises. The atom chains move in
longitudinal vibrations in the directions of the bonds causing a lengthening
effect during increased temperature.

A PE contour on [010] plane of the $\rho_{vd}$ = 10% is visualized using OVITO
in its initial state at 1K (Figure 7(a) ) and at 800K, the point of most
negative TEC, in Figure 7(b).

(a) 1K

(b) 800K

Figure 7: a) Potential Energy contour of 10% vacancy defected model at 1K b)
Potential Energy contour of 10% vacancy defected model at 800K

The structure initially shows a stable lattice, but shows the formation of
localized vacancy defect clusters that interact with each other triggering
shortening effects within the system. As vacancy defects increase in
concentration the localized cluster interactions cause macroscopic decreases
to the TEC at an increasing rate.

(a) 1K

(b) 200K

Figure 8: a) Potential Energy contour of 10% frenkel pair defected model at 1K
and at b) 200K

A PE contour on [010] plane of the $\rho_{fp}$ = 10% is visualized using OVITO
in its initial state at 1K (Figure 8(a) ) and at 200K, the point of most
negative TEC, in Figure 8(b). The potential energy scale within the system
remains during thermal equilibration. However, the frenkel pair defects
interact with each other at this concentration to completely overwhelm the
material by 200K. Where there are localized defect clusters at 1K, the
material appears to be amorphous in regions in the system hardly keeping its
lattice structure. The material at this concentration is not behaving like a
solid lattice and suggests the material is prematurely changing states of
matter. The results from the specific heat capacity study indicate that the
energy required to raise the temerpature of the system is so low that the
material sublimates.

##  4 Conclusion

We have shown the baseline structures have agreeing thermal properties with
documented experimental and analytical values in literature. Observing
defected 4H-SiC systems at various concentrations, Frenkel pairs show the
highest magnitude difference per defect density in TEC and specific heat
capacity in comparison with the pure structures. The variation in thermal
expansion comes from the defects effect on the interatomic potential of the
system. When defects are introduced the bonds and anaharmonicity in the system
change resulting in changes in the internal energy. Changes in the internal
energy consequently create deviation in the volume response via thermodynamic
processes. We also document that defects at larger concentrations can cause
NTE, which can cause severe incompatibility at material interfaces in
electronic devices prompting degradation in the electrical performance. Though
interstitials have the smallest effect on the thermal expansion, they have a
much larger impact on effecting the internal energy of the system. Specific
heat simulations show interstitials drop the energy needed to raise the
temperature of the system over twice as much as the effect from the vacancies.
The defect types showed decreases in $c_{v}$ at a decreasing rate suggesting
the defects are interacting with each other to cause more rapid degeneration
of the material. At high frenkel pair concentrations, the specific heat
capacity reaches zero corresponding to an amorphous effect in the material and
premature sublimation. This suggests the isothermal processes shift to
adiabatic at this critical $\rho_{fp}$ Overall, the effects from displacement
damage significantly alter the thermal properties of 4H-SiC as defect
concentration increases. Alterations in the TEC and the specific heat can
cause thermal stresses at material interfaces and quicker heating in power
devices that can lead to permanent degradation or premature burnouts.

## References

  * [1] F. Roccaforte, P. Fiorenza, G. Greco, R. L. Nigro, F. Giannazzo, F. Iucolano, and M. Saggio, “Emerging trends in wide band gap semiconductors (sic and gan) technology for power devices,” Microelectronic Engineering, vol. 187, pp. 66–77, 2018.
  * [2] J.-M. Lauenstein, “Wide-bandgap semiconductors in space: Appreciating the benefits but understanding the risks,” in Conference on Radiation Effects on Components and Systems (RADECS 2018), no. 2018-561-NEPP, 2018.
  * [3] T. Kimoto and J. A. Cooper, Fundamentals of silicon carbide technology: growth, characterization, devices and applications.  John Wiley & Sons, 2014.
  * [4] C. Leroy and P.-G. Rancoita, “Particle interaction and displacement damage in silicon devices operated in radiation environments,” Reports on Progress in Physics, vol. 70, no. 4, p. 493, 2007.
  * [5] A. J. Boutte, D. J. Cochran, D. Chen, M. J. Campola, J. A. Pellish, R. L. Ladbury, E. P. Wilcox, J.-M. Lauenstein, R. A. Gigliuto, K. A. LaBel, et al., “Compendium of recent total ionizing dose and displacement damage for candidate spacecraft electronics for nasa,” in 2013 IEEE Radiation Effects Data Workshop (REDW), pp. 1–9, IEEE, 2013.
  * [6] J. Srour, C. J. Marshall, and P. W. Marshall, “Review of displacement damage effects in silicon devices,” IEEE transactions on nuclear science, vol. 50, no. 3, pp. 653–670, 2003.
  * [7] Y. Chen, H. Liu, T. Gao, and H. Wei, “Simulation of the irradiation cascade effect of 6h-sic based on molecular dynamics principles,” Micromachines, vol. 14, no. 2, p. 455, 2023.
  * [8] E. Aradi, J. Lewis-Fell, G. Greaves, S. Donnelly, and J. Hinks, “Low-temperature investigations of ion-induced amorphisation in silicon carbide nanowhiskers under helium irradiation,” Applied Surface Science, vol. 501, p. 143969, 2020.
  * [9] T. Koyanagi, M. Lance, and Y. Katoh, “Quantification of irradiation defects in beta-silicon carbide using raman spectroscopy,” Scripta Materialia, vol. 125, pp. 58–62, 2016.
  * [10] P. Hazdra and S. Popelka, “Displacement damage and total ionisation dose effects on 4h-sic power devices,” IET Power Electronics, vol. 12, no. 15, pp. 3910–3918, 2019.
  * [11] K. Baumann, Robert; Kruckmeyer, Radiation Handbook for Electronics.  Texas Instruments, 2020.
  * [12] J. Howard, Spacecraft environments interactions: Space radiation and its effects on electronic systems.  NASA, 1999.
  * [13] C. C. Foster, “Total ionizing dose and displacement-damage effects in microelectronics,” MRS bulletin, vol. 28, no. 2, pp. 136–140, 2003.
  * [14] G. P. Summers, E. Burke, C. Dale, E. Wolicki, P. Marshall, and M. Gehlhausen, “Correlation of particle-induced displacement damage in silicon,” IEEE Transactions on Nuclear Science, vol. 34, no. 6, pp. 1133–1139, 1987.
  * [15] Z. M. Hossain, F. Elahi, and Z. Zhang, “Differential anharmonicity and thermal expansion coefficient in 3 c-sic nanowires,” Physical Review B, vol. 99, no. 11, p. 115407, 2019.
  * [16] F. Elahi and Z. M. Hossain, “Molecular dynamics study of interfacial strength and debonding in sic/sic nanocomposite,” MRS Advances, vol. 7, no. 22, pp. 462–467, 2022.
  * [17] Y. Li, H. Chen, Y. Chen, Y. Wang, L. Shao, and W. Xiao, “Point defect effects on tensile strength of $\alpha$\- zirconium studied by molecular dynamics simulations,” Nuclear Materials and Energy, vol. 20, p. 100683, 2019.
  * [18] J.-W. Jiang, Z. Qi, H. S. Park, and T. Rabczuk, “Elastic bending modulus of single-layer molybdenum disulfide (mos2): finite thickness effect,” Nanotechnology, vol. 24, no. 43, p. 435705, 2013.
  * [19] J.-W. Jiang, “Phonon bandgap engineering of strained monolayer mos 2,” Nanoscale, vol. 6, no. 14, pp. 8326–8333, 2014.
  * [20] S. Li, K. M. Taddei, X. Wang, H. Wu, J. Neuefeind, D. Zackaria, X. Liu, C. Dela Cruz, and B. Lv, “Thermal expansion coefficients of high thermal conducting bas and bp materials,” Applied Physics Letters, vol. 115, no. 1, 2019.
  * [21] A. M. Drews, Control of Thermal Expansion Coefficient of a Metal Powder Composite via Ceramic Nanofiber Reinforcement.  PhD thesis, University of Akron, 2009.
  * [22] E. Arriola, N. R. E. Lim, R. L. Moran, J. P. Mercado, R. Dimagiba, J. Gonzaga, and A. Ubando, “Evaluation of the effects of introducing channels to composite materials to reduce warpage on semiconductor packages due to coefficient of thermal expansion mismatch,” in 2019 IEEE 11th International Conference on Humanoid, Nanotechnology, Information Technology, Communication and Control, Environment, and Management (HNICEM), pp. 1–5, IEEE, 2019.
  * [23] E. M. Carnicom, W. Xie, Z. Yang, K. Górnicka, T. Kong, T. Klimczuk, and R. J. Cava, “Importance of specific heat characterization when reporting new superconductors: An example of superconductivity in liga2rh,” Chemistry of Materials, vol. 31, no. 6, pp. 2164–2173, 2019.
  * [24] J. A. McPherson, Modeling and improving Single-Event burnout performance from heavy ion bombardment in high-voltage 4H-SiC power devices.  Rensselaer Polytechnic Institute, 2021.
  * [25] J. A. McPherson, P. J. Kowal, G. K. Pandey, T. P. Chow, W. Ji, and A. A. Woodworth, “Heavy ion transport modeling for single-event burnout in sic-based power devices,” IEEE Transactions on Nuclear Science, vol. 66, no. 1, pp. 474–481, 2018.
  * [26] J. A. McPherson, C. W. Hitchcock, T. P. Chow, W. Ji, and A. A. Woodworth, “Ion-induced mesoplasma formation and thermal destruction in 4h-sic power mosfet devices,” IEEE Transactions on Nuclear Science, vol. 68, no. 5, pp. 651–658, 2021.
  * [27] M. I. Baskes, “Modified embedded-atom potentials for cubic materials and impurities,” Physical review B, vol. 46, no. 5, p. 2727, 1992.
  * [28] K.-H. Kang, T. Eun, M.-C. Jun, and B.-J. Lee, “Governing factors for the formation of 4h or 6h-sic polytype during sic crystal growth: An atomistic computational approach,” Journal of crystal growth, vol. 389, pp. 120–133, 2014.
  * [29] B.-J. Lee, M. Baskes, H. Kim, and Y. K. Cho, “Second nearest-neighbor modified embedded atom method potentials for bcc transition metals,” Physical Review B, vol. 64, no. 18, p. 184102, 2001.
  * [30] T. Ayalew, SiC semiconductor devices technology, modeling and simulation.  PhD thesis, 2004.
  * [31] M. E. Levinshtein, S. L. Rumyantsev, and M. S. Shur, Properties of Advanced Semiconductor Materials: GaN, AIN, InN, BN, SiC, SiGe.  John Wiley & Sons, 2001.
  * [32] Z. Li and R. C. Bradt, “Thermal expansion of the hexagonal (4 h) polytype of sic,” Journal of applied physics, vol. 60, no. 2, pp. 612–614, 1986.
  * [33] Y. Touloukian and T. Makita, “Thermo-physical properties of matter. the trpc data series, volume 6: Specific heat, non-metallic liquids and gases,” IFI/Plenum, New York, p. 293, 1970.
  * [34] M. Nakabayashi, T. Fujimoto, M. Katsuno, and N. Ohtani, “Precise determination of thermal expansion coefficients observed in 4h-sic single crystals,” in Materials science forum, vol. 527, pp. 699–702, Trans Tech Publ, 2006.


11institutetext: Engineering Research Center of Digital Forensics, Ministry of
Education, Nanjing 210044, P. R. China
School of Computer and Software, Nanjing University of Information Science and
Technology, Nanjing 210044, P. R. China
School of Computer Science and Cybersecurity, Communication University of
China, Beijing 100024, P. R. China
Hong Kong Applied Science and Technology Research Institute (ASTRI), Science
Park East Avenue, Hong Kong 999077, P. R. China
Corresponding author: Wenjie Liu 11email:  wenjiel@163.com.).

# Quantum Searchable Encryption for Cloud Data Based on Full-Blind Quantum
Computation

Wenjie Liu 1122 Yinsong Xu, and Wen Liu, and Haibin Wang and Zhibin Lei 223311
2 24411223344

###### Abstract

Searchable encryption (SE) is a positive way to protect users sensitive data
in cloud computing setting, while preserving search ability on the server
side. SE allows the server to search encrypted data without leaking
information about the plaintext data. In this paper, a multi-client universal
circuit-based full-blind quantum computation (FBQC) model is proposed. In
order to meet the requirements of multi-client accessing or computing
encrypted cloud data, all clients with limited quantum ability outsource the
key generation to a trusted key center and upload their encrypted data to the
data center. Considering the feasibility of physical implementation , all
quantum gates in the circuit are replaced with the combination of
${\pi\mathord{\left/{\vphantom{\pi 8}}\right.\kern-1.2pt}8}$ rotation operator
set $\\{$${R_{z}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, ${R_{y}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $C{R_{z}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $C{R_{y}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $CC{R_{z}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $CC{R_{y}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$$\\}$. In addition, the data center is only allowed
to perform one ${\pi\mathord{\left/{\vphantom{\pi 8}}\right.\kern-1.2pt}8}$
rotation operator each time, but does not know the structure of the circuit
(i.e., quantum computation), so it can guarantee the blindness of computation.
Then, through combining this multi-client FBQC model and Grover searching
algorithm, we continue to propose a quantum searchable encryption scheme for
cloud data. It solves the problem of multi-client access mode under searchable
encryption in the cloud environment, and has the ability to resist against
some quantum attacks. To better demonstrate our scheme, an example of our
scheme to search on encrypted 2-qubit state is given in detail. Furthermore,
the security of our scheme is analysed from two aspects: external attacks and
internal attacks, and the result indicates that it can resist against such
kinds of attacks and also guarantee the blindness of data and computation.

###### Keywords:

q

uantum searchable encryption, cloud data, full-blind quantum computation,
trusted key center, multi-client access, grover algorithm,
${\pi\mathord{\left/{\vphantom{\pi 8}}\right.\kern-1.2pt}8}$ rotation operator

##  1 Introduction

In recent years, cloud computing has achieved great development in different
fields, such as wireless networks [1, 2, 3], IoT [4, 5, 6, 7, 8], resource
allocation [9, 10, 11] and so on. As it provides economic and convenient
service, more and more clients are planning to upload their data onto the
public clouds now. And with the popularity of mobile devices, more and more
companies can push the content they want based on the data uploaded by
clients, which greatly promotes the development of mobile Internet [12, 14,
13, 15]. However, data stored in the cloud server may suffer from malicious
use by cloud service providers since data owners have no longer direct control
over data. For instance, data stored in a bank must not be arbitrarily
obtained [16, 17, 18]. Considering data privacy and security, it is a
recommended practice for data owners to encrypt data before uploading onto the
cloud [19]. Therefore, an efficient search technique for encrypted data is
extremely urgent.

A popular way to search over encrypted data is searchable encryption (SE),
which is desirable to support the fullest possible search functionality on the
server side, without decrypting the data, and thus, with the smallest possible
loss of data confidentiality. The first searchable encryption was proposed by
Song et al. [20]. This scheme uses stream ciphers and pseudo-random functions
to implement ciphertext retrieval, but it also has a series of problems, such
as low search efficiency and data privacy. Therefore, Goh [21] built a index
structure based on the Bloom filter to achieve fast retrieval of ciphertext
data. However, the Bloom filter itself has a certain error rate, and the
result returned by the cloud server to the data user may not be accurate.
Besides, Curtmola et al. [22] and Boneh et al. [23] use the idea of ”keyword-
file” to construct a symmetric searchable encryption scheme and a public key
search able encryption scheme, respectively. Both schemes have significant
improvements in safety and efficiency. Nowadays, many researchers have tried
to use kNN algorithm [24, 25], user interest model [26], blockchain technology
[27, 28], multi-keyword ranked search [29] and so on, to improve the search
efficiency and data privacy.

However, with the development of quantum computation, the powerful computing
power of quantum computers poses an increasingly strong threat to public key
systems [30] and symmetric key systems [31, 32]. Besides, quantum computation
are also applied in other fields, such as quantum key agreement (QKA) [33,
34], quantum steganography (QS) [35, 36], quantum machine learning [37, 38],
and so on. Especially, to protect the privacy of client’s data, many
researchers have proposed a novel quantum computation model: blind quantum
computation (BQC), where the client with limited quantum resources can perform
quantum computation by delegating the computation to an untrusted quantum
server, and the privacy of the client can still be guaranteed. BQC can be
generally divided into two categories: one is the measurement-based blind
quantum computation (MBQC), and the other is the circuit-based blind quantum
computation (CBQC). In MBQC, measurement is the main driving force of
computation, which follows the principle of ”entangle-measure-correct”, and a
certain number of quantum qubits are entangled to form a standard graph state
[39, 40, 41].

Different from MBQC, CBQC is based on the quantum circuit, which is composed
of many kinds of quantum gates [42, 43, 44, 45, 46, 47, 48, 49, 50]. Among
them, Fisher [44] and Broadbent [45] firstly proposed a representative CBQC
model: delegating quantum computation (DQC). In their schemes, an untrusted
server can perform arbitrary quantum computations on encrypted quantum bits
(qubits) without learning any information about the inputs, where the quantum
computations are implemented by a universal set of quantum gates ($X$, $Z$,
$H$, $S$, $T$, CNOT). And then the client can easily decrypt the results of
the computation with the decryption key. Then, Tan et al.[43] give 3 circuits
of other quantum gates (CZ, SWAP, and Toffoli) for blind quantum computation.
However, in their schemes, the server knows the content of delegating
computation. To further protect computation privacy, a few universal circuit-
based ”full-blind” quantum computation (FBQC) schemes are proposed [46, 47],
i.e., the server also does not know the content of delegated computation.
These two schemes use two different strategies to achieve full blindness.
Zhang et al.’s scheme decomposes all quantum gates into several basic rotation
operators, and inserts trap qubits and trap gates to achieve full blindness,
where the trap gate is composed of basic rotation operators and does not
affect the computation results. In Liu et al.’s scheme, the client uses the
strategy of oblivious mechanism to make the computation blind, where the
desirable delegated quantum operation, one of $\\{H,P,CNOT,T\\}$, is replaced
by a fixed sequence ($H$, $P$, CZ, CNOT, $T$). However, all these mentioned
CBQC schemes are only a single-client model, i.e., clients can only delegate
the server to compute their own data, which are not convenient for different
clients to compute others’ data.

In order to implement multi-client universal circuit-based FBQC for searchable
encryption, i.e., different clients can store or search their data in the
quantum cloud server, we propose a quantum searchable encryption scheme for
cloud data based on full-blind quantum computation (QSE-FBQC). Clients with
limited quantum ability firstly use $X$ and $Z$ gates to encrypt their data
with the encryption keys generated by the key center, and then upload the
encrypted data to the data center. The data center performs search computation
on the encrypted data if other clients need, where the search computation are
implemented by a universal set of quantum gates ($X$, $Z$, $H$, $S$, $T$,
CNOT, CZ, Toffoli). But, the data center only performs one
${\pi\mathord{\left/{\vphantom{\pi 8}}\right.\kern-1.2pt}8}$ rotation operator
from ${\pi\mathord{\left/{\vphantom{\pi 8}}\right.\kern-1.2pt}8}$ rotation
operator set $\\{$${R_{z}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, ${R_{y}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $C{R_{z}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $C{R_{y}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $CC{R_{z}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$, $CC{R_{y}}({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})$$\\}$ on qubits sent by the key center each time,
and sends these qubits back to the key center. Repeating this process multiple
times can complete any quantum gate in the circuit of search computation. This
kind of strategy can make the data center unable to know the positions and the
orders of quantum gates in the circuit, which guarantees the blindness of
computation. When the search computation finishes, the key center generate
corresponding decryption key. Finally, the clients who need the search result
from the data center, also use $X$ and $Z$ gates to decrypt the encrypted
search result with the decryption key.

The rest of the paper is organized as follows. Sect. 2 provides some
preliminary knowledge about quantum computation and circuit-based blind
quantum computation. Then, a quantum searchable encryption scheme for cloud
data based on full-blind quantum computation is proposed in Sect. 3. Moreover,
we give a concrete example that use Grover algorithm to search on encrypted
2-qubit state in Sect. 4. And the security of our scheme is analysed in Sect.
5. Sect. 6 is devoted to compare our scheme with some existing SE schemes and
BQC schemes. Finally, Sect. 7 gives discussion and conclusion of this paper.

##  2 Preliminaries

###  2.1 Quantum computation

In quantum compution, the quantum bit (called qubit) [51] is the basic unit of
quantum information and has two possible states $\left|0\right\rangle$ and
$\left|1\right\rangle$, which is often referred to as quantum superposition
state,

$\left|\varphi\right\rangle=\alpha\left|0\right\rangle+\beta\left|1\right\rangle,$
(1)

where $\alpha$, $\beta$ are complex numbers, and
${\left|\alpha\right|^{2}}+{\left|\beta\right|^{2}}=1$. $\left|0\right\rangle$
and $\left|1\right\rangle$ can be represented by vectors,

$\left|0\right\rangle=\left[\begin{array}[]{l}1\\\ 0\end{array}\right],{\kern
1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern
1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern 1.0pt}{\kern
1.0pt}{\kern 1.0pt}{\kern
1.0pt}\left|1\right\rangle=\left[\begin{array}[]{l}0\\\ 1\end{array}\right].$
(2)

Then, $\left|\varphi\right\rangle$ can be expressed in vector form
$\left|\varphi\right\rangle=\left(\begin{smallmatrix}\alpha\\\
\beta\end{smallmatrix}\right)$.

With the information carrier (qubit), we also need some quantum gates to
implement the information processing. For single-qubit gates, we have Pauli-X,
Pauli-Z, H (Hadamard), S and T gates, which can be described as $2\times 2$
unitary matrices as below,

$\begin{split}&\textit{X}=\left[{\begin{matrix}0&1\\\
1&0\end{matrix}}\right],{\kern 4.0pt}\textit{Z}=\left[{\begin{matrix}1&0\\\
0&-1\\\ \end{matrix}}\right],{\kern
4.0pt}\textit{H}=\frac{1}{{\sqrt{2}}}\left[{\begin{matrix}1&1\\\
1&{-1}\end{matrix}}\right],{\kern 4.0pt}\\\
&\textit{S}=\left[{\begin{matrix}1&0\\\ 0&{i}\end{matrix}}\right],{\kern
4.0pt}\textit{T}=\left[{\begin{matrix}1&0\\\
0&{{e^{{{i\pi}\mathord{\left/{\vphantom{{i\pi}4}}\right.\kern-1.2pt}4}}}}\end{matrix}}\right].\end{split}$
(3)

Especially, Ref. [51] also points out that for arbitrary unitary operator $U$
performed on single-qubit, there exist $\theta$, $\alpha$, $\beta$ and
$\gamma$, s.t.

$\begin{split}U&={e^{i\theta}}{R_{z}}(\alpha){R_{y}}(\beta){R_{z}}(\gamma)\\\
&=\left({\begin{matrix}{{e^{i(\theta-\frac{\alpha}{2}-\frac{\gamma}{2})}}\cos\frac{\beta}{2}}&{-{e^{i(\theta-\frac{\alpha}{2}+\frac{\gamma}{2})}}\sin\frac{\beta}{2}}\\\
{{e^{i(\theta+\frac{\alpha}{2}-\frac{\gamma}{2})}}\sin\frac{\beta}{2}}&{{e^{i(\theta+\frac{\alpha}{2}+\frac{\gamma}{2})}}\cos\frac{\beta}{2}}\\\
\end{matrix}}\right)\end{split}$ (4)

For double-qubit gates, the commonly used multi-qubit gates are CNOT and CZ
gates. The matrix representations and quantum circuits of CNOT and CZ are
shown in Fig. 1 and Fig. 2, respectively.

Figure 1: Matrix representation and quantum circuit of CNOT gate.
Figure 2: Matrix representation and quantum circuit of CZ gate.

Finally, for triple-qubit gates, Toffoli gate is another frequently used
multi-qubit gate, which is illustrated in Fig. 3. With these single-qubit
gates and multi-qubit gates, we can implement arbitrary quantum computation.

Figure 3: Truth table and quantum circuit of Toffoli gate.

###  2.2 Circuit-based blind quantum computation

Fisher [44] and Broadbent [45] proposed a specific blind quantum computation
scheme based on quantum circuit. It (see Fig. 4 a) starts with a client who
has quantum information that needs to be sent to a remote server for
processing. The client first encrypts one input qubit
$\left|\psi\right\rangle$ and sends it to a quantum server, who performs a
computation $U$ on the encrypted qubit. The server returns the state which the
client decrypts to get $U\left|\psi\right\rangle$.

In the scheme, to encrypt a qubit $\left|\psi\right\rangle$, a client applies
a combination of Pauli $X$ and $Z$ operations to get a encrypted qubit
${X^{a}}{Z^{b}}\left|\psi\right\rangle$, where $a,b\in\\{0,1\\}$ (as well as
$c,d\in\\{0,1\\}$ for the CNOT gate in Fig. 4f). Then, the server perform
quantum computing $U$, which is composed of unitary operations from the
Clifford group $\\{X,Z,H,S,\textit{CNOT}\\}$ and one additional non-Clifford
gate, $T$ gate. As shown in Fig. 4 b-f, when
$U\in\\{X,Z,H,S,\textit{CNOT}\\}$, clifford gates do not require any
additional resources, and decryption is straightforward. However, when $U=T$
(see Fig. 4 g), the server requires the client to send an auxiliary qubit
${Z^{d}}{P^{y}}\left|+\right\rangle$, where $y,d\in\\{0,1\\}$. to control a
CNOT gate with the encrypted qubit. The server measures the encrypted qubit
and outcome $c\in\\{0,1\\}$ is returned to the client, which is used in
decryption. The client sends a single classical bit, $x=a\oplus y$, to control
a $S$ gate on the auxiliary qubit, which is returned to the client as
${X^{a^{\prime\prime}}}{Z^{b^{\prime\prime}}}R\left|\psi\right\rangle$, where
$a^{\prime\prime}=a\oplus c$ and $b^{\prime\prime}=a(c\oplus y\oplus 1)\oplus
b\oplus d\oplus y$.

Figure 4: The process of blind quantum computation for each quantum gate in
Fisher’s and Broadbent’s schemes

In Ref.[43], Tan et al. give the circuit of CZ and Toffoli gates for blind
quantum computation,which is illustrated in Fig. 5.

Figure 5: The process of blind quantum computation for CZ and Toffoli gate

##  3 Quantum searchable encryption for cloud data based on universal full-
blind quantum computation

###  3.1 Multi-client universal circuit-based full-blind quantum computation
model

As mentioned above, these circuit-based BQC schemes (including circuit-based
FBQC schemes) are only a single-client model as shown in Fig. 6 (a), i.e.,
clients only delegate server to compute over their own encrypted data in this
model, which are not convenient to data sharing. Besides, clients need to
interact with server and compute decryption key frequently, which consume a
large amount of computing and communication resources. To solve these two
problems and keep full-blind, we propose a multi-client universal circuit-
based full-blind quantum computation model (see Fig. 7 (b)), where clients
($Alic{e_{1}}$, $Alic{e_{2}}$, $\cdots$, $Alic{e_{n}}$) outsource key
generation to a trusted key center ($Charlie$) and let key center interact
with the server (i.e., data center $Bob$). $Charlie$ and $Bob$ compose the
quantum cloud servers.

Figure 6: Single-client model (a) and multi-client model (b) of circuit-based
BQC schemes

Suppose a client $Alic{e_{1}}$ as the data owner uploads her encrypted data
$\left|\psi\right\rangle$ to $Bob$, and another client $Alic{e_{2}}$ delegates
$Bob$ to perform quantum computation on $\left|\psi\right\rangle$ to get the
computation result. The basic process of our scheme is given as below.

Step 1: $Alic{e_{1}}$ sends a number $n$ (the number of qubits in
$\left|\psi\right\rangle$) to $Charlie$.

Step 2: $Charlie$ sends back a string of $2n$ random binary bits back to
$Alic{e_{1}}$ by BB84 protocol [52]. The $2n$ bits of the binary string act as
$ek=({x_{i}},{z_{i}})$, where ${x_{i}},{z_{i}}\in\\{0,1\\}$ and
$i\in\\{1,2,\cdots,n\\}$.

Step 3: $Alic{e_{1}}$ encrypts her data $\left|\psi\right\rangle$ with $ek$
and sends encrypted state
${E_{ek}}\left|\psi\right\rangle=\otimes_{i=1}^{n}X_{i}^{{x_{i}}}Z_{i}^{{z_{i}}}\left|\psi\right\rangle$
to $Bob$.

Step 4: $Alic{e_{2}}$ asks for $Charlie$ to delegate $Bob$ to perform quantum
computation over ${E_{ek}}\left|\psi\right\rangle$, and $Charlie$ gets
${E_{ek}}\left|\psi\right\rangle$ from $Bob$.

Step 5: If $Charlie$ wants $Bob$ to perform ${G_{i}}$ (or ${G_{i,l}}$, or
${G_{i,l,k}}$) gate on ${\left|\psi\right\rangle_{i}}$ (or
${\left|\psi\right\rangle_{i,l}}$, or ${\left|\psi\right\rangle_{i,l,k}}$),
$Charlie$ needs to insert two trap qubits (or one trap qubits, or no trap
qubits) into ${\left|\psi\right\rangle_{i}}$ (or
${\left|\psi\right\rangle_{i,l}}$, or ${\left|\psi\right\rangle_{i,l,k}}$)
randomly (see Fig. 7, 8 and 9), where $G$ $\in$ $\\{$$X$, $Z$, $H$, $S$, $T$,
CNOT, CZ, Toffoli$\\}$, $i$, $l$ and $k$ represents the $i$th, $l$th and $k$th
qubit in $\left|\psi\right\rangle$ respectively.

Step 6: $Charlie$ sends 3 prepared qubits to $Bob$ and instructs $Bob$ to
perform rotation operator ${U_{i}}$ (or ${U_{i,l}}$, or ${U_{i,l,k}}$) on
these 3 qubits, where $U$ $\in$
$\\{$${R_{z}}({\pi\mathord{\left/{\vphantom{\pi 4}}\right.\kern-1.2pt}4})$,
${R_{y}}({\pi\mathord{\left/{\vphantom{\pi 4}}\right.\kern-1.2pt}4})$,
$C{R_{z}}({\pi\mathord{\left/{\vphantom{\pi 4}}\right.\kern-1.2pt}4})$,
$C{R_{y}}({\pi\mathord{\left/{\vphantom{\pi 4}}\right.\kern-1.2pt}4})$,
$CC{R_{z}}({\pi\mathord{\left/{\vphantom{\pi 4}}\right.\kern-1.2pt}4})$,
$CC{R_{y}}({\pi\mathord{\left/{\vphantom{\pi 4}}\right.\kern-1.2pt}4})$$\\}$,
where ${R_{z}}({\mu_{1}}{\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})={R_{z}}{({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})^{{\mu_{1}}}}$ and
${R_{y}}({\mu_{2}}{\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})={R_{y}}{({\pi\mathord{\left/{\vphantom{\pi
4}}\right.\kern-1.2pt}4})^{{\mu_{2}}}}$, $i$, $l$ and $k$ represents the
$i$th, $l$th and $k$th qubit in these 3 qubits, respectively.

Step 7: $Bob$ performs rotation operator $U$ on 3 qubits, and sends back to
$Charlie$.

Step 8: $Charlie$ performs $X$ and $Z$ operations on 3 qubits as needed.

Step 9: Repeat Step 6 to 8 until $Charlie$ gets
$(\otimes_{i=1}^{n}X_{i}^{{{x^{\prime}}_{i}}}Z_{i}^{{{z^{\prime}}_{i}}})\otimes
G\left|\psi\right\rangle$ and generates decryption key
$dk=({{x^{\prime}}_{i}},{{z^{\prime}}_{i}})$, where $G$ gate can be composed
of a plurality of $U$ gates (as shown in Eq. 5) and
${{x^{\prime}}_{i}},{{z^{\prime}}_{i}}\in\\{0,1\\}$. When $U$ is used as a
trap gate, it can be executed in any order.

$\begin{split}&X={e^{\frac{{i\pi}}{2}}}{R_{y}}(\pi){R_{z}}(\pi),Z={e^{\frac{{i\pi}}{2}}}{R_{z}}(\pi){R_{y}}(0),\\\
&H={e^{\frac{{i\pi}}{2}}}{R_{y}}(\frac{\pi}{2}){R_{z}}(\pi),S={e^{\frac{{i\pi}}{4}}}{R_{z}}(\frac{\pi}{2}){R_{y}}(0),\\\
&T={e^{\frac{{i\pi}}{8}}}{R_{z}}(\frac{\pi}{4}){R_{y}}(0),\\\
&C{Z_{12}}={[C-({e^{\frac{{i\pi}}{2}}}{R_{z}}(\pi){R_{y}}(0))]_{12}},\\\
&CNO{T_{12}}={[C-({e^{\frac{{i\pi}}{4}}}{R_{z}}(\frac{\pi}{2}){R_{y}}(0))]_{12}},\\\
&Toffol{i_{12,3}}={[CC-X]_{12,3}},\end{split}$ (5)

where ${R_{y}}(0)={R_{z}}(0)=I$, $-{R_{y}}(2\pi)=-{R_{y}}(\frac{\pi}{4})=I$,
${R_{y}}(\pi)={R_{y}}{(\frac{\pi}{4})^{4}}$,
${R_{y}}(\frac{\pi}{2})={R_{y}}{(\frac{\pi}{4})^{2}}$,
${R_{z}}(\frac{\pi}{2})={R_{z}}{(\frac{\pi}{4})^{2}}$,
${R_{z}}(\pi)={R_{z}}{(\frac{\pi}{4})^{4}}$, ${(C-{R_{y}}(\theta))_{12}}$=
$\left(\begin{smallmatrix}1&0&0&0\\\ 0&1&0&0\\\
0&0&\cos\frac{\theta}{2}&\sin\frac{\theta}{2}\\\
0&0&\sin\frac{\theta}{2}&\cos\frac{\theta}{2}\end{smallmatrix}\right)$ and
${(C-{R_{z}}(\theta))_{12}}$= $\left(\begin{smallmatrix}1&0&0&0\\\ 0&1&0&0\\\
0&0&{e^{-\frac{{i\theta}}{2}}}&0\\\
0&0&0&{e^{\frac{{i\theta}}{2}}}\end{smallmatrix}\right)$. In our scheme, the
global phase factors (${e^{\frac{{i\theta}}{2}}}$) are ignored.

Step 10: Repeat Step 5 to 9 until $Charlie$ gets
${E_{dk}}\left|{result}\right\rangle=(\otimes_{i=1}^{n}X_{i}^{{{x^{\prime}}_{i}}}Z_{i}^{{{z^{\prime}}_{i}}})(\otimes_{j=1}^{s}{G_{j}})\left|\psi\right\rangle=(\otimes_{i=1}^{n}X_{i}^{{{x^{\prime}}_{i}}}Z_{i}^{{{z^{\prime}}_{i}}})\left|{result}\right\rangle$
and generates final decryption key
$dk=({{x^{\prime}}_{i}},{{z^{\prime}}_{i}})$, where $s$ represents the number
of $G$ gate in the circuit of quantum computation, $j\in\\{1,2,\cdots,s\\}$
and $\left|{result}\right\rangle$ is the computation result which
$Alic{e_{2}}$ needs.

Step 11: $Charlie$ sends ${E_{dk}}\left|{result}\right\rangle$ and $dk$ to
$Alic{e_{2}}$, where $dk$ is transformed by BB84.

Step 12: $Alic{e_{2}}$ decrypts the encrypted result
${E_{dk}}\left|{result}\right\rangle$ with $dk$, to get
$\left|{result}\right\rangle$.

To better understand our multi-client universal FBQC scheme, we give three
examples of delegating $Bob$ to perform one single-qubit gate (X gate in Fig.
7), one double-qubit gate (CZ gate in Fig. 8), and one triple-qubit gate
(Toffoli gate in Fig. 9), respectively. For the sake of simplicity, we mainly
explain Step 5 to 9 in these examples.

####  3.1.1 single-qubit gate - X gate

1\. $Charlie$ sends 3 encrypted qubits
$X_{1}^{a}Z_{1}^{b}{\left|\psi\right\rangle_{1}}\otimes
X_{2}^{c}Z_{2}^{d}{\left|\phi\right\rangle_{2}}\otimes
X_{3}^{e}Z_{3}^{f}{\left|\phi\right\rangle_{3}}$ to $Bob$
(${\left|\phi\right\rangle_{2}}$ and ${\left|\phi\right\rangle_{3}}$ are trap
qubits, and their positions are arbitrary.).

2\. $Bob$ performs four rounds (i.e., Step 6 to 8)
${R_{z}}{(\frac{\pi}{4})_{1}}$ on qubit
$X_{1}^{a}Z_{1}^{b}{\left|\psi\right\rangle_{1}}$ and returns 3 qubits to
himself through $Charlie$.

3\. $Bob$ performs four rounds ${R_{y}}{(\frac{\pi}{4})_{1}}$ on
${R_{z}}{(\pi)_{1}}{X^{a}}{Z^{b}}{\left|\psi\right\rangle_{1}}$ and returns 3
qubits to himself through $Charlie$.

4\. To confuse the actual delegating operations, $Bob$ also performs eight
rounds ${(C-{R_{z}}(\frac{\pi}{4}))_{23}}$,
${(CC-{R_{y}}(\frac{\pi}{4}))_{12,3}}$, ${(C-{R_{y}}(\frac{\pi}{4}))_{12}}$
and ${(CC-{R_{z}}(\frac{\pi}{4}))_{12,3}}$ on 3 qubits. Note, all trap gates
are randomly inserted without affecting the original circuits.

5\. $Charlie$ gets $(X_{1}^{a}Z_{1}^{b}){X_{1}}{\left|\psi\right\rangle_{1}}$
from $Bob$ and generates decryption key $dk={(a,b)_{1}}$.

Figure 7: Our model for single-qubit gates $X$, $Z$, $H$, $S$ and $T$ ($a$,
$b$, $c$, $d$, $e$, $f$ $\in$ $\\{0,1\\}$), where the sign 1 belongs to
$\left|\psi\right\rangle$ and the signs 2 and 3 belong to trap qubits,
respectively. And the blue, green, red and brown dotted line indicates the
encryption operations, the actual operations, the trap operations and the
decryption operations, respectively.

####  3.1.2 double-qubit gate - CZ gate

1\. $Charlie$ sends 3 encrypted qubits $(X_{1}^{a}Z_{1}^{b}\otimes
X_{2}^{c}Z_{2}^{d}){\left|\psi\right\rangle_{1,2}}\otimes
X_{3}^{e}Z_{3}^{f}{\left|\phi\right\rangle_{3}}$ to $Bob$
(${\left|\phi\right\rangle_{3}}$ is a trap qubit.).

2\. Bob performs four rounds ${(C-{R_{z}}(\frac{\pi}{4}))_{12}}$ on
$(X_{1}^{a}Z_{1}^{b}\otimes
X_{2}^{c}Z_{2}^{d}){\left|\psi\right\rangle_{1,2}}$ and returns 3 qubits to
himself through $Charlie$.

3\. To confuse the actual delegating operations, $Bob$ also performs eight
rounds ${(C-{R_{z}}(\frac{\pi}{4}))_{23}}$,
${(CC-{R_{y}}(\frac{\pi}{4}))_{12,3}}$, ${(C-{R_{y}}(\frac{\pi}{4}))_{12}}$
and ${(CC-{R_{z}}(\frac{\pi}{4}))_{12,3}}$ on 3 qubits.

4\. $Charlie$ gets $(X_{1}^{a}Z_{1}^{b\oplus c}\otimes X_{2}^{c}Z_{2}^{a\oplus
d})C{Z_{12}}{\left|\psi\right\rangle_{1,2}}$ from $Bob$ and generates
decryption key $dk=\\{{(a,b\oplus c)_{1}},{(c,a\oplus d)_{2}}\\}$.

Figure 8: Our model for double-qubit gates CZ and CNOT.

####  3.1.3 triple-qubit gate - Toffoli gate

1\. $Charlie$ sends encryption quantum states $(X_{1}^{a}Z_{1}^{b}\otimes
X_{2}^{c}Z_{2}^{d}\otimes
X_{3}^{e}Z_{3}^{f}){\left|\psi\right\rangle_{1,2,3}}$ to $Bob$.

2\. $Bob$ performs four rounds ${(CC-{R_{z}}(\frac{\pi}{4}))_{12,3}}$ on
$(X_{1}^{a}Z_{1}^{b}\otimes X_{2}^{c}Z_{2}^{d}\otimes
X_{3}^{e}Z_{3}^{f}){\left|\psi\right\rangle_{1,2,3}}$ and returns 3 qubits to
himself through $Charlie$.

3\. $Bob$ performs four rounds ${(CC-{R_{y}}(\frac{\pi}{4}))_{12,3}}$ and
returns 3 qubits to himself through $Charlie$.

4\. When $f=1$, $Charlie$ should encrypt 3 qubits again by performing
$(X_{1}^{{a_{1}}\cdot f}Z_{1}^{{b_{1}}\cdot f})\otimes(X_{2}^{{c_{1}}\cdot
f}Z_{2}^{{d_{1}}\cdot f})$ on first 2 qubits and send them to $Bob$. It is the
same for the similar case (when $a=c=1$). $Bob$ performs four rounds
${(C-R_{z}^{f}(\frac{\pi}{4}))_{12}}$ and returns 3 qubits to $Charlie$.
$Charlie$ needs to decrypt by performing $(X_{1}^{{a_{1}}\cdot
f}Z_{1}^{({b_{1}}\oplus{c_{1}})\cdot f})\otimes(X_{2}^{{c_{1}}\cdot
f}Z_{2}^{({a_{1}}\oplus{d_{1}})\cdot f})$ on first 2 qubits.

4\. $Charlie$ performs ${I_{1}}\otimes X_{2}^{c}Z_{2}^{d}\otimes
X_{3}^{e}Z_{3}^{f}$ on 3 qubits and returns them to $Bob$.

5\. $Bob$ performs four rounds ${(C-R_{z}^{c}(\frac{\pi}{4}))_{13}}$ and
${(C-R_{y}^{c}(\frac{\pi}{4}))_{13}}$, and returns to himself through
$Charlie$.

6\. Bob performs four rounds ${(C-R_{z}^{a}(\frac{\pi}{4}))_{23}}$ and
${(C-R_{y}^{a}(\frac{\pi}{4}))_{23}}$, and returns to himself through
$Charlie$.

7\. To confuse the actual delegating operations, $Bob$ performs eight rounds
${R_{z}}{(2\pi)_{1}}$, ${R_{y}}{(2\pi)_{3}}$,
${(C-{R_{z}}(\frac{\pi}{4}))_{12}}$ and ${(C-{R_{y}}(\frac{\pi}{4}))_{23}}$.

8\. $Charlie$ gets $(X_{1}^{a}Z_{1}^{b})\otimes
Toffol{i_{12,3}}{\left|\psi\right\rangle_{1,2,3}}$ from $Bob$ and generates
decryption key $dk=\\{{(a,b)_{1}},{(0,0)_{2}},{(0,0)_{3}}\\}$.

Figure 9: Our model for triple-qubit gate Toffoli.

As can be seen from the above, through trap gates, trap qubits and ways of
constant interaction, $Bob$ cannot distinguish these qubits from $Charlie$
every time whether belong to the same original quantum state. Meanwhile, he
also cannot distinguish which rotation operators belong to the same original
quantum gate.

###  3.2 Quantum searchable encryption for cloud data based on full-blind
quantum computation

We have established a multi-client universal circuit-based FBQC framework for
easy data sharing. To achieve the aim of searchable encryption, we propose a
concrete quantum searchable encryption scheme for cloud data based on full-
blind quantum computation (QSE-FBQC). For the sake of simplicity, we take four
roles (the data owner $Alic{e_{1}}$, the data searcher $Alic{e_{2}}$, the data
center $Bob$ and the key center $Charlie$) as an example to describe our
scheme. The specific process of QSE-FBQC scheme is as follows and shown in
Fig. 11.

1\. $Alic{e_{1}}$ sends a number $n$ to $Charlie$, where $n$ is the number of
qubits which she wants to encrypt.

2\. $Charlie$ sends back a string of $2n$ random binary bits back to
$Alic{e_{1}}$ by BB84 [52]. The $2n$ bits of the binary string act as
$ek=({x_{i}},{z_{i}})$, where ${x_{i}},{z_{i}}\in\\{0,1\\}$ and
$i\in\\{1,2,\cdots,n\\}$.

3\. $Alic{e_{1}}$ encrypts her plain data
$\left|\psi\right\rangle=\frac{1}{{\sqrt{M}}}\sum\limits_{j=0}^{M-1}{\left|{j,data(j)}\right\rangle}$
with $ek$ and sends encrypted state
${E_{ek}}\left|\psi\right\rangle=\frac{1}{{\sqrt{M}}}({I^{\otimes
m}}\otimes(\otimes_{i=1}^{n}X_{i}^{{x_{i}}}Z_{i}^{{z_{i}}}))\sum\limits_{j=0}^{M-1}{\left|{j,data(j)}\right\rangle}$
to $Bob$, where the item index $j$ within $\left|\psi\right\rangle$ is not
encrypted and composed of $m$ qubits, $M={2^{m}}$, ${data(j)}$ is the data and
composed of $n$ qubits.

4\. $Alic{e_{2}}$ wants $Bob$ to search over
${E_{ek}}\left|\psi\right\rangle$, and $Charlie$ interacts with $Bob$
according to the quantum circuit of search computing, which is as same as Step
5 to 10. The search computation can be composed of Grover algorithm, which is
illustrated in Fig. 10. For a search space of $N={2^{n}}$ elements and one
solution, we only need to apply the search oracle $O(\sqrt{N})$ times to
obtain a solution. During the interaction between Bob and Charlie, the sender
needs to add decoy qubits to the data and record their location. When the
receiver receives the data, the sender announces the states and locations of
the decoy qubits (selected from
$\left\\{{\left|0\right\rangle,\left|1\right\rangle,\left|+\right\rangle,\left|-\right\rangle}\right\\}$),
and the receiver confirms whether it is the same as the published state by
measuring the state of the decoy qubits. If they are the same, the receiver
proceeds to the next step; otherwise, the sender resends the data.

Figure 10: Schematic circuit for Grover algorithm. (b) is the schematic
circuit for $G$ in (a).

5\. When the search computation is completed, $Charlie$ sends the search
result ${E_{dk}}\left|{search\\_result}\right\rangle$ and decryption key $dk$
to $Alic{e_{2}}$, where $dk$ is transformed by BB84.

6\. $Alic{e_{2}}$ uses $dk$ to decrypt the state
${E_{dk}}\left|{search\\_result}\right\rangle$, and gets
$\left|{search\\_result}\right\rangle$.

Figure 11: The process of our QSE-FBQC scheme

##  4 An example of QSE-FBQC scheme

Suppose $Alic{e_{1}}$ has a set 00, 01, 10, 11 and $Alic{e_{2}}$ wants to find
item 01 from this set. It is equivalent to using Grover algorithm to find
$\left|0\right\rangle\left|1\right\rangle$ from
$\left|+\right\rangle\left|+\right\rangle$, and the circuit of search
computation is shown in Fig. 12. The example proceeds in seven steps provided
below.

1\. $Alic{e_{1}}$ sends a number 2 to $Charlie$.

2\. $Charlie$ sends a string of 4 random binary bits (act as $ek$) back to
$Alic{e_{1}}$ by BB84 protocol.

3\. $Alic{e_{1}}$ encrypts her data
$\left|\psi\right\rangle={\left|+\right\rangle_{1}}{\left|+\right\rangle_{2}}$
with $X$ and $Z$ gates according to $ek$.

4\. $Alic{e_{2}}$ wants to get
${\left|0\right\rangle_{1}}{\left|1\right\rangle_{2}}$ from
${E_{ek}}\left|\psi\right\rangle$, and $Charlie$ interacts with $Bob$
according to the quantum circuit of search computing in Fig. 12. $Charlie$
needs to insert an auxiliary qubit $\left|1\right\rangle$ into
$\left|\psi\right\rangle$ firstly. The whole process of search computing is
shown in Fig. 13.

5\. When the search is completed, $Charlie$ sends the search result state
$(X_{1}^{{x_{1}}}Z_{1}^{{z_{1}}})\otimes(X_{2}^{{z_{1}}}Z_{2}^{0})\otimes(X_{3}^{0}Z_{3}^{0}){\left|{result}\right\rangle_{1,2,3}}$
and $dk=\\{{({x_{1}},{z_{1}})_{1}},{({z_{1}},0)_{2}},{(0,0)_{3}}\\}$ to
$Alic{e_{2}}$.

6\. $Alic{e_{2}}$ uses $dk$ to decrypt the state
$(X_{1}^{{x_{1}}}Z_{1}^{{z_{1}}})\otimes(X_{2}^{{z_{1}}}Z_{2}^{0})\otimes(X_{3}^{0}Z_{3}^{0}){\left|{result}\right\rangle_{1,2,3}}$,
and abandons the auxiliary third qubit to get
${\left|0\right\rangle_{1}}{\left|1\right\rangle_{2}}$ (the global phase
factors are ignored).

Figure 12: The circuit of Grover algorithm for
${\left|0\right\rangle_{1}}{\left|1\right\rangle_{2}}$ from
${\left|+\right\rangle_{1}}{\left|+\right\rangle_{2}}$.
Figure 13: The whole process of search computing on
${\left|+\right\rangle_{1}}{\left|+\right\rangle_{2}}{\left|1\right\rangle_{3}}$.

##  5 Security analysis

In this section, the security of the proposed QSE-FBQC scheme is analyzed as
below. We analyze the security from two aspects: external attacks and internal
attacks. The former refers to the attacks by the eavesdroppers outside the
protocol, while the latter refers to the attacks by the data center in the
scheme.

###  5.1 External attack

Let Eve be an eavesdropper, who tries to get some information about clients’
data. To get the information, he firstly needs to get encryption or decryption
key from $Charlie$, because all of the transmitted data are encrypted by the
key. First, he can perform the intercept-and-resend attack by intercepting all
qubits sent from $Charlie$ and resending fake qubits to the client in Step 2
or 11. However, due to the use of BB84 protocol, all qubits are encoded into
$X$ or $Z$ basis according to the classical key, Eve cannot distinguish which
basis each qubit belongs to and gets nothing form these qubits. And the client
can check for the existence of such attack by measuring the received fake
qubits. Then, the client can abandon this key and ask $Charlie$ to regenerate
a new key.

Besides, Eve may also perform the intercept-and-resend attack during the
communication between $Bob$ and $Charlie$. Due to the existence of tarp qubits
and trap gates, Eve cannot distinguish which qubits are not trap qubits, and
which required operations are actual operations. But this kind of attack will
destroy the results of the delegated computation because of fake qubits sent
by Eve. $Charlie$ can insert decoy qubits randomly, which consist of $X$-basis
and $Z$-basis, and record the positions of them. Similar to BB84 protocol,
when $Bob$ gets all qubits, $Charlie$ announce the positions and the state of
decoy qubits. $Bob$ can check for the existence of such attack with a higher
probability by measuring the decoy qubits. For example, if the number of decoy
qubits used for eavesdropping checking is $m$, the success probability of
detecting the existence of Eve is
$1-{\left({{3\mathord{\left/{\vphantom{34}}\right.\kern-1.2pt}4}}\right)^{m}}$,
which obviously increases with the increase of $m$, and which is close to 1
when $m$ is large enough.

###  5.2 Internal attack

The internal attack mainly caused by $Bob$, who wants to know the information
about the data and the computation. In a sense, to immunize internal attacks
is actually to ensure the blindness of the data and the computation, which is
analysed as below.

####  5.2.1 The blindness of data

For the blindness of data in our scheme, $Alice$ performs encryption
operations $X$ and $Z$ on $n$-qubit state $\left|\psi\right\rangle$, and then
sends these encrypted qubits
$\otimes_{i=1}^{n}X_{i}^{{x_{i}}}Z_{i}^{{z_{i}}}\left|\psi\right\rangle$ to
$Bob$. Although $Bob$ intercepts them, he does not know the value of
$({x_{i}},{z_{i}})$ ($i\in\\{1,2,\cdots,n\\}$), he still cannot get anything
from the encrypted data.

However, the circuit of $T$ gate and Toffoli gate for blind quantum
computation is special. Because $Charlie$ is not able to perform the $S$, CNOT
and CZ corrections, respectively, which the three operations should be
delegated to $Bob$. Once $Bob$ obtains the information of corrections, then
the encryption keys of encrypted qubits are exposed. So, $Charlie$ needs to
encrypt qubits again with $X$ and $Z$ operations when the $S$, CNOT and CZ
corrections need to be delegated. Therefore, $Bob$ can not distinguish whether
these qubits belong to the original quantum state and get nothing from the
encrypted qubits.

####  5.2.2 The blindness of computation

The computation that the client wants to implement can be seen as a desirable
circuit which is made up of the delegated quantum gates, therefore the
blindness of computation is equivalent to the blindness of the delegated
quantum gates. In order to make the delegated quantum gates blind, these
quantum gates ($G$ gate) can be decomposed into the combination of rotation
operators ($U$ gate). $Bob$ performs partial rotation operators in every
round, which can compose the actual $G$ gate or trap gates, so he does not
know what is the correct gate. That is, $Charlie$ can successfully hide
quantum computation process.

Without loss of generality, we give an simple example to explain our model.
Suppose $Charlie$ wants to delegate quantum gates $H$, $X$, CZ and Toffoli to
$Bob$, while $Bob$ cannot know the data and the content of computation in our
model. The data have already been all encrypted by $Alice$ with gates $X$ and
$Z$. Let all rotation operators have labels according to the order in every
quantum circuit from left to right. In quantum circuit of gate $H$, the
performing order of these rotation operators is ${h_{1}}$, ${h_{2}}$,
$\cdots$, ${h_{m}}$. In quantum circuit of gate $X$, the performing order of
these rotation operators is ${x_{1}}$, ${x_{2}}$, $\cdots$, ${x_{n}}$. In
quantum circuit of gate CZ, the performing order of these rotation operators
is ${c_{1}}$, ${c_{2}}$, $\cdots$, ${c_{d}}$. In quantum circuit of gate
Toffoli, the performing order of these rotation operators is ${t_{1}}$,
${t_{2}}$, $\cdots$, ${t_{w}}$. Note that, ${h_{i}}$, ${x_{i}}$, ${c_{i}}$ and
${t_{i}}$ $\in$ $U$. In the model, all gates are started in an arbitrary way,
i.e., the process is randomly designed by $Charlie$, such as ${t_{1}}$,
${x_{1}}$, ${c_{1}}$, ${h_{1}}$, ${c_{2}}$, ${x_{2}}$, $\cdots$, ${t_{w}}$,
${x_{n}}$, ${c_{d}}$, ${h_{m}}$. $Bob$ cannot distinguish these qubits from
$Charlie$ every time whether belong to the same original quantum states.
Meanwhile, he also cannot distinguish which rotation operators belong to a
quantum gate. Therefore, $Bob$ cannot know what gates are realized in our
model.

##  6 Performance evaluation

In order to evaluate our scheme, we chose two classical searchable encryption
(SE) schemes [29, 26] and two blind quantum computation (BQC) schemes [45, 47]
as references, and compare our QSE-FBQC scheme with them from the following
aspects: time complexity of index construction, time complexity of search ,
full-blind, multi-client access and eavesdropping detection.

The classical SE schemes generally consists of three main parts: index
construction, trapdoor generation and search. Since the process of index
construction and trapdoor generation are to encrypt the keyword set $W$
extracted from data or query keywords ${\tilde{W}}$ through the encryption key
$SK$, the time complexity of each process is similar. Therefore, we only
consider the aspect of the time complexity of index construction. Suppose that
the number of entries for the data is $N$. In Cao et al.’s and Fu et al.’s SE
scheme, the major computation in the phase of index construction includes the
splitting procedure and two multiplications of a
$\left({cN+u+1}\right)\times\left({cN+u+1}\right)$ matrix and a
$\left({cN+u+1}\right)$ vector, where $c$ and $u$ are constants, and ${cN}$
represents the number of keywords in $W$. So the time complexity is
$O({N^{2}})$. However, it does not need the process of index construction and
trapdoor generation, and make search computation over encrypted data directly
in Broadbent’s BQC scheme, Liu et al.’s BQC scheme and our scheme. So the time
complexity of index construction is 0. On the other hand, although Fu et al.’s
SE scheme based on user interest model is more efficient than Cao et al.’s
scheme when users request more relevant data, the time complexity of search
are both $O(N)$. But, these mentioned BQC schemes and our scheme use Grover
algorithm to make a quadratic speedup in search, so the time complexity are
$O(\sqrt{N})$. For a more intuitive representation, the results of the
comparison are shown in Table 1.

As we can see, BQC schemes and our scheme are significantly more efficient
than the classical SE schemes in the aspect of search efficiency. However,
these BQC schemes do not support multi-client access, which is not convenient
for data sharing in cloud environment. And all clients in our scheme outsource
the key generation to a trusted key center, which is easy to make each client
get search result by the decryption key from the key center. Besides, although
Liu et al. consider that the desirable delegated quantum operation, one of
$\\{H,P,CNOT,T\\}$, is replaced by a fixed sequence $(H,P,CZ,CNOT,T)$ to make
the computation blind, they do not consider detecting eavesdroppers when two
parties communicate with each other in their scheme. Our scheme takes the
strategy of inserting decoy qubits into transmitted data to check for
eavesdropping behavior.

Table 1: Comparison with classical SE schemes and BQC schemes  Schemes | Cao et al.’s | Fu et al.’s | Broadbent’s | Liu et al.’s | Our scheme
---|---|---|---|---|---
SE scheme[29] | SE scheme[26] | BQC scheme[45] | BQC scheme[47]
Time complexity of index construction | $O({N^{2}})$ | $O({N^{2}})$ | 0 | 0 | 0
Time complexity of search | $O(N)$ | $O(N)$ | $O(\sqrt{N})$ | $O(\sqrt{N})$ | $O(\sqrt{N})$
Full-blind quantum computation | No | No | No | Yes | Yes
Multi-client access | Yes | Yes | No | No | Yes
Eavesdropping detection | No | No | No | No | Yes

##  7 Discussion and conclusion

In this paper, we firstly propose a multi-client circuit-based full-blind
quantum computation model, and then apply this model on the searchable
encryption to get a QSE-FBQC scheme. In our scheme, different clients with
limited quantum ability can upload their encrypted data to a powerful but
untrusted quantum data center and the data center can search on the encrypted
data without decryption. Besides, the data center also cannot know what search
computation he has implemented by himself, i.e., making the computation blind.

In the field of classical searchable encryption (SE), most schemes are either
based on public key (RSA) [23], or based on symmetric key [20, 22]. As we
know, RSA has been theoretically broken by Shor algorithm [30] in polynomial
time, while some symmetric cryptosystems, such as CBC-MAC, GMAC, GCM, etc.,
also have been recently broken by using quantum period finding [31, 32].
Therefore, how to use quantum technology to implement SE becomes an
interesting work worth studying, which motivates us to study searchable
encryption using blind quantum computation. Although some circuit-based BQC
schemes [42, 43, 44, 45, 46, 47] have been continuously proposed in recent
years, they only consider the single-client model, which cannot meet the
requirements of multi-client accessing or searching data in the cloud
environment. Besides, almost all of these schemes focus on guaranteeing the
blindness of the data, while ignoring the blindness of the computation. The
second motivation of our work is to implement the multi-client access mode as
well as guarantee the blindness of computation.

This work designs a multi-client FBQC model, and utilizes it to propose a
quantum SE scheme in cloud environment, but it maybe need some improvements or
extensions in a practical one. In our scheme, the trusted key center hosts all
the keys, so he becomes the cornerstone of the security and would also be the
target of attacks (including quantum attacks). How to guarantee his security,
i.e., to protect him from various attacks, will become an aspect to be
explored. Second, how to prevent illegal user access in the multi-party FBQC
model is not considered in this article, maybe quantum identity authentication
(QIA) [50] is a feasible one of the candidate solutions.

## Acknowledgment

The authors would like to express heartfelt gratitude to the anonymous
reviewers and editor for their comments that improved the quality of this
paper. And the support of all the members of the quantum research group of
NUIST is especially acknowledged, their professional discussions and advice
have helped us a lot.

## References

  * [1] F. Wang, J. Xu, X. Wang, S. G. Cui, ”Joint offloading and computing optimization in wireless powered mobile-edge computing systems,” IEEE Transactions on Wireless Communications, vol. 17, no. 3, pp. 1784-1797, 2018.
  * [2] X. Xu, Y. Li, T. Huang, Y. Xue, K. Peng, L. Qi, W. Dou, ”An energy-aware computation offloading method for smart edge computing in wireless metropolitan area networks,” Journal of Network and Computer Applications, vol. 133, pp. 75-85, 2019.
  * [3] X. Li, G. Xu, X. Zheng, K. Liang, E. Panaousis, T. Li, W. Wang, C. Shen, ”Using sparse representation to detect anomalies in complex WSNs,” ACM Trans. Intell. Syst. Technol., vol. 10, no. 6, pp. 1-18, 2019.
  * [4] K. Ota, M. Dong, J. Gui, A. Liu, ”QUOIN: Incentive mechanisms for crowd sensing networks,” IEEE Network, vol. 32, no. 2, pp. 114-119, 2018.
  * [5] L. Qi, X. Xu, W. Dou, J. Yu, Z. Zhou, X. Zhang, ”Time-aware IoE service recommendation on sparse data,” Mobile Information Systems, vol. 2016, Article ID 4397061, 2016.
  * [6] X. Xu, Q. Liu, Y. Luo, K. Peng, X. Zhang, S. Meng, L. Qi, ”A computation offloading method over big data for IoT-enabled cloud-edge computing,” Future Generation Computer Systems, vol. 95, pp. 522-533, 2019.
  * [7] H. Ren, H. Li, Y. Dai, K. Yang, X. Lin, ”Querying in internet of things with privacy preserving: challenges, solutions and opportunities,” IEEE Network, vol. 32, no. 6, pp. 144-151, 2018.
  * [8] G. Xu, Y. Zhang, L. Jiao, E. Panaousis, K. Liang, H. Wang, X. Li, ”DT-CP: A daouble-TTPs based contract-signing protocol with lower computational cost,” IEEE Access, 2019. DOI: 10.1109/ACCESS.2019.2952213
  * [9] X. Xu, C. He, Z. Xu, L. Qi, S. Wan, M. Z. A. Bhuiyan, ”Joint optimization of offloading utility and privacy for edge computing enabled IoT,” IEEE Internet of Things Journal, DOI: 10.1109/JIOT.2019.2944007
  * [10] L. Qi, Y. Chen, Y. Yuan, S. Fu, X. Zhang, X. Xu, ”A QoS-aware virtual machine scheduling method for energy conservation in cloud-based cyber-physical systems”, World Wide Web, 2019. DOI: 10.1007/s11280-019-00684-y
  * [11] X. Xu, X. Zhang, H. Gao, Y. Xue, L. Qi, W. Dou, ”BeCome: Blockchain-enabled computation offloading for IoT in mobile edge computing,” IEEE Transactions on Industrial Informatics. 2019. DOI: 10.1109/TII.2019.2936869
  * [12] L. Qi, R. Wang, C. Hu, S. Li, Q. He, X. Xu, ”Time-aware distributed service recommendation with privacy-preservation,” Information Sciences, vol. 480, pp. 354-364, 2019.
  * [13] G. Xu, W. Wang, L. Jiao, X. Li, K. Liang, X. Zheng, W. Lian, H. Xian, H. Gao, ”SoProtector: Safeguard privacy for native SO files in evolving mobile IoT applications,” IEEE Internet of Things Journal, 2019. DOI: 10.1109/JIOT.2019.2944006
  * [14] W. Gong, L. Qi, Y. Xu, ”Privacy-aware multidimensional mobile service quality prediction and recommendation in distributed fog environment,” Wireless Communications and Mobile Computing, vol. 2018, Article ID 3075849, 2018.
  * [15] L. Qi, X. Zhang, W. Dou, C. Hu, C. Yang, J. Chen, ”A two-stage locality-sensitive hashing based approach for privacy-preserving mobile service recommendation in cross-platform edge environment,” Future Generation Computer Systems, vol. 88, pp. 636-643, 2018.
  * [16] H. Wang, S. Ma, H. Dai, ”A rhombic dodecahedron topology for human-centric banking big data,” IEEE Transactions on Computational Social Systems, vol. 6, no. 5, pp. 1095-1105, 2019.
  * [17] F. Su, ”A survey on big data analytics technologies,” in Proc. Int. Conf. 5G Future Wireless Netw. Cham, Switzerland: Springer, 2017, pp. 359¨C370.
  * [18] H. Wang, S. Ma, H. N. Dai, M. Imran, T. Wang, ”Blockchain-based data privacy management with nudge theory in open banking,” Future Generation Computer Systems, 2019. DOI: 10.1016/j.future.2019.09.010
  * [19] C. Bösch, P. Hartel, W. Jonker, A. Peter, ”A survey of provably secure searchable encryption,” ACM Comput. Surv., vol. 47, no. 2, pp. 1801-1851, 2014.
  * [20] D. X. Song, D. Wagner, A. Perrig, ”Practical techniques for searches on encrypted data,” In: Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000, Berkeley, CA, USA, 2000, pp. 44-55.
  * [21] E.-J. Goh, ”Secure indexes,” IACR Cryptology ePrint Archive, vol. 2003, pp. 216, 2003.
  * [22] R. Curtmola, J. Garay, S. Kamara, R. Ostrovsky, ”Searchable symmetric encryption: Improved definitions and efficient constructions,” In: Proceedings of 13th ACM Conference on Computer and Communications Security, USA, 2006, pp. 79-88.
  * [23] D. Boneh, D. C. Giovanni, R. Ostrovsky, G. Persiano, ”Public key encryption with keyword search,” In: Advances in Cryptology-EUROCRYPT 2004, Interlaken, Switzerland, 2004, pp. 506-522.
  * [24] Z. Xia, X. Wang, L. Zhang, Z. Qin, X. Sun, K. Ren, ”A privacy-preserving and copy-deterrence content-based image retrieval scheme in cloud computing,” IEEE Transactions on Information Forensics and Security, vol. 11, no. 11, pp. 2594-2608, 2016.
  * [25] G. Xu, H. Li, Y. Dai, K. Yang and X. Lin, ”Enabling efficient and geometric range query with access control over encrypted spatial data,” IEEE Transactions on Information Forensics and Security, vol. 14, no. 4, pp. 870-885, 2019.
  * [26] Z. Fu, K. Ren, J. Shu, X. Sun, F. Huang, ”Enabling personalized search over encrypted outsourced data with efficiency improvement,” IEEE Transactions on Parallel and Distributed Systems, vol. 27, no. 9, pp. 2546-2559, 2016.
  * [27] L. Chen, W.-K. Lee, C.-C. Chang, K.-K. R. Choo, N. Zhang, ”Blockchain based searchable encryption for electronic health record sharing,” Future Generation Computer Systems, vol. 95, pp. 420-429, 2019.
  * [28] H. Wang, C. Guo, S. Cheng, ”LoC-A new financial loan management system based on smart contracts,” Future Generation Computer Systems, vol. 100, pp. 648-655, 2019.
  * [29] N. Cao, C. Wang, M. Li, K. Ren, W. Lou, ”Privacy-preserving multi-keyword ranked search over encrypted cloud data,” IEEE Transactions on Parallel and Distributed Systems, vol. 25, no. 1, pp. 222-233, 2014.
  * [30] P.W. Shor, ”Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” SIAM J. Comput., vol. 26, no. 5, pp. 1484-1509, 1997.
  * [31] M. Kaplan, G. Leurent, A. Leverrier, M. Naya-Plasencia, ”Breaking symmetric cryptosystems using quantum period finding,” In: CRYPTO 2016, LNCS, vol. 9815, 2016, pp. 207-237.
  * [32] X. Dong, Z. Li, X. Wang, ”Quantum cryptanalysis on some generalized Feistel schemes,” Science China Information Sciences, vol. 62, no. 2, pp. 22501, 2019.
  * [33] W. Huang, Q. Su, B. Liu, Y. H. He, F. Fan, and B. J. Xu, ”Efficient multiparty quantum key agreement with collective detection,” Scientific Reports, vol. 7, no. 1, pp. 15264, 2017.
  * [34] W. J. Liu, Y. Xu, C. N. Yang, P. P. Gao, and W. B. Yu, ”An efficient and secure arbitrary n-party quantum key agreement protocol using bell states,” International Journal of Theoretical Physics, vol. 57, no. 1, pp. 195-207, 2018.
  * [35] F. Wu, X. Zhang, W. Yao, Z. Zheng, L. Xiang, and W. Li, ”An advanced quantum-resistant signature scheme for cloud based on eisenstein ring,” Computers, Materials & Continua, vol. 56, no. 1, pp. 19-34, 2018.
  * [36] Z. Qu, T. Zhu, J. Wang, and X. Wang, ”A novel quantum stegonagraphy based on brown states,” Computers, Materials & Continua, vol. 56, no. 1, pp. 47-59, 2018.
  * [37] W. J. Liu, P. P. Gao, W. B. Yu, Z. G. Qu, and C. N. Yang, ”Quantum relief algorithm,” Quantum Information Processing, vol. 17, no. 10, pp. 280, 2018.
  * [38] W. J. Liu, P. P. Gao, Y. X. Wang, W. B. Yu, and M. J. Zhang, ”A unitary weights based one-iteration quantum perceptron algorithm for non-ideal training sets,” IEEE Access, vol. 7, no. 4, pp. 36854-36865, 2019.
  * [39] A. Broadbent, J. Fitzsimons, E. Kashefi, ”Universal blind quantum computation,” In: 50th Annual IEEE Symposium on Foundations of Computer Science, Atlanta, GA, 2009, pp. 517–526.
  * [40] X. Kong, Q. Li, C. Wu, F. Yu, J. He, Z. Sun, ”Multiple-server flexible blind quantum computation in networks,” International Journal of Theoretical Physics, vol. 55, no. 6, pp. 3001-3007, 2016.
  * [41] E. Kashefi, A. Pappa, ”Multiparty delegated quantum computing,” Cryptography, vol. 1, no. 2, pp. 12, 2017.
  * [42] P. Arrighi, L. Salvail, ”Blind quantum computation,” International Journal of Quantum Information, vol. 4, no. 5, pp. 883-898, 2006.
  * [43] X. Tan, X. Zhou, ”Universal half-blind quantum computation,” Annals of Telecommunications, vol. 72, no. 9, pp. 589-595, 2017.
  * [44] K. A. G. Fisher, A. Broadbent, L. K. Shalm, Z. Yan, J. Lavoie, R. Prevedel, T. Jennewein, K. J. Resch, ”Quantum computing on encrypted data,” Nature Communications, vol. 5, pp. 3074, 2014.
  * [45] A. Broadbent, ”Delegating private quantum computations,” Canadian Journal of Physics, vol. 93, no. 9, pp. 941-946, 2015.
  * [46] X. Zhang, J. Weng, X. Li, W. Luo, X. Tan, T. Song, ”Single-server blind quantum computation with quantum circuit model,” Quantum Information Processing, vol. 17, no.6, pp. 134, 2018.
  * [47] W. Liu, Z. Chen, J. Liu, Z. Su, L. Chi, ”Full-blind delegating private quantum computation,” Computers, Materials & Continua, vol. 56, no. 2, pp. 211-223, 2018.
  * [48] Y. B. Sheng, L. Zhou, ”Blind quantum computation with a noise channel” Phys. Rev. A, vol. 98, no. 5, pp. 052343, 2018.
  * [49] J. F. Fitzsimons, E. Kashefi, ”Unconditionally verifiable blind quantum computation”, Phys. Rev. A, vol. 96, no. 1, pp. 012303, 2017.
  * [50] Q. Li, Z. Li, W. H. Chan, S. Zhang, C. Liu, ”Blind quantum computation with identity authentication,” Physics Letters A, vol. 382, no. 14, pp. 938-941, 2018.
  * [51] M. A. Nielsen, and I. Chuang, Quantum Computation and Quantum Information. New York, NY, USA: Cambridge University Press, 2002, pp. 20-30.
  * [52] C. H. Bennett, G. Brassard, ”Quantum cryptography: public key distribution and coin tossing,” In International conference on Computers, Systems & Signal Processing, Springer, Bangalore, India, 1984, pp. 175–179.