A Preemptive Multi-Secret Sharing Method Based on Cellular Automata

Abstract

The present invention discloses a cellular automaton-based multi-secret sharing method, and designs and introduces a cellular automaton-based (n,n) threshold scheme in the update phase. All participants can independently execute the evolutionary protocol and update the shares based on the sum of the shares sent by other participants. The design idea first ensures the communication complexity, and the (n,n) threshold scheme ensures that the shares of all participants must be combined to recover the secret, so that at most (n-1) passive attackers cannot steal the system secret. From the perspective of the cellular automaton method itself, it has higher computational efficiency than the current mainstream polynomial-based method. Combining the above factors, the present invention forms an efficient and secure cellular automaton secret sharing mechanism.

Description

Technical Field

[0001] The present invention relates to an information security application of a computer, and in particular to a solution and a system thereof which can be directly applied to secret sharing. Background Art

[0002] Secret sharing can be widely used in secret management and recovery, solving the security problems caused by one or a small group of people mastering the secret. (t,n) threshold secret sharing divides the secret information into n meaningless sub-secrets, and only those who have at least t sub-secrets can recover the secret information.

[0003] From the perspective of the secret sharing process, it mainly includes four stages: initialization stage, sharing stage, update stage and reconstruction stage. Among them, the initialization stage mainly initializes the parameters and models involved in the (t,n) threshold scheme to complete the preparation work. In the sharing stage, the original secret is converted into shares and handed over to the secret sharing participant team for management. The new shares are different from the original secret, so the secret is protected. In the update stage, the shares in the hands of the secret sharing participants are periodically updated to ensure that the attacker cannot obtain enough shares to recover the secret by attacking the participants in the same cycle. In the reconstruction stage, the shares held by the secret sharing participant team are used to select an appropriate number of shares to recover the original secret.

[0004] The initialization phase, sharing phase, and reconstruction phase mentioned above are the three most basic phases, and the introduction of the update phase is to protect the security of secrets in the system. Therefore, from a security perspective, the above four phases are indispensable.

[0005] From the perspective of secret sharing technology theory, it mainly includes secret sharing technology based on polynomial method, secret sharing technology based on Chinese remainder theorem, secret sharing technology based on cellular automaton, etc. Among them, secret sharing technology based on polynomial method is the most widely studied technology and the mainstream secret sharing technology. Therefore, the secret sharing technology based on polynomial method has been studied in depth, and dynamic threshold research and attacker model research have emerged. Dynamic threshold research has been extended to allow dynamic participating groups, dynamic thresholds, etc., while the attacker model has carried out security research from two aspects, active attacker model and passive attacker model. In addition, secret sharing technology based on polynomial method has also studied the security of the shares held by the secret sharing participating groups, and proposed that the shares need to be continuously updated periodically to achieve the purpose of protecting secrets. In contrast, secret sharing technology based on Chinese remainder theorem and secret sharing technology based on cellular automaton are obviously lagging behind, and there are fewer studies on related dynamic participating groups, dynamic thresholds and attacker models. In addition, research on update mechanisms for secret sharing technologies based on the Chinese remainder theorem and secret sharing technologies based on cellular automata is relatively scarce, and is still in the theoretical research stage of combining cellular automata or the Chinese remainder theorem with secret sharing.

[0006] Polynomial-based secret sharing technology is the mainstream secret sharing technology. It mainly decomposes the secret into secret sharing participating groups based on the polynomial solution theory, and can quickly restore the original secret through the Lagrangian method. This technology generally uses Lagrangian operations, exponential operations, large number modular operations, etc. to perform secret sharing calculations. At present, the optimal communication complexity that can be achieved by the update mechanism in polynomial-based secret sharing technology is , the optimal security threshold to deal with passive attackers in the update phase is

[0007] The secret sharing technology based on the Chinese remainder theorem is mainly based on the theory of the Chinese remainder theorem and makes extensive use of modular remainder operations. However, due to the strict conditions of the modulus, the secret sharing scheme based on the Chinese remainder theorem is usually difficult to construct. At present, the communication complexity of the sharing and reconstruction phases of the secret sharing technology based on the Chinese remainder theorem is about and However, there are relatively few studies on the related prior updating mechanisms.

[0008] The secret sharing technology based on cellular automata is mainly based on the theory of cellular automata. Researchers design one-dimensional and two-dimensional cellular automata structures and study and find reversible characteristics, and apply the reversible cellular automata theory to the field of secret sharing. However, similar to the secret sharing technology based on the Chinese remainder theorem, the current secret sharing scheme based on cellular automata still lacks a prior update mechanism. An efficient prior update mechanism is urgently needed to fill the research gap of secret sharing schemes based on cellular automata. Summary of the invention

[0009] The purpose of the present invention is to propose a multi-secret sharing method based on cellular automata to solve the secret update problem in the secret sharing scheme based on cellular automata.

[0010] The technical solution of the present invention to achieve the above-mentioned purpose is to provide a multi-secret sharing method based on cellular automata, including: an initialization phase, initializing the relevant parameters of the cellular automata, constructing a t The reversible linear memory cellular automaton (LMCA) of order t is constructed, and then the evolution M of LMCA of order t is constructed;

[0011] In the sharing phase, the evolved M calculates and divides the secret shares into n shares that are different from the original k secrets and distributes them to n participants.

[0012] In the update phase, a (n,n) threshold scheme is designed and introduced. n participants form an n-order reversible LMCA through joint negotiation, including various parameters of the reversible LCMA in the update phase: Neighbor radius in the update phase And the n-1 rule parameters of the (n,n) reversible linear memory cellular automaton in the update phase , n participants calculate n transformation shares based on their secret shares in an independent and parallel manner and distribute them to n participants, and then the n participants add up all the transformation shares obtained to obtain new shares and delete the original secret shares;

[0013] In the reconstruction phase, the original k secrets are recovered through two secret recovery processes (n,n) and (t,n).

[0014] The steps of the above update phase include: 3a), participants According to the shares held In a continuous share sequence To construct the initial configuration sequence, we use position i in ,in, , let U be the evolution of LMCA constructed in the update phase, participants This evolution U is used to calculate the new shares to be distributed to the n participants.

[0015] 3b) n participants negotiate or set a default random evolution number , where round is the number of update rounds, ,and satisfy .

[0016] 3c) Configuring Evolution for Initialization Second, form Stage Evolution .

[0017] 3d) Participants Select the last n configurations as new secret shares:

[0018] ,calculate And publish this round of .

[0019] 3e) Participants In the same order, the new shares Distribute to participant groups .

[0020] 3f) Participants Participants will receive New share of , calculate this round (1 ≤𝑗≤𝑛) to verify the share correctness.

[0021] 3g) Participants By summing get .

[0022] 3h) Participants By calculation , and publish In this round Complete a round of share update.

[0023] The above reconstruction phase consists of two parts. First, the (n,n) solution of the update phase is restored, including the following steps:

[0024] 41a) Secret Sharing Processor By calculating the last round ( ) to verify the share correctness.

[0025] 41b) If all the shares are correct, the continuous shares will be With public parameters Combined, based on initial configuration Construct the inverse of evolution U; initialize configuration evolution can be recovered , where R is the total number of update rounds.

[0026] Then set up the participant group The continuous shares held are , for the (t,n) solution to implement recovery, we need t A continuous share, is from t consecutive shares (0 ≤𝛼≤𝑛−𝑡) selected from , where 𝛼 is the initial position of the t consecutive shares, including the steps:

[0027] 42a) For 1 ≤ 𝑖 ≤ 𝑛, the secret sharing processor Can be To verify the correctness of the share.

[0028] 42b) When the share is correct, compare the share with the public parameter Combined, based on initial configuration Construct the inverse of M, based on the above configuration evolution + 𝛼 times recovered , evolution Recover out .

[0029] 42c) If 𝑡≥𝑘, then ; If 𝑡≤𝑘, then ,and .

[0030] The multi-secret sharing method of the present invention has outstanding substantive characteristics and significant progress: it can provide a more efficient and secure secret sharing mechanism. Specifically, first, the main computational overhead of the secret sharing method based on cellular automata is composed of random number generation, XOR operation and simple addition operation, and the overall computational efficiency is very high.

[0031] Second, the method is analyzed and verified from the perspective of confidentiality and correct key recovery, which is more secure against passive attackers than existing technologies.

[0032] Third, it has the same communication complexity as the current best mainstream secret sharing scheme.

[0033] Fourth, it can be easily converted into a decentralized parallel execution protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of an example of multi-secret sharing based on cellular automata of the present invention.

[0035] Figure 2 It is a schematic diagram of the multi-secret sharing process based on cellular automata of the present invention. DETAILED DESCRIPTION

[0036] In order to make the objects, features and advantages of the present application more obvious and understandable, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0037] In order to clearly describe the implementation of the method of the present invention, the symbols involved are defined as shown in the following table: .

[0038] A one-dimensional memory cellular automaton (CA) is a discrete system consisting of a finite number of cell states, where the state value of each cell depends on the state values ​​of its neighbors. For a CA containing N cells, if the radius of the neighbors is , then for the The neighbors of a cell can be written as . With symbol Marked as cell The state value at time T is: ,

[0039] Or there is an equivalent formula: ( ).

[0040] At the same time, for each cell state , its state not only depends on the value of the neighbor at the previous moment, but also has different performances under the control of a series of rules, namely: ( ). The radius is The CA has rules, denoted by , then: .therefore, .

[0041] If the state of each cell If it depends not only on the value of the neighbor at the previous moment, but also on the state of the neighbor at the past t-1 moment, then it can be called a memorizable cellular automaton. Reference AMD Rey, Mateus JP, GR Sánchez. A secret sharing scheme based on cellularautomata[J]. AppliedMathematics&Computation, 2005, 170(2):1356-1364. (hereinafter referred to as Rey[1]) and Eslami Z, Ahmadabadi J Z. A verifiable multi-secret sharing scheme based on cellularautomata[J]. Information Sciences, 2010, 180(15): 2889-2894.

[0042] (hereinafter referred to as Eslami[2]) In the study, we can see that a linear memorizable cellular automaton is defined by the following formula: .

[0043] And Rey[1] proved that when In the case of , the above linear memory cellular automaton is reversible. Its inverse linear memory cellular automaton satisfies the following expression:

[0044] .

[0045] Proposition 1: Initial sequence ( ) is split into T initial sequences , , They are all under the same rules When the linear cellular automaton When reversible, It is also reversible. And its inverse is:

[0046]

[0047] Proof: According to the reasoning of Rey[1] and Eslami[2], we know that: is reversible, then its inverse is: . And for the sequence have: . Considering that except for position i, all other positions are 0. Therefore, . It can be introduced , obtained the certificate.

[0048] Based on the research of Rey[1] and Eslami[2], this paper proposes a multi-secret sharing method based on cellular automation based on Proposition 1. k While keeping a secret, n participants are allowed to periodically update their shares to protect the security of their shares. This method consists of four stages: (1) Initialization stage, initializing the parameters of the cellular automation and constructing a t In the sharing phase, the evolved M calculates and divides the secret into n shares that are different from the original k secrets and distributes them to the n participants. These n shares become the new secrets in the hands of the n participants, or secret shares. In the update phase, the (n,n) threshold scheme is designed and introduced. The n participants form an n-order reversible LMCA through joint negotiation, including the parameters of the reversible LCMA in the update phase: the neighbor radius in the update phase And the n-1 rule parameters of the (n,n) reversible linear memory cellular automaton in the update phase , n participants calculate n transformation shares based on their secret shares in an independent and parallel manner and distribute them to n participants. The n participants then add up all the transformation shares obtained to obtain new shares and delete the original secret shares. (4) In the reconstruction phase, after two secret recovery processes (n,n) and (t,n), the original k secrets are recovered.

[0049] For the concrete and process-based implementation of each stage, please refer to Figure 1 and Figure 2 As shown, details are as follows.

[0050] 1. Initialization phase, including the following steps:

[0051] 1a) Choose a prime number pMake the discrete logarithm problem difficult to solve in 𝐺𝐹(𝑝) and select a generator g for 𝐺𝐹(𝑝)\{0}; here, GF(p) is a mathematical finite field, Galois Field (GF), p in the brackets is a prime number, when p is a prime number, F={0, 1, 2, ... p-1}. Addition and multiplication of modular operations under mod(p) form a finite field, and this field is recorded as GF(p). p is the size of the field. The key to the difficulty of discrete logarithm is that, taking the mathematical expression used by Deffie-Hellman as an example: G=g^s (mod p), the discrete logarithm problem means that it is difficult to obtain s from the known G, g, p. The key to the difficulty of calculation here is that p is a very large prime number. Combined with the following problem, the significance of this step a is to choose a discrete logarithm problem (for example: G=g^s (modp) used by Deffie-Hellman). Publishing G can verify the correctness of s, but knowing G cannot deduce s (the key secret).

[0052] GF(p) represents the mod(p) operation, so the value is between 0 and p-1. 𝐺𝐹(𝑝)\{0} represents the domain excluding the value 0, that is, between 1 and p-1. For example, after choosing Deffie-Hellman's G=g^s (mod p), GF(P) is g^s(mod p). Here g can be chosen arbitrarily, for example: 2, 3, etc., or the key of the secret sharing processor D can be chosen.

[0053] 1b) Select the neighbor radius size to satisfy And set ,in is the maximum bit length of the secret to be shared, the neighborhood radius The superscript indicates the initialization phase.

[0054] 1c) Randomly select and publish random numbers ,for satisfy , t-1 The random numbers are used as the initial t The rules for each configuration are encoded to drive the state changes of the cell.

[0055] 1d) Through the formula

[0056] Build t Evolution of LMCA of order M, , The radius is The local transformation function of LMCA and the rule number is .

[0057] 1e) Calculate the initial configuration sequence: If ,set up , and select random (𝑡−𝑘) binary strings of length N to fill the remaining gaps; ;if ,set up .

[0058] Second, in the sharing phase, let M be the evolution of LMCA constructed in the initialization phase. The evolution M is used to calculate the shares to be distributed to n participants. The specific steps are as follows:

[0059] 2a) Randomly select an evolution number ,and satisfy ;

[0060] 2b) Configuring Evolution for Initialization Second, form Stage Evolution M: ;

[0061] 2c) If ,calculate , and announced ;

[0062] 2d) Settings ; 2e), calculation , and publish .

[0063] in, Requirements , mainly to ensure that the configuration to be distributed is consistent with the initial t There is no overlap between the configurations. Select As the number of evolutions, on the one hand, since the number of participants is n, at least n configurations are required; on the other hand, in order to ensure that the latest n configurations selected do not overlap with the initial configuration, that is: In addition, due to the discrete logarithm problem of 𝐺𝐹(𝑝), it is announced that The information of the share itself will not be leaked. It can play a role in verification. Finally, It is a public parameter.

[0064] 3. Update phase, assuming Is a participant (1 ≤𝑖≤𝑛) shares held, then The share update operation can be completed through the following process:

[0065] 3a) Participants According to the shares held In a continuous share sequence To construct the initial configuration sequence, we use position i in ,in, , let U be the evolution of LMCA constructed in the update phase, participants Use this evolution U to calculate the new shares to be distributed to n participants;

[0066] 3b) n participants negotiate or set a default random evolution number , where round is the number of update rounds, ,and satisfy ;

[0067] 3c) Configuring Evolution for Initialization Second, form Stage Evolution ;

[0068] 3d) Participants Select the last n configurations as new secret shares:

[0069] ,calculate And publish this round of

[0070] ;

[0071] 3e) Participants In the same order, the new shares Distribute to participant groups ;

[0072] 3f) Participants Participants will receive New share of , calculate this round (1 ≤𝑗≤𝑛) to verify the share Correctness;

[0073] 3g) Participants By summing get ;

[0074] 3h) Participants By calculation , and publish In this round Complete a round of share update.

[0075] Fourth, in the reconstruction phase, the original k secrets need to be restored through two secret recovery processes, (n,n) and (t,n) respectively.

[0076] First, the (n,n) solution in the update phase is restored, including the following steps:

[0077] 41a) Secret Sharing Processor By calculating the last round ( ) to verify the share Correctness;

[0078] 41b) If all the shares are correct, the continuous shares will be With public parameters Combined, based on initial configuration Construct the inverse of evolution U; initialize configuration evolution can be recovered , where R is the total number of update rounds;

[0079] Then set up the participant group The continuous shares held are , for the (t,n) solution to implement recovery, we need t A continuous share, is from t consecutive shares (0 ≤𝛼≤𝑛−𝑡) selected from , where 𝛼 is the initial position of the t consecutive shares, including the steps:

[0080] 42a) For 1 ≤ 𝑖 ≤ 𝑛, the secret sharing processor Can be

[0081] To verify the correctness of the share;

[0082] 42b) When the share is correct, compare the share with the public parameter Combined, based on initial configuration Construct the inverse of M, based on the above configuration evolution + 𝛼 times recovered , evolution Recover out ;

[0083] 42c) If 𝑡≥𝑘, then ; If 𝑡≤𝑘, then ,and .

[0084] In addition, the present invention also defines the following security model for the implementation and verification of the multi-secret sharing method. Usually, passive attackers are honest but curious attackers who will not disrupt the normal operation of the protocol, but intentionally retain some information to achieve the goal of stealing secrets. Once an active attacker captures a node, he steals the secret data on it and wantonly destroys the protocol that should be followed. Compared with passive attackers, active attackers are easily discovered and eliminated once they initiate malicious behavior. Passive attackers steal secrets quietly, which is more harmful. The present invention mainly faces passive attackers and designs a solution that is more tolerant of passive attackers.

[0085] Drawing on [3] Hirt M, Maurer U, Lucas C. A dynamic tradeoff between active and passive corruptions in secure multi-party computation [C] / / Annual Cryptology Conference. Springer, 2013: 203- 219. and Dolev S, Eldefrawy K, Lampkins J, et al. Proactive secret sharing with a dishonest majority [C] / / International Conference on Security and Cryptography for Networks. Springer, 2016: 529-548. for the security definition of secret sharing schemes, the present invention defines security as correctness and confidentiality.

[0086] A passive attacker facing any probabilistic polynomial-time model with threshold a , claiming that the secret sharing protocol is secure when it satisfies the following conditions:

[0087] Confidentiality: At any time, the attacker Controls a members of the committee. Based on the secret shares held by these a members, the attacker If the secret cannot be obtained, it means that the system meets the confidentiality requirements.

[0088] Correctness: The premise that the secret is recoverable and the attacker cannot obtain the secret, and the premise that the attacker Under the interference of , continuous secret shares are selected. If the recovered secret 𝑆′ is consistent with the original secret 𝑆, the system operates correctly.

[0089] Based on the above embodiment, the security analysis and performance analysis are carried out compared with the existing mainstream solutions as follows.

[0090] 1. Security Analysis,In the update phase, an (n,n) scheme is constructed, which means that the shares of all participants are always required to recover the original secret. Therefore, the existence of at most (n-1) passive attackers can only obtain at most (n-1) shares. This ensures that the passive attackers cannot recover the secret, making the system meet confidentiality. Furthermore, the passive attackers will not destroy the system protocol. At the same time, by calculating and publishing It can verify the correctness of the shares well. It can timely discover and correct incorrect shares. Therefore, the secret can be correctly recovered by selecting continuous secret shares at any time. In summary, without leaking any secrets and always ensuring the correct recovery of secrets, this protocol can safely resist the existence of up to (n-1) passive attackers. In the security system against passive attackers, the threshold (n-1) is the best level that current related research can achieve.

[0091] 2. Performance Analysis,The first update mechanism proposed by the present invention, in the update phase, each participant The shares held Calculate new share And distributed to n participants. Each participant in this link The communication complexity is , so the total communication complexity is As shown in the following table

[0092] As shown. Among them, Maram[5] refers to Sai KrishnaDeepak Maram, Fan Zhang, et al.CHURP: Dynamic-Committee Proactive Secret Sharing[C] / / In Proceedings of the2019 ACM SIGSAC Conference on Computer and Communications Security (CCS '19).New York, NY, USA, 2019:2369–2386. And Eldefrawy[6] refers to Eldefrawy K., LepointT., Leroux A. Communication-Efficient Proactive Secret Sharing forDynamicGroups with Dishonest Majorities[C] / / International Conference onAppliedCryptography and Network Security(ACNS 2020). 2020:3-23. It can be seen that compared with the mainstream polynomial-based secret sharing method, the present invention has the same level of communication complexity.

[0093] In addition, the main operations of the update mechanism based on cellular automata are composed of simple addition, XOR operation, random number generation, etc. Compared with the large number modulus and exponential operation of the polynomial method, the calculation efficiency is obviously higher, that is, lower time complexity.

[0094] The above is a detailed introduction to the multi-secret sharing method provided by the present application. The present invention uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A multi-secret sharing method based on cellular automata, characterized in that include: Initialization phase: initialize the cellular automaton related parameters, construct a t-order reversible linear memory cellular automaton, and then construct the evolution M of the t-order linear memory cellular automaton; 1a) Choose a prime number p that makes the discrete logarithm problem difficult to solve in GF(p), and choose a generator g for GF(p)\{0}; 1b) Select the neighbor radius r o size to satisfy And set N = l, where e is the maximum bit length of the secret to be shared, and the neighborhood radius r o The superscript indicates the initialization phase; 1c) Randomly select and publish random numbers For 1≤i≤t-1, The t-1 random numbers are respectively used as the rule codes of the initial t configurations to promote the state change of the cell; 1d) Through the formula Construct the evolution M of a t-order linear memory cellular automaton, 0≤j≤N-1, The radius is r o The local transformation function of the linear memcpy cellular automaton and the rule number is 1e) Calculate the initial configuration sequence: If t ≥ k, set And select random (tk) binary strings of length N to fill the remaining gaps; form If t≤k, set In the sharing phase, the evolved M calculates and divides the secret shares into n shares that are different from the original k secrets and distributes them to n participants. 2a) Randomly select an evolution number m o , and m o Meet m o ≥max(k,t); 2b) Initialize configuration evolution (m o +n-1) times, forming (m o +n) level evolution M: 2c) If t≤k, calculate And publish {β1, ..., β k-t }; 2d) Settings 2e) Calculation and publish In the update phase, a threshold scheme of (n,n) is designed and introduced. The n participants form an n-order reversible linear memory cellular automaton through joint negotiation, including the parameters of the reversible linear memory cellular automaton in the update phase: the neighbor radius r in the update phase u And the n-1 rule parameters of the (n,n) reversible linear memory cellular automaton in the update phase n participants calculate n transformation shares independently and in parallel based on their secret shares and distribute them to n participants. n participants then add up all the transformation shares they obtain to get new shares and delete the original secret shares. In the reconstruction phase, the original k secrets are recovered through two secret recovery processes (n,n) and (t,n); First, the (n,n) solution in the update phase is restored, including the following steps: 41a) Secret Sharing Processor By calculating the last round To verify the share SH i Correctness; 41b), if all the shares are correct, the consecutive shares {SH1, ..., SH n } and public parameters Combined, based on initial configuration Construct the inverse of evolution U; initialize configuration evolution can be recovered Where R is the total number of update rounds; Then set up the participant group The continuous shares held are For the (t,n) scheme to implement recovery, t consecutive shares are required, let is from t consecutive shares (0≤α≤nt) selected from , where α is the initial position of the t consecutive shares, including the steps: 42a) For 1≤i≤n, the secret sharing processor Can be To verify the correctness of the share; 42b) When the share is correct, compare the share with the public parameter Combined, based on initial configuration Construct the inverse of M, based on the above configuration Evolution o +α times recovery Evolution o +α+t-1) times recovery 42c), if t ≥ k, then If t≤k, then and 2. According to the cellular automation-based multi-secret sharing method of claim 1, it is characterized in that The steps of the update phase include: 3a) Participant P i According to the shares held by SH i In the continuous share sequence {SH j } j∈[1，n] To construct the initial configuration sequence, we use position i in in, Let U be the evolution of the linear memcpy cellular automaton constructed in the update phase, and the participant P i Use this evolution U to calculate the new shares to be distributed to n participants; 3b) n participants negotiate or set a default random evolution number Where round is the number of update rounds, round ≥ 1, and satisfy 3c) Configuring Evolution for Initialization Second, form Stage Evolution U: 3d) Participant P i Select the last n configurations as new secret shares: calculate And publish this round of 3e) Participant P i In the same order, the new shares Distribute to group of participants 3f) Participant P i The received j New share of Calculate this round To verify the share Correctness; 3g), Participant P i By summing Get new share SH i ; 3h), Participant P i By calculation And publish P i In this round Complete a round of share update.

Images