A method, system, device and storage medium for sharing secret information

Abstract

The present invention discloses a secret information sharing method, system, device and storage medium, which are applied to the field of information security technology and solve the problem of low reliability and poor flexibility of classic secret sharing schemes. The method comprises: converting secret information into an element in the Galois field as a secret element and comparing it with the Galois field. k ‑1 elements constitute the vector to be encoded; based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is encoded into the encoding vector, and the obtained n The encoding results of the elements are divided into n Shares sent to n participating nodes, so that r Participating nodes utilize r The solution of the present invention can effectively deal with malicious fraud by participating nodes during the secret reconstruction phase. It is information-theoretic security rather than computational security. The distribution node does not need to participate in secret reconstruction, and there is no data expansion in the secret distribution process, which is conducive to further ensuring security.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, system, device and storage medium for sharing secret information. Background Art

[0002] With the continuous development of informatization, digitization, and intelligentization, data leakage has become an increasingly serious problem. Cryptography provides many practical technologies to ensure data security, such as encryption and digital signatures. In cryptographic systems, due to the inherent security requirements of cryptographic algorithms and their widespread application, the implementation details of cryptographic algorithms are often public. Therefore, the security of commercial cryptographic systems depends on the confidentiality of keys, and key management is a key research direction in the field of cryptography.

[0003] like Figure 1 As shown in FIG, a schematic diagram of a commonly used key management method is shown. Figure 1 It is a threshold secret sharing scheme that divides the key or other sensitive information into several shares, that is, into several parts, and then gives them to different participants for safekeeping. The threshold secret sharing scheme requires that only a certain number (threshold value) k The secret can only be recovered when more than a threshold of participants cooperate. Fewer than a threshold of participants cannot recover the secret. The set of participants that can reconstruct the secret is called the authorized set, while the set of participants that cannot is called the unauthorized set. All authorized sets constitute the access structure of the secret sharing scheme.

[0004] Figure 1 The effectiveness of this classic secret sharing technique relies on the assumption that all participants are honest. However, this assumption is unreasonable in reality. During the secret reconstruction phase, some participants may present false shares, preventing honest participants from recovering the secret or obtaining incorrect results. Fraudsters can then use the honest participants' shares to reconstruct the secret, significantly threatening the reliability of the system. Furthermore, some current fraud prevention methods involve constructing verifiable secret sharing schemes, such as using digital signatures to verify participants' shares and introducing so-called shadow shares in addition to the shares. However, the security of such schemes relies on the difficulty of the discrete logarithm problem or the prime factorization problem, and therefore is computationally secure, unable to withstand quantum computing attacks with their immense computing power.

[0005] In summary, how to effectively realize the sharing of secret information and improve reliability is a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0006] The purpose of the present invention is to provide a secret information sharing method, system, device and storage medium to effectively realize the sharing of secret information and improve reliability.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] A method for sharing secret information, comprising:

[0009] According to the set conversion rules, the secret information is converted into an element in the set Galois field as the secret element;

[0010] Select from the set Galois field n different elements, as n The public identity information of each participating node;

[0011] Select from the Galois field k -1 element, and together with the secret element, form a k The vector to be encoded of elements;

[0012] Based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is used to encode the vector to be encoded, and the result includes n The encoding result of elements;

[0013] According to the different positions of the elements, the encoding results are divided into n shares and send them to n Participating nodes, so that when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. If r > k And judge r When there are false shares among the shares, the false shares are corrected and then the secret element is reconstructed, and the secret information corresponding to the secret element is determined;

[0014] in, n is a positive integer not less than 2, k A positive integer represents the minimum number of shares required to reconstruct the secret. r is a positive integer, and r < k Secret reconstruction is not possible when r > k The number of false shares corrected shall not exceed .

[0015] In one embodiment, the Galois field is selected from the setn different elements, as n The public identity information of each participating node, including:

[0016] Randomly select from the set Galois field n different elements, as n The public identity information of each participating node.

[0017] In one embodiment, the randomly selected n different elements, as n The public identity information of each participating node, including:

[0018] Uniformly randomly select from the set Galois field n different elements, as n The public identity information of each participating node.

[0019] In one embodiment, the Galois field is selected k -1 element, and together with the secret element, form a k The vector to be encoded is composed of

[0020] Uniformly randomly select from the Galois field k -1 element, and together with the secret element, form a k The vector to be encoded is of elements.

[0021] In one embodiment, the encoding rule based on the generalized Reed-Solomon code is n The identity information of the participating nodes is used to encode the vector to be encoded, and the result includes n The encoding result of the elements includes:

[0022] Based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is used to establish a Vandermonde matrix, and the vector to be encoded is encoded by the established Vandermonde matrix, and the obtained vector includes n The encoding result of the elements.

[0023] In one embodiment, the encoding rule based on the generalized Reed-Solomon code is n The identity information of the participating nodes is used to establish a Vandermonde matrix, and the vector to be encoded is encoded by the established Vandermonde matrix, and the obtained vector includes n The encoding result of the elements includes:

[0024] Based on the encoding rules of generalized Reed-Solomon code, nThe identity information of the participating nodes is as follows ( s 1, ..., s n ) = a · G The calculation method is to encode the vector to be encoded, and the result includes n The encoding result of elements;

[0025] in, a To include k The vector to be encoded has elements, G To pass n The Vandermonde matrix is ​​built based on the identity information of the participating nodes, and , s 1 to s n To obtain include n The encoding result of elements, to for n The identity information of each participating node.

[0026] In one embodiment, it further includes:

[0027] When a new participating node is needed, no less than k The participating nodes operate according to the preset share addition rules so that the newly added participating nodes obtain 1 new share.

[0028] In one embodiment, when a new participating node is needed, no less than k Participating nodes operate according to the preset share addition rules so that the newly added participating nodes obtain 1 new share, including:

[0029] When a new participating node is needed, the current n of the participating nodes r Each participating node calculates its own intermediate value;

[0030] in, r The first of the participating nodes i The median value calculated by the participating nodes Expressed as , s i For the i The shares of participating nodes, m i for M -1 Before k The first column of the submatrix i row vector, matrix , M -1 for M The inverse matrix of , to for n The identity information of each participating node, The identity information of the newly added participating node, T is the transposed matrix symbol, r ≥ k ;

[0031] Based on the preset information security sending method, the newly added participating nodes can determine the to The sum of the newly added nodes is used as the new share of the newly added nodes, and the newly added nodes cannot determine the to Any intermediate value in .

[0032] In one embodiment, based on the preset information security sending method, the newly added participating node determines to The sum of the newly added nodes is used as the new share of the newly added nodes, and the newly added nodes cannot determine the to Any intermediate value, including:

[0033] for r Each of the participating nodes divides the intermediate value calculated by itself into r data, so that they are divided into r The sum of the data is equal to the intermediate value calculated by itself, and the participating node retains r After one of the data, the rest r- 1 data is sent to the rest r- 1 participating node;

[0034] for r Each of the participating nodes will store the data and receive r- 1 data and send the summation result to the newly added participating nodes so that the newly added participating nodes will r After summing up the data sent by participating nodes, we can get to and use the sum as the 1 new share obtained by the newly added participating node.

[0035] In one embodiment, it further includes:

[0036] When a participating node needs to be removed, no less than k The participating nodes are removed according to the preset participating node removal rules, so that each participating node except the removed participating node receives 1 new share to replace the original share.

[0037] In one embodiment, when a participating node needs to be removed, no less than k Participating nodes are removed according to the preset participating node removal rules, so that each participating node except the removed participating node receives a new share to replace the original share, including:

[0038] When a participating node needs to be removed, the current n of the participating nodes r Each participating node calculates its own sub-secret data based on its current share;

[0039] in, r The first of the participating nodes i The sub-secret data calculated by the participating nodes a i0 Expressed as , s i For the i The shares of participating nodes, M i0 for exist M The algebraic cofactor in the matrix , det( M ) means M The determinant of to for n The identity information of each participating node, r ≥ k ;

[0040] based on r Secret data, by r The participating nodes operate according to the preset share security generation method, so that each participating node except the removed participating node obtains a new share to replace the original share, and no participating node can obtain the sub-secret data of any other participating node.

[0041] In one embodiment, based on r Secret data, by rThe participating nodes operate according to the preset share security generation method, so that each participating node except the removed participating node obtains a new share to replace the original share, and no participating node can obtain the sub-secret data of any other participating node, including:

[0042] for r Each participating node among the participating nodes calculates the sub-secret data calculated by itself and the first polynomial constructed by itself n -1 sub-share value, and the calculated n -1 sub-share value is allocated to all participating nodes except the removed node, including itself. n -1 remaining participating node;

[0043] For the remaining participating nodes except the removed ones n -1 participating node, which has obtained r After the sub-share value is obtained, r The sum of the sub-share values ​​is used as the new share of the self to replace the original share of the self;

[0044] in, r Among the participating nodes i The first polynomial constructed by the participating nodes is expressed as , t is a positive integer and 1≤ t ≤ k -1, a i1 to a i（k-1） For the i The participating nodes are selected from the Galois field k -1 element; i The participating nodes construct the first polynomial by x The value of is the remaining nodes except the removed participating nodes. n -1 identity information of participating nodes, calculated in turn n -1 sub-share value.

[0045] In one embodiment, it further includes:

[0046] When the minimum number of shares required to achieve secret reconstruction needs to be adjusted k When the value is , no less than kParticipating nodes operate according to the preset threshold adjustment rules so that each current participating node gets 1 new share to replace the original share, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to ;

[0047] It represents the minimum number of shares required to achieve secret reconstruction after adjustment.

[0048] In one embodiment, when the minimum number of shares required to achieve secret reconstruction needs to be adjusted k When the value is , no less than k Participating nodes operate according to the preset threshold adjustment rules so that each current participating node gets 1 new share to replace the original share, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to ,include:

[0049] When the minimum number of shares required to achieve secret reconstruction needs to be adjusted k When the value of n of the participating nodes r Each participating node calculates its own sub-secret data based on its current share;

[0050] in, r The first of the participating nodes i The sub-secret data calculated by the participating nodes a i0 Expressed as: , s i For the i The shares of participating nodes, M i0 for exist M The algebraic cofactor in the matrix , det( M ) means M The determinant of to for n The identity information of each participating node, r ≥ k ;

[0051] based on r Secret data, by rThe participating nodes operate according to the preset threshold adjustment method, so that each participating node gets a new share to replace the original share, and any participating node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to .

[0052] In one embodiment, based on r Secret data, by r The participating nodes operate according to the preset threshold adjustment method, so that each participating node gets a new share to replace the original share, and any participating node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to ,include:

[0053] for r Each of the participating nodes calculates the sub-secret data calculated by itself and the second polynomial constructed by itself. n Sub-share values, and the calculated n The sub-share values ​​are allocated to each of n Participating nodes;

[0054] for n Each participating node in the participating nodes obtains r After the sub-share value is obtained, r The sum of the sub-share values ​​is used as the new share of the self to replace the original share of the self;

[0055] in, r Among the participating nodes i The second polynomial constructed by the participating nodes is expressed as , c is a positive integer and , a i1 to For the i The participating nodes are selected from the Galois field element; i The participating nodes construct the second polynomial by x The value of the current n The identity information of the participating nodes is calculated in turn. n Sub-share value.

[0056] In one embodiment, the encoding result is divided into n shares and send them to n Participating nodes, so that when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. If r > k And judge r When there are false shares among the shares, the false shares are corrected and then the secret element is reconstructed, and the secret information corresponding to the secret element is determined, including:

[0057] According to the different positions of the elements, the encoding results are divided into n shares and send them to n Participating nodes, so that when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. If r > k , then judge s · H T =0 is true, if not, then judge r When there are false shares among the shares, the secret element is reconstructed after correcting the false shares, and the secret information corresponding to the secret element is determined;

[0058] in, H To satisfy M k H T =0( r - k )× r full rank matrix, M k is a matrix M Before k The submatrix consisting of rows, T is the transposed matrix symbol, the matrix , to for n The identity information of each participating node, , s1 to s r Indicates secret reconstruction r The shares of each participating node.

[0059] In one embodiment, it further includes:

[0060] when r Participating nodes utilize r The shares are secretly reconstructed and the r When there are fake shares in the shares, if the number of fake shares does not exceed , r Each participating node determines the identity information of the participating node corresponding to each false share.

[0061] In one embodiment, if r = k , then based on r Reconstructing the secret element from the shares and determining the secret information corresponding to the secret element includes:

[0062] if r = k , then based on r Shares, calculated by The secret element is reconstructed in a manner and the secret information corresponding to the secret element is determined.

[0063] In one embodiment, it further includes:

[0064] when r Participating nodes utilize r shares to perform secret reconstruction and r = k When based on r After reconstructing the secret element from the shares, r Each participating node outputs a prompt message indicating that the reconstructed secret element has a security risk.

[0065] A secret information sharing system, comprising: a distribution node and n Participating nodes;

[0066] The distribution node is used to:

[0067] According to the set conversion rules, the secret information is converted into an element in the set Galois field as the secret element;

[0068] Select from the set Galois field n different elements, as n The public identity information of each participating node;

[0069] Select from the Galois field k -1 element, and together with the secret element, form a k The vector to be encoded of elements;

[0070] Based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is used to encode the vector to be encoded, and the result includes n The encoding result of elements;

[0071] According to the different positions of the elements, the encoding results are divided into n shares and send them to n Participating nodes;

[0072] The participating nodes are used to:

[0073] when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then based on r shares to reconstruct the secret element, if r > k And judge r When there are false shares among the shares, the false shares are corrected and then the secret element is reconstructed;

[0074] Determining corresponding secret information based on the reconstructed secret element;

[0075] in, n is a positive integer not less than 2, k A positive integer represents the minimum number of shares required to reconstruct the secret. r is a positive integer and r < k Secret reconstruction is not possible when r > k The number of false shares corrected shall not exceed .

[0076] A secret information sharing device, comprising:

[0077] memory for storing computer programs;

[0078] A processor is configured to execute the computer program to implement the steps of the above-mentioned method for sharing secret information.

[0079] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the secret information sharing method described above.

[0080] The beneficial effect of applying the technical solution provided by the embodiment of the present invention is that the solution of the present invention is based on generalized Reed-Solomon codes to achieve the sharing of secret information, which can effectively deal with the situation where fraudsters provide false shares. In addition, the security of the solution of the present invention does not rely on any assumption of computational difficulty, that is, the solution of the present invention is information-theoretic security rather than security in the computational sense of classical solutions, so the solution of the present invention can resist quantum computing attacks. In addition, after the secret distribution, the solution of the present invention does not require the participation of the distribution node in subsequent stages, including secret reconstruction, which is conducive to further improving flexibility and reliability. The shares saved by the participating nodes have the same length as the secret element, so that the secret distribution process of the solution of the present invention does not have data expansion, which is also conducive to further ensuring security.

[0081] Specifically, in order to be able to implement encoding based on generalized Reed-Solomon codes in the future, in the solution of the present invention, the distribution node converts the secret information into an element in the set Galois field according to the conversion rules set as needed, and the secret element can be used as the secret element together with the element selected from the Galois field. k -1 element, together forming a containing k The vector to be encoded has elements, that is, the vector to be encoded carries a secret element. n Participating nodes need to be selected from the set Galois field n different elements, as n The public identity information of the participating nodes. Based on the encoding rules of the generalized Reed-Solomon code, n The identity information of the participating nodes is encoded into the encoding vector to obtain n The encoding result of the elements. The encoding result includes n elements, each element as 1 share, so that the encoding result can be divided into n The shares are thus given to n Based on the principle of generalized Reed-Solomon code, when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then it can be based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. Of course, the reconstruction accuracy cannot be guaranteed at this time, that is, r = k Time requirements r Only when all participating nodes are honest can they reconstruct the correct secret element, and then determine the secret information corresponding to the secret element according to the conversion rule. r > kWhen the solution of the present invention can determine r Are there any false shares in the shares? If so, can the number of false shares not exceeding After the false shares are corrected, the secret element can be reconstructed and the secret information corresponding to the secret element can be determined;

[0082] It can be seen that the solution of the present invention can determine r Whether there are false shares in the shares, and whether the number can be corrected does not exceed The false share of the present invention can effectively deal with the situation where the fraudster provides false shares. And r Less than k No matter how high the computing resources of the attacker are, the secret reconstruction cannot be achieved. That is, the security of the scheme of the present invention does not rely on any assumption of computational difficulty. It is information-theoretic security rather than security in the computational sense of the classical scheme, which makes the scheme of the present invention resistant to quantum computing attacks. In addition, it can be seen that in the scheme of the present invention, the distribution node only needs to complete the distribution of shares. When performing operations in subsequent stages including secret reconstruction, the scheme of the present invention does not require the participation of the distribution node, which is conducive to further improving reliability. The shares and secret elements saved by the participating nodes are all elements in the Galois field and have the same length, so that the secret distribution process of the scheme of the present invention does not have data expansion, which is also conducive to further ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0084] Figure 1 This is a schematic diagram of a commonly used key management method.

[0085] Figure 2 is a flow chart of an implementation method of a secret information sharing method in the present invention;

[0086] Figure 3 A schematic diagram of the structure of a secret information sharing system in the present invention;

[0087] Figure 4 This is a schematic structural diagram of a secret information sharing device in the present invention;

[0088] Figure 5 This is a schematic structural diagram of a computer-readable storage medium in the present invention. DETAILED DESCRIPTION

[0089] The core of the present invention is to provide a method, system, device and storage medium for sharing secret information, which can effectively deal with the situation where there are false shares. It is information-theoretic security rather than computational security. The implementation of subsequent stages of secret distribution does not require the participation of distribution nodes, and there is no data expansion in the secret distribution process, which is conducive to further ensuring security.

[0090] In order to enable those skilled in the art to better understand the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0091] Please refer to Figure 2 , Figure 2 The following is a flow chart of an implementation method of a secret information sharing method in the present invention. The secret information sharing method may include the following steps:

[0092] Step S101: According to a set conversion rule, the secret information is converted into an element in a set Galois field as a secret element.

[0093] The distribution node can also be called the distribution center, which can realize the distribution of secrets, that is, it can generate each share of the secret and send it to each participating node. The participating nodes can also be called participants, who can receive the corresponding shares and can be k Participating nodes realize secret reconstruction.

[0094] The secret information represents the information to be encrypted, and it can be understood that the specific form of the secret information can be various, for example, it can be a paragraph of text, it can be a string of numbers, it can be a key including letters and symbols, and in the scheme of the present invention, when subsequent encoding is performed, it is based on the encoding rules of the generalized Reed-Solomon code. Therefore, the secret information needs to be converted into an element in the Galois field so that the encoding can be achieved based on the encoding rules of the generalized Reed-Solomon code in the subsequent steps.

[0095] The specific content of the conversion rule can be set and adjusted according to actual needs. As long as the secret information can be converted into an element in the set Galois field according to the set conversion rule, the converted element is called the secret element. For example, in one scenario, the secret information is a key including letters and symbols, and the conversion rule stipulates that different letters and symbols will be converted into corresponding fixed-bit binary values, and then based on each binary value obtained, it is mapped to an element in the set Galois field. In addition, it can be understood that the conversion rule needs to be saved so that the conversion process is reversible, that is, when the secret is reconstructed, after the participating nodes obtain the secret element, they can reversely determine the secret information according to the conversion rule. For example, in actual applications, the conversion rule can be publicly saved by the distribution node, and for example, each participating node saves the conversion rule.

[0096] Galois Field can also be called a finite field. In the following text, Galois Field is represented as ,The specific parameter settings of the Galois field can be set and adjusted according to ,actual needs.

[0097] Step S102: Select from the set Galois Field n different elements, as n The public identity information of each participating node.

[0098] In the secret distribution phase, the distribution node can perform the operations from step S101 to step S105 to divide n shares and send them to n That is, when executing step S102, the distribution node can select a node from the set Galois field. n different elements, as n The public identity information of each participating node.

[0099] In a specific embodiment of the present invention, step S102 may include: randomly selecting a n different elements, as n The public identity information of each participating node.

[0100] This embodiment takes into account that n The public identity information of each participating node is not limited in the present invention, as long as it is set in the Galois field. n In this implementation, the elements are randomly selected from the Galois field. n Different elements are selected randomly, which is more convenient to implement.

[0101] Furthermore, in one embodiment, step S102 may include: uniformly and randomly selecting n different elements, as n The public identity information of each participating node.

[0102] This implementation method takes into account that when each element in the Galois field is selected as identity information, ideally, the selection probability should be consistent, that is, when randomly selected, each element in the Galois field has the same probability of being selected as the identity information of the corresponding participating node. Therefore, in this implementation method, a uniform random selection is performed from the set Galois field. n different elements, as n The public identity information of each participating node.

[0103] The uniform randomness described in this embodiment means that when randomly selected, each element in the Galois field has the same probability of being selected, which can be expressed by the formula: , to From Galois Domain uniformly randomly selected from n different elements, that is, to for n The identity information of each participating node, or n The IDs of the participating nodes are represented by the same symbols in the following text.

[0104] Step S103: Select from the Galois Field k -1 element, and together with the secret element, form a k The vector to be encoded is of elements.

[0105] As above, when selecting from the Galois field k -1 element, random selection can be used for easy implementation. k When there are 1 element, ideally, the selection probability of each element should also be consistent. Therefore, in a specific embodiment of the present invention, step S103 may specifically include:

[0106] Uniformly randomly selected from the Galois field k -1 element, and together with the secret element, form a k The vector to be encoded is of elements.

[0107] The uniform randomness described in this embodiment means that when randomly selecting, each element in the Galois field has the same probability of being selected. Therefore, when this embodiment is used to execute step S103, the distribution node will uniformly randomly select an element from the Galois field. k -1 element, which can be represented as , that is, the selected k -1 elements are recorded in sequence as a 1 to a k-1 .

[0108] Select from the Galois Field k -1 element, together with the secret element obtained in step S101, a k The vector to be encoded is a vector of elements. For example, the secret element is represented as a 0, then contains k The vector to be encoded can be expressed as a =( a 0, a 1, ..., a k-1 ).

[0109] Step S104: Based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is encoded into the encoding vector to obtain n The encoding result of the elements.

[0110] The vector to be encoded carries a secret element. In the solution of the present invention, encoding is implemented based on the encoding rules of GRS (Generalized Reed-Solomon), so that security at the information theory level can be achieved.

[0111] When encoding is implemented based on the encoding rules of generalized Reed-Solomon codes, encoding can generally be implemented based on a Vandermonde matrix. Therefore, in a specific embodiment of the present invention, step S104 may specifically include:

[0112] Based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is used to establish a Vandermonde matrix, and the encoding vector is encoded by the established Vandermonde matrix, and the obtained vectors include n The encoding result of the elements.

[0113] In this implementation, encoding of generalized Reed-Solomon codes can be conveniently and effectively implemented based on the Vandermonde matrix.

[0114] For example, in a specific embodiment of the present invention, step S104 may specifically include:

[0115] Based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is as follows ( s 1, ..., s n ) = a · G The calculation method is to encode the encoding vector and obtain n The encoding result of elements;

[0116] in, a To include k The vector to be encoded is G To pass n The Vandermonde matrix is ​​built based on the identity information of the participating nodes, and , s 1 to s n To obtain include n The encoding result of elements, to for n The identity information of each participating node.

[0117] In this embodiment, by n The Vandermonde matrix is ​​built based on the identity information of the participating nodes. G , by passing the vector to be encoded a With the Vandermonde matrix G Multiplying by , we can easily and effectively determine the n The encoding results of elements include n The encoding result of the elements is expressed as ( s 1, ..., s n ).

[0118] Step S105: Divide the encoding result into n shares and send them to n Participating nodes, so that when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. If r > k And judge r When there are false shares among the shares, the false shares are corrected and then the secret element is reconstructed, and the secret information corresponding to the secret element is determined;

[0119] in, n is a positive integer not less than 2, k A positive integer represents the minimum number of shares required to reconstruct the secret. r is a positive integer, and r < k Secret reconstruction is not possible when r > k The number of false shares corrected shall not exceed .

[0120] After the distribution center performs the operations from step S101 to step S104, it can obtain n The encoding result of elements ( s 1, ..., s n ). Then the shares can be distributed.

[0121] When distributing shares, the encoding results are divided into n shares, that is, for the encoding result n elements, each element as 1 share, so it can be divided into n shares, and each n Each share needs to be sent to the corresponding participating node, for example, the first share s 1 is sent to the first participating node, and the second share s 2 is sent to the second participating node, and so on. After distribution, n Each of the participating nodes received 1 share.

[0122] In addition, it can be understood that in actual applications, when the encoding results are divided into n shares and send them to n When there are 1 participating node, in order to ensure the security of communication, information transmission needs to be carried out in a confidential manner to transfer the first share s 1 is sent to the first participating node as an example, the distribution center can use encrypted communication to send the first share s 1 is sent to the first participating node, so that other participating nodes cannot get the first share except the first participating node s 1. Similarly, in the subsequent implementations, unless otherwise specified, information transmission between the distribution node and the participating nodes, as well as between different participating nodes, shall be conducted in a confidential manner to ensure the security of information transmission.

[0123] In the solution of the present invention, the distribution node divides the encoding result into n shares and send them to nAfter the distribution node has completed the secret distribution task, the distribution node has completed the secret distribution task. Subsequent secret reconstruction, as well as operations such as adding participating nodes, removing participating nodes, and adjusting threshold values ​​in some implementations, do not require the participation of the distribution node, which helps further ensure the security of the solution of the present invention. Therefore, in actual applications, after completing the secret distribution task, the distribution node can delete all stored related information.

[0124] It should also be noted that when distributing shares, the encoding results are divided into n The shares, that is, different shares and secret elements are all elements in the Galois field. The same size of space can be used in the computer to store the elements in a single Galois field. That is, in the scheme of the present invention, the shares stored by the participating nodes have the same length as the secret element, so that there is no data expansion in the secret distribution process of the scheme of the present invention, which is also conducive to further ensuring security.

[0125] After encoding and dividing the shares as described above, if secret reconstruction is to be achieved, the number of participating nodes participating in secret reconstruction cannot be less than k , k It is a positive integer, which represents the minimum number of shares required to achieve secret reconstruction, and can also be called the threshold value.

[0126] That is to say, when r Participating nodes utilize r When the secret is reconstructed, the requirement r ≥ k Secret reconstruction can be achieved. r = k , there is no error correction capability at this time, that is, at this time only r When all participating nodes are honest and do not provide false shares, r The secret element is reconstructed from the shares, and then the secret information corresponding to the secret element is determined according to the conversion rule described in step S101.

[0127] And if r > k , we can judge r Whether there are false shares in the shares, it can be detected that there are no more than r - k False shares can be corrected first, and then the secret element can be reconstructed after correction, and then the secret information corresponding to the secret element can be determined according to the conversion rule described in step S101. When correcting false shares, the number of corrected false shares shall not exceed .

[0128] In classic secret sharing techniques, after the secret distribution phase, the system's access structure becomes fixed. However, between secret distribution and secret reconstruction, the set of participants or the threshold for secret reconstruction may change. For example, if a participant leaves or loses their share, this could pose a significant threat to the security of the entire system. This problem arises because classic secret sharing techniques are designed for fixed access structures and cannot adapt to changing access structures; in other words, they lack a "dynamic" nature.

[0129] The solution of the present invention can support adding participating nodes, removing participating nodes and dynamic adjustment of threshold values, all without the participation of distribution nodes.

[0130] In a specific embodiment of the present invention, it may further include:

[0131] When a new participating node is needed, no less than k The participating nodes operate according to the preset share addition rules so that the newly added participating nodes obtain 1 new share.

[0132] In this implementation, if a new participating node is needed, no less than k Each participating node operates according to the preset share addition rule, thereby being able to obtain 1 new share as the share of the newly added participating node. Therefore, this implementation method effectively realizes the increase of shares.

[0133] For the preset share addition rules, they can be set according to actual needs and combined with the encoding rules of the generalized Reed-Solomon code. For example, the Cramer's rule for solving the system of equations can be used to perform distributed computing and ultimately obtain 1 new share.

[0134] In a specific embodiment of the present invention, when a new participating node is needed, no less than k Participating nodes operate according to the preset share addition rules so that the newly added participating nodes obtain 1 new share, which may specifically include:

[0135] Step 1: When a new participating node is needed, the current n of the participating nodes r Each participating node calculates its own intermediate value;

[0136] in, r The first of the participating nodes i The median value calculated by the participating nodes Expressed as , si For the i The shares of participating nodes, m i for M -1 Before k The first column of the submatrix i row vector, matrix , M -1 for M The inverse matrix of , to for n The identity information of each participating node, The identity information of the newly added participating node, T is the transposed matrix symbol, r ≥ k ;

[0137] Step 2: Based on the preset information security sending method, the newly added participating nodes determine to The sum of the newly added nodes is used as the new share of the newly added nodes, and the newly added nodes cannot determine the to Any intermediate value in .

[0138] In this implementation, a specific implementation is provided in which operations are performed according to a preset share addition rule so that a newly added participating node obtains 1 new share.

[0139] Before adding this participating node, n Participating nodes, that is, the newly added participating node is n +1 participating node, the identity information of the newly added participating node is represented as . Understandably, to Similarly, for the identity information of the newly added participating nodes , is also an element selected from the set Galois field, and and to They are all different.

[0140] In this embodiment, the calculation of the intermediate value is performed r Participating nodes, which can be the current n Any of the participating nodes r Participating nodes. rParticipating nodes, each participating node will calculate an intermediate value based on the share it saves and the Cramer's law solved by the equation group, thereby achieving the purpose of distributed computing of the present invention.

[0141] by r The first of the participating nodes i For example, the participating nodes i The median value calculated by the participating nodes Expressed as , s i For the i The shares of participating nodes, m i for M -1 Before k The first column of the submatrix i row vector, , it can be seen that for the i For each participating node, s i , m i as well as All are known.

[0142] r Each participating node can calculate the corresponding 1 intermediate value, so a total of r The middle value, this r The sum of the intermediate values ​​is the 1 additional share obtained by the newly added participating nodes.

[0143] And it should be noted that for r For each participating node, it is based on the preset information security sending method, so that the newly added participating nodes can determine the to but it is impossible to determine the sum of to This is because if r Participating nodes directly to Sent to the newly added participating node, the participating node can then to Determine the corresponding s 1 to s r , resulting in the newly added participating node obtaining multiple shares, causing great security risks.

[0144] The specific rules based on the preset information security sending method can be set and adjusted according to actual needs, as long as the purpose of the present invention can be achieved, that is, to enable the newly added participating nodes to determine the to but it is impossible to determine the sum of to Any intermediate value in .

[0145] In a specific embodiment of the present invention, the above step 2 may specifically include:

[0146] for r Each of the participating nodes divides the intermediate value calculated by itself into r data, so that they are divided into r The sum of the data is equal to the intermediate value calculated by itself, and the participating node retains r After one of the data, the rest r- 1 data is sent to the rest r- 1 participating node;

[0147] for r Each of the participating nodes will store the data and receive r- 1 data and send the summation result to the newly added participating nodes so that the newly added participating nodes will r After summing up the data sent by participating nodes, we can get to and use the sum as the 1 new share obtained by the newly added participating node.

[0148] In this embodiment, for r Each of the participating nodes divides the intermediate value calculated by itself into r data, so that they are divided into r The sum of the data is equal to the intermediate value calculated by itself, which can be easily achieved in the Galois field.

[0149] by r The first of the participating nodes i For example, the participating nodes i The median value calculated by the participating nodes is , then, i Participating nodes need to be selected from the Galois field r Data: , need to meet For the selected to thisr Data, No. i Participating nodes need to keep this r 1 of the data and the rest r- 1 data is sent to the rest r- 1 participating node.

[0150] That is to say, including the 1 data retained by itself, and the rest r- 1 participating node sends r- 1 data, r Each of the participating nodes can obtain r data, and will r The sum of the data is sent to the newly added participating nodes.

[0151] It can be seen that the newly added participating nodes can receive r A total of r The summation result is r Sum the summation results, and the total is to The sum of , thus taking the sum as the 1 new share obtained by the newly added participating node. And it can be seen that, since this implementation method is to to The nodes are split and aggregated, making it impossible for newly added participating nodes to determine the to Any intermediate value in .

[0152] In addition, it should be pointed out that the above is based on the current n For example, the newly added participating node is n+ 1 participating node. In actual application, one or more participating nodes can be further added. Each time a participating node is added, the principle is the same as above. Similarly, in the following text, the current node is n For example, for removing the participating node n In practical applications, one or more participating nodes may be further removed, and the principle is the same.

[0153] In a specific embodiment of the present invention, it may further include:

[0154] When a participating node needs to be removed, no less than k The participating nodes are removed according to the preset participating node removal rules, so that each participating node except the removed participating node receives 1 new share to replace the original share.

[0155] As described above, in classic secret sharing technologies, after the secret distribution phase, the system's access structure becomes fixed, making it unable to adapt to changes in the access structure and lacking a dynamic nature. The solution of the present invention supports the addition and removal of participating nodes, as well as dynamic adjustment of thresholds, all without the involvement of the distribution node.

[0156] In this implementation, if a participating node needs to be removed, no less than k The participating nodes operate according to the preset participating node removal rules, so that each participating node except the removed participating node can obtain a new share to replace the old invalid share. Therefore, this implementation method effectively realizes the removal of participating nodes.

[0157] The preset participating node removal rules can be set according to actual needs and combined with the encoding rules of the generalized Reed-Solomon code. For example, the Cramer's law for solving the system of equations can be used to perform distributed computing, and finally a new share can be configured for each currently remaining participating node.

[0158] In a specific embodiment of the present invention, when a participating node needs to be removed, no less than k Participating nodes are removed according to the preset participating node removal rules, so that each participating node except the removed participating node receives a new share to replace the original share, which may specifically include:

[0159] The first step: When a participating node needs to be removed, the current n of the participating nodes r Each participating node calculates its own sub-secret data based on its current share;

[0160] in, r The first of the participating nodes i The sub-secret data calculated by the participating nodes a i0 Expressed as , s i For the i The shares of participating nodes, M i0 for exist M The algebraic cofactor in the matrix , det( M ) means M The determinant of to for nThe identity information of each participating node, r ≥ k ;

[0161] The second step: Based on r Secret data, by r The participating nodes operate according to the preset share security generation method, so that each participating node except the removed participating node obtains a new share to replace the original share, and no participating node can obtain the sub-secret data of any other participating node.

[0162] In this implementation, a specific implementation of performing operations according to preset participating node removal rules to complete the participating node removal is provided.

[0163] In this implementation, before removing this participating node, there is n Participating nodes, for example, the participating node to be removed is n Participating nodes.

[0164] In this embodiment, the calculation of the sub-secret data is performed r Participating nodes, which can be the current n Any of the participating nodes r Participating nodes, of course, r The participating nodes will not include the participating nodes to be removed. r Participating nodes, each participating node will calculate 1 sub-secret data based on the share it saves, thereby achieving the purpose of distributed computing of the present invention.

[0165] by r The first of the participating nodes i For example, the participating nodes i The sub-secret data calculated by the participating nodes a i0 Expressed as , it can be seen that for the i For each participating node, s i , M i0 and det( M ) are all known.

[0166] r Each participating node can calculate a corresponding sub-secret data based on its own share, so a total of r Secret data, based on this r Secret data, by rThe participating nodes operate according to the preset share security generation method, so that each participating node except the removed participating node can obtain a new share to replace the original share, and no participating node can obtain the sub-secret data of any other participating node.

[0167] It should be noted that in this embodiment, r For each participating node, the operation is carried out in accordance with the preset share security generation method, which not only achieves the purpose of each participating node except the removed participating node to obtain a new share, but also makes it impossible for any participating node to obtain the sub-secret data of any other participating node. This is because if a participating node obtains the sub-secret data of other participating nodes in the process of obtaining each new share, it can determine the share of the corresponding participating node or the sub-secret data of the other participating nodes based on this. r Summing up individual secret data to obtain a secret element will cause great security risks.

[0168] The specific rules of the preset share security generation method can be set and adjusted according to actual needs, as long as the purpose of the present invention can be achieved, that is, each participating node except the removed participating node will obtain a new share to replace the original share, and at the same time, no participating node can obtain the sub-secret data of any other participating node.

[0169] In a specific embodiment of the present invention, the second step may specifically include:

[0170] for r Each participating node among the participating nodes calculates the sub-secret data calculated by itself and the first polynomial constructed by itself n -1 sub-share value, and the calculated n -1 sub-share value is allocated to all participating nodes except the removed node, including itself. n -1 remaining participating node;

[0171] For the remaining participating nodes except the removed ones n -1 participating node, which has obtained r After the sub-share value is obtained, r The sum of the sub-share values ​​is used as the new share of the self to replace the original share of the self;

[0172] in, r Among the participating nodes i The first polynomial constructed by the participating nodes is expressed as , tis a positive integer and 1≤ t ≤ k -1, a i1 to a i（k-1） For the i Participating nodes are selected from the Galois field k -1 element; i The participating nodes construct the first polynomial by x The value of is the remaining nodes except the removed participating nodes. n -1 identity information of participating nodes, calculated in turn n -1 sub-share value.

[0173] In this embodiment, for r Each participating node among the participating nodes uses the first polynomial to express the sub-secret data calculated by itself, which can be easily implemented in the Galois field and will not expose the sub-secret data calculated by itself.

[0174] by r The first of the participating nodes i For example, the participating nodes i The sub-secret data calculated by the participating nodes is a i0 , which needs to be selected from the Galois field k -1 element: , it can be seen that here a i1 to a i（k-1） It means the i Participating nodes are uniformly randomly selected from the Galois field. k -1 element, a i1 to a i（k-1） this k The -1 element is used as the i The coefficients of the first polynomial constructed by the participating nodes. i The first polynomial constructed by the participating nodes is expressed as Furthermore, it can be understood that, for different participating nodes, the coefficients of each term in the constructed first polynomial may be different.

[0175] No. i After each participating node constructs its own first polynomial, it will convert the independent variable of the first polynomial into x The value of is the remaining nodes except the removed participating nodes. n-1 identity information of participating nodes, and then calculate n -1 sub-share value. For example to for n The identity information of each participating node, and the n Participating nodes are removed participating nodes, then x The values ​​are to , No. i The participating nodes can calculate n -1 sub-share value, and then calculate this n -1 sub-share value is allocated to each of the following sub-shares, including itself n -1 remaining participating node, which is the number of nodes that will be calculated in this example. n -1 sub-share value is allocated to the first participating node to the n -1 participating node.

[0176] It can be seen that for the remaining participating nodes excluding the removed ones, n -1 participating node, each of which can obtain r After obtaining the sub-share value, r By summing the sub-share values, a node determines its new share. Its original share is now invalid and can be deleted. Furthermore, the use of the first polynomial in this implementation prevents direct exposure of the sub-secret data, preventing any participating node from obtaining the sub-secret data of any other participating node.

[0177] In a specific embodiment of the present invention, it may further include:

[0178] When the minimum number of shares required to achieve secret reconstruction needs to be adjusted k When the value is , no less than k Participating nodes operate according to the preset threshold adjustment rules so that each current participating node gets 1 new share to replace the original share, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to Understandably, It represents the minimum number of shares required to achieve secret reconstruction after adjustment.

[0179] The solution of the present invention can support adding participating nodes, removing participating nodes and dynamic adjustment of threshold values, all without the participation of distribution nodes.

[0180] In this implementation, if the minimum number of shares required to achieve secret reconstruction needs to be adjustedk If the threshold value needs to be adjusted, it can be adjusted by no less than k The participating nodes operate according to the preset threshold adjustment rules, so that each current participating node gets 1 new share to replace the original share, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to , so this implementation method effectively realizes the adjustment of the threshold value.

[0181] The preset threshold adjustment rule can be set according to actual needs in combination with the encoding rule of the generalized Reed-Solomon code. For example, the Cramer's rule for solving the equation group can be used to perform distributed computing to achieve threshold value adjustment.

[0182] In a specific embodiment of the present invention, when it is necessary to adjust the minimum number of shares to achieve secret reconstruction k When the value is , no less than k Participating nodes operate according to the preset threshold adjustment rules so that each current participating node gets 1 new share to replace the original share, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to , which may include:

[0183] When the minimum number of shares required to achieve secret reconstruction needs to be adjusted k When the value of n of the participating nodes r Each participating node calculates its own sub-secret data based on its current share;

[0184] in, r The first of the participating nodes i The sub-secret data calculated by the participating nodes a i0 Expressed as: , s i For the i The shares of participating nodes, M i0 for exist M The algebraic cofactor in the matrix , det( M ) means M The determinant of to for n The identity information of each participating node, r ≥ k ;

[0185] based onr Secret data, by r The participating nodes operate according to the preset threshold adjustment method, so that each participating node gets a new share to replace the original share, and any participating node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to .

[0186] In this implementation, a specific implementation is provided in which operations are performed according to preset threshold adjustment rules to complete the adjustment of the participation threshold value.

[0187] In this embodiment, the threshold value adjustment is completed r Participating nodes, which can be the current n Any of the participating nodes r Participating nodes. r Participating nodes, each participating node will calculate a corresponding sub-secret data based on the share it saves, thereby achieving the purpose of distributed computing of the present invention.

[0188] by r The first of the participating nodes i For example, the participating nodes i The sub-secret data calculated by the participating nodes a i0 Expressed as , please refer to the above description and will not repeat it here.

[0189] r Each participating node can calculate 1 sub-secret data based on its own share, so a total of r Secret data, based on this r Secret data, by r Each participating node operates according to the preset threshold adjustment method so that n Each participating node can get a new share to replace the original share, and any participating node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to .

[0190] It should be noted that in this embodiment, rFor each participating node, the operation is carried out according to the preset threshold adjustment method. This not only achieves the purpose of threshold adjustment, but also prevents any participating node from obtaining the sub-secret data of any other participating node. This is because if a participating node obtains the sub-secret data of another participating node during the threshold adjustment process, it can use this to determine the corresponding participating node's share, posing a significant security risk.

[0191] The specific rules of the preset threshold adjustment method can be set and adjusted according to actual needs, as long as the purpose of the present invention can be achieved, that is, not only the adjustment of the threshold value is achieved, but also any participating node cannot obtain the sub-secret data of any other participating node.

[0192] In a specific embodiment of the present invention, based on r Secret data, by r The participating nodes operate according to the preset threshold adjustment method, so that each participating node gets a new share to replace the original share, and any participating node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares required to achieve secret reconstruction is reduced from k Adjust to , which may specifically include:

[0193] for r Each of the participating nodes calculates the sub-secret data calculated by itself and the second polynomial constructed by itself. n Sub-share values, and the calculated n The sub-share values ​​are allocated to each of n Participating nodes;

[0194] for n Each participating node in the participating nodes obtains r After the sub-share value is obtained, r The sum of the sub-share values ​​is used as the new share of the self to replace the original share of the self;

[0195] in, r Among the participating nodes i The second polynomial constructed by the participating nodes is expressed as , c is a positive integer and , a i1 to For the i Participating nodes are selected from the Galois field element; iThe participating nodes construct the second polynomial by x The value of the current n The identity information of the participating nodes is calculated in turn. n Sub-share value.

[0196] Similar to the above embodiment, in this embodiment, for r Each participating node among the participating nodes expresses the sub-secret data calculated by itself with the second polynomial, which can be easily implemented in the Galois field and will not expose the sub-secret data calculated by itself.

[0197] by r The first of the participating nodes i For example, the participating nodes i The sub-secret data calculated by the participating nodes is a i0 , since the threshold value is adjusted, that is, k The value of , therefore, i Participating nodes need to be selected from the Galois field Elements: , it can be seen that here a i1 to It means the i Participating nodes are uniformly randomly selected from the Galois field. elements, a i1 to this The element is used as the i The coefficients of the second polynomial constructed by the participating nodes. i The second polynomial constructed by the participating nodes is expressed as Furthermore, it can be understood that, for different participating nodes, the coefficients of each term in the constructed second polynomial may be different.

[0198] No. i After the participating nodes construct their own second polynomial, they will use the independent variable of the second polynomial x The value of the current n The identity information of the participating nodes is calculated in turn n Sub-share values. For example to for n The identity information of each participating node, x The values ​​are to , No.i The participating nodes can calculate n Sub-share values, and then the calculated n The sub-share values ​​are allocated to each of n Participating nodes.

[0199] It can be seen that for n Each participating node can obtain r After obtaining the sub-share value, r By summing up the sub-share values, the new share is determined. The original share is now invalid and can be deleted. As can be seen, due to the use of polynomial wrapping in this implementation, no participating node can obtain the sub-secret data of any other participating node.

[0200] In a specific embodiment of the present invention, step S105 may specifically include:

[0201] According to the different positions of the elements, the encoding results are divided into n shares and send them to n Participating nodes, so that when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. If r > k , then judge s · H T =0 is true, if not, then judge r When there are false shares among the shares, the secret element is reconstructed after correcting the false shares, and the secret information corresponding to the secret element is determined;

[0202] in, H To satisfy M k H T =0( r - k )× r full rank matrix, M k is a matrix M Before k The submatrix consisting of rows, T is the transposed matrix symbol, the matrix , to forn The identity information of each participating node, , s 1 to s r Indicates secret reconstruction r The shares of each participating node.

[0203] As described above, when r Participating nodes utilize r When the secret is reconstructed, the requirement r ≥ k Secret reconstruction can be achieved. r > k , we can judge r Whether there are false shares in the shares, it can be detected that there are no more than r - k A false share.

[0204] In this embodiment, r > k When s · H T =0 is established to determine r Whether all participating nodes are honest.

[0205] if s · H T = 0, it can be determined that no participating nodes provide false shares, so it can be directly based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. If s · H T =0 is not true, it is necessary to reconstruct the secret element after correcting the false share and determine the secret information corresponding to the secret element.

[0206] In a specific embodiment of the present invention, it may further include:

[0207] when r Participating nodes utilize r The shares are secretly reconstructed and the r When there are fake shares in the shares, if the number of fake shares does not exceed , r Each participating node determines the identity information of the participating node corresponding to each false share.

[0208] Based on the principle of generalized Reed-Solomon code, if r > kIf the number of false shares does not exceed r - k , it can be determined that there are false shares. If the number of false shares does not exceed , then we can not only determine r Whether there are false shares in the shares, it is also possible to further determine which one or several shares are false shares, that is, in this embodiment, after determining whether there are false shares r When there are fake shares in the shares, if the number of fake shares does not exceed , r Each participating node can determine the identity information of each participating node corresponding to each false share, that is, find the ID of the participating node that increased the false share and determine its identity. In addition, it is understandable that if the number of false shares exceeds But no more than r - k , we can only determine that there are false shares, but we cannot locate the false shares.

[0209] In a specific embodiment of the present invention, if r = k , then based on r The shares are used to reconstruct the secret element and determine the secret information corresponding to the secret element, including:

[0210] if r = k , then based on r Shares, calculated by The secret element is reconstructed in a manner and the secret information corresponding to the secret element is determined.

[0211] In this embodiment, based on r When the secret is reconstructed by the shares, it is calculated The secret element is reconstructed in this way, which is computationally simple and convenient. For example, in the above example, the secret element is expressed as a 0, and contains k The vector to be encoded is a =( a 0, a 1, ..., a k-1 ), the secret element a 0 is at the first element position of the vector to be encoded, then calculate After that, the first component obtained is the secret element a 0.

[0212] Furthermore, it is understandable that r > kAfter the false shares are corrected, the The secret element is reconstructed in this way.

[0213] In a specific embodiment of the present invention, it may further include:

[0214] when r Participating nodes utilize r shares to perform secret reconstruction and r = k When based on r After reconstructing the secret element from the shares, r Each participating node outputs a prompt message that the reconstructed secret element has security risks.

[0215] As described above, r = k Correct secret reconstruction can also be achieved when , but only if no participating nodes provide false shares. r = k Even if secret reconstruction is performed, it is impossible to determine whether any participating node has provided false shares. Therefore, in this implementation, a prompt message indicating that there is a security risk in the secret element will be output in this case to remind each participating node to pay attention to this situation.

[0216] The beneficial effect of applying the technical solution provided by the embodiment of the present invention is that the solution of the present invention is based on generalized Reed-Solomon codes to achieve the sharing of secret information, which can effectively deal with the situation where fraudsters provide false shares. In addition, the security of the solution of the present invention does not rely on any assumption of computational difficulty, that is, the solution of the present invention is information-theoretic security rather than security in the computational sense of classical solutions, so the solution of the present invention can resist quantum computing attacks. In addition, after the secret distribution, the solution of the present invention does not require the participation of the distribution node in subsequent stages, including secret reconstruction, which is conducive to further improving flexibility and reliability. The shares saved by the participating nodes have the same length as the secret element, so that the secret distribution process of the solution of the present invention does not have data expansion, which is also conducive to further ensuring security.

[0217] Specifically, in order to be able to implement encoding based on generalized Reed-Solomon codes in the future, in the solution of the present invention, the distribution node converts the secret information into an element in the set Galois field according to the conversion rules set as needed, and the secret element can be used as the secret element together with the element selected from the Galois field. k -1 element, together forming a containing k The vector to be encoded has elements, that is, the vector to be encoded carries a secret element. n Participating nodes need to be selected from the set Galois field ndifferent elements, as n The public identity information of the participating nodes. Based on the encoding rules of the generalized Reed-Solomon code, n The identity information of the participating nodes is encoded into the encoding vector to obtain n The encoding result of the elements. The encoding result includes n elements, each element as 1 share, so that the encoding result can be divided into n The shares are thus given to n Based on the principle of generalized Reed-Solomon code, when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then it can be based on r The shares reconstruct the secret element and determine the secret information corresponding to the secret element. Of course, the reconstruction accuracy cannot be guaranteed at this time, that is, r = k Time requirements r Only when all participating nodes are honest can they reconstruct the correct secret element, and then determine the secret information corresponding to the secret element according to the conversion rule. r > k When the solution of the present invention can determine r Are there any false shares in the shares? If so, can the number of false shares not exceeding After the false shares are corrected, the secret element can be reconstructed and the secret information corresponding to the secret element can be determined;

[0218] It can be seen that the solution of the present invention can determine r Whether there are false shares in the shares, and whether the number can be corrected does not exceed The false share of the present invention can effectively deal with the situation where the fraudster provides false shares. And r Less than k No matter how high the computing resources of the attacker are, the secret reconstruction cannot be achieved. That is, the security of the scheme of the present invention does not rely on any assumption of computational difficulty. It is information-theoretic security rather than security in the computational sense of the classical scheme, which makes the scheme of the present invention resistant to quantum computing attacks. In addition, it can be seen that in the scheme of the present invention, the distribution node only needs to complete the distribution of shares. When performing operations in subsequent stages including secret reconstruction, the scheme of the present invention does not require the participation of the distribution node, which is conducive to further improving reliability. The shares and secret elements saved by the participating nodes are all elements in the Galois field and have the same length, so that the secret distribution process of the scheme of the present invention does not have data expansion, which is also conducive to further ensuring security.

[0219] Corresponding to the above method embodiment, an embodiment of the present invention further provides a secret information sharing system, which can be referred to in correspondence with the above.

[0220] See Figure 3 The secret information sharing system includes: a distribution node 31 and n 32 participating nodes. Figure 3 3 participating nodes 32 are shown, which are referred to as the first to third participating nodes in sequence.

[0221] The distribution node 31 is used to:

[0222] According to the set conversion rules, the secret information is converted into an element in the set Galois field as the secret element;

[0223] Select from the set Galois field n different elements, as n The public identity information of each participating node;

[0224] Select from the Galois field k -1 element, and together with the secret element, form a k The vector to be encoded of elements;

[0225] Based on the encoding rules of generalized Reed-Solomon code, n The identity information of the participating nodes is used to encode the vector to be encoded, and the result includes n The encoding result of elements;

[0226] According to the different positions of the elements, the encoding results are divided into n shares and send them to n Participating nodes;

[0227] The participating nodes 32 are used to:

[0228] when r Participating nodes utilize r When the secret is reconstructed for each share, if r = k , then based on r shares to reconstruct the secret element, if r > k And judge r When there are false shares among the shares, the false shares are corrected and then the secret element is reconstructed;

[0229] Determining corresponding secret information based on the reconstructed secret element;

[0230] in,n is a positive integer not less than 2, k A positive integer represents the minimum number of shares required to reconstruct the secret. r is a positive integer and r < k Secret reconstruction is not possible when r > k The number of false shares corrected shall not exceed .

[0231] Corresponding to the above method and system embodiments, embodiments of the present invention further provide a secret information sharing device and a computer-readable storage medium, which can be referred to in correspondence with the above.

[0232] See Figure 4 , the secret information sharing device may include:

[0233] Memory 401, used for storing computer programs;

[0234] The processor 402 is configured to execute the computer program to implement the steps of the secret information sharing method in any of the above embodiments.

[0235] See Figure 5 The computer-readable storage medium 50 stores a computer program 51. When executed by a processor, the computer program 51 implements the steps of the secret information sharing method described in any of the above embodiments. The computer-readable storage medium 50 herein includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0236] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0237] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only intended to help understand the technical solutions and core concepts of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from the principles of the present invention, and such improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A method for sharing secret information, characterized in that: include: According to the set conversion rules, the secret information is converted into an element in the set Galois field as the secret element; Select n distinct elements from the set Galois Field as the public identity information of the n participating nodes; Selecting k-1 elements from the Galois field and forming a vector to be encoded containing k elements together with the secret element; Based on the encoding rules of the generalized Reed-Solomon code, the vector to be encoded is encoded using the identity information of the n participating nodes to obtain an encoding result including n elements; Divide the encoding result into n shares according to the position of the elements and send them to n participating nodes respectively, so that when r participating nodes use r shares to perform secret reconstruction, if r=k, the secret element is reconstructed based on the r shares and the secret information corresponding to the secret element is determined; if r>k and it is determined that there are false shares among the r shares, the false shares are corrected before reconstructing the secret element and determining the secret information corresponding to the secret element; Where n is a positive integer not less than 2, k is a positive integer representing the minimum number of shares required to achieve secret reconstruction, r is a positive integer, and when r < k, secret reconstruction cannot be achieved, and when r > k, the number of corrected false shares does not exceed ; Also includes: When a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules so that the newly added participating node will obtain 1 additional share; When a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules so that the newly added participating node obtains 1 additional share, including: When a new participating node is needed, r participating nodes out of the current n participating nodes will calculate their respective intermediate values; Among them, the median value calculated by the i-th participating node among the r participating nodes is Expressed as , s i is the share of the i-th participating node, m i M -1 The i-th row vector of the first k columns of the submatrix, the matrix , M -1 is the inverse matrix of M, , to is the identity information of each of the n participating nodes, is the identity information of the newly added participating node, T is the transposed matrix symbol, r≥k; Based on the preset information security sending method, the newly added participating nodes can determine the to The sum of the newly added nodes is used as the new share of the newly added nodes, and the newly added nodes cannot determine the to Any intermediate value in .

2. The method for sharing secret information according to claim 1, characterized in that: The step of selecting n distinct elements from the set Galois Field as the public identity information of the n participating nodes includes: Randomly select n different elements from the set Galois field as the public identity information of the n participating nodes.

3. The method for sharing secret information according to claim 2, characterized in that: The method randomly selects n different elements from the set Galois field as the public identity information of the n participating nodes, including: N distinct elements are uniformly and randomly selected from the set Galois field as the public identity information of the n participating nodes.

4. The method for sharing secret information according to claim 1, wherein: The k-1 elements are selected from the Galois field and together with the secret element form a vector to be encoded containing k elements, including k-1 elements are uniformly and randomly selected from the Galois field, and together with the secret element, form a vector to be encoded containing k elements.

5. The method for sharing secret information according to claim 1, wherein: The encoding rule based on the generalized Reed-Solomon code encodes the vector to be encoded using the identity information of n participating nodes to obtain an encoding result including n elements, including: Based on the encoding rule of generalized Reed-Solomon code, a Vandermonde matrix is ​​established through the identity information of n participating nodes, and the vector to be encoded is encoded through the established Vandermonde matrix to obtain an encoding result including n elements.

6. The method for sharing secret information according to claim 5, characterized in that: The encoding rule based on the generalized Reed-Solomon code establishes a Vandermonde matrix through the identity information of n participating nodes, and encodes the vector to be encoded through the established Vandermonde matrix to obtain an encoding result including n elements, including: Based on the encoding rules of generalized Reed-Solomon code, the identity information of n participating nodes is used to calculate the number of nodes according to (s1, ..., s n )=a·G, encoding the vector to be encoded to obtain an encoding result including n elements; Wherein, a is the vector to be encoded containing k elements, G is the Vandermonde matrix established by the identity information of n participating nodes, and , s1 to s n is the encoding result including n elements, to is the identity information of each of the n participating nodes.

7. The method for sharing secret information according to claim 1, wherein: Based on the preset information security sending method, the newly added participating nodes can determine the to The sum of the newly added nodes is used as the new share of the newly added nodes, and the newly added nodes cannot determine the to Any intermediate value, including: For each of the r participating nodes, the participating node divides the intermediate value calculated by itself into r data so that the sum of the r divided data is equal to the intermediate value calculated by itself, and after retaining one of the r data, the participating node sends the remaining r-1 data to the remaining r-1 participating nodes respectively; For each of the r participating nodes, the participating node sums the retained data with the received r-1 data, and sends the summed result to the newly added participating node, so that the newly added participating node sums the sent data of the r participating nodes to obtain to and use the sum as the 1 new share obtained by the newly added participating node.

8. The method for sharing secret information according to claim 1, wherein: Also includes: When a participating node needs to be removed, no less than k participating nodes among the current participating nodes will operate according to the preset participating node removal rules, so that each remaining participating node except the removed participating node will receive a new share to replace the original share.

9. The method for sharing secret information according to claim 8, characterized in that: When a participating node needs to be removed, at least k participating nodes among the current participating nodes will perform operations according to the preset participating node removal rules, so that each participating node except the removed participating node will receive a new share to replace the original share, including: When a participating node needs to be removed, r participating nodes out of the current n participating nodes calculate their own sub-secret data based on their current shares; Among them, the sub-secret data a calculated by the i-th participating node among the r participating nodes i0 Expressed as , s i is the share of the i-th participating node, M i0 for Algebraic cofactors in M, matrices , det(M) represents the determinant of M, to is the identity information of each of the n participating nodes, r ≥ k; Based on the r sub-secret data, the r participating nodes operate according to the preset share security generation method, so that each participating node except the removed participating node obtains 1 new share to replace the original share, and no participating node can obtain the sub-secret data of any other participating node.

10. The method for sharing secret information according to claim 9, characterized in that: Based on the r sub-secret data, the r participating nodes operate according to the preset share security generation method, so that each participating node except the removed participating node obtains a new share to replace the original share, and no participating node can obtain the sub-secret data of any other participating node, including: For each of the r participating nodes, the participating node calculates n-1 sub-share values ​​using the sub-secret data calculated by itself and the first polynomial constructed by itself, and distributes the calculated n-1 sub-share values ​​to the n-1 remaining participating nodes, including itself, excluding the removed participating node; For the remaining n-1 participating nodes excluding the removed participating node, after obtaining r sub-share values, the participating node sums up the r sub-share values ​​it obtained as its new share to replace its original share; Among them, the first polynomial constructed by the i-th participating node among the r participating nodes is expressed as , t is a positive integer and 1≤t≤k-1, a i1 to a i（k-1） The k-1 elements selected by the i-th participating node from the Galois field; the i-th participating node calculates n-1 sub-share values ​​in sequence by successively setting the values ​​of the independent variable x of the constructed first polynomial to the identity information of the remaining n-1 participating nodes excluding the removed participating node.

11. The method for sharing secret information according to claim 1, wherein: Also includes: When the value of the minimum number of shares k required to achieve secret reconstruction needs to be adjusted, no less than k participating nodes among the current participating nodes shall operate according to the preset threshold adjustment rules so that each current participating node obtains 1 new share to replace the original share, and the minimum number of shares required to achieve secret reconstruction is adjusted from k to ; It represents the minimum number of shares required to achieve secret reconstruction after adjustment.

12. The method for sharing secret information according to claim 11, characterized in that: When the value of the minimum number of shares k required to achieve secret reconstruction needs to be adjusted, no less than k participating nodes among the current participating nodes shall operate according to the preset threshold adjustment rules so that each current participating node obtains 1 new share to replace the original share, and the minimum number of shares required to achieve secret reconstruction is adjusted from k to ,include: When the value of the minimum number of shares k required to achieve secret reconstruction needs to be adjusted, r of the current n participating nodes calculate their respective sub-secret data based on their current shares; Among them, the sub-secret data a calculated by the i-th participating node among the r participating nodes i0 Expressed as: , s i is the share of the i-th participating node, M i0 for Algebraic cofactors in M, matrices , det(M) represents the determinant of M, to is the identity information of each of the n participating nodes, r ≥ k; Based on r sub-secret data, r participating nodes operate according to the preset threshold adjustment method, so that each participating node obtains 1 new share to replace the original share, and any participating node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares required to achieve secret reconstruction is adjusted from k to .

13. The method for sharing secret information according to claim 12, characterized in that: Based on r sub-secret data, r participating nodes operate according to the preset threshold adjustment method, so that each participating node obtains 1 new share to replace the original share, and any participating node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares required to achieve secret reconstruction is adjusted from k to ,include: For each of the r participating nodes, the participating node calculates n sub-share values ​​using the sub-secret data calculated by itself and the second polynomial constructed by itself, and distributes the calculated n sub-share values ​​to the n participating nodes including itself; For each of the n participating nodes, after obtaining r sub-share values, the participating node sums up the r sub-share values ​​it obtained and uses the sum as its new share to replace its original share; Among them, the second polynomial constructed by the i-th participating node among the r participating nodes is expressed as , c is a positive integer and , a i1 to is the node selected by the i-th participating node from the Galois field elements; the i-th participating node calculates n sub-share values ​​in sequence by taking the value of the independent variable x of the constructed second polynomial as the identity information of the current n participating nodes in sequence.

14. The secret information sharing method according to any one of claims 1 to 13, characterized in that: The encoding result is divided into n shares according to the position of the elements and sent to n participating nodes respectively, so that when r participating nodes use r shares to perform secret reconstruction, if r=k, the secret element is reconstructed based on the r shares and the secret information corresponding to the secret element is determined; if r>k and it is determined that there are false shares among the r shares, the false shares are corrected before reconstructing the secret element and determining the secret information corresponding to the secret element, including: According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively, so that when r participating nodes use r shares to reconstruct the secret, if r=k, the secret element is reconstructed based on the r shares and the secret information corresponding to the secret element is determined. If r>k, it is determined that s·H T = 0 is true, if not true, then when it is determined that there are false shares among the r shares, the secret element is reconstructed after correcting the false shares, and the secret information corresponding to the secret element is determined; Among them, H is to satisfy M k H T = 0 (rk) × r order full rank matrix, M k is the submatrix composed of the first k rows of the matrix M, T is the transposed matrix symbol, the matrix , to is the identity information of each of the n participating nodes, , s1 to s r It represents the shares of the r participating nodes that perform secret reconstruction.

15. The method for sharing secret information according to claim 14, characterized in that: Also includes: When r participating nodes use r shares to reconstruct the secret, and it is determined that there are false shares among the r shares, if the number of false shares does not exceed , r participating nodes all determine the identity information of the participating nodes corresponding to each false share.

16. The method for sharing secret information according to claim 14, characterized in that: If r=k, reconstructing the secret element based on the r shares and determining the secret information corresponding to the secret element includes: If r=k, then based on r shares, by calculating The secret element is reconstructed in a manner and the secret information corresponding to the secret element is determined.

17. The method for sharing secret information according to claim 14, characterized in that: Also includes: When r participating nodes use r shares to perform secret reconstruction and r=k, after reconstructing the secret element based on the r shares, the r participating nodes all output a prompt message that the reconstructed secret element has security risks.

18. A secret information sharing system, characterized in that: include: Distribution node and n participating nodes; The distribution node is used to: According to the set conversion rules, the secret information is converted into an element in the set Galois field as the secret element; Select n distinct elements from the set Galois Field as the public identity information of the n participating nodes; Selecting k-1 elements from the Galois field and forming a vector to be encoded containing k elements together with the secret element; Based on the encoding rules of the generalized Reed-Solomon code, the vector to be encoded is encoded using the identity information of the n participating nodes to obtain an encoding result including n elements; Divide the encoding result into n shares according to the position of the elements and send them to n participating nodes respectively; The participating nodes are used to: When r participating nodes use r shares to reconstruct the secret, if r=k, the secret element is reconstructed based on the r shares. If r>k and it is determined that there are false shares among the r shares, the false shares are corrected before reconstructing the secret element. Determining corresponding secret information based on the reconstructed secret element; Where n is a positive integer not less than 2, k is a positive integer representing the minimum number of shares to achieve secret reconstruction, r is a positive integer and when r < k, secret reconstruction cannot be achieved, and when r > k, the number of corrected false shares does not exceed ; Also includes: When a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules so that the newly added participating node will obtain 1 additional share; When a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules so that the newly added participating node obtains 1 additional share, including: When a new participating node is needed, r participating nodes out of the current n participating nodes will calculate their respective intermediate values; Among them, the median value calculated by the i-th participating node among the r participating nodes is Expressed as , s i is the share of the i-th participating node, m i M -1 The i-th row vector of the first k columns of the submatrix, the matrix , M -1 is the inverse matrix of M, , to is the identity information of each of the n participating nodes, is the identity information of the newly added participating node, T is the transposed matrix symbol, r≥k; Based on the preset information security sending method, the newly added participating nodes can determine the to The sum of the newly added nodes is used as the new share of the newly added nodes, and the newly added nodes cannot determine the to Any intermediate value in .

19. A secret information sharing device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the secret information sharing method according to any one of claims 1 to 17.

20. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the secret information sharing method according to any one of claims 1 to 17 are implemented.

Images