Let $U_S$ be a random variable subject to the uniform distribution on $\FF_q^{\sy}$, which is called
the {\em random seed} for servers.
By using the random seed $U_S$,
the shared randomness $R = (R_1,\ldots, R_{2\snn})^T $ is generated as
$R_j :=G_j U_S$ for $j=1, \ldots, 2\snn$.
The randomness $R$ is distributed so that $j$-th server contains $R_j$ and $R_{\snn +j}$
for $j=1, \ldots, \snn$.
\STEPTWO
\textbf{User's encoding}:
The user
randomly encodes the index $K$ to classical queries
$Q^{(K)}:=(Q_1^{(K)},\ldots,Q_{\red{2}\snn}^{(K)})^T$, \red{which
is an ${\bar{\snn}} \times \sff \sx $ random matrix for $k=1, \ldots, \sff$.
The user sends $Q_j^{(K)},Q_{\snn+j}^{(K)}$ to the $j$-th server $\mathtt{serv}_j$.}
\STEPTHREE
\textbf{Servers' encoding}:
The $j$-th server $\mathtt{serv}_j$ applies unitary
$\mathsf{W}( Q_j^{(K)} \vec{m}+R_j , Q_{\snn+j}^{(K)} \vec{m}+R_{\snn+j})$ on ${\cal D}_j$.
\STEPFOUR
\textbf{Decoding}:
For a subset $\cA \in \fA$,
the user takes partial trace on $\cD_{U}[\cA^c]$, and makes measurement on the basis
$\{\mathbf{W}_{\cA}(y) |\phi\rangle^{\otimes |\cA|}\}_{y \in \FF_q^{2|\cA|}}$.
Based on the obtained outcome, %the end-user recovers $m$.
the user outputs the measurement outcome $m$ as the retrieval result.
\end{algorithmic}
\end{Protocol}

\begin{lemm}\Label{L2}
The following conditions for the matrix $G$ and the query $Q^{(K)}$ are equivalent.
\begin{description}
\item[(K1)]
The linear FEASPIR protocol with $G,Q^{(K)}$
is $(\ACC,\REJ)$-secure.
\item[(K2)]
The linear CSPIR protocol with $G,Q^{(K)}$
is $(\bar{\ACC},\bar{\REJ})$-secure.
\end{description}
%The linear EASPIR protocol with general $(G,F)$ and $|\Phi\rangle$ is
%$(\ACC,\REJ)$-secure if and only if
%$(G,F)$ is an $(\bar{\ACC},\bar{\REJ})$-PMS.
\end{lemm}
\begin{proof}
%When $(G,F)$ is an $(\bar{\ACC},\bar{\REJ})$-MMSP,
%the above linear EASS protocol is an $(\ACC,\REJ)$-EASS.
Given a subset $\cA \subset [\snn]$ and $x \in \FF_q^{{\bar{\snn}}}$, we have
\begin{align}
& \Tr_{(\cA,U)^c} \mathbf{W}_{[\snn]}( x) (|\Phi\rangle \langle \Phi|)
\mathbf{W}_{[\snn]}^\dagger( x)  \nonumber \\
\mathbf{W}_{\cA}(P_{\bar{\cA}} x)  |\phi\rangle \langle \phi|
\mathbf{W}_{\cA}^\dagger(P_{\bar{\cA}} x) \otimes \rho_{mix}^{\otimes |
\red{\cA^c}|}.
\end{align}
Hence, the above state can be identified with the
classical information $ P_{\bar{\cA}} x$.
That is, the analysis on the correctness and the secrecy
of the linear FEASPIR protocol with $G,Q^{(K)}$
follows from those
of the linear CSPIR protocol with $G,Q^{(K)}$.
%Hence, the desired statement follows from Proposition \ref{prop1}.
\end{proof}

Next, we assume that the $2\snn\times \sy$
matrix $G$ is written as $(G^{(1)},G^{(2)})$ with
a $2\snn\times \sy_1$ self-column-orthogonal matrix $G^{(1)}$
a $2\snn\times \sy_2$ matrix $G^{(2)}$.
Then, to discuss the relation with CQSPIR protocols,
we modify Protocol \ref{protocol4} as follows.
The initial state $|\Phi\rangle$ is replaced by $ |\Phi[0,G^{(1)}]\rangle$.
The random seed $U_S$ is written as $(U_{S,1},U_{S,2})$ with
$U_{S,1} \in \FF_q^{\by_1}$ and $U_{S,2} \in \FF_q^{\by_2}$ so that
$G U_S= G^{(1)} U_{S,1}+G^{(2)} U_{S,2}$.
The applied unitary
$\mathsf{W}( Q_j^{(K)} \vec{m}+G_j U_S , Q_{\snn+j}^{(K)} \vec{m}+G_{\snn+j} U_S)$
on ${\cal D}_j$ is replaced by
$\mathsf{W}( Q_j^{(K)} \vec{m}+G_j^{(2)} U_{S,2} , Q_{\snn+j}^{(K)} \vec{m}+G_{\snn+j}^{(2)} U_{S,2})$.
In this protocol, the end-user's space $\cD_E$ is given as $\cD_E[0,G^{(1)}]$.
This protocol is formally written as Protocol \ref{protocol5}, and is called
the linear EASPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$.
When $\sy_2$ is zero, i.e., $G_j^{(2)}$ is not given,
the linear EASPIR protocol with $G^{(1)},\emptyset,Q^{(K)}$
does not require shared randomness among servers, and is called
the randomless linear EASPIR protocol with $G^{(1)},Q^{(K)}$.

\begin{Protocol}[H]
\caption{Linear EASPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$}
\Label{protocol5}
\begin{algorithmic}
\STEPONE
\textbf{Preparation}:
We set ${\cal D}_U$ to be $\cH^{\otimes \snn} $.
We set the initial state $\rho_{DU}$ on
$\cD_1 \otimes \cdots \otimes \cD_{\snn} \otimes {\cal D}_U$
to be $|\Phi[0,G^{(1)}]\rangle$.
Let $U_{S,2}$ be a random variable subject to the uniform distribution on $\FF_q^{\sy_2}$.
The shared randomness $R = (R_1,\ldots, R_{2\snn})^T $ is generated as
$R_j :=G_j^{(2)} U_{S,2}$ for $j=1, \ldots, 2\snn$.
The randomness $R$ is distributed so that $j$-th server contains $R_j$ and $R_{\snn +j}$
for $j=1, \ldots, \snn$.
\STEPTWO
\textbf{User's encoding}:
The user
randomly encodes the index $K$ to classical queries
$Q^{(K)}:=(Q_1^{(K)},\ldots,Q_{\red{2}\snn}^{(K)})^T$, \red{which
is an ${\bar{\snn}} \times \sff \sx $ random matrix for $k=1, \ldots, \sff$.
The user sends $Q_j^{(K)},Q_{\snn+j}^{(K)}$ to the $j$-th server $\mathtt{serv}_j$.}
\STEPTHREE
\textbf{Servers' encoding}:
The $j$-th server $\mathtt{serv}_j$ applies unitary
$\mathsf{W}( Q_j^{(K)} \vec{m}+R_j , Q_{\snn+j}^{(K)} \vec{m}+R_{\snn+j})$ on ${\cal D}_j$.
\STEPFOUR
\textbf{Decoding}:
For a subset $\cA \in \fA$,
the user takes partial trace on $\cD_{U}[\cA^c]$, and
makes the measurement  given by the POVM
$\{\mathbf{W}_{\cA}(y) (
\Tr_{\cD[\cA^c],\cD_{U}[\cA^c]}
|\Phi[0,G^{(1)}]\rangle \langle \Phi[0,G^{(1)}]|)
\mathbf{W}_{\cA}^\dagger(y)\}_{y \in \FF_q^{2|\cA|}}$.
Based on the obtained outcome, %the end-user recovers $m$.
the user outputs the measurement outcome $m$ as the retrieval result.
\end{algorithmic}
\end{Protocol}

\begin{theo}\Label{TH2}
Given a $2 \snn\times \sy_1$ self-column-orthogonal matrix $G^{(1)}$,
a $2 \snn \times \sy_2$ matrix $G^{(2)}$, and query $Q^{(K)}$,
the following conditions are equivalent.
\begin{description}
\item[(L1)]
The linear EASPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$
is $(\ACC,\REJ)$-secure.
\item[(L2)]
The linear FEASPIR protocol with $(G^{(1)},G^{(2)}),Q^{(K)}$
is $(\ACC,\REJ)$-secure.
\item[(L3)]
The linear CSPIR protocol with $(G^{(1)},G^{(2)}),Q^{(K)}$
is $(\bar{\ACC},\bar{\REJ})$-secure.
%$(G,F)$ is an $(\bar{\ACC},\bar{\REJ})$-MMSP.
\end{description}
\end{theo}

Theorem \ref{TH2} can be shown in the same way as Theorem \ref{TH1}.
That is,
the equivalence between (L2) and (L3) follows from Lemma \ref{L2}, and
the equivalence between (L1) and (L2) can be shown in the same way as Theorem \ref{TH1}.

In the same way as Proposition \ref{ZNO2},
we have the following proposition.
\begin{prop}\Label{ZNOSPIR}
In Protocol \ref{protocol5},
even when STEP 4 is replaced by another decoder,
the decoder can be simulated by the decoder given in STEP 3.
That is, once STEPs 1, 2, and 3 are given in Protocol \ref{protocol5CQ},
without loss of generality, we can assume that our decoder is given as STEP 4.
\end{prop}

In addition, the linear FEASPIR protocol with $G,Q^{(K)}$ %($G^{(1)},G^{(2)},Q^{(K)}$)
is called
the standard linear FEASPIR protocol with $(G,F)$ %($G^{(1)},G^{(2)},Q^{(K)}$)
when the query $Q^{(K)}$ is given as \eqref{CAP1} by using $F$.
Under the same condition,
the linear EASPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$
is called the standard linear EASPIR protocol with $(G^{(1)},G^{(2)},F)$.
In particular,
when $\sy_2=0$, the protocol does not have the matrix $G^{(2)}$, i.e.,
protocol does not have the random variable $U_{S,2}$.
Such a protocol is called the randomless standard linear EASPIR protocol with $(G^{(1)},F)$.

Therefore, we obtain the following corollary by combining
Theorem \ref{TH2} and Proposition \ref{P2}.

\begin{coro}\Label{Cor2}
Given a $2 \snn \times \sy_1$ self-column-orthogonal matrix $G^{(1)}$,
a $2 \snn \times \sy_2$ matrix $G^{(2)}$, and
a $2 \snn \times \sx$ matrix $F$,
the following conditions are equivalent.
\begin{description}
\item[(M1)]
The standard linear EASPIR protocol with $(G^{(1)},G^{(2)},F)$
is $(\ACC,\REJ)$-secure.
\item[(M2)]
The standard linear FEASPIR protocol with $((G^{(1)},G^{(2)}),F)$
is $(\ACC,\REJ)$-secure.
\item[(M3)]
The standard linear CSPIR protocol with $((G^{(1)},G^{(2)}),F)$
is $(\bar{\ACC},\bar{\REJ})$-secure.
\item[(M4)]
The matrix $((G^{(1)},G^{(2)}),F)$ is an $(\bar{\ACC},\bar{\REJ})$-MMSP.
\end{description}
\end{coro}

When $\sy_1$ is ${\bar{\snn}}/2=\snn$,
as discussed in Section \ref{S6-1-3},
$\cD_{E}[0,G^{(1)}]$ is a one-dimensional system. Hence,
the state $|\Phi[0,G^{(1)}]\rangle$
is a product state.
%can be considered as a state on $\cD_D$.
Protocol \ref{protocol5} essentially
coincides with the linear CQSPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$.
%In particular, it is called the standard linear CQSPIR protocol with $(G^{(1)},G^{(2)},F)$
%when $Q^{(K)}$ has the standard form with $F$.
Since a (standard) linear CQSPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$
($(G^{(1)},G^{(2)},F)$) is a special case of
a (standard) linear EASPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$ ($(G^{(1)},G^{(2)},F)$),
the relations among Conditions (L1), (L3), (M1), (M3), and (M4)
yields Theorem \ref{Cor3CQ}.
In the same way, Proposition \ref{ZNOSPIR}
implies Proposition \ref{ZNOSPIRCQ}.

\if0
\begin{coro}\Label{Cor3}
Given a $2\snn \times \snn$ self-column-orthogonal matrix $G^{(1)}$,
a $2\snn\times \sy_2$ matrix $G^{(2)}$,
a query $Q^{(K)}$,
the following conditions are equivalent.
\begin{description}
\item[(I1)]
The linear CQSPIR protocol with $G^{(1)},G^{(2)},Q^{(K)}$
is $(\ACC,\REJ)$-secure.
\item[(I2)]
The linear CSPIR protocol with $(G^{(1)},G^{(2)}),Q^{(K)}$
is $(\bar{\ACC},\bar{\REJ})$-secure.
\end{description}
In addition, we assume that $F$ is a $2\snn\times \sx$ matrix.
the following conditions for $G^{(1)},G^{(2)}$, and $F$ are equivalent.
\begin{description}
\item[(I3)]
The standard linear CQSPIR protocol with $(G^{(1)},G^{(2)},F)$
is $(\ACC,\REJ)$-secure.
\item[(I4)]
The standard linear CSPIR protocol with $((G^{(1)},G^{(2)}),F)$
is $(\bar{\ACC},\bar{\REJ})$-secure.
\item[(I5)]
The matrix $((G^{(1)},G^{(2)}),F)$ is an $(\bar{\ACC},\bar{\REJ})$-MMSP.
\end{description}
\end{coro}
\fi

Combining Corollary \ref{Cor2} and Theorem \ref{TH3}, we obtain the following corollary as a generalization of Corollary \ref{Coro7CQ}

\begin{coro}\Label{Coro7}
$\snn \ge \srr > \stt >0$,
there exists an $(\srr,\stt,\snn)$-secure EASPIR protocol with rate $2(\srr-\stt)/\snn$.
\end{coro}

Remember that the rate of CQSPIR cannot exceed $1$ due to the condition $\stt \ge \snn/2$.
This constraint always holds beyond the condition in Corollary \ref{Coro7}
because CQSPIR does not have shared entanglement.
Since EASPIR has shared entanglement, the rate of CQSPIR exceeds $1$ by removing
the condition $\stt \ge \snn/2$,
which can be considered as an advantage of EASPIR over CQSPIR.
Further, we have the following lemma, which implies Lemma \ref{LL5CQ}.

\begin{lemm}\Label{LL5}
When we apply the conversion given in Theorem \ref{theo:SPIRtoNSS}
to the standard linear FEASPIR protocol with $(G,F)$,
the resultant EASS protocol is the linear FEASS protocol with $(G,F)$.
\end{lemm}

\begin{proof}
First, we calculate the share of the resultant EASS protocol.
Protocol \ref{Flow5} and
Protocol \ref{protocol5},
we find that it is calculated as
\begin{align}
& \otimes_{j=1}^{\snn}
\mathsf{W}( Q_j^{(1)} \vec{m}+G_{j} U_S , Q_{\snn+j}^{(1)} \vec{m}+G_{\snn+j} U_S)
|\Phi\rangle \nonumber \\
\stackrel{(a)}{=}& \otimes_{j=1}^{\snn}
\mathsf{W}( F_j E_1 \vec{m}+G_{j} U_S , F_{\snn+j} E_1 \vec{m}+G_{\snn+j} U_S)  |\Phi\rangle \nonumber \\
=& \otimes_{j=1}^{\snn}
\mathsf{W}( F_j m_1+G_j U_S , F_{\snn+j} m_1+G_{\snn+j} U_S )  |\Phi\rangle \nonumber \\
\mathsf{W}_{[\snn]}( F m_1+G U_S)  |\Phi\rangle,\Label{XWA}
\end{align}
where $(a)$ follows from \eqref{CAP1}.
The RHS of \eqref{XWA} is  the same as the share of  the linear FEASS protocol with $(G,F)$.

The decoding of the resultant EASS protocol is
the standard linear EASPIR protocol with $(G,F)$, which is given as follows.
For a subset $\cA \in \fA$,
the user makes measurement on the basis
$\{\mathbf{W}_{\cA}(y) |\phi\rangle^{|\cA|}\}_{y \in \FF_q^{2|\cA|}}$.
Based on the obtained outcome, %the end-user recovers $m$.
the user outputs the measurement outcome $m$ as the retrieval result.
It is the same as the decoder of the linear FEASS protocol with $(G,F)$ presented as
Protocol \ref{protocol1}.
\end{proof}

In fact, the same property holds for the standard linear EASPIR protocol with
$((G^{(1)},G^{(2)}),F)$, which includes a standard linear CQSPIR protocol as a special case.

\section{Conversion from EASPIR protocol to EASS protocol}\Label{ZMTA}
\subsection{Conversion from general EASPIR protocol}
As stated in [10], CSPIR protocol can be converted to CSS protocol.
In this subsection, we present how EASPIR protocol is converted to EASS protocol.
Protocol \ref{Flow5} shows the converted protocol from an EASPIR protocol.
Protocol \ref{Flow5} contains the conversion from an CQSPIR protocol to CQSS protocol
as the special case when $\cD_{E}=\cD_U$ is one-dimensional.

\begin{Protocol}[H]
\caption{EASS protocol converted from EASPIR protocol}
\Label{Flow5}
\begin{algorithmic}
\STEPONE
\textbf{Preparation}:
The dealer chooses the quantum systems $\cD_{D}$ to be $\cD_1' \otimes \cdots \otimes \cD_{\snn}' $,
and the end-user chooses the quantum system $\cD_{E}$ to be $\cD_U$, respectively.
They share the state $\rho_{\mathrm{prev}}$
as the state $\rho_{DE}$ on the joint quantum system $\cD_{D}\otimes \cD_{E}$
before the protocol.
\STEPTWO
\textbf{Share generation}:
The dealer set $K$ to be $1$.
Depending on the message $m \in \cM$,
the dealer applies the TP-CP map
$\otimes_{j=1}^{\snn}\mathsf{Enc}_{\mathrm{serv}_j} (\vec{m},Q_j^{(1)}, R_j) $
to the system $\cD_{D}=\cD_1' \otimes \cdots \otimes \cD_{\snn}' $, where
$\vec{m}=(m,0,\ldots, 0)$.
The dealer obtains the system $\cD_1 \otimes \cdots \otimes \cD_{\snn} $.
The resultant joint state on $\cD_1 \otimes \cdots \otimes \cD_{\snn} \otimes \cD_E$ is
$\rho( \vec{M},Q^{(1)},1) $.
The dealer sends the $j$-th share system $\cD_j$ to the $j$-th player.
\STEPTHREE
\textbf{Decoding}:
For a subset $\cA \in \fA$,
the end-user decodes the message from the received state from players $\cA$
by the decoder defined as the POVM
$\mathsf{Dec}(1,Q^{(1)},\cA) \coloneqq \{ {Y}_{1,Q^{(1)},\cA}(w) \mid  w\in [\smm] \}$ on
$\cD[\cA] \otimes \cD_E$.
\end{algorithmic}
\end{Protocol}

\begin{theo} \Label{theo:SPIRtoNSS}
When the original EASPIR protocol is $(\REC,\COL)$-secure,
the converted EASS protocol via Protocol \ref{Flow5}
is $(\REC,\COL)$-secure.
\end{theo}

\begin{proof}
%This theorem can be shown as follows.
The correctness of the converted EASS protocol follows from
the correctness of the original EASPIR protocol.

The secrecy of the converted EASS protocol follows from
User secrecy and Server secrecy of the original EASPIR protocol
in the following way.
User secrecy of the original EASPIR protocol guarantees that
$\prod_{j \in \cB}Q_j^{(1)}$ cannot be distinguished from
$\prod_{j \in \cB}Q_j^{(k)}$ for $k \neq 1$, we have
$\otimes_{j \in \cB} \mathsf{Enc}_{\mathrm{serv}_j} (\vec{m},Q_j^{(1)}, R_j)
=\otimes_{j \in \cB} \mathsf{Enc}_{\mathrm{serv}_j} (\vec{m},Q_j^{(k)}, R_j)$.
\begin{align}
&\Tr_{(\cB,U)^c}\rho( \vec{m},Q^{(1)},1)  \nonumber \\
=& \otimes_{j \in \cB} \mathsf{Enc}_{\mathrm{serv}_j} (\vec{m},Q_j^{(1)}, R_j)
(\Tr_{(\cB,U)^c}\rho_{\mathrm{prev}})  \nonumber \\
=&\otimes_{j \in \cB} \mathsf{Enc}_{\mathrm{serv}_j} (\vec{m},Q_j^{(k)}, R_j)
(\Tr_{(\cB,U)^c}\rho_{\mathrm{prev}})  \nonumber \\
=& \Tr_{(\cB,U)^c}\rho( \vec{m},Q^{(k)},k) .
\end{align}
Server secrecy of the original EASPIR protocol guarantees that
the state $\Tr_{(\cB,U)^c}\rho( \vec{m},Q^{(k)},k)$ is independent of $m_1$,
which implies the secrecy of the converted EASS protocol.
\end{proof}

\subsection{Conversion from linear EASPIR protocol}
We consider how the linear EASPIR protocol with $G^{(1)},G^{(2)},Q^K$
is converted to a linear EASS protocol.
When the conversion protocol, Protocol \ref{Flow5} is applied to Protocol \ref{protocol4},
we have the following protocol.

\begin{Protocol}[H]
\caption{Linear EASS protocol converted from linear EASPIR protocol with $G^{(1)},G^{(2)},Q^K$}
\Label{protocol-conv}
\begin{algorithmic}
\STEPONE
\textbf{Preparation}:
We set the initial state $\rho_{DE}$ on ${\cal D}_D \otimes {\cal D}_E[0,G^{(1)}]$
to be $ |\Phi[0,G^{(1)}]\rangle$.
\STEPTWO
\textbf{Share generation}:
The dealer prepares a uniform random variable $U_{D,2} \in \FF_q^{\sy_2} $.
For $m \in \cM$, the dealer applies
$\mathbf{W}_{[\snn]}( Q_j^{(1)} (m,0,\ldots,0)+G_j^{(2)} U_{D,2})$ on ${\cal D}_j$.
That is,
the encoding operation $\Gamma[m]$ \red{on ${\cal D}_D$} is defined as
\begin{align}
\Gamma[m](\rho):= \sum_{u_{D,2} \in \FF_q^{\sy_2}}
\frac{1}{q^{\sy_2}}
\mathbf{W}_{[\snn]}( Q^{(1)} (m,0,\ldots,0)+G^{(2)} u_{D,2}) \rho
\mathbf{W}_{[\snn]}^\dagger( Q^{(1)} (m,0,\ldots,0) +G^{(2)} u_{D,2}).
\end{align}
The shares are given as parts of the state
$ \Gamma[m](|\Phi[0,G^{(1)}]\rangle \langle \Phi[0,G^{(1)}]|)$.
\STEPTHREE
\textbf{Decoding}:
For a subset $\cA \in \fA$,
the end-user takes partial trace on $\cD_{E}[\cA^c]$, and
makes the measurement  given by the POVM
$\big\{\mathbf{W}_{\cA}(z) (
\Tr_{\cD[\cA^c],\cD_{E}[\cA^c]}
|\Phi[0,G^{(1)}]\rangle \langle \Phi[0,G^{(1)}]|)
\mathbf{W}_{\cA}^\dagger(z)\big\}_{z \in \FF_q^{2|\cA|}}$.
Based on the obtained outcome, the end-user recovers $m$.
\end{algorithmic}
\end{Protocol}

Next, we consider the case when the query $Q^K$ has the standard form \eqref{CAP1}.
In this case,
the uniform random number $U_Q$ in \eqref{CAP1}
is rewritten as $(U_{Q,1},U_{Q,2})$ by using the uniform random numbers
$U_{Q,1}$ and $U_{Q,2})$ on $\FF_q^{\sy_1}$ and $\FF_q^{\sy_2}$.
$Q^{(1)} (m,0,\ldots,0)+G^{(2)} U_{D,2}$ is rewritten as
\begin{align}
& Q^{(1)} (m,0,\ldots,0)+G^{(2)} U_{D,2}
=Fm +(G^{(1)},G^{(2)}) U +G^{(2)} U_{D,2} \nonumber\\
=& Fm +G^{(1)} U_{Q,1}+G^{(2)} (U_{Q,2}+U_{D,2}). \Label{MCUZ}
\end{align}
Since $\bW_{[\snn]}(G^{(1)} U_{Q,1})$ does not change the state
$ |\Phi[0,G^{(1)}]\rangle$,
the application of \eqref{MCUZ} is equivalent to
the application of $Fm +G^{(2)} (U_{Q,2}+U_{D,2})$, which is
Step 2 of Protocol \ref{protocol2}.
Therefore, we find that
the standard linear EASPIR protocol with $(G^{(1)},G^{(2)},F)$
is converted to the linear EASS protocol with $(G^{(1)},G^{(2)},F)$ via
the conversion protocol, Protocol \ref{Flow5}.
That is, the standard linear EASPIR protocols with $(G^{(1)},G^{(2)},F)$
have one-to-one correspondence with
linear EASS protocols

When we restrict our protocols to standard linear CQSPIR protocols,
we have the following lemma.

\begin{lemm}\Label{LL5CQ}
When we apply the conversion given in Theorem \ref{theo:SPIRtoNSS}
to the standard linear CQSPIR protocol with $(G^{(1)},G^{(2)},F)$,
the resultant CQSS protocol is the linear CQSS protocol with $(G^{(1)},G^{(2)},F)$.
\end{lemm}

When the CQSPIR protocol is a standard linear CQSPIR protocol,
the converted CQSS protocol is characterized by the same matrices.
That is, the reverse conversion is possible in this case.

\section{Example of unified construction of protocols}\Label{Sec-Ex}

\begin{table*}[t]
\begin{center}
\caption{Characterizations for matrices used for respective protocols}
\begin{tabular}{|c|c|c|c|}
\hline
& $G^{(1)}$ & $G^{(2)}$ & $F$\\
\hline
linear standard FEASPIR   &
\multicolumn{2}{c|}{\multirow{2}{*}{one $2\snn \times \sy$ matrix}}
&  \multirow{2}{*}{$2\snn \times \sx$} \\
linear FEASS (general form) & \multicolumn{2}{c|}{} &\\
\hline
linear standard EASPIR &  $2\snn \times \sy_1$     & \multirow{2}{*}{$2\snn \times \sy_2$}
&  \multirow{2}{*}{$2\snn \times \sx$} \\
linear EASS   (general form)  &self-column-orthogonal  & & \\
\hline
$(\srr,\stt,\snn)$-secure linear standard EASPIR
&  $2\snn \times \sy_1$     & \multirow{2}{*}{$2\snn \times (2\stt-\sy_1)$}
&  \multirow{2}{*}{$2\snn \times (2\srr-2\stt)$} \\
$(\srr,\stt,\snn)$-secure linear EASS & self-column-orthogonal  & & \\
\hline
linear standard CQSPIR (general form)   &  $2\snn \times \snn$
& \multirow{2}{*}{$2\snn \times \sy_2$}  &  \multirow{2}{*}{$2\snn \times \sx$}     \\
linear CQSS & self-column-orthogonal  & & \\
\hline
$(\srr,\stt,\snn)$-secure linear standard CQSPIR
&  $2\snn \times \snn$     & \multirow{2}{*}{$2\snn \times (2\stt-\snn)$}
&  \multirow{2}{*}{$2\snn \times (2\srr-2\stt)$} \\
$(\srr,\stt,\snn)$-secure linear CQSS & self-column-orthogonal  & & \\
\hline
\multirow{2}{*}{linear QQSS  (general form)}  &  $2\snn \times (\snn -\sx)$
&  \multirow{2}{*}{$2\snn \times \sy_2$} & $2\snn \times 2\sx$ \\
& self-column-orthogonal & & column-orthogonal to $G^{(1)}$ \\
\hline
\multirow{2}{*}{$(\srr,\stt,\snn)$-secure linear QQSS}   &  $2\snn \times (\snn -\srr+\stt)$
&  \multirow{2}{*}{$2\snn \times (\stt +\srr-\snn)$} & $2\snn \times 2(\srr-\stt)$ \\
& self-column-orthogonal & & column-orthogonal to $G^{(1)}$ \\
\hline
\end{tabular}
\end{center}
\end{table*}

%\subsection{CQSS, QQSS, and CQSPIR protocols}
In this section, we give an example of MMSP which can be converted to
randomless linear CQSS, randomless linear QQSS, randomless standard linear CQSPIR
randomless linear EASS, randomless linear QQSS,
and randomless standard linear EASPIR protocols.
Since the construction of the respective protocols are given in the above sections,
we construct only MMSPs in this section.

\begin{exam}
We choose
\begin{align}
G^{(1)}: =
\begin{pmatrix}
1 & 0  \\
1 & 0\\
2 & 2 \\
0 & 1  \\
0 & 1  \\
0 & 2
\end{pmatrix} \in  \FF_3^{6\times 2},\quad
F: =
\begin{pmatrix}
2 & 0  \\
1 & 0\\
1 & 2 \\
1 & 0  \\
0 & 2 \\
1 & 2
\end{pmatrix} \in  \FF_3^{6\times 2}.
\end{align}
The column vectors of $(G^{(1)},F)$ are linearly independent.
$G^{(1)}$ is self-column-orthogonal, and
$F$ is column-orthogonal to $G^{(1)}$.
Hence, according to Protocol \ref{protocol1CQ},
the randomless linear CQSS protocol with $(G^{(1)},F)$ can be constructed.
Also, according to Protocol \ref{protocol6},
the randomless linear QQSS protocol with $(G^{(1)},F)$ can be constructed.
%and its decoder is given in Theorem \ref{TH4}.
In addition,
according to Protocol \ref{protocol5CQ} with \eqref{CAP1},
the randomless standard linear CQSPIR protocol with $(G^{(1)},F)$ can be constructed.
the randomless linear EASS protocol with $(G^{(1)},F)$
the randomless standard linear EASPIR protocol with $(G^{(1)},F)$
can be constructed
according to Protocols \ref{protocol2} and \ref{protocol5}, respectively.

We choose $\fA = \{ \{1,2\} , \{2,3\},\{1,2,3\} \}$ and
$\fB = \{ \emptyset, \{1\}, \{2\}, \{3\} \}$.
%$\fB_2 = \{ \emptyset, \{1\}, \{2\}, \{3\}, \{1,3\} \}$.
\begin{align}
P_{\overline{\{1,2\}}} (G^{(1)}, F)
\begin{pmatrix}
1 & 0 & 2 & 0  \\
1 & 0 & 1 & 0\\
0 & 1 & 1 & 0 \\
0 & 1 & 0 & 2
\end{pmatrix},~
P_{\overline{\{2,3\}}} (G^{(1)}, F)
\begin{pmatrix}
1 & 0 & 1 & 0  \\
2 & 2 & 1 & 2\\
0 & 1 & 0 & 2 \\
0 & 2 & 1 & 2
\end{pmatrix}
\end{align}
are invertible,
the MMSP $(G^{(1)}, F)$ accepts $\fA$.
Since the matrices
\begin{align}
P_{\overline{\{1\}}} G^{(1)}
P_{\overline{\{2\}}} G^{(1)}
\begin{pmatrix}
1 & 0   \\
0 & 1
\end{pmatrix},\quad
P_{\overline{\{3\}}} G^{(1)}
\begin{pmatrix}
2 & 2   \\
0 & 2
\end{pmatrix},
\end{align}
are invertible,
the MMSP $(G^{(1)}, F)$ rejects $\fB$.
Hence, $(G^{(1)}, F)$ is an $(\overline{\fA},\overline{\fB})$-MMSP.
the randomless linear CQSS protocol with $(G^{(1)},F)$ and
the randomless standard linear CQSPIR protocol with $(G^{(1)},F)$ are
$(\overline{\fA},\overline{\fB})$-secure due to
and Theorem~\ref{Cor3CQ}, respectively.
the randomless linear EASS protocol with $(G^{(1)},F)$ and
the randomless standard linear EASPIR protocol with $(G^{(1)},F)$ are
$(\overline{\fA},\overline{\fB})$-secure due to
and Theorem~\ref{TH2}, respectively.
In addition, due to Theorem~\ref{TH4QQ},
the randomless linear QQSS protocol with $(G^{(1)},F)$
is $(\overline{\fA},\overline{\fB})$-secure, and its decoder
is given as $\overline{\Gamma}[\Pi]$ defined in \eqref{XMT},
where the POVM $\Pi= \{\Pi_{m}\}_{m\in \FF_q^{2 \sx}}$ is the decoder of
the randomless linear EASS protocol with $(G^{(1)},F)$.
\end{exam}

\begin{exam}
Next, we choose $G^{(1),*}$ and $F^*$ as
\begin{align}
G^{(1),*}: =
\begin{pmatrix}
1 & 0  & 0\\
1 & 0 & 0\\
2 & 2 & 2\\
0 & 1 &0 \\
0 & 1  &2\\
0 & 2  &2
\end{pmatrix} \in  \FF_3^{6\times 3},\quad
F^{*}: =
\begin{pmatrix}
2 & 0  \\
1 & 1\\
1 & 2 \\
0 & 0  \\
0 & 2 \\
0 & 2
\end{pmatrix} \in  \FF_3^{6\times 2}.
\end{align}
The column vectors of $(G^{(1),*},F^*)$ are linearly independent.
Then, $G^{(1),*}$ is self-column-orthogonal.
Hence, according to Protocol \ref{protocol1CQ},
the randomless linear CQSS protocol with $(G^{(1),*},F^*)$ can be constructed.
Also, according to Protocol \ref{protocol5CQ} with \eqref{CAP1},
the randomless standard linear CQSPIR protocol with $(G^{(1),*},F^*)$ can be constructed.

We choose $\fA^* = \{ \{1,2,3\} \}$ and
$\fB^* = \{ \emptyset, \{1\}, \{2\}, \{3\} ,\{1,3\}\}$.
\begin{align}
P_{\overline{\{1,3\}}} G^{(1),*}
\begin{pmatrix}
1 & 0 & 0 \\
2 & 2 & 2\\
0 & 1 & 0 \\
0 & 2 & 2
\end{pmatrix},\quad
P_{\overline{\{1,3\}}} F^{*}
\begin{pmatrix}
2 & 0 \\
1 & 2 \\
0 & 0 \\
0 &  2
\end{pmatrix},
\end{align}
the column vectors of $P_{\overline{\{1,3\}}} F^*$
is written as linear sums of
the column vectors of $P_{\overline{\{1,3\}}} G^{(1),*}$.
since the rank of $P_{\overline{\{2\}}} G^{(1),*}$ is $2$,
the column vectors of $P_{\overline{\{2\}}} F^*$
is written as linear sums of
the column vectors of $P_{\overline{\{2\}}} G^{(1),*}$.
Hence, the MMSP $(G^{(1),*}, F^*)$ rejects $\fB^*$.
Since the column vectors of $(G^{(1),*}, F^*)$ are linearly independent,
the MMSP $(G^{(1),*}, F^*)$ accepts $\fA^*$.
Hence, $(G^{(1),*}, F^*)$ is an $(\overline{\fA^*},\overline{\fB^*})$-MMSP.
the randomless linear CQSS protocol with $(G^{(1),*},F^*)$ and
the randomless standard linear CQSPIR protocol with $(G^{(1),*},F^*)$ are
due to
Theorem~\ref{Cor1} and Theorem~\ref{Cor3CQ}, respectively.
\end{exam}

\begin{exam}
In this example, we give an example of MMSP which can be converted to
randomless linear EASS and randomless standard linear EASPIR protocols that overperform
linear CQSS and linear CQSPIR protocols, respectively.

Let $p$ be a prime.
We define the $2p \times 2$ matrix $G^{**}=(g_{j,k})$ and
the $2p \times 2$ matrix $F^{**}=(f_{j,k})$ over $\FF_p$ as
$g_{j,1}=1 $,
$g_{j+p,1}=0 $,
$g_{j,2}=0 $,
$g_{j+p,2}=1 $,
$f_{j,1}=j-1 $,
$f_{j+p,1}=0 $,
$f_{j,2}=0 $,
$f_{j+p,2}=j-1 $ for $j=1, \ldots, p$.
The column vectors of $(G^{**},F^{**})$ are linearly independent.
Then, $G^{(1)}$ is self-column-orthogonal.

When $p >2$, $(G^{**},F^{**})$ cannot be used for
a randomless linear CQSS protocol,
a randomless linear QQSS protocol, nor
a randomless standard linear CQSPIR protocol.
the randomless linear EASS protocol with $(G^{**},F^{**})$ and
the randomless standard linear EASPIR protocol with $(G^{**},F^{**})$
can be constructed according to Protocols \ref{protocol2} and \ref{protocol5}, respectively.

We choose $\ACC^{**}= \{ \cA \subset [p] \mid |\cA| \geq 2 \}$
and $\REJ^{**}= \{ \cB \subset [p] \mid |\cB| \leq 1 \}$.
For $i<j \in [p]$, we have
\begin{align}
P_{\overline{\{i\}}} (G^{**} F^{**})=
\left(
\begin{array}{cccc}
1 & 0 & i-1&0 \\
0 & 1 & 0 & i-1
\end{array}
\right), \quad
P_{\overline{\{i,j\}}} (G^{**} F^{**})=
\left(
\begin{array}{cccc}
1 & 0 & i-1&0 \\
1 & 0 & j-1&0 \\
0 & 1 & 0 & i-1\\
0 & 1 & 0 & j-1
\end{array}
\right).
\end{align}
The first relation shows that the MMSP $(G^{**}, F^{**})$ rejects $\fB^{**}$,
the second relation shows that
the MMSP $(G^{**}, F^{**})$ accepts $\fA^{**}$.

Thus, the randomless linear EASS protocol with $(G^{**},F^{**})$ and
the randomless standard linear EASPIR protocol with $(G^{**},F^{**})$ are
$(\overline{\fA}^{**},\overline{\fB}^{**})$-secure due to
Theorem~\ref{TH1} and Theorem~\ref{TH2}, respectively.
The randomless linear EASS protocol with $(G^{**},F^{**})$ and
the randomless standard linear EASPIR protocol with $(G^{**},F^{**})$
have the rate $2$.
\end{exam}

\begin{figure}[htbp]
\begin{center}
\includegraphics[width=0.8\linewidth]{pic2.pdf}
\end{center}
\caption{One-to-one relations among various linear protocols.
In this figure, the word ``linear'' is omitted.
Arrows of each color show
a one-to-one relation among several protocols.
$\ctext{1}$ shows the restriction that $G=(G^{(1)},G^{(2)})$ and $G^{(1)}$ is self-column-orthogonal.
$\ctext{2}$ shows the restriction that $G^{(2)}=\emptyset$ and $F$ is
column-orthogonal to $G^{(1)}$.}
\Label{FF1C}
\end{figure}

%\subsection{EASS and EASPIR protocols}
\section{Conclusion} \Label{sec:conclusion}
We have characterized CQSS and QQSS protocols and CQSPIR protocols
under general access structure by using MMSP with symplectic structure.
These characterizations yield
ramp type of CQSS and QQSS protocols and CQSPIR protocols with general qualified set,
which were not studied sufficiently until this paper.
Also, these characterizations yield interesting constructions QQMDS codes.
However, the derivation of these characterizations cannot be derived from
simple application of similar relations in the classical case.
To overcome this problem,
we have introduced EASS and EASPIR protocols.
Since these two types of protocols can be converted to classical protocols,
we have easily derived
their relation with general access structure and MMSP
while these analyses require column-orthogonality for MMSP.
CQSS and QQSS protocols and CQSPIR protocols can be considered as
special cases of EASS and EASPIR protocols, respectively.
That is,
the relation among these settings is summarized as Fig. \ref{FF1C}.
In addition,
we have shown the existence of desired types of MMSP in Appendix, which implies
the existence of
CQSS, QQSS, and CQSPIR protocols parameterized by two threshold parameters $\stt$ and $\srr$.

For this discussion, as subclasses of EASS and EASPIR protocols,
we have newly introduced \red{linear} EASS and \red{linear} EASPIR protocols
and the symplectification for an access structure.
In particular, we have focused on linear FEASS and FEASPIR protocols
because they are directly linked to
linear classical protocols as Lemmas \ref{L2U} and \ref{L2}
thanks to the orthogonality of generalized Bell basis.
Such a simple structure has never appeared in
CQSS and QQSS protocols and CQSPIR protocols.
Under the self-column-orthogonality for the matrix $G^{(1)}$,
linear FEASS and FEASPIR protocols are converted to
linear EASS and EASPIR protocols as Theorems \ref{TH1} and \ref{TH2}.
Since the classical linear protocols are linked to MMSP as Proposition \ref{prop1} and Lemma \ref{P2},
linear EASS and EASPIR protocols are linked to MMSP via the above relations.
Since CQSS and CQSPIR protocols are special classes of EASS and EASPIR protocols,
CQSS and CQSPIR protocols are characterized by using MMSP in this way.

However, the relation with QQSS is more complicated.
To establish the relation between QQSS and EASS protocols, we have introduced new relation between
dense coding and quantum state transmission.
It was known that noiseless quantum state transmission implies
dense coding with zero error.
However, no existing study clarified whether dense coding protocol with zero error
yields noiseless quantum state transmission.
In this paper, we have constructed a concrete protocol for
noiseless quantum state transmission from dense coding protocol with zero error.
That is, we constructed a decoder for quantum state transmission with zero error
from a decoder for dense coding protocol with zero error as Lemma \ref{L5}.
Also, we have derived the equivalence relation between the mutual information
between dense coding and quantum state transmission as Lemma \ref{L6}.
Using these relations,
we have made the conversion between QQSS and EASS protocols as Theorem \ref{TH4}.
Also, we have pointed out that a special class of QQSS protocols yields QQMDS codes, which are often called
quantum MDS codes.
In addition, as Remark \ref{R5}, we have sown that
any stabilizer code can be characterized as the performance of
QQSS protocols in our method.
{\bf Overall, our main contribution can be summarized as
revealing the relation between EASS and EASPIR protocols and
the symplectification for an access structure, which is
a hidden simple structure behind CQSS, QQSS, and CQSPIR protocols.}

Although we have constructed various types of MMSP with
these constructions are based on algebraic extension similar to [40, 81].
In contrast, existing studies [75] discussed how small size of field can realize QQMDS codes under certain condition.
Therefore, it is an interesting future study to find efficient constructions of
various types of MMSP with
column-orthogonality depending on two threshold parameters $\stt$ and $\srr$.
This is because these constructions are essential for constructing
our linear protocols.
In addition, the existing study \cite[Section IV-B]{HVA} discussed SPIR with quantum noisy
multiple access channel.
Since noisy setting is realistic, it is another interesting study to extend our results to
the setting with quantum noisy channels.

\section*{Acknowledgments}
% SS is supported by Lotte Foundation and JSPS Grant-in-Aid for JSPS Fellows No. JP20J11484.
% MH is supported in part by a JSPS Grant-in-Aids for
% 	Scientific Research (A) No.17H01280 and for Scientific Research (B) No.16KT0017,
% 	and Kayamori Foundation of Information Science Advancement.
MH is supported in part by the National Natural Science Foundation of China (Grant No. 62171212),
Guangdong Provincial Key Laboratory (Grant No. 2019B121203002),
a JSPS Grant-in-Aids for Scientific Research (A) No.17H01280.
SS is supported by JSPS Grant-in-Aid for JSPS Fellows No. JP20J11484 and Lotte Foundation Scholarship.

\appendices

%\section{Proofs of Theorems \ref{TH3} and \ref{TH6}}\Label{A1}

\section{Preparation for proofs of Theorems \ref{TH3} and \ref{TH6}}\Label{A1}
This appendix prepares several lemmas to be used in our proofs of
Theorems \ref{TH3CQ}, \ref{TH3}, and \ref{TH6}.
For this aim, we prepare the following lemma.
\begin{lemm}\Label{LL11}
We consider a $(\sdd+1) \times (\sdd+1)$ matrix
$A=(a_{i,j})_{1\le i\le \sdd+1, 1\le j\le \sdd+1 }$ over a finite field $\FF_q[e]$ to satisfy the following conditions.
(i) The $\sdd \times \sdd$ matrix $(a_{i,j})_{1\le i\le \sdd, 1\le j\le \sdd }$
is an invertible matrix.
(ii) The components $a_{i,j}$ except for $a_{\sdd+1,\sdd+1 }$ belong to $\FF_q$.
Then, the $(\sdd+1) \times (\sdd+1)$ matrix
$A$ is invertible.
\end{lemm}

\begin{proof}
We show the desired statement by contradiction.
We assume that $A$ is not an invertible matrix.
We denote the $\sdd+1$ column vectors of $A$
by $a^1, \ldots, a^{\sdd+1}$.
Since the $\sdd$ column vectors of
$a^1, \ldots, a^{\sdd}$
are linearly independent,
there exist $\sdd$ elements
$\beta_1, \ldots, \beta_{\sdd}$ of $\FF_q[e] $ such that
\begin{align}
\sum_{j=1}^{\sdd} \beta_j a_{i,j}
=a_{i,\sdd+1} \Label{LPA}
\end{align}
for $i=1, \ldots, \sdd+1$.
The finite field $\FF_q[e] $ is a vector space over the finite field $\FF_q$
generated by $\alpha^0=1, \alpha^1, \ldots, \alpha^n$ with a certain positive integer $n \ge 1$, where $\alpha:= a_{\sdd+1,\sdd+1}$.
We choose elements $\beta_{j,i} \in \FF_q$ such that
$\beta_j=\sum_{i=0}^{n} \beta_{j,i} \alpha^i$.
Then, \eqref{LPA} with $i=\sdd+1 $ is rewritten as
\begin{align}
\sum_{i=0}^{n} (\sum_{j=1}^{\sdd}  \beta_{j,i}  a_{\sdd+1,j}) \alpha^i
=\sum_{j=1}^{\sdd} \sum_{i=0}^{n} \beta_{j,i} \alpha^i a_{\sdd+1,j}
\end{align}
Considering the case with $i=1$, we have
\begin{align}
\sum_{j=1}^{\sdd}  \beta_{j,1}  a_{\sdd+1,j}=1,
\end{align}
which implies that
the vector $(\beta_{j,1})_{j=1}^{\sdd}$ is a non-zero vector.
We denote the $\sdd+1$ column vectors of $A$ only with the initial $\sdd$ components
by $b^1, \ldots, b^{\sdd+1} \in \FF_q^{\sdd}$.
Since $b^1, \ldots, b^{\sdd}$ are linearly independent,
the vector $\sum_{j=1}^{\sdd}  \beta_{j,1}  b^j$
is a non-zero vector.

Next, we rewrite \eqref{LPA} with $i=1, \ldots, \sdd $ as
\begin{align}
\sum_{i=0}^{n} (\sum_{j=1}^{\sdd}  \beta_{j,i}  b^j )\alpha^i
=\sum_{j=1}^{\sdd} \sum_{i=0}^{n} \beta_{j,i} \alpha^i b^j
=\sum_{j=1}^{\sdd} \beta_j b^j
=b^{\sdd+1} \Label{LPA2}.
\end{align}
We focus on the case with $i=1$, which implies
\begin{align}
\sum_{j=1}^{\sdd}  \beta_{j,1}  b^j
\end{align}
However, the LHS is a non-zero vector,
we obtain contradiction.
Hence, we obtain the desired statement.
\end{proof}

\begin{lemm}\Label{LL12}
Assume that a $(\sdd +\sff) \times \sdd$ matrix
$D$ over a finite field $\FF_{q'}$ is a $(\sdd +\sff , \sdd)$-MDS code.
We consider a $(\sdd +\sff) \times \sgg$ matrix $F=(f_{i,j})_{1\le i \le \sdd +\sff,
1\le j \le \sgg}$
over the finite field $\FF_{q'}[e_1, \ldots, e_{\sdd}]$,
We assume the following conditions.
(i) $\sff \ge \sgg$.
The component $f_{i,j}$ belongs to $\FF_{q'}$ when $i+j\le \sdd+\sgg$.
The component $f_{i,j}$ belongs to
\FF_{q'}[e_1, \ldots, e_{i+j- \sdd-\sgg}]
\setminus \FF_{q'}[e_1, \ldots, e_{i+j- \sdd-\sgg-1}]$
when $i+j> \sdd+\sgg$.
Then, the $(\sdd +\sff) \times (\sdd+\sgg)$ matrix
$G:=(D,F)$ is  a $(\sdd +\sff , \sdd+\sgg)$-MDS code.
\end{lemm}

\begin{proof}
We denote the matrix $G$ as $(g_{i,j})_{1\le i \le \sdd +\sff, 1 \le j \le \sdd +\sgg}$.
We choose a strictly increasing function $\pi$ from
$[\sdd+\sgg]$ to $[\sdd+\sff]$.
We define the subset $\cA_\pi$ as
$\{\pi(1), \ldots, \pi(\sdd+\sgg)\}$.
Hence, it is sufficient to show that
the $(\sdd +\sgg) \times (\sdd+\sgg)$ matrix
$P_{\cA_\pi}(D,F)$ is invertible for any map $\pi$.
To show this statement, we show that
the matrix
$G_k:=(g_{\pi(i),j})_{1\le i \le \sdd +k, 1 \le j \le \sdd +k}$
is invertible for $k=0,1, \ldots, \sgg$
by the induction for $k$.
The case with $k=0$ holds because
$D$ is a $(\sdd +\sff , \sdd)$-MDS code.

Now, we assume that $G_k$ is invertible for $k=t-1$.
The component
$g_{\pi(t),t }=f_{\pi(t)-\sdd,t }$ is an element of
$\FF_{q'}[e_1, \ldots, e_{\pi(t)+t- 2\sdd-\sgg}]
\setminus \FF_{q'}[e_1, \ldots, e_{\pi(t)+t- 2 \sdd-\sgg-1}]$.
Also, other components of $G_t$ belong to
$\FF_{q'}[e_1, \ldots, e_{\pi(t)+t- 2 \sdd-\sgg-1}]$.
Hence, Lemma \ref{LL11} guarantees that $G_t$ is invertible.
\end{proof}

Now, we recall Proposition 4 of
\cite[Appendix D]{SH20}, which is a generalization of
Appendix of [81].

\begin{prop}[\protect{\cite[Proposition 4]{SH20}}]\Label{PP8}
Given positive integers $l<r$ and a prime $p$,
we choose $q$ such that
$\FF_q$ is an algebraic extension $\FF_p[e_1, \ldots, e_{k+r-l-2}]$.
We choose $\alpha_{i,j}$ as an element of
$\FF_p[e_1, \ldots, e_{i+j-2}]\setminus \FF_p[e_1, \ldots, e_{i+j-3}]$.
We define $l$ vectors $v^1, \ldots, v^l \in \FF_{p}^r$ as
\begin{align}
\left\{
\begin{array}{ll}
\delta_{i,j} & \hbox{ when } i \le l \\
\alpha_{i-l,j} & \hbox{ when } i \ge l+1.
\end{array}
\right.
\end{align}
In addition, we assume that $\alpha_{1,1}=1$.
Then, the matrix $(v^1, \ldots, v^{l})$ is an $(r,l)$-MDS code.
\end{prop}

\begin{lemm}\Label{L78}
Given positive integers $l<k<r$ and a prime $p$,
we choose $q$ such that
$\FF_{q}$ is an algebraic extension $\FF_p[e_1, \ldots, e_{k+r-l-2}]$.
We choose $\alpha_{i,j}$ as an element of
$\FF_p[e_1, \ldots, e_{i+j-2}]\setminus \FF_p[e_1, \ldots, e_{i+j-3}]$.
We define $k$ vectors $v^1, \ldots, v^k \in \FF_{p}^r$ as
\begin{align}
\left\{
\begin{array}{ll}
\delta_{i,j} & \hbox{ when } i \le l \\
\alpha_{i-l,j} & \hbox{ when } i \ge l+1.
\end{array}
\right.
\end{align}
In addition, we assume that  $\alpha_{1,1}=1$.
%Then, the matrix $(v^1, \ldots, v^{l+s})$ is a $(r,l+s)$-MDS code for $s=0, \ldots, k-l$.
Then, the matrix $(v^1, \ldots, v^{k})$ is an $(r,k)$-MDS code.
\end{lemm}

\begin{proof}
We apply Lemma \ref{LL12} to the case when
$D=(v^1, \ldots, v^l)$,
$F=(v^{l+1}, \ldots, v^{k})$,
$\sdd=l $,
$\sff=r-l$, $\sgg=k-l $,
$\FF_{q'}$ is $\FF_p[e_1, \ldots, e_{l+k-3}]$.
Then, we find that
the matrix $(v^1, \ldots, v^{k})$ is an $(r,k)$-MDS code.
\end{proof}

\begin{lemm}\Label{AMT}
We consider a finite field $\FF_p$.
We choose
a $(\sbb-\saa)\times \saa$ matrix $A_1=(a_{i,j})_{1\le i \le \sbb-\saa, 1\le j\le \saa}$ and
a $(\sbb-\saa)\times \saa$ matrix $A_2=(a_{i,j})_{\sbb-\saa+1\le i \le 2(\sbb-\saa), 1\le j\le \saa}$
over $\FF_p[e_1, \ldots, e_{2\sbb-\saa-1}]$ to satisfy the following conditions.
The component $a_{i,j}$ is an element of
$\FF_p[e_1, \ldots, e_{i+j-1}]\setminus \FF_p[e_1, \ldots, e_{i+j-2}]$
for $1\le i \le 2(\sbb-\saa)$ and $1 \le j \le \saa$.
We choose a $\saa\times \saa$ matrix $A_3=(a_{i,j})_{2(\sbb-\saa)+1\le i \le 2\sbb-\saa, 1\le j\le \saa}$
over $\FF_p[e_1, \ldots, e_{2\sbb-1}]$
to satisfy the conditions;
The component $a_{i,j}$ is an element of
$\FF_p[e_1, \ldots, e_{i+j-1}]\setminus \FF_p[e_1, \ldots, e_{i+j-2}]$
for $2(\sbb-\saa)+1\le i \le 2\sbb-\saa$ and $1 \le j \le \saa$.
The relation
\begin{align}
&a_{2(\sbb-\saa)+j,i}+\sum_{k=1}^{\sbb-\saa} a_{k,j} a_{\sbb-\saa +k,i}
\nonumber \\
a_{2(\sbb-\saa)+i,j}+\sum_{k=1}^{\sbb-\saa} a_{k,j} a_{\sbb-\saa +k,i}
\Label{AMP}
\end{align}
holds for $1 \le i \le \saa$ and $1 \le j \le \saa$.
Notice that the above choice is always possible.
Then, we define
a $2\sbb \times \saa$ matrix $A$ and
a $2\sbb \times (2\sbb-\saa)$ matrix $B$ as follows
\begin{align}
\left(
\begin{array}{c}
A_2 \\
A_3 \\
A_1 \\
\end{array}
\right), \quad
\left(
\begin{array}{ccc}
I & 0 & 0\\
-A_1^T & A_2^T & A_3^T \\
0 & I & 0 \\
0 & 0 & I
\end{array}
\right).
\end{align}
In addition, we assume that $a_{1,1}=1$.
Then, we have the following conditions.
\begin{description}
\item[(N1)]
The relation $A^T J A =0$ holds.
\item[(N2)]
The relation $A^T J B =0$ holds.
\item[(N3)]
The $2\sbb \times \saa$ matrix $A$ is a
$(2\sbb , \saa)$-MDS code.
\item[(N4)]
The $2\sbb \times (2\sbb-\saa)$ matrix $B$ is a
$(2\sbb , (2\sbb-\saa))$-MDS code.
\end{description}
\end{lemm}

\red{In fact,
since the set $\FF_p[e_1, \ldots, e_{i+j-1}]\setminus \FF_p[e_1, \ldots, e_{i+j-2}]$
is not empty, it is possible to choose
the component $a_{i,j}$ in the above way.}

\begin{proof}
The condition (N1) follows from the condition \eqref{AMP}.
The condition (N2) follows from the definitions of $A$ and $B$.
The condition (N3) holds if and only if
the $2\sbb \times \saa$ matrix
\left(
\begin{array}{c}
I \\
A_1 \\
A_2 \\
\end{array}
\right)$ is a
$(2\sbb , \saa)$-MDS code.
The latter condition follows from Proposition \ref{PP8}.
Hence, we obtain the condition (N3).
The condition (N4) holds if and only if
the $2\sbb \times (2\sbb-\saa)$ matrix
\left(
\begin{array}{ccc}
I & 0 & 0\\
0 & I & 0 \\
0 & 0 & I \\
-A_1^T & A_2^T & A_3^T
\end{array}
\right)$ is a
$(2\sbb , (2\sbb-\saa))$-MDS code.
The latter condition follows from Proposition \ref{PP8}.
Hence, we obtain the condition (N4).
\end{proof}

\begin{lemm}\Label{AMX}
We choose matrices $A$ and $B$ in the same way as Lemma \ref{AMT}.
We choose a prime power $q$ such that
$\FF_{q}=\FF_p[e_1, \ldots, e_{2\sbb-1}]$.
We choose
a $(\sbb-\saa)\times \scc$ matrix $C_1=(c_{i,j})_{1\le i \le \sbb-\saa, 1\le j\le \saa}$ and
a $(\sbb-\saa)\times \scc$ matrix $C_2=(c_{i,j})_{\sbb-\saa+1\le i \le 2(\sbb-\saa), 1\le j\le \saa}$
over $\FF_{q}[e_1', \ldots, e_{2\sbb-\saa-1}']$ to satisfy the following conditions.
The component $c_{i,j}$ is an element of
$\FF_{q}[e_1', \ldots, e_{i+j-1}']\setminus \FF_{q}[e_1', \ldots, e_{i+j-2}']$
for $1\le i \le 2(\sbb-\saa)$ and $1 \le j \le \scc$.
We choose a $\saa\times \scc$ matrix $C_3=(c_{i,j})_{2(\sbb-\saa)+1\le i \le 2\sbb-\saa, 1\le j\le \scc}$ to satisfy the conditions;
The component $c_{i,j}$ is an element of
$\FF_{q}[e_1', \ldots, e_{i+j-1}']\setminus \FF_{q}[e_1', \ldots, e_{i+j-2}']$
for $2(\sbb-\saa)+1\le i \le 2\sbb-\saa$ and $1 \le j \le \scc$.

Then, we define
a $2\sbb \times \scc$ matrix $C$ as follows
\begin{align}
\left(
\begin{array}{c}
C_2 \\
C_3 \\
C_1 \\
\end{array}
\right).
\end{align}
Then, we have the following conditions.
\begin{description}
%Any column vector of $A^T J C $ is a non-zero vector.
\item[(N5)]
The $2\sbb \times (\saa+\scc)$ matrix $(A,C)$ is a
$(2\sbb , (\saa+\scc))$-MDS code.
\item[(N6)]
Let $C^{(s)}$ be the matrix composed of the first $s$ column vectors of $C$.
The $2\sbb \times (\saa+s)$ matrix $(A,C^{(s)})$ is a
$(2\sbb , (\saa+s))$-MDS code.
\item[(N7)]
The $2\sbb \times (2\sbb-\saa+\scc)$ matrix $(B,C)$ is a
$(2\sbb , (2\sbb-\saa+\scc))$-MDS code.
\end{description}
\end{lemm}
\begin{proof}

\if0
Due to the construction,
$c_{2(\sbb-\saa)+j,i}$ belongs to
$\FF_{q'}[e_1', \ldots, e_{2(\sbb-\saa)+i+j-1}']
\setminus \FF_{q'}[e_1', \ldots, e_{2(\sbb-\saa)+i+j-2}']$
$\sum_{k=1}^{\sbb-\saa} c_{k,j} a_{\sbb-\saa +k,i}
-\sum_{k=1}^{\sbb-\saa} a_{k,i} c_{\sbb-\saa +k, j}$
belongs to
$\FF_{q'}[e_1', \ldots, e_{2(\sbb-\saa)+j-1}']$.
$(\FF_{q'}[e_1', \ldots, e_{2(\sbb-\saa)+i+j-1}']
\setminus \FF_{q'}[e_1', \ldots, e_{2(\sbb-\saa)+i+j-2}'])
\cap
\FF_{q'}[e_1', \ldots, e_{2(\sbb-\saa)+j-1}']=
\emptyset$,
the relation
\begin{align}
\sum_{k=1}^{\sbb-\saa} a_{k,i} c_{\sbb-\saa +k, j}
\neq
\sum_{k=1}^{\sbb-\saa} c_{k,j} a_{\sbb-\saa +k,i}
\Label{AMP2}
\end{align}
holds for $1 \le i \le \saa$ and $1 \le j \le \scc$.
Hence, we obtain the condition (N5).
\fi

The condition (N5) holds if and only if
the $2\sbb \times (\saa+\scc)$ matrix
\left(
\begin{array}{cc}
I & 0\\
A_1& C_1 \\
A_2& C_2 \\
A_3 & C_3
\end{array}
\right)$ is a
$(2\sbb , \saa)$-MDS code.
We apply Lemma \ref{LL12} to the case with
\begin{array}{c}
I \\
A_1 \\
A_2 \\
\end{array}
\right)$,
\begin{array}{c}
\end{array}
\right)$,
$l= \saa$,
$\FF_{q'}=\FF_{q}[e_1',\ldots, e_{\scc-1}']$.
Then, due to the condition (N3) of Lemma \ref{AMT},
we obtain the condition (N5).

To show the condition (N6),
we apply Lemma \ref{LL12} to the case with
\begin{array}{c}
I \\
A_1 \\
A_2 \\
\end{array}
\right)$,
\begin{array}{c}
\end{array}
\right)$,
$l= \saa$,
$\FF_{q'}=\FF_{q}[e_1',\ldots, e_{s-1}']$.
Hence, we obtain the condition (N6).

The condition (N7) holds if and only if
the $2\sbb \times (\saa+\scc)$ matrix
\begin{array}{cccc}
I & 0 & 0 & C_2\\
0 & I & 0 & C_1\\
0 & 0 & I & 0 \\
-A_1^T & A_2^T & A_3^T & C_3
\end{array}
\right)$ is a
$(2\sbb , (2\sbb-\saa))$-MDS code.
We apply Lemma \ref{LL12} to the case with
\begin{array}{ccc}
I & 0 & 0 \\
0 & I & 0 \\
0 & 0 & I \\
-A_1^T & A_2^T & A_3^T
\end{array}
\right)$,
\begin{array}{c}
0 \\
\end{array}
\right)$,
$l= 2\sbb-\saa$,
$\FF_{q'}=\FF_{q}[e_1',\ldots, e_{2(\sbb-\saa)+\scc-1}']$.
Then, due to the condition (N4) of Lemma \ref{AMT},
we obtain the latter condition.
Hence, we obtain the condition (N7).
\end{proof}

\section{Proof of Theorem \ref{TH3}}\Label{A2}
To show Theorem \ref{TH3},
we apply Lemma \ref{AMX}
with $\sbb=\snn$, $\saa=\sy_1$, $\scc=2\srr$ that is given in Appendix \ref{A1}.
Then, we choose the matrices $G^{(1)},G^{(2)},F$ as
the matrix composed of the first $2\stt-\sy_1$ column vectors of $C$,
the matrix composed of the remaining $2\srr-(2\stt-\sy_1)$ column vectors of $C$,
Due to the condition \eqref{AMP}, the matrix $G^{(1)}$ is self-column-orthogonal.

The condition (N6) with $s=2\stt-\sy_1$
guarantees that $(G^{(1)},G^{(2)})$ is a $(2\snn,2\stt)$-MDS code.
This property guarantees the rejection condition with $\bar{\fB}$ with the choice $\REJ = \{ \cB \subset [\snn] \mid |\cB| \leq \stt \}$.
Also, the condition (N5)
guarantees that $( (G^{(1)},G^{(2)}),F)$ is a $(2\snn,2\srr)$-MDS code.
This property guarantees the acceptance condition with $\bar{\fA}$ with the choice
$\fA = \{ \cA \subset [\snn] \mid |\cA| \geq \srr \}$.
Therefore, the proof of Theorem \ref{TH3} is completed.

\section{Proof of Theorem \ref{TH3CQ}}\Label{A2B}
To show Theorem \ref{TH3CQ},
we apply Lemma \ref{AMX}
with $\sbb=\snn$, $\saa=\snn$, $\scc=2\srr$ that is given in Appendix \ref{A1}.
Then, we choose the matrices $G^{(1)},G^{(2)},F$ as
the matrix composed of the first $\sy_2:=[2\stt-\snn]_+$ column vectors of $C$,
the matrix composed of the remaining $2\srr-\sy_2$ column vectors of $C$,
Due to the condition \eqref{AMP}, the matrix $G^{(1)}$ is self-column-orthogonal.

The condition (N6) with $s=\sy_2$
guarantees that $(G^{(1)},G^{(2)})$ is a $(2\snn,\snn+ \sy_2)$-MDS code.
This property guarantees the rejection condition with $\bar{\fB}$ with the choice $\REJ = \{ \cB \subset [\snn] \mid |\cB| \leq \stt \}$ because
$\snn+\sy_2 \ge 2\stt$.
Also, the condition (N5)
guarantees that $( (G^{(1)},G^{(2)}),F)$ is a $(2\snn,2\srr)$-MDS code.
This property guarantees the acceptance condition with $\bar{\fA}$ with the choice
$\fA = \{ \cA \subset [\snn] \mid |\cA| \geq \srr \}$.
Therefore, the proof of Theorem \ref{TH3CQ} is completed.

\section{Proof of Theorem \ref{TH6}}\Label{A3}
Condition (E3) implies Condition (E2), we show the directions
(E2) $\Rightarrow$ (E1) and (E1) $\Rightarrow$ (E3).

To show the direction
(E2) $\Rightarrow$ (E1),
we assume Condition (E2).
Due to Theorem \ref{TH4QQ},
there exists a linear QQSS protocol that satisfies the correctness with $\ACC = \{ \cA \subset [\snn] \mid |\cA| \geq \srr \}$.
If Condition (E1) does not holds, i.e.,  $\srr < (\snn+1)/2$,
there are two disjoint subsets $\cA_1\cA_2 \in \ACC$.
Hence, the players in $\cA_1$ and the players in $\cA_2$
can recover the original state, which contradicts the no-cloning theorem [83, 84].
Hence, Condition (E2) implies Condition (E1).

To show the direction
(E1) $\Rightarrow$ (E3),
we assume Condition (E1), and
choose $\stt':= \max(\stt, \snn-\srr)$.
Then, we choose a positive integer $s$,
a $2\snn \times (\snn-\srr+\stt')$ self-column-orthogonal matrix $G^{(1)}$,
a $2\snn\times (\stt'+\srr-\snn)$ matrix $G^{(2)}$,
and a $2\snn\times 2 (\srr-\stt')$ matrix $F$ column-orthogonal
to the matrix $G^{(1)}$
on $\FF_{q}$ with $q=p^s$
such that
the matrix $(G^{(1)},G^{(2)},F)$ is an $(\srr,\stt',\snn)$-QQMMSP.
Since $\stt'\ge \stt$, this statement implies Condition (E3).

For this aim, we apply Lemma \ref{AMX}
to the case with
$\sbb= \snn$, $\saa= \snn-\srr+\stt'$,
$\scc=\stt'+\srr-\snn$ that is given in Appendix \ref{A1}.
We choose the $2\snn \times (\snn-\srr+\stt')$ matrix $G^{(1)}$,
the $2\snn \times (\stt'-\srr+\snn)$ matrix $G^{(2)}$,
and the $2\snn \times 2 (\stt'-\stt')$ matrix $F$,
as $A$, $C$, and $
\left(
\begin{array}{cc}
I & 0 \\
-A_1^T & A_2^T \\
0 & I \\
0 & 0
\end{array}
\right)$,
The matrix $G^{(1)}$ is self-column-orthogonal due to the condition (N1).
The matrix $F$ is column-orthogonal to $G^{(1)}$ due to the condition (N2).

The matrix $(G^{(1)},G^{(2)})$ is $(2\snn,2\stt')$-MDS code due to the condition (N5).
the $\snn+ \srr-\stt'$ column vectors of $(G^{(1)},F)$
forms the orthogonal space to the $\snn+ \srr-\stt'$ column vectors of $G^{(1)}$,
the linear space spanned by
the $\snn+ \srr-\stt'$ column vectors of $(G^{(1)},F)$
the linear space spanned by
the $\snn+ \srr-\stt'$ column vectors of $B$.
the matrix $(G^{(1)},G^{(2)},F)$ is $(2\snn,2\srr)$-MDS code
if and only if
The matrix $(B,G^{(2)})$ is $(2\snn,2\srr)$-MDS code, which is guaranteed by
the condition (N6).
the matrix $(G^{(1)},G^{(2)},F)$ is an $(\srr,\stt',\snn)$-QQMMSP, which
implies Condition (E3).

\begin{thebibliography}{99}

[1]
A. Shamir, ``How to share a secret,'' {\em Communications of the ACM,} 22(11):612--613, 1979.

[2]
G.R. Blakley, ``Safeguarding Cryptographic Keys,'' {\em Managing Requirements Knowledge, International Workshop on (AFIPS),} 48: 313--317, 1979.

[3]
B. Chor, O. Goldreich, E. Kushilevitz, and M. Sudan, ``Private information retrieval,'' {\em Journal of the ACM,} 45(6):965--981, 1998.

[4]
M. Rabin, ``How to exchange secrets by oblivious transfer,''
{\em Tech. Memo TR-81}, Aiken Computation Laboratory, Harvard University, 1981.

[5]
Y. Gertner, Y. Ishai, E. Kushilevitz, and T. Malkin,
``Protecting data privacy in private information retrieval schemes,''
{\em Journal of Computer and Systems Sciences}, 60(3):592--629, 2000. Earlier version in STOC 98.

[6]
A. Beimel, Y. Ishai, E. Kushilevitz, and I. Orlov,
``Share Conversion and Private Information Retrieval,''
{\em 2012 IEEE 27th Conference on Computational Complexity (CCC),} 2012.

[7]
L. Li, M. Militzer, and A. Datta, `
`rPIR: ramp secret sharing-based communication-efficient private information retrieval,''
{\em Int. J. Inf. Secur.} 16, 603--625, 2017.

[8]
H. Yang, W. Shin, and J. Lee,
``Private Information Retrieval for Secure Distributed Storage Systems,''
{\em IEEE Transactions on Information Forensics and Security}, pp.(99):1-1, 2018.

[9]
R. G.L. D'Oliveira and S. El Rouayheb,
``Lifting Private Information Retrieval from Two to any Number of Messages,''
{\em Proc. IEEE Int. Symp. Inf. Theory (ISIT),}  pp. 1744--1748, 2018.

[10]
S. Song and M. Hayashi,
``Equivalence of Non-Perfect Secret Sharing and Symmetric Private Information Retrieval with General Access Structure,''
{\em IEEE Journal on Selected Areas in Communications},
Volume: 40, Issue: 3, pp. 999 -- 1012 (2022).

%%%%%%%%% survey
[11]
A. Beimel,
``Secret-Sharing Schemes: A Survey,'' {\em Chee Y.M. et al. (eds) Coding and Cryptology.
IWCC 2011. Lecture Notes in Computer Science,} vol 6639, Springer, Berlin, Heidelberg, 2011.

[12]
M. Bertilsson and I. Ingemarsson,
``A construction of practical secret sharing schemes using linear block codes,''
In J. Seberry and Y. Zheng, editors, Advances in
Cryptology -- AUSCRYPT '92, volume 718 of
{\em Lecture Notes in Computer Science}, pp. 67--79. Springer-Verlag, 1993.

[13]
M. van Dijk, ``A linear construction of perfect secret sharing schemes,''
In A. De Santis, editor, Advances in Cryptology -- EUROCRYPT '94, volume 950 of
{\em Lecture Notes in Computer Science}, pp. 23--34. Springer-Verlag, 1995.

%%%%%%START of CQSS studies
[14]
M. Hillery, V. Buzek, and A. Berthaume,
``Quantum secret sharing,'' {\em Phys. Rev. A}, 59(3):1829--1834, 1999.

[15]
A. Karlsson, M. Koashi, and N. Imoto,
``Quantum entanglement for secret sharing and secret splitting,'' {\em Phys. Rev. A} 59, 162, 1999.

[16]
D. Gottesman,
``On the Theory of Quantum Secret Sharing,'' {\em Phys. Rev. A} 61, 042311, 2000.

%%% QSS & Graph state
[17]
P. Sarvepalli,
``Non-Threshold Quantum Secret Sharing Schemes in the Graph State Formalism, {\em Phys. Rev. A} 86, 042303, 2012. % QQ&CQ, general access structure

[18]
E. Kashefi, D. Markham, M. Mhalla, and S. Perdrix, `
`Information Flow in Secret Sharing Protocols,''
{\em Electronic Proceedings of Theoretical Computer Science,} 9, 87, 2009.

[19]
D. Markham and B. C. Sanders,
``Graph States for Quantum Secret Sharing,''
{\em Physical Review A} 78, 042309, 2008.

[20]
A. Keet, B. Fortescue, D. Markham, and B. C. Sanders,
``Quantum secret sharing with qudit graph states,'' {\em Phys. Rev. A,} 82, 062315, 2010.

[21]
MM. Wang, XB. Chen, and YX. Yang,
``Quantum secret sharing for general access structures based on multiparticle entanglements,''
{\em Quantum Inf Process} 13, 429--443, 2014.

%%ramp QSS

[22]
R. Matsumoto,
``Quantum stabilizer codes can realize access structures impossible by classical secret sharing,''
{\em IEICE Trans. Fundam.} E100--A(12), 2738--2739, 2017.

[23]
R. Matsumoto,
``Classical access structures of ramp secret sharing based on quantum stabilizer codes,''
{\em Quantum Information Processing}, vol.19, no.1, 2020.

%%%Connection to other problems

[24]
A. Marin and D. Markham,
``Equivalence between sharing quantum and classical secrets and error correction,''
{\em Phys. Rev. A}, vol. 88, issue 4, p. 042332, 2013.

%%QSS for general access structure
[25]
A. Smith ``Quantum secret sharing for general access structures,''
arXiv: 0001087, 2000.

%%START of QQSS studies

%%ramp QSS

[26]
P. Zhang and R. Matsumoto,
``Quantum Strongly Secure Ramp Secret Sharing,''
{\em Quantum Information Processing,} vol. 14, no. 2, pp. 715--729, 2015.

[27]
R. Matsumoto,
``Coding Theoretic Construction of Quantum Ramp Secret Sharing,''
{\em IEICE Trans. Fundamentals,} vol.E101-A, no.8, pp.1215--1222, 2018.

[28]
S. Gravier, J. Javelle, M. Mhalla, and S. Perdrix,
``On Weak Odd Domination and Graph-based Quantum Secret Sharing,''
{\em TCS Theoretical Computer Science,} 598, 129-137. 2015.

[29]
R. Cleve, D. Gottesman, and H.-K. Lo, ``How to share a quantum secret,''
{\em Phys. Rev. Lett.,} {\bf 83}(3):648--651, 1999.

[30]
P. Sarvepalli and R. Raussendorf, ``Matroids and quantum-secret-sharing schemes,''
{\em Phys. Rev. A} 81, 052333, 2010.

[31]
T. Ogawa, A. Sasaki, M. Iwamoto, H. Yamamoto,
``Quantum secret sharing schemes and reversibility of quantum operations,''
{\em Phys. Rev. A}, 72(3), 032318, 2005.

[32]
G.R. Blakley and C. Meadows,
``Security of ramp schemes,''
In:Advances in Cryptology-CRYPTO’84. Lecture Notes in Computer Science, vol. 196, pp. 242–269. Springer (1985)

[33]
M. Iwamoto and H. Yamamoto,
``Strongly secure ramp secret sharing schemes for general access structures,''
{\em Inf. Process. Lett.} 97(2), 52–57 (2006)

[34]
W. Ogata, K. Kurosawa, and S. Tsujii,
``Nonperfect secret sharing schemes,''
In: Advances in Cryptology-AUSCRYPT ’92.
{\em Lecture Notes in Computer Science}, vol. 718, pp. 56--66. Springer (1993).

[35]
D.R. Stinson,
``Cryptography Theory and Practice,''
3rd edn. Chapman \& Hall, London (2006)

[36]
H. Yamamoto,
``Secret sharing system using (k, l, n) threshold scheme,''
{\em Electron. Commun. Jpn. I Commun.} 69(9), 46--54 (1986).

[37]
I. Kerenidis and R. de Wolf, ``Quantum symmetrically-private information retrieval,''
{\em Information Processing Letters}, vol. 90, pp. 109--114, 2004.

[38]
S. Song and M. Hayashi,
``Capacity of Quantum Private Information Retrieval with Multiple Servers,''
{\em IEEE Transactions on Information Theory}, vol. 67, no. 1, pp. 452--463, 2021.

[39]
S. Song and M. Hayashi,
``Capacity of Quantum Private Information Retrieval with Collusion of All But One of Servers,''
%{\em Proceedings of 2019 IEEE Information Theory Workshop (ITW)}, pp. 1--5, 2019.
{\em IEEE Journal on Selected Areas in Information Theory},  vol. 2, no. 1, pp. 380--390, 2021.

[40]
S. Song and M. Hayashi,
``Capacity of Quantum Private Information Retrieval with Colluding Servers,''
{\em IEEE Transactions on Information Theory},  Volume: 67, Issue: 7, 5491 -- 5508 (2021).

[41]
M. Allaix, L. Holzbaur, T. Pllaha, and C. Hollanti,
%``Quantum Private Information Retrieval from MDS-coded and Colluding Servers,''
``Quantum Private Information Retrieval From Coded and Colluding Servers,''
{\em IEEE Journal on Selected Areas in Information Theory}, vol. 1, no. 2, pp. 599--610, 2020.
%{\em arXiv:2001.05883 [cs.IT]}, 2020.

[42]
M. Allaix, S. Song, L. Holzbaur, T. Pllaha, M. Hayashi, and C. Hollanti,
``On the Capacity of Quantum Private Information Retrieval from MDS-Coded and Colluding Servers,''
{\em IEEE Journal on Selected Areas in Communications},
vol. 40, no. 3, pp. 885 -- 898, 2022.

[43]
W. Y. Kon and  C. C. W. Lim,
``Provably Secure Symmetric Private Information Retrieval with Quantum Cryptography,''
{\em Entropy}, vol.~23, no.~1, 54, 2021.

[44]
C. Wang, W. Y. Kon, H. J. Ng, and C. C. Lim,
``Experimental symmetric private information retrieval with measurement-device-independent quantum network'',
{\em Light Sci Appl}, {\bf 11}, 268 (2022).

[45]
C. Wang, W. Y. Kon, H. J. Ng, and C. C. Lim,
``Experimental symmetric private information retrieval with quantum key distribution,''
{\em Quantum Information and Measurement VI 2021, F. Sciarrino, N. Treps, M. Giustina, and C. Silberhorn, eds., Technical Digest Series}, Optica Publishing Group, 2021.

%%% Classical

[46]
R. Tajeddine, O. W Gnilke, D. Karpuk, R. Freij-Hollanti, C. Hollanti, and S. El Rouayheb,
``Private information retrieval schemes for coded data with arbitrary collusion patterns,'' {\em 2017 IEEE International Symposium on Information Theory (ISIT),} pp.~1908--1912, 2017.

[47]
Y. Zhang and G. Ge, ``Private information retrieval from MDS coded databases with colluding servers under several variant models,''
%{\em arXiv} preprint: 1705.03186, 2017.
arXiv:1705.03186, 2017.

[48]
H. Sun and S. A. Jafar, ``Private information retrieval from MDS coded data with colluding servers: Settling a
conjecture by Freij-Hollanti et al.,''
{\em IEEE Transactions on Information Theory,} 64(2):1000--1022, 2018.

[49]
X. Yao, N. Liu, and W. Kang, ``The Capacity of Private Information Retrieval Under Arbitrary Collusion Patterns,''
{\em Proceedings of 2020 IEEE International Symposium on Information Theory (ISIT)}, pp. 1041--1046, 2020.

[50]
J. Cheng, N. Liu, and W. Kang, ``The Capacity of Symmetric Private Information Retrieval under Arbitrary Collusion and Eavesdropping Patterns,''
{\em IEEE Transactions on Information Forensics and Security}, vol. 17, pp. 3037-3050, 2022.
%, doi: 10.1109/TIFS.2022.3201375.

[51]
R. Tajeddine, O. W. Gnilke, D. Karpuk, R. Freij-Hollanti, and C. Hollanti,
``Private Information Retrieval From Coded Storage Systems With Colluding, Byzantine, and Unresponsive Servers,''
{\em IEEE Transactions on Information Theory,} vol. 65, no. 6, pp. 3898-3906, 2019. %, doi: 10.1109/TIT.2018.2890285.

[52]
K. Banawan and S. Ulukus, ``The Capacity of Private Information Retrieval from Byzantine and Colluding Databases,'' {\em IEEE Transactions on Information Theory,} vol. 65, no. 2, pp. 1206--1219, 2019.

%Q. Wang and M. Skoglund, ``Secure private information retrieval from colluding databases with eavesdroppers,'' {\em Proc. IEEE Int. Symp. Inf. Theory (ISIT),}  pp. 2456--2460, 2018.

[54]
L. Holzbaur, R. Freij-Hollanti, J. Li, and C. Hollanti,
``Towards the capacity of private information retrieval from coded and colluding servers,''
arXiv:1903.12552v6, 2021.

[53]
Q. Wang and M. Skoglund,
``Symmetric Private Information Retrieval from MDS Coded Distributed Storage With Non-Colluding and Colluding Servers,''
{\em IEEE Transactions on Information Theory}, vol. 65, no. 8, 2019.

[55]
I. Kerenidis, M. Lauri\`{e}re, F. Le Gall, and M. Rennela,
``Information cost of quantum communication protocols,''
{\em Quantum information \& computation,} 16(3-4):181--196, 2016.

[56]
D. Aharonov, Z. Brakerski, K.-M. Chung, A. Green, C.-Y. Lai, O. Sattath,
``On Quantum Advantage in Information Theoretic Single-Server PIR,''
{\em In: Ishai Y., Rijmen V. (eds) EUROCRYPT 2019,} Springer, Cham, vol.~11478, 2019.

[57]
S. Song, F. Le Gall, and M. Hayashi,
``Prior Entanglement Exponentially Improves One-Server Quantum Private Information Retrieval for Quantum Messages,''
in preparation.

[58]
M. A. Nielsen and I. L. Chuang, {\em Quantum computation and quantum information,} Cambridge: Cambridge University Press, 2000.

[59] M. Hayashi,
{\em Quantum Information Theory: Mathematical Foundation}, Graduate Texts in Physics, Springer, (Second edition of Quantum Information: An Introduction, Springer), 2017.

[60]
A. R. Calderbank, E. M. Rains, P. W. Shor, and N. J. A. Sloane,
``Quantum error correction via codes over gf (4),''
{\em IEEE Transactions on Information Theory,} vol. 44, no. 4, pp. 1369--1387, 1998.

[61]
A. Ashikhmin and E. Knill, ``Nonbinary quantum stabilizer codes,''
{\em IEEE Transactions on Information Theory,} vol. 47, no. 7, pp. 3065--3072, 2001.

[62]
A. Ketkar, A. Klappenecker, S. Kumar and P. Sarvepalli, ``Nonbinary stablizer codes over finite fields,''
{\em IEEE Transactions on Information Theory,} vol.~52, no.~11, pp.~4892--4914, 2006.

[63]
M. Hayashi, {\em Group Representation for Quantum Theory}, Cham, Switzerland: Springer, 2017.

[64]
F. J. MacWilliams and N.J.A. Sloane,
{\em The Theory of Error-Correcting Codes,}
%student revised ed.,
North-Holland Mathematical Library, Volume 16
Elsevier-North-Holland, Amsterdam, 1977.

[65]
M. Karchmer and A. Wigderson, ``On span programs,'' {\em Proc. of the 8th IEEE Structure in Complexity Theory,} pp. 102--111, 1993.

[66]
E. F. Brickell, ``Some ideal secret sharing schemes,'' {\em Journal of Combin. Math. and Combin. Comput.,} 6:105--113, 1989.

[67]
A. Beimel, {\em Secure Schemes for Secret Sharing and Key Distribution,}
PhD thesis, Technion, 1996.
www.cs.bgu.ac.il/ beimel/pub.html.

[68]
H. Sun and S. Jafar, ``The Capacity of Symmetric Private Information Retrieval,''
2016 IEEE Globecom Workshops (GC Wkshps), Washington, DC, 2016, pp. 1--5.

[69]
{Q. Wang and M. Skoglund,}
``Secure Symmetric Private Information Retrieval from Colluding Databases with Adversaries,''
{\em 2017 55th Annual Allerton Conference on Communication, Control, and Computing (Allerton)}, pp. 1083--1090, 2017.

[70]
W. Ogata, K. Kurosawa, and S. Tsujii,
``Nonperfect Secret Sharing Schemes,''
{\em Advances in Cryptology, Auscrypt 92, Lecture Notes in Comput. Sci.,}
718, 56--66, 1993.

[71]
K. Okada and K. Kurosawa,
``Lower Bound on the Size of Shares of Nonperfect Secret Sharing Schemes,''
{\em Advances in Cryptology, Asiacrypt 94, Lecture Notes in Comput. Sci.,}
917, 33--41, 1995.

[72]
P. Paillier, ``On ideal non-perfect secret sharing schemes,''
{\em Security Protocols, 5th International Workshop, Lecture Notes in Comput. Sci.,}
1361, 207--216, 1998

[73]
E. Knill and R. Laflamme,
``Theory of quantum error-correcting codes,''
{\em Phys. Rev. A} 55, 900 -- 911 (1997).

[74]
E. M. Rains, ``Nonbinary quantum codes,''
{\em IEEE Trans. Inf. Theory} 45, 1827 (1999).

[75]
F. Huber, and M. Grassl,
``Quantum Codes of Maximal Distance and Highly Entangled Subspaces,''
{\em Quantum} 4, 284 (2020).

[76]
K. Rietjens, B. Schoenmakers, and P. Tuyls,
``Quantum Information Theoretical Analysis of Various Constructions for Quantum Secret Sharing,''
{\em Proceedings of the 2005 IEEE International Symposium on Information Theory,}
Adelaide, Australia (IEEE, Piscataway, NJ, 2005), pp. 1598--1302, 2005.

[77]
M. Grassl, Th. Beth, and T. Pellizzari
``Codes for the quantum erasure channel,''
{\em Phys. Rev. A} {\bf 56}, 33 -- 38, 1997

[78]
A. Ambainis, M. Mosca, A. Tapp and R. De Wolf,
``Private quantum channels,''
{\em Proceedings 41st Annual Symposium on Foundations of Computer Science},
2000, pp. 547-553.
%, doi: 10.1109/SFCS.2000.892142.

[79]
P. Shor and J. Preskill,
``Simple Proof of Security of the BB84 Quantum Key Distribution Protocol,''
{\em Phys. Rev. Lett.} {\bf 85}, 441  (2000).

[80]
C. H. Bennett and S. J. Wiesner,
``Communication via one and two-particle operators on einstein-podolsky-rosen states,''
{\em Physical Review Letters}, {\bf 69}, 2881 (1992).

[81]
N. Cai and M. Hayashi,
``Secure Network Code for Adaptive and Active Attacks with No-Randomness in Intermediate Nodes,''
{\em IEEE Transactions on Information Theory}, vol.~66, 1428--1448, 2020.

[82]
M. Hayashi and \'{A}. V\'{a}zquez-Castro,
``Computation-aided classical-quantum multiple access to boost network communication speeds,''
{\em Physical Review Applied}, {\bf 16}, 054021 (2021).

[83]
W. Wootters and W. Zurek,
``A Single Quantum Cannot be Cloned,'' {\em Nature} 299 (5886): 802 -- 803 (1982).

[84]
D. Dieks, ``Communication by EPR devices,''
{\em Physics Letters A},{\bf 92} (6): 271 -- 272  (1982).

\end{thebibliography}

\end{document}

%general colluding sets

%R. Tajeddine, O. W Gnilke, D. Karpuk, R. Freij-Hollanti, C. Hollanti, and S. El Rouayheb, ``Private information retrieval schemes for coded data with arbitrary collusion patterns,'' {\em 2017 IEEE International Symposium on Information Theory (ISIT),} pp.~1908--1912, 2017.

%qualified set

%R. Tajeddine, O. W. Gnilke, D. Karpuk, R. Freij-Hollanti and C. Hollanti, ``Private Information Retrieval From Coded Storage Systems With Colluding, Byzantine, and Unresponsive Servers," {\em IEEE Transactions on Information Theory,} vol. 65, no. 6, pp. 3898-3906, 2019. %, doi: 10.1109/TIT.2018.2890285.

\end{thebibliography}

\end{document}