## 1 Introduction
By changing the arrival time of each signal, the eavesdropper can not only not introduce any errors but also obtain the information of some final keys [14]. Quantum hackers can also use detector blinding attacks to steal information [15]. The measurement-device-independent quantum key distribution (MDI-QKD) protocol [16] can remove all side-channels of the measurement devices [15], which effectively solves the security vulnerability. The MDI-QKD protocol allows the communicating parties to connect through untrusted relay nodes. In MDI-QKD, the equipment used by untrusted relay is more expensive and complex, but it can expand the transmission distance and double the coverage distance of the traditional QKD scheme when the key rate is equivalent to QKD [16]. In MDI-QKD with discrete variables, different implementations are proposed. This approach can achieve a long-distance quantum cryptography system [17]. The protocol is suitable for asymmetric channels [18]. QKD based on two fields was proposed as a measurement-device-independent scheme [19; 20]. A phase-matching QKD protocol is proposed, which is immune to all possible detection attacks [21]. It is related to the two field QKD protocol [22]. Continuous-variable MDI-QKD systems have also been studied. In order to generate secret correlations, they transmit the coherent state to the relay, where continuous-variable Bell detection and output broadcast are performed [23]. Strict security analysis of continuous-variable MDI-QKD is proposed, which shows its feasibility [24]. A multimode continuous-variable QKD system with non-Gaussian operations is proposed [25]. In the chip-based MDI-QKD network, each user only needs a compact transmitter chip, and the relay holds an expensive and huge measurement system (and quantum memory [26]) shared by all users. It is suitable for constructing a star-type quantum access network, placing complex and expensive measurement equipment in the central untrusted relay. Each user only needs a low-cost transmitter, such as an integrated photonic chip. The measuring equipment is placed on the central relay, which performs Bell state measurement (BSM). In a 200 square kilometer metropolitan area, an MDI-QKD star-type network was built by [PERSON] and others [27]. For the mixed situation of trusted and untrusted relay in the network, the routing algorithm is proposed [28]. Because the link structure and node types of the QKDN based on partially trusted relay are more complex, it is more likely that the key distribution in the process of service transmission fails. Therefore, the survivability problem in partially trusted relay scenario is of great significance. In view of the situation that there is trusted and untrusted relay in the network, how to allocate the normal key resources of QKD and design an appropriate protection scheme became the core topic of this paper. To solve the problem, we first describe a conventional QKDN based on fully trusted relay and a QKDN based on partially trusted relay to show differences between them. Then, the partially trusted relay-based protection strategy is proposed, which considers the protection threshold to enhance the security. A simulation based on the scheme was carried out on two different topologies. The results show there is a trade-off between key service request blocking rate and protection path construction success rate. The remainder of this paper is organized as follows. Section 2 describes the QKDN with fully trusted relay and partially trusted relay. Section 3 presents a problem statement to address the question. Section 4 proposes the protection strategy with partially trusted relay in detail. The simulation results and analysis are in Section 5. Finally, Section 6 outlines the summary and conclusions.