Threshold secret recovery method and device

Abstract

The invention discloses a threshold secret recovery method and device. The disclosed method includes: acquiring a first share generated by a first share generation structure from a participant; judging whether the number of the obtained first shares is greater than a first threshold value t; recovering the secret through a (t, n) threshold secret recovery method under the condition that the number of the first shares is greater than the first threshold value t; when the number of the acquired first shares is smaller than a first threshold value t, acquiring a second share generated through a second share generation structure from the participant; and recovering a secret by using the acquired first share and the acquired second share, and using a subset of an intersection of a first share set generated by the first share generation structure and a second share set generated by the second share generation structure as a key share set, the number of shares of the key share set determined to be the key share set is greater than or equal to a key threshold value r smaller than the first threshold value.

Description

Technical Field

[0001] This invention relates to a threshold secret recovery method and apparatus, and more specifically, to a threshold secret recovery method and apparatus that can enhance the recoverability of secrets. Background Technology

[0002] Threshold secret recovery refers to a method where multiple participants store shares determined by a share structure, and recover the secret by collecting the required number of shares (t shares) from the total n shares held by the participants. The minimum number of shares (t) required to recover the secret is equivalent to the threshold value.

[0003] In 1979, Sharmir published a method for secret sharing and recovery in the journal *Communications of the ACM*. According to Sharmir's threshold secret sharing method, coefficients other than the constant term used as the secret are randomly selected to determine a (t-1) degree polynomial, and n shares are determined from the n points passing through this polynomial. The (t-1) degree polynomial is equivalent to a share structure; if t shares out of the n shares are known, the secret corresponding to the constant term can be known.

[0004] This threshold secret sharing and recovery method provides perfect security. Perfect security means that no information related to the secret S can be obtained with fewer than (t-1) shares. The secret contained in the polynomial is S as a constant term. For any point (0, S') where S' ≠ S, there always exists a (t-1)th degree polynomial passing through that point and (t-1) points, thus preventing an attacker from knowing any information related to S.

[0005] On the other hand, methods such as the Blakely secret-sharing method presented at the 1979 International Workshop on Managing Requirements Knowledge also utilize geometric properties as the share structure. In this method, sub-dimensional planes or lines are used in vector space, and their intersections are defined as secrets. For example, the intersection point Q of a known line and an arbitrary (t-1)-dimensional hyperplane can be used as the secret, and n points on the hyperplane can be used as shares. The hyperplane can be determined from t points out of the n points, and the secret can be recovered by finding the intersection point Q between the determined hyperplane and the known line. Alternatively, after generating shares from the intersection points of multiple hyperplanes using the intersection points as secrets, the secret can be recovered from the t hyperplanes.

[0006] For the (t, n) threshold secret recovery method described above, an attacker can only learn the secret if they seize at least t shares out of n shares, thus improving the security of the secret. Moreover, even if some of the participants holding the shares lose their shares, the secret can be recovered at any time as long as at least t shares are retained.

[0007] However, if more than (nt) shares are lost, the secret cannot be recovered, so participants need to be especially careful not to lose shares. But if the number of shares (n) is increased or the number of critical shares (t) is decreased in order to deal with the situation where the secret cannot be recovered, the possibility of the attacker learning the secret also increases, thus a trade-off problem occurs. Summary of the Invention

[0008] Technical issues

[0009] Embodiments of the present invention propose a threshold secret recovery method that takes into account the characteristics of secret sharing participants and can improve secret recoverability even when shares are lost.

[0010] Furthermore, embodiments of the present invention propose a threshold secret recovery method that allows for the use of other forms of secret recovery methods when a large number of shares have been lost and the secret cannot be recovered through a specific share structure, thereby improving the recoverability of the secret.

[0011] Technical solution

[0012] According to one aspect of the present invention, a threshold secret recovery method is provided, comprising: a step (a) obtaining a first share generated by a first share generation structure from a participant; a step (b) determining whether the number of the obtained first shares is greater than or equal to a first threshold value t; a step (c) recovering the secret using a (t, n) threshold secret recovery method if the number of the first shares is greater than or equal to the first threshold value t; a step (d) obtaining a second share generated by a second share generation structure from a participant if the number of the obtained first shares is less than the first threshold value t; and a step (e) recovering the secret using the obtained first shares and the obtained second shares, wherein a subset of the intersection of the set of first shares generated by the first share generation structure and the set of second shares generated by the second share generation structure is taken as a key share set, wherein the key share set is determined to have a key share set whose number of shares is greater than or equal to a key threshold value r less than the first threshold value.

[0013] The first threshold value t for restoring the secret in the first share generation structure is set to be greater than the number of participants who are likely to betray the first share.

[0014] A set of replicated shares is determined as a subset of the intersection of the first set of shares generated by the first share generation structure and the second set of shares generated by the second share generation structure. The intersection of the replicated share set and the key share set is an empty set, and the union of the replicated share set and the key share set is the intersection of the first set of shares and the second set of shares.

[0015] The second share set includes the key share set, the replicated share set, and the additional share set determined by the second share generation structure.

[0016] The set of replicated shares and the set of additional shares are allocated to participants with a low probability of loss.

[0017] The number of intersections between the set of shares allocated to participants with the potential for betrayal and the set of key shares is set to be less than the key threshold value r.

[0018] The second share generation structure is determined to have a structure different from the first share generation structure by using the set of key shares included in the first share and the set of replicated shares.

[0019] If all shares of the first share set belong to the union of the key share set and the replicated share set, the second share generation structure is determined to be the same as the first share generation structure.

[0020] The second threshold value of the second share generation structure is set to be greater than or equal to the number of elements in the union of the key share set and the replicated share set.

[0021] According to another aspect of the present invention, a threshold secret recovery apparatus is provided, comprising: a processor; at least one memory connected to the processor, the processor performing: a step (a) of obtaining a first share generated by a first share generation structure from a participant; a step (b) of determining whether the number of the obtained first shares is greater than or equal to a first threshold value t; a step (c) of recovering a secret using a (t, n) threshold secret recovery method if the number of the first shares is greater than or equal to the first threshold value t; a step (d) of obtaining a second share generated by a second share generation structure from a participant if the number of the obtained first shares is less than the first threshold value t; and a step (e) of recovering a secret using the obtained first shares and the obtained second shares, wherein a subset of the intersection of the set of first shares generated by the first share generation structure and the set of second shares generated by the second share generation structure is taken as a key share set, the key share set being determined to have a key share set whose number of shares is less than or equal to a key threshold value r.

[0022] The effects of the invention

[0023] This invention has the advantage of taking into account the characteristics of participants in secret sharing, and can improve the recoverability of secrets even if shares are lost.

[0024] Moreover, the present invention has the advantage of improving the recoverability of secrets by using other forms of secret recovery methods when a large number of shares have been lost and the secret cannot be recovered through a specific share structure. Attached Figure Description

[0025] Figure 1 A block diagram illustrating the structure of a threshold secret recovery device according to an embodiment of the present invention;

[0026] Figure 2 A diagram illustrating an example of determining shares using a polynomial share generation structure;

[0027] Figure 3 A flowchart illustrating the overall process of a share generation structure and share generation method for recovering secrets according to an embodiment of the present invention;

[0028] Figure 4 A diagram illustrating an example of a set of shares generated according to an embodiment of the present invention;

[0029] Figure 5 A table illustrating the preferences of participants according to one embodiment of the invention;

[0030] Figure 6 A diagram illustrating the set of shares used for threshold secret sharing as described below;

[0031] Figure 7 A flowchart illustrating the overall process of a threshold secret recovery method according to an embodiment of the present invention is provided. Detailed Implementation

[0032] The following description, with reference to the accompanying drawings, details specific to embodiments of the present invention. The detailed description below is merely illustrative and does not limit the invention.

[0033] In the description of embodiments of the present invention, detailed descriptions of well-known technologies related to the present invention are omitted if they are deemed likely to unnecessarily obscure the spirit of the embodiments. Furthermore, the terminology described below is defined in consideration of its function in the present invention and may be changed according to the intentions or practices of the user, operator, etc. Therefore, its definitions should be determined based on the entirety of this specification. The terminology used in the detailed description is only for describing one embodiment and should not be construed as limiting. Unless expressly used otherwise, the singular form includes the meaning of the plural form. In this description, expressions such as "comprising" or "having" are used to refer to certain characteristics, numbers, steps, actions, elements, a portion thereof, or combinations thereof, and should not be construed as excluding the presence or possibility of one or more other characteristics, numbers, steps, actions, elements, a portion thereof, or combinations thereof.

[0034] Before detailing the structure of the present invention, this invention is an improvement on the (t, n) recovery method, which is an existing threshold secret recovery method. In this embodiment, the threshold secret recovery method of the present invention is defined as (t, (r, S) c The threshold secret recovery method of the present invention can be defined as a way to enable multiple participants to share shares using a multiple share generation structure. In order to share shares through this multiple share generation structure, in addition to t (the threshold value for the number of shares used to recover the secret) and n (the number of shares), r and S are additionally defined. c This is used to recover secrets. The details of r and S will be discussed below with reference to the accompanying diagram. c The definition of threshold secret recovery method of the present invention will be described in detail.

[0035] Figure 1 A block diagram illustrating the structure of a threshold secret recovery device according to an embodiment of the present invention.

[0036] Reference Figure 1According to one embodiment of the present invention, a threshold secret recovery device includes a share acquisition module 100 and a secret recovery module 150. Various types of computing devices can be included within the threshold secret recovery device of the present invention. As an example, the threshold secret recovery device of the present invention can be one of the terminal devices storing shares, or it can be another server device used for secret recovery.

[0037] The share acquisition module 100 functions to acquire shares from the terminals of multiple participants in order to recover the secret. To recover the secret, it is necessary to acquire shares that are distributed and stored on the terminals of multiple participants, and the share acquisition module 100 is the module that performs this function.

[0038] According to a preferred embodiment of the present invention, the share acquisition module 100 includes a first share acquisition module 102 and a second share acquisition module 104. In the (t, n) threshold secret sharing and recovery method, which is a conventional threshold secret recovery method, a single share generation structure is used to generate shares from the single share generation structure. However, the present invention uses multiple share generation structures; this embodiment will illustrate the use of two share generation structures as an example.

[0039] The first share acquisition module 102 functions to acquire the first share determined by the first share generation structure from the participant terminal that stores shares. Various known share generation structures can be used as the first share generation structure. For example, a high-order polynomial can be used as the first share generation structure, as in the Sharmir method. Of course, a geometric structure can also be used as the first share generation structure.

[0040] Figure 2 A diagram illustrating an example of determining shares using a polynomial share generation structure.

[0041] Figure 2 The graph of a cubic polynomial is shown. In the graph, the secret is the constant term S, and the y-intercept is the key. Since it is a cubic polynomial, at least four shares are needed to obtain the secret S; therefore, t can be defined as 4. The number of shares n is arbitrarily determined to be greater than t. Figure 2 The diagram shows the case where the total number of shares is 5. The result is... Figure 2 The threshold secret sharing structure shown is a (4, 5) secret sharing structure.

[0042] Moreover, in Figure 2 In this case, the total share is (1, f(1)), (2, f(2)), (3, f(3)), (4, f(4)), (5, f(5)).

[0043] As an example, in Figure 2In the case where the polynomial shown is the first share generation structure, the multiple shares determined from the first share generation structure are distributed and stored in the terminals of multiple participants. For example, (1, f(1)) is stored in the terminal of the first participant, and (2, f(2)) is stored in the terminal of the second participant.

[0044] The first share acquisition module 102 functions to acquire multiple shares of the first share generation structure, which are distributed and stored in the terminals of multiple participants, in order to restore the secret.

[0045] The second share acquisition module 104 is a module for acquiring multiple shares generated through the second share generation structure. The shares acquired by the second share acquisition module 104 through the second share generation structure are used when the secret cannot be recovered using only the shares generated by the first share generation structure.

[0046] As described above, in addition to the first share generation structure, this invention also utilizes a second share generation structure, which serves as another share generation structure, to improve secrecy recoverability. The second share generation structure and its share generation method will be introduced first, followed by further discussion... Figure 1 Please provide an explanation.

[0047] Figure 3 A flowchart illustrating the overall process of a share generation structure and share generation method for recovering secrets according to an embodiment of the present invention is provided. Figure 4 A diagram illustrating an example of a plurality of share sets generated according to an embodiment of the present invention.

[0048] Reference Figure 3 First, the first share generation structure is determined (step 300). The first share generation structure can be arbitrarily determined; it can be a share generation structure using polynomials as described above, or a share generation structure utilizing geometric structures. The user sets a threshold value (t) for the number of shares and a total number of shares (n) for the share generation structure, allowing the corresponding share generation structure to be arbitrarily determined. For example, if the user sets the threshold value t to 4, a first share generation structure using a cubic polynomial can be generated.

[0049] After generating the first share generation structure, multiple first shares are generated from the first share generation structure (step 310). The number of shares n in the first share generation structure is arbitrarily set to be greater than t. When the first share generation structure is a polynomial, any n x coordinates are determined to generate n first shares composed of (x, y).

[0050] After generating multiple first shares of the first share generation structure, the generated multiple first shares are distributed to the terminals of multiple participants so that the multiple first shares are distributed and stored in the terminals of multiple participants (step 320).

[0051] The order of steps 300 to 320 can be the same as the existing method for generating shares and allocating them to participants' terminals in (t, n) threshold secret sharing. However, in this invention, the preferences of multiple participants can be taken into account when allocating shares to them.

[0052] Figure 5 A table showing the preferences of multiple participants according to one embodiment of the invention.

[0053] Reference Figure 5 The tendencies of multiple participants can be categorized as Loss-Strong and Consistently Honest (LS / CH), Loss-Weak and Consistently Honest (LW / CH), Loss-Strong and Potentially Dishonest (LS / PD), and Loss-Weak and Potentially Dishonest (LW / PD).

[0054] If there are honest LS / CH participants with a low probability of losing shares, shares can be allocated only to LS / CH participants to reduce the possibility of secret loss or leakage to outsiders. However, in the absence of LS / CH participants and the presence of only other types of participants, securely managing secrets becomes a complex issue. Even if LS / CH participants exist, allocating shares only to such participants based on the secret-sharing application may not be preferable if accessibility is poor.

[0055] In particular, when allocating shares to PD-type participants who are highly likely to betray, it is preferable to set restrictions.

[0056] Reference Figure 4 The first share generation structure is shown as S. F From the first share, generate structure S F There are a total of 10 first shares generated.

[0057] exist Figure 4 In this case, there are 4 participants with the high probability of betrayal (PD type). Therefore, the critical share quantity t should be set to be greater than the number of users with the high probability of betrayal (PD type) among the participants in the first share generation structure. In short, S （F，PD） The number of shares included should be less than t.

[0058] After generating multiple first shares, a critical share set is determined from these first shares (step 330). The critical share set is the set of shares belonging to the first share generation structure S. F A subset of S is a second share generation structure. G The subset (the subset of the intersection of the share set of the first share generation structure and the share set of the second share generation structure) is the set of shares required to restore the secret in the exception case (Fallback Case).

[0059] In this embodiment, the key share set is defined as S. c The number of shares belonging to the key share set is determined based on r. In this embodiment, r is defined as a key threshold value, and r should be set to be less than t, so that the secret can be recovered using r key shares even if the number of shares in the first share generation structure is less than t. The number of shares belonging to the key share set is set to be greater than or equal to r. In short, S c Specify to satisfy |S c |≥r. r can also be defined as the minimum number of shares required to recover the secret from the second share generation structure when the secret cannot be recovered from the shares generated by the first share generation structure. On the other hand, in determining the key share set S... c At that time, the share set S of participants with a high probability of betrayal will be selected. （F，PD） With the key share set S c The number of intersections is determined to be less than r. In S c ∩S （F，PD） In cases involving more than r shares, participants of the PD type with a high probability of betrayal can recover the secret using only their allocated shares. Therefore, it is preferable to include the share set S of participants with a high probability of betrayal. （F，PD） With the key share set S c The number of intersections is determined to be less than r.

[0060] Reference Figure 4 The key share set S is shown as a subset of the intersection of the shares of the first share generation structure and the shares of the second share generation structure. c S c The quantity is set to 3. In this case, r can be 2 or 3. On the other hand, refer to Figure 4 The intersection of the key share set and the share set with a high probability of betrayal is 1, which is set to be less than r.

[0061] Given the set of key shares, determine the generation structure S, which is the first share. F The share and the second share generation structure S GA subset of the intersection of the shares and not with the key share set S c Overlapping set of replication shares S dup (Step 340). Replicated share set S dup With the key share set S c The union of these sets can be defined as the intersection of the first set of shares from the first share generation structure and the second set of shares from the second share generation structure. According to a preferred embodiment of the invention, it is preferable to allocate shares of the duplicate share set and the key share set to participants of the LS type with a low probability of loss.

[0062] After determining the key share set and the replicated share set, a second share generation structure is generated (step 350) that can have shares of the key share set and shares of the replicated share set as shares. The second share generation structure should be different from the first share generation structure and should have shares of the key share set and shares of the replicated share set as shares. Using a share generation structure different from the first share generation structure as the second share generation structure is to prevent shares not belonging to S from being used as shares. c ∪S dup The remaining share was used to restore the secret.

[0063] For the second share generation structure, a threshold value and the number of shares should also be determined. The threshold value of the second share generation structure should be greater than or equal to |S|, which is the intersection of the shares of the first share generation structure and the second share generation structure. c ∪S dup According to one embodiment of the present invention, the threshold value of the second share generation structure can be determined using α, which is a threshold value adjustment constant. As an example, the threshold value of the second share generation structure can be set as r + |S|. dup |+α, α is appropriately chosen as the threshold adjustment constant so that the threshold value of the second share generation structure is different from that of the first share generation structure.

[0064] Furthermore, the number of shares in the second share generation structure can be determined using δ, which serves as a share quantity adjustment constant. The number of shares in the second share generation structure is set to be greater than a threshold value for the second share generation structure, which can be set as |S c |+|S dup |+α+δ.

[0065] When the second share generation structure is a polynomial, the degree of the polynomial is set to be 1 less than the threshold value of the determined second share generation structure.

[0066] Even if the threshold value for the second share generation structure is determined, only the share (S) shared with the first share generation structure is used. c ∪S dupIn some cases, it may not be possible to uniquely determine the second share generation structure. In such cases, the second share generation structure can be determined by randomly selecting the remaining elements used to determine the second share generation structure (for example, the coefficients of the polynomial, the points passing through the polynomial, the points on the hyperplane, or the coefficients of the hyperplane equation).

[0067] On the other hand, all elements of the first share generation structure belong to the replica share set S. dup Or key share set S c In the case that, S is the first share generation structure F =S c ∪S dup In the case of generating |S c ∪S dup |The above threshold values ​​can generate S c ∪S dup The second share generation structure for all shares is acceptable even if the second share generation structure does not meet the condition that it should be different from the first share generation structure.

[0068] Given the established second share generation structure, determine the set S of additional shares belonging to the second share generation structure. add (Step 360). The number of additional shares belonging to the additional share set may depend on the total number of shares in the second share generation structure. When the second share generation structure is polynomial, additional points can be arbitrarily specified to determine the shares belonging to the additional share set.

[0069] The additional share set S was determined. add In this case, the participants are allocated shares of the second share generation structure (step 370). S, as a share shared with the first share generation structure... c and S dup It has already been allocated to specific participants, and therefore only applies to those belonging to the additional share set S. add The shares are allocated. According to a preferred embodiment of the invention, the shares belonging to the additional share set S are allocated... add The share was allocated to participants with a low probability of loss and a tendency to LS.

[0070] As mentioned above, through Figure 3 The method shown determines the first share generation structure and the second share generation structure, the shares belonging to the first share generation structure, the shares belonging to the second share generation structure, and the shares shared by the first share generation structure and the second share generation structure.

[0071] Refer again Figure 1The second share acquisition module 104 acquires shares belonging to the second share generation structure. The second share acquisition module 104 is activated and operates only when the secret cannot be recovered from the first share in the first share generation structure. The second share acquisition module 104 acquires the second share from the terminal of the participant that stores the share specified from the second share generation structure.

[0072] The secret recovery module 150 recovers the secret using the share obtained by the share acquisition module 100. The secret recovery module 150 includes a normal case secret recovery module 152 and a rollback case secret recovery module 154.

[0073] When the secret can be recovered solely from the shares generated by the first share structure, the normal case secret recovery module 152 recovers the secret using the (t, n) secret recovery method. When shares of the first share generation structure above the threshold value t are available, the normal case secret recovery module 152 recovers the secret using the (t, n) secret recovery method.

[0074] When the secret cannot be recovered normally due to the loss of a share in the first share generation structure, the rollback secret recovery module 154 performs the function of recovering the secret. The rollback secret recovery module 154 aggregates shares belonging to the key share set S. c The shares include r shares, shares belonging to the replication share set, and shares S belonging to the additional share set. add |S dup |+α shares are used to restore the secret. The total number of shares collected is r+|S dup | + α, this is (r + |S) dup |+α,|S c |+|S dup The minimum number of shares required to recover a secret in a threshold secret sharing mechanism (|+α+δ) is 1.

[0075] The threshold secret recovery method of the present invention will be introduced below, taking the polynomial utilization share generation structure based on the Sharmir method as an example.

[0076] Figure 6 A diagram illustrating the set of shares used for threshold secret sharing as described below.

[0077] Assuming secret S=3, participants X1, X2, X3 (LW / CH type), Y4, Y5 (LW / PD type), and Y6 (LS / PD type) participate in the sharing and recovery of the (t, (r, Sc), n) threshold secret. In this case, the (3, (1, Sc), 5) threshold secret recovery method is illustrated using parameters t=3, r=1, and n=5.

[0078] First, the first share generation structure is generated. Since t=3, the first share generation structure is a quadratic polynomial with a constant (secret) value of 3. The other coefficients of the quadratic polynomial are arbitrarily or randomly assigned, assuming the first share generation structure is f(x) = x. 2 +9x+3.

[0079] Since n=5, a total of 5 first shares are obtained. These 5 first shares are defined as V1, V2, V3, V4, and V5. In short, the first share set S is generated based on the first share generation structure. F For S F ={V1, V2, V3, V4, V5}.

[0080] Assigned to S （F，PD） The number of shares is less than t. To satisfy this, V1, V2, V3, V4, and V5 are allocated to X1, X2, Y4, X3, and Y5 respectively. In this case, S （F，PD） ={V3, V5}. On the other hand, specify the set S of key shares used to recover the secret in the rollback case. c As an example, let Sc = {V1, V2}. The number of key share sets should be greater than r, |S c |=2,r=1.

[0081] Next, specify the set of replication shares, designated as S. dup ={V3}. S dup It should be assigned to a participant of type LS, therefore it is assigned to Y4.

[0082] Given a key share set and a replica share set, the second share generation structure is determined. This is illustrated using the case where the second share generation structure is also polynomial. The threshold value for the second share generation structure is set to r + |S|. dup When |+α and the second share generation structure is polynomial, its degree is set to r+|S. dup |+α-1, choose α=3 to set the degree of the polynomial of the second share generation structure to 4.

[0083] The second share generation structure should be able to generate shares belonging to S. c ∪S dup The share generation structure of the shares {V1, V2, V3} is such that the second share generation structure is a fourth-degree polynomial passing through three points V1, V2, and V3. By using the value 1, randomly generated along the three points V1, V2, and V3, as the coefficient of the highest-degree term, we can obtain the second share generation structure g(x) = x. 4 +x 3 +4x 2 +4x+3.

[0084] If a second share generation structure is generated, the additional share set S is determined using the second share generation structure. add In S add The quantity is determined by α + δ, and when δ = 0 is chosen, |S add |=3. Select 3 other points (4, g(4)), (5, g(5)), (6, g(6)) through the second share generation structure (gx) to define additional shares A4, A5, A6. Allocate additional shares to participants Y6 of the LS / PD type with a low probability of loss.

[0085] Figure 7 A flowchart illustrating the overall process of a threshold secret recovery method according to an embodiment of the present invention is provided.

[0086] Reference Figure 7 The first share is generated using the first share generation structure (step 700). As described above, the first share is generated based on the threshold value t and the number of shares n.

[0087] Having generated the first share, the second share is generated using the second share generation structure (step 710). As mentioned above, some of the second shares overlap with the first share; after determining the second share generation structure, additional shares are generated.

[0088] Determine whether the number of available shares in the first share generation structure is greater than the threshold value t (step 720).

[0089] If the number of available shares in the first share generation structure exceeds the threshold value t, the secret is recovered only through the first share of the first share generation structure (step 730).

[0090] If the available shares in the first share generation structure are less than the threshold value t, the secret is recovered using the additional share set, key share set, and replicated share set of the second share generation structure (step 740). When recovering the secret using the additional share set of the second share generation structure, the shares that have not been lost and have been retained from the additional share set, key share set, and replicated share set are selected to recover the secret (step 740).

[0091] On the other hand, a computing device for implementing the threshold secret recovery method of the present invention may include a processor and a memory, wherein the processor may execute the method of the present invention by running at least one program stored in a computer-readable storage medium.

[0092] The present invention has been described with reference to the embodiments shown in the accompanying drawings, but these are merely illustrative, and it will be understood by those skilled in the art that various modifications and equivalent embodiments may exist. Therefore, the true technical scope of protection of the present invention should be determined based on the technical concept of the appended claims.

Claims

1. A threshold secret recovery method, comprising: Step (a) to obtain the first share generated by the first share generation structure from the participant; Step (b) is to determine whether the quantity of the first share obtained is above the first threshold value t. When the quantity of the first share is above the first threshold value t, step (c) is performed to restore the secret using the (t, n) threshold secret recovery method. If the number of first shares obtained is less than the first threshold value t, the step (d) is to obtain the second shares generated by the second share generation structure from the participants; and Step (e) involves recovering the secret using the first share and the second share obtained. The subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure is taken as the key share set, wherein the number of shares in the key share set is determined to be above the key threshold value r which is less than the first threshold value.

2. The threshold secret recovery method according to claim 1, wherein the first threshold value t for recovering the secret in the first share generation structure is set to be greater than the number of participants who are allocated the first share and who have the potential to betray.

3. The threshold secret recovery method according to claim 1, wherein a set of replicated shares is determined as a subset of the intersection of the first set of shares generated by the first share generation structure and the second set of shares generated by the second share generation structure, wherein the intersection of the replicated share set and the key share set is an empty set, and the union of the replicated share set and the key share set is the intersection of the first set of shares and the second set of shares.

4. The threshold secret recovery method according to claim 3, wherein the second share set includes the key share set, the replicated share set, and the additional share set determined by the second share generation structure.

5. The threshold secret recovery method according to claim 4, wherein the set of replicated shares and the set of additional shares are allocated to participants with a low probability of loss.

6. In the threshold secret recovery method according to claim 2, the number of intersections between the set of shares allocated to the participants with the possibility of betrayal and the set of key shares is set to be less than the key threshold value r.

7. The threshold secret recovery method according to claim 4, wherein the second share generation structure is determined to have a structure different from the first share generation structure by utilizing the set of key shares included in the first share and the set of replicated shares.

8. In the threshold secret recovery method according to claim 4, if all shares of the first share set belong to the union of the key share set and the replicated share set, the second share generation structure is determined to be the same as the first share generation structure.

9. The threshold secret recovery method according to claim 4, wherein the second threshold value of the second share generation structure is set to be greater than or equal to the number of elements in the union of the key share set and the replicated share set.

10. A threshold secret recovery device, comprising: processor; At least one memory is connected to the processor. The processor executes: Step (a) to obtain the first share generated by the first share generation structure from the participant; Step (b) is to determine whether the quantity of the first share obtained is above the first threshold value t. When the quantity of the first share is above the first threshold value t, step (c) is performed to restore the secret using the (t, n) threshold secret recovery method. If the number of first shares obtained is less than the first threshold value t, the step (d) is to obtain the second shares generated by the second share generation structure from the participants; and Step (e) involves recovering the secret using the first share and the second share obtained. The subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure is taken as the key share set, wherein the number of shares in the key share set is determined to be above the key threshold value r which is less than the first threshold value.

11. The threshold secret recovery device according to claim 10, wherein the first threshold value t for recovering the secret of the first share generation structure is set to be greater than the number of participants who are likely to betray the first share.

12. The threshold secret recovery device according to claim 10, wherein a set of replicated shares is determined as a subset of the intersection of a first set of shares generated by the first share generation structure and a second set of shares generated by the second share generation structure, wherein the intersection of the replicated share set and the key share set is an empty set, and the union of the replicated share set and the key share set is the intersection of the first set of shares and the second set of shares.

13. The threshold secret recovery device according to claim 12, wherein the second share set includes the key share set, the replicated share set, and the additional share set determined by the second share generation structure.

14. The threshold secret recovery device of claim 13, wherein the set of replicated shares and the set of additional shares are allocated to participants with a low probability of loss.

15. The threshold secret recovery device according to claim 11, wherein the number of intersections between the set of shares allocated to the participants with the potential for betrayal and the set of key shares is set to be less than the key threshold value r.

16. The threshold secret recovery device according to claim 13, wherein the second share generation structure is determined to have a structure different from the first share generation structure by utilizing the set of key shares included in the first share and the set of replicated shares.

Images