secret distribution device, support device, and user device, and secret distribution program, support program, and user device program

Abstract

The secret distribution device has a true random number generation section that generates true random numbers, and a calculation section that performs secret distribution on a value obtained by multiplying k (k > 1) true random numbers from the true random number generation section, performs calculation on the inverse of one of the k true random numbers, and combines the inverse with one of the distributed values after secret distribution, and performs calculation on k sets of conversion random numbers.

Description

Technical Field

[0001] The technology disclosed herein relates to a secret distribution device, a support device, a user device, a sender device, a receiver device, a verification request device, a verifier device, a secret distribution program, a support program, a user device program, a sender program, a receiver program, a verification request program, and a verifier program. Background Technology

[0002] Security assessments related to information security technologies can be broadly categorized into information theory security and computational security. Information theory security refers to the security where even an attacker with unlimited computing power cannot solve the problem due to insufficient information. Computational security, on the other hand, refers to the security where an attacker can solve the problem as long as they possess computing power exceeding expectations.

[0003] As a method with information theory security, the (k,n) threshold secret distribution method is known. The (k,n) threshold secret distribution method works as follows: by distributing a secret message into n distinct values, and collecting k values ​​(k≦n) from the n distributed values, the original secret message can be restored. However, with fewer than k values, no information related to the secret message can be obtained. A widely known secret distribution method is the (k,n) threshold secret distribution method proposed by Shamir (hereinafter referred to as the Shamir method). In the Shamir method, the distributors of the secret message are called dealers, including n servers or participants that store the distributed values ​​(hereinafter referred to as distributed values), and the restorer who restores the secret message. Additionally, x is called the server identifier (ID). i (i=1, 2, ..., n) are public values ​​that anyone can know.

[0004] The Shamir method for secret information s is as follows.

[0005] [Shamir method]

[0006] [dispersion]

[0007] 1. The distributor chooses any prime number p where s < p and n < p.

[0008] 2. The distributor selects n distinct x from Z / pZ. i (i=1, 2, ..., n), and used as the server ID.

[0009] 3. The distributor selects k-1 random numbers a from Z / pZ. l (l=1, 2, ..., k-1), and generate the following formula (hereinafter referred to as the scatter formula).

[0010] W i =s+a1x i +a2x i 2 +···+a k-1 x i k-1 (mod p) (1)

[0011] 4. The distributor substitutes each server ID into x in equation (1). i For the dispersion value W i Perform calculations and assign W i Distributed to server x i .

[0012] [Decryption]

[0013] 1. Set the scatter value used in decryption to W. i (i=1, 2, ..., k). Additionally, the server ID corresponding to the aforementioned dispersion value is set to x. i (i=1, 2, ..., k).

[0014] 2. The restorer collects k dispersion values ​​W. i and x i and W i Substituting the equations into the scatter equations, we can solve the k simultaneous equations to obtain s. Using the Lagrange interpolation formula is convenient when reconstructing s.

[0015] In addition, the secret dispersion method for addition is also widely known. The following explanation addresses the case where n=k.

[0016] [The Secret of Addition: Dispersion Method]

[0017] [dispersion]

[0018] 1. The distributor generates k-1 random numbers S1 to S2. k-1 .

[0019] 2. The distributor calculates the following for the secret information s.

[0020] S k =s-S1-···-S k-1 (2)

[0021] 3. The distributor selects an identification code x for k servers. i (i=1, 2, ..., k), and S i Distributed as a distribution value to server x i .

[0022] [Decryption]

[0023] 1. The restorer collects k S. i And for s=S1+…+S k The calculations are performed to restore the secret information s.

[0024] With n=k+1, the distributor will... i S i+1 Distributed to server x i However, for convenience, S... k+1 Consider it as S1.

[0025] The addition-based secret distribution method also includes a distributor, n servers, and a restorer. The principle of secret distribution is that the distributor distributes the secret information and carries nothing with them, retrieving it from the servers when needed, thus creating this structure. Furthermore, the addition-based secret distribution method ensures that even if k-1 distributed values ​​are leaked, the secret information remains unknown due to insufficient information, thereby achieving information theory security. However, regardless of the specific secret distribution method, a secure communication path is used for distributing the distributed values ​​from the distributor to the servers, and for the restorer to collect the distributed values. Because the secret distribution method possesses information theory security, the security of the communication also requires information theory security. As a cryptographic method for achieving information theory security, the Vernam cipher is known, but the Vernam cipher, as a key, requires the sender and receiver to securely share a large number of truly random numbers without anyone knowing their identity. However, generally, it is difficult for the sender and receiver to generate a large number of truly random numbers themselves, and without direct offline meetings, it is difficult to share random numbers while maintaining information theory security. Therefore, general-key cryptography with computational security, such as the Advanced Encryption Standard (AES), which only requires sharing a short key, is generally used. However, when considering systems including communication, the aforementioned secret distributed system, as a whole, becomes computationally weak in security, meaning that secret distributed systems may leak secret information during communication. Therefore, in systems using secret distributed cryptography, it is necessary to construct structures that allow for easy generation and sharing of random numbers using Fenham ciphers to achieve theoretical information security, including communication security.

[0026] On the other hand, research into quantum computers has been progressing in recent years. It can be argued that if quantum computers become a reality, current cryptographic methods that only offer computational security could be easily deciphered. Therefore, if quantum computers are realized, even if the secret distribution method itself possesses information-theoretical security, if only computational security can be achieved along the communication path, such a secret distribution system could potentially be compromised by information leakage through the communication path. Furthermore, methods with information-theoretical security are unbreakable even with unlimited computing power, and therefore cannot be broken even with a quantum computer. Summary of the Invention

[0027] [The problem the invention aims to solve]

[0028] In view of the aforementioned problems, the present invention aims to provide a secret distribution device, support device, user device, sender device, receiver device, verification request device, verifier device, secret distribution program, support program, user device program, sender program, receiver program, verification request program, and verifier program that can achieve information theory security for the entire system, including communication.

[0029] [Technical means to solve the problem]

[0030] To achieve the aforementioned objective, the secret distribution device of the first aspect of the present disclosure comprises: a true random number generation unit that generates true random numbers; and a calculation unit that secretly distributes the value obtained by multiplying k (k>1) true random numbers from the true random number generation unit, sets one of the k true random numbers as a first random number, calculates its reciprocal, combines the reciprocal with one of the distributed values ​​after secret distribution, and then calculates the k sets of conversion random arrays.

[0031] The second type of support device is a support device that supports a sender device and a receiver device that perform cryptographic communication with each other, and includes: a true random number generation unit that generates true random numbers; a storage unit that stores the true random number generated by the true random number generation unit that is sent and stored in the sender device as a first sender random number, and stores a true random number that is sent and stored in the receiver device, which is different from the first sender random number, as a first receiver random number; a secret calculation unit that performs secret calculation on a second random number using the first sender random number and on the second random number using the first receiver random number, wherein the second random number is a true random number generated by the true random number generation unit and used by the sender device and the receiver device for cryptographic communication; and a communication unit that sends the second random number, which is secretly calculated using the first sender random number, to the sender device, and sends the second random number, which is secretly calculated using the first receiver random number, to the receiver device.

[0032] The third type of support device is based on the second type, wherein the storage unit stores a first user random number to be stored by each of the plurality of user devices participating in the secret calculation based on secret distribution, and the support device further includes: a support value calculation unit that calculates the support value required by each of the user devices participating in the secret calculation; and a secret calculation unit that performs secret calculation on the calculated support value using the first user random number of each of the plurality of user devices, and the communication unit sends the secretly calculated support value to each of the plurality of user devices.

[0033] The fourth type of support device, as described in the third type, includes an identification code attachment unit that attaches an identification code to a first user random number of each of the plurality of user devices in order to know the usage status of the first user random number of each of the plurality of user devices. The communication unit sends the information obtained as a result of the secret calculation and the identification code to each of the plurality of user devices.

[0034] The fifth type of user device includes: a receiving unit that receives information obtained as a result of the secret calculation and the identification code from the support device described in the fourth type; and a secret decryption unit that decrypts the information obtained as a result of the secret calculation using a first user random number with the identification code attached.

[0035] The sixth type of transmitter device includes: a random number calculation unit that sets a desired number of random numbers from the first transmitter random number or the second transmitter random number described in the second type as a first dispersion value, and calculates a random number of times a coefficient other than a constant term used as the first dispersion value based on the first dispersion value and secret information possessed by the transmitter device; a dispersion value calculation unit that calculates a second dispersion value using the secret information possessed by the transmitter device, the random number, and the random number of times the random number is set as a coefficient; and a communication unit that transmits the second dispersion value to a receiver device.

[0036] The receiver device in the seventh form includes a recovery unit that recovers the secret information based on the second dispersion value sent from the sender device described in the sixth form, a first dispersion value consisting of a required number of random numbers from the first sender random number or the second sender random number sent from the support device described in the fifth invention, and the number of times the random number used in the second dispersion value is set as a coefficient.

[0037] The eighth form of the verification request device is a verification request device for requesting verification that one is the person whose authentication information is registered in the verifier device. It is characterized by comprising: a transformation unit that transforms a transmitted message in a manner verifiable by secret computation, wherein the transmitted message is a transmitted message obtained by secret computation of information composed of the authentication information registered in the verifier device and information different each time it is transmitted; and a transmission unit that sends the transformed transmitted message to the verifier device, wherein the transformed transmitted message is transformed such that the result of the secret subtraction operation is 0 only when the registered authentication information, the information different each time it is transmitted, and the transformed transmitted message are consistent through a secret subtraction operation based on secret dispersion.

[0038] The verifier device of the ninth form is a verifier device that registers the authentication information recorded in the eighth form. It includes: a receiving unit that receives the modified transmission information; and a verification unit that performs the secret subtraction operation recorded in the eighth form on the registered authentication information, the information that is different each time it is transmitted, and the modified transmission information in the received transmission information, and verifies whether the result of the secret subtraction operation is 0.

[0039] The tenth form of the secret distribution device includes: a calculation unit that performs secret calculations on the secret information by multiplying the secret information with a true random number from a true random number generation unit; calculates a random number with a coefficient other than a constant term used as the first distribution value based on a first distribution value which is first registration information and a fourth random number from the true random number generation unit; calculates a second distribution value using the fourth random number and the calculated random number; and performs secret calculations using a deletion random number (i.e., a value obtained by dividing the fourth random number by the second registration information, third registration information obtained from the true random number generation unit, and the reciprocal of the true random number) to delete the true random number from the secret information, the first distribution value, the second distribution value, and the secret information after secret calculations, without performing division operations; and a communication unit that transmits the value calculated by the calculation unit.

[0040] The eleventh to twentieth forms correspond to the programs of the first to tenth forms, respectively.

[0041] The secret distribution device of the twenty-first type includes: a true random number generation unit that generates true random numbers using natural phenomena that cannot be controlled by humans; and a secret distribution unit that directly obtains multiple true random numbers from the true random number generation unit, calculates n distribution values ​​using one or more of the true random numbers and based on a secret information, and if k (n ≥ k > 1) of the calculated n distribution values ​​are collected, the secret information can be restored; if there are k-1 or fewer distribution values, the secret information cannot be restored. The true random number generation unit and the secret distribution unit are configured on a semiconductor.

[0042] [The effects of the invention]

[0043] The technology disclosed herein enables information-theoretical security for the entire system, including communications. Attached Figure Description

[0044] [ Figure 1A [ ] is a block diagram representing an example of the secret distribution device 100 in the first embodiment.

[0045] [ Figure 1B [Illustration 1] is a diagram showing an example of a first variant of the secret distribution device 100 in the first embodiment.

[0046] [ Figure 1C [Illustration 1] is a diagram showing an example of a second variation of the secret distribution device 100 in the first embodiment.

[0047] [ Figure 2 [ ] is a block diagram showing an example of the structure of the secret distribution section 12.

[0048] [ Figure 3 ] is a block diagram representing an example of a secret distributed system when n=k=2.

[0049] [ Figure 4 [] is a flowchart illustrating an example of the processing flow of the secret distribution procedure 24P1.

[0050] [ Figure 5 [] is a flowchart representing an example of the processing flow of the restoration procedure 24P2.

[0051] [ Figure 6 ] is a block diagram representing a secret distributed system of existing technology.

[0052] [ Figure 7 ] is a block diagram representing an example of a secret distributed system.

[0053] [ Figure 8 [Illustration 1] is a block diagram representing a secret distributed system with three servers in the prior art.

[0054] [ Figure 9 [] is a block diagram representing an example of a secret distributed system including two servers in the second implementation.

[0055] [ Figure 10 [Illustration] is a diagram illustrating an example of the processing of the secret distribution unit 12 and the secret computing unit of the CPU 12 in the secret distribution device 100 of the second embodiment.

[0056] [ Figure 11 [This is a flowchart illustrating an example of the overall process of the secret distribution device 100 in the third embodiment, from secret distribution to the restoration of the secret calculation / operation result.]

[0057] [ Figure 12 [Illustration] is a diagram showing an example of the processing of the secret distribution unit 12 of the CPU 12 of the secret distribution device 100 in the fourth embodiment.

[0058] [ Figure 13 [] is a block diagram representing an example of a secret distribution system in the fourth implementation form.

[0059] [ Figure 14 ] is a block diagram representing an example of a verification system in the sixth implementation.

[0060] [ Figure 15 ] is a block diagram representing an example of the verification system in the seventh implementation.

[0061] [ Figure 16 [Illustration 1] is a diagram showing an example of a modified version of the first embodiment of the secret distribution device 100.

[0062] [ Figure 17 [Illustration 1] is a diagram showing an example of a modified version of the second embodiment of the secret distribution device 100.

[0063] [ Figure 18 [Illustration 1] is a diagram showing an example of a modified version of the fourth embodiment of the secret distribution device 100.

[0064] [ Figure 19 ] is a block diagram representing an example of a verification system for a variant of the sixth implementation.

[0065] [ Figure 20 [] is a block diagram representing an example of a verification system for a variant of the seventh implementation. Detailed Implementation

[0066] Hereinafter, an example of an embodiment of the technology disclosed herein will be described in detail with reference to the accompanying drawings.

[0067] <First Implementation Form>

[0068] Figure 1A This is a block diagram illustrating an example of the secret distribution device 100 in its first embodiment. For example... Figure 1A As shown, the secret distribution device 100 includes a true random number generation unit 10, a secret distribution unit 12, a storage unit 14, and a communication unit 16. The true random number generation unit 10, the secret distribution unit 12, the storage unit 14, and the communication unit 16 are connected in a communicative manner via a bus. The secret distribution device 100 is configured on a semiconductor (a chip). Specifically, the true random number generation unit 10, the secret distribution unit 12, the storage unit 14, and the communication unit 16 are configured on a semiconductor.

[0069] Although Figure 1A Although not shown in the figure, the parameters described later are input to the secret dispersion unit 12 via the input unit 15, as in the first and second modifications of the secret dispersion device 100 of the first embodiment described later.

[0070] The covert distribution device 100 of this embodiment is, for example, equipped in a Subscriber Identity Module (SIM) card or a Secure Digital (SD) card. The covert distribution device 100 operates by inserting the SIM card or SD card into a personal computer or smartphone, which may include a communication device (not shown). The communication unit 16 functions as a connection port for communication between the true random number generation unit 10, the covert distribution unit 12, and the storage unit 14 and the personal computer or smartphone.

[0071] As described above, the secret distribution device 100 of the first embodiment is constructed on a semiconductor (a chip), but the technology disclosed herein is not limited thereto.

[0072] Figure 1B This is a diagram illustrating a first variation of the secret distribution device 100 in its first embodiment. (See diagram for example.) Figure 1B As shown, a first variation of the secret distribution device 100 in the first embodiment includes a computer 20, a true random number generator 10, a communication device 160, a storage unit 14, and an input unit 15. The computer 20 includes a central processing unit (CPU) 22, a read-only memory (ROM) 24, a random access memory (RAM) 26, and an input / output (I / O) port 28. The CPU 22, ROM 24, RAM 26, and I / O port 28 are interconnected via a bus 30. The true random number generator 10, the communication device 160, the storage unit 14, and the input unit 15 are connected to the I / O port 28. The ROM 24 stores various programs, represented by the secret distribution program 24P1 and the recovery program 24P2, which will be described later. The CPU 22 reads the secret distribution program 24P from the ROM 24 into the RAM 26 and executes the secret distribution program 24P, thereby functioning as the secret distribution unit 12.

[0073] Figure 1C This is a diagram illustrating a second variation of the secret distribution device 100 in the first embodiment. (See diagram for example.) Figure 1C As shown, a second variation of the secret distribution device 100 in the first embodiment is configured such that a ROM 24, a CPU 22, an input unit 15, a true random number generation unit 10, a RAM 26, a storage unit 14, and a communication device 160 are interconnected via a bus 36. Furthermore, as described above, various programs, such as the secret distribution program 24P1 and the recovery program 24P2 (described later), are stored in the ROM 24. The CPU 22 reads the secret distribution program 24P from the ROM 24 into the RAM 26 and executes the secret distribution program 24P, thereby functioning as the secret distribution unit 12.

[0074] On the other hand, such as Figure 7 As shown, the first embodiment of the secret distribution system includes a secret distribution device 100 and k-1 server devices (hereinafter referred to as "servers") 110N1 to 110Nk-1. Furthermore, servers 110N1 to 110Nk-1 and... Figure 1CThe covert distribution device 100 shown also includes a CPU, storage unit, and communication unit. Servers in other embodiments have the same structure. The covert distribution device 100 and k-1 servers 110N1 to 110Nk-1 are interconnected via network 102 in a communicative manner. However, fewer than k-1 servers may be used, but k-1 will be described here.

[0075] For simplicity, let's assume n=k=2. Figure 1A The secret dispersion action is explained. In this case, such as Figure 3 As shown, the secret distributed system includes a server 110. Furthermore, Figure 3 An example of a secret distribution device 100 including two first embodiments is shown.

[0076] First, the true random number generation unit 10 measures and generates pulses from each alpha particle released during the natural decay of a quantum phenomenon, and generates random numbers from the pulse intervals. This is because, since a naturally decaying nuclide that undergoes a quantum phenomenon within the atomic nucleus is used, there is no need for control to maintain the quantum phenomenon. Alpha particles are released spontaneously under quantum phenomena, completely unaffected by external environmental factors such as temperature, pressure, and electromagnetic fields. Therefore, since the natural decay is not artificially generated, it is unaffected by human intervention and can guarantee truly random numbers. In other methods, various controls such as temperature, pressure, and electromagnetic fields are required, making it difficult to install a true random number generation unit in a semiconductor. By employing the above method, the true random number generation unit 10 can be installed in a semiconductor and coexist with the secret distribution unit 12 or the storage unit 14, etc.

[0077] Next, as Figure 2 As shown, the secret distribution unit 12 includes a setting control unit 12A and a calculation unit 12B. When parameters for secret distribution, such as (n, k, p) (where p represents the number of bits in the random number), are input from the input unit 15, the setting control unit 12A receives the parameters and controls the entire unit (specifically, the true random number generation unit 10, the storage unit 14, the communication unit 16, and the calculation unit 12B).

[0078] In addition, the setting control unit 12A retrieves random numbers from the true random number generation unit 10 and outputs them to the calculation unit 12B, etc. Furthermore, in addition to outputting random numbers to the calculation unit 12B, the setting control unit 12A also outputs random numbers to the secret calculation unit 18 or the storage unit 14 (in the case of the Finum cipher) as described later.

[0079] For example, when using the Shamir method (and when n=k=2), the true random number input from the true random number generation unit 10 is extracted in p bits and sent to the calculation unit 12B as a1. For example, when p=3 and the true random number generation unit 10 outputs 1, 0, 1, 1, ... in sequence, the control unit 12A extracts (i.e., extracts) the random number from the true random number generation unit 10 in 3 bits, thereby obtaining 101, and sends 101=5 (decimal number) as a1 to the calculation unit 12B.

[0080] In the setting control unit 12A, the server ID is preset via the input unit 15 and also sent to the computing unit 12B. Figure 7 In the example shown, the input is x1 to x2. k-1 As the server ID for servers 110N1 to 110Nk-1, and in Figure 3 In the example (where k=2), x1 is input as the server ID of server 110. Additionally, a p-bit prime number p is also preset in the setting control unit 12A via input unit 15, and can be output to the calculation unit 12B in accordance with p.

[0081] Furthermore, for example, in the case of using the secret dispersion method of addition, the control unit 12A is set to extract (i.e., extract) the true random number generated by the true random number generation unit 10 in p bits, and output it as S1 to the calculation unit 12B, etc. For example, when p=3 and the true random number generation unit 10 outputs 0, 1, 0, 0 in sequence, the control unit 12A is set to extract (i.e., extract) the random number from the true random number generation unit 10 in 3 bits, thereby obtaining 010, and sending 010 or 2 (converted to decimal) as S1 to the calculation unit 12B. Unlike the case (k=2), when k is 3 or more, the control unit 12A is set to extract k-1 true random numbers and output them as a i or S i (i=1, ..., k-1), and x i Send them together to the Computing Department 12B.

[0082] The calculation unit 12B uses the parameters sent from the setting control unit 12A and the secret information input via the input unit 15 to calculate equation (1) in the case of the Shamir method and to calculate equation (2) in the case of secret dispersion of addition. That is, in the case of the Shamir method, the calculation unit 12B calculates the dispersion value W according to equation (1). i Calculations are performed, and the dispersion value S is calculated according to equation (2) in the case of secret dispersion of addition. kCalculations are performed. When dealing with multiple secret distribution methods such as the Shamir method and addition-based secret distributions, the parameters indicating which secret distribution method to select can be input from the outside to the setting control unit 12A via the input unit 15, thereby handling multiple calculations. Alternatively, since the apparatus of this disclosure, as described later, can handle various processes, a program can also be input from the outside via the input unit 15 and set in the calculation unit 12B, and the calculation unit 12B performs calculations according to the program.

[0083] Next, the calculation unit 12B of the secret dispersion unit 12 calculates the dispersion value W. i Or dispersion value S i The n-k+1 (minimum 1) scattered values ​​are sent to the storage unit 14, which stores the n-k+1 (minimum 1) scattered values. The calculation unit 12B sends the remaining k-1 scattered values ​​to the communication unit 16.

[0084] The communication unit 16 sends k-1 distributed values ​​to k-1 servers 110N1~110Nk-1 (refer to...) Figure 7 For example, the communication unit 16 sends the first dispersion value out of k-1 dispersion values ​​to server 110N1, the second dispersion value to server 110N2, and so on, sending the (k-1)th dispersion value to server 110Nk-1. In this case, even if the dispersion values ​​are sent directly without encryption, the information theory security can be maintained. However, encryption using a computationally secure cryptosystem such as AES is also possible. The AES encryption is used to increase the workload for attackers, ensuring that the information theory security is maintained even if the encryption is compromised.

[0085] The above is an example of the processing flow of the secret distribution procedure 24P1. Figure 4 .

[0086] In step 52, the setting control unit 12A sets the secret information input via the input unit 15 and the variables such as (n, k, p) required for secret distribution.

[0087] In step 54, the control unit 12A is set to extract a true random number from the true random number generation unit 10, and the parameters (n, k, p) are set in the calculation unit 12B.

[0088] In step 56, the calculation unit 12B uses secret information, true random numbers, and parameters to calculate the dispersion value W of equation (1) or equation (2). i Or dispersion value S i Perform the calculation.

[0089] In step 58, the storage unit 14 saves the n-k+1 scattered values.

[0090] In step 60, the communication unit 16 distributes (i.e., sends) the k-1 distributed values ​​to the external server 110 (see reference). Figure 3 ).

[0091] Regarding the [dispersion] described in the background art, such as Figure 6 As shown, n distributed values ​​are sent from distributor 200 to n servers 202N1 to 202Nn. Therefore, if these values ​​are eavesdropped on, even if they are encrypted, the secret information will be leaked if decrypted by a quantum computer or similar device.

[0092] In contrast, the secret distribution device 100 of this disclosure is configured such that the distributor himself can participate in secret computation, and as... Figure 7 As shown, k-1 distributed values ​​are sent to k-1 servers 110N1 to 110Nk-1. Therefore, it can be seen that even if all k-1 distributed values ​​are eavesdropped on / decrypted, the secret information will not be leaked, thus achieving information theoretical security.

[0093] In addition, Figure 1A In this device, a secret distribution unit 12, a true random number generation unit 10, and a storage unit 14 are constructed on a single semiconductor. Therefore, it can be said that through communication between the true random number generation unit 10, the secret distribution unit 12, and the storage unit 14 constructed on the single semiconductor, information leakage is virtually impossible, thus achieving theoretical information security for the device. Furthermore, if each component is securely managed, it can also be... Figure 1B , Figure 1C It is constructed using computers in that way.

[0094] Next, the process equivalent to "restoration" will be explained. The processing flow of restoration procedure 24P2 will be shown below. Figure 5 .

[0095] First, in step 62, the parameters (n, k, p) required for the restoration process are input from the input unit 15 and set in the setting control unit 12A. Then, the communication unit 16 calls (i.e. receives) k-1 scattered values ​​from servers 110N1 to 110Nk-1 and sends them to the calculation unit 12B. The scattered values ​​can be sent directly or encrypted using AES or similar methods. Similar to the scattered value case, the encryption is performed to increase the workload for the attacker. In the case of encryption / decryption, the encryption key is stored in the communication unit 16.

[0096] Next, in step 64, n-k+1 (minimum 1) dispersion values ​​(more than 1 dispersion value) are sent from storage unit 14 to calculation unit 12B. In step 66, calculation unit 12B performs a restoration calculation. When using the Shamir method, the restoration calculation performed by calculation unit 12B executes the Lagrange interpolation formula or solves the simultaneous equations to restore the secret information. In the case of additive secret dispersion, the secret information is restored by summing the dispersion values. In step 68, the restoration result is obtained by being sent (output) via communication unit 16.

[0097] The "restoration" and "dispersion" shown in the background art are similarly considered... Figure 6 If the structure is such that k of its scattered values ​​are eavesdropped on or cryptically deciphered, the secret information will be leaked.

[0098] In contrast, the apparatus of the present disclosure becomes Figure 7 The structure ensures that secret information will not be leaked from the k-1 scattered values, thus achieving information theory security.

[0099] Generally speaking, in secret distribution, the principle of the secret distribution device (distributor) is: after distributing the secret information, the secret distribution device (distributor) leaves nothing behind. When it wants to restore the secret information, it obtains k distribution values ​​from the distributed server to restore the secret information, thus becoming the [distribution] and [restoration] as shown in the background art.

[0100] In contrast, in this embodiment, the secret distribution device (distributor) 100 is configured to keep a distributed value at hand (the device) and manage it secretly (or participate in secret calculations), thus achieving information theory security.

[0101] As explained above, this embodiment can achieve information security for the entire system, including communication. Specifically, a true random number generation unit 10, a secret distribution unit 12, and a storage unit 14 are configured on a semiconductor. Figure 1A The semiconductor shown is mounted as a SIM card or an SD card, if... Figure 3 By inserting a server or personal computer (PC) 100A, or a smartphone (hereinafter referred to as "phone") 100B as shown, information security can be maintained even if all information sent from the secret distribution device (distributor) 100 to the server 110 is leaked. Alternatively, it can be done as follows... Figure 1B , Figure 1CThis would create a PC 100A and a mobile phone 100B on the computer. Therefore, even if an attacker attacks the communication and server 110 to obtain information, the secret information will not be leaked, thus achieving information theoretical security across the entire secret distributed system, including communication. However, Figure 3 Multiple servers 110 may exist, as may multiple PCs 100A or mobile phones 100B equipped with secret distribution devices (distributors) 100. Alternatively, tablet terminals may be used instead of mobile phones.

[0102] <Second Implementation Form>

[0103] In the first embodiment, a secret distribution device is shown that achieves information theory security by storing and restoring secret information. In the second embodiment, a device is shown that achieves information theory security even against processes including secret computation.

[0104] Here, in the case of using secret distribution for secret computation, the important points (conditions) for achieving information theory security for the system, including communications, are the following two.

[0105] (1) First condition

[0106] The first condition is that the secret computation algorithm can perform secret computation with n=k. To date, many secret computation algorithms have been proposed, but most cannot achieve n=k. The reason is that, in the case of Shamir's method, the multiplication of k-1 degree polynomials (dispersed values) on k servers results in a 2k-2 degree polynomial, thus requiring 2k-1 servers for restoration. Therefore, in most cases, the number of servers is n=2k-1, and even with the minimum k=2, the required number of servers is still n=2k-1=3. In this case, it becomes... Figure 8 In the device structure shown, for example, if server 204A acts as the distributor and distributes the distributed value to servers 204B and 204C, an attacker can eavesdrop on each communication because k=2, and the secret information will be leaked from the communication.

[0107] (2) Second condition

[0108] The second condition is that the system does not use a trusted third party (TTP) or other entity capable of theoretically secure communication. A TTP is a trusted third-party organization that supports clandestine computations. The relationship between the TTP and the server is as follows: Figure 6 The distributor 200 is replaced with a relationship like TTP, with Figure 6Similarly, if communication between TTP 200 and servers 202N1 to 202Nn is eavesdropped on, confidential information will be leaked. Even if it is intended to be set as... Figure 7 The structure shown is impractical because the secret distribution device 100 is also considered a server from the perspective of TTP. Therefore, it is necessary to achieve information-theoretically secure communication without using TTP. Alternatively, as a cryptographic method for achieving information-theoretically secure communication, the Fehenme cipher is known, but as mentioned above, the Fehenme cipher requires sharing a large number of truly random numbers in advance on both the sending and receiving sides, which is labor-intensive. Therefore, it is necessary to achieve information-theoretically secure communication using the Fehenme cipher or similar methods in a simple manner.

[0109] The secret computation algorithm that satisfies the above two conditions remains unknown. As an algorithm that satisfies condition 1, there are the Tokyo University of Science (TUS) method shown in Non-Patent Document 1 and the Smart, Pastro, Damgard, Zakarias (SPDZ) method shown in Non-Patent Document 2.

[0110] (Non-patent literature 1)

[0111] Keiichi Iwamura and Ahmad Akmal Aminuddin Mohd Kamal, “Communication-Efficient Secure Computation of Encrypted Inputs Using (k, n) Threshold Secret Sharing,” IEEE Access, May 2023.

[0112] (Non-patent document 2)

[0113] Damgaard I, Keller M, Larraia E, Pastro V, Scholl P., Smart NP: “Practical covertly secure MPC for dishonest majority - Or: Breaking the SPDZ Limits.” In: Crampton J., Jajodia S., Mayes K. (eds) Computer Security (ESORICS) 2013, Lecture Notes in Computer Science (LNCS), Vol. 8134, pp. 1-18, Springer, Berlin, Heidelberg (2013) 2013).LNCS, vol. 8134, pp. 1-18. Springer, Berlin, Heidelberg. (2013))

[0114] The TUS method shown in Non-Patent Document 1 requires TTP.

[0115] The SPDZ method shown in Non-Patent Document 2 does not require TTP, but it cannot achieve information theory security.

[0116] Therefore, this embodiment shows a way to satisfy conditions 1 and 2.

[0117] The TUS method is as follows Figure 6The system includes a distributor 200 (inputter), n servers 202N1 to 202Nn, and a restorer device (not shown). Furthermore, a TTP (Transmission to Protocol) (not shown) exists outside the system. In the TUS (Transmission to Protocol) mode, if each communication between servers 202N1 to 202Nn, between the distributor 200 (inputter) and each of servers 202N1 to 202Nn, and between the restorer device and each of servers 202N1 to 202Nn is secure and information theory security is achieved as a whole for the system, then Fenham ciphers are required in each of these communications. Therefore, in this embodiment, the TUS mode is improved so that information theory security, including communication, is achieved even without using TTP or Fenham ciphers.

[0118] First, the existing TUS method before improvement is shown. The TUS method can calculate extended product sum operations as in Equation 1 below. [Formula 1]

[0119] For simplicity, this explanation uses the product sum operation of a1a2+a3 as an example, with n=k=3. The form of the expression is defined by l and mi in the extended product sum operation expression, for example, l=2, m1=2, m2=1. Furthermore, the dispersion value of a is represented as [a]. j (j=0, ..., n-1). The secret distribution is assumed to use the Shamir method.

[0120] In TUS mode, the product sum operation a1a2+a3 is calculated as follows.

[0121] a1a2+a3=(a1+1)(a2+1)-(a1+1)-(a2+1)+(a3+1) (3)

[0122] Regarding secret information a i In the case of adding 1, even if the secret information is 0, the random number b will still be used. i Directly hide and set to b i a i (The random numbers used in secret calculations do not use 0) will also become 0, a i =0 is leaked, therefore b is the secret information plus 1. i (a) i The formula (3) is hidden in the form of +1) and then calculated.

[0123] [The concealment of secret information]

[0124] 1. Inputter A i (i=1, 2, 3) For each secret message ai Generate k random numbers b i，0 b i，1 b i，k-1 Calculate the following and set b i，j Send to server S j (j=0,···,n-1=k-1). Figure 6 There are 3 distributors, 200, and inputter A as mentioned above. i Corresponding to 3 distributors 200, server S j Corresponding to Figure 6 Servers 202N1 to 202Nn.

[0125] [Formula 2]

[0126] 2. Inputter A i (i=1, 2, 3) Regarding the secret information a that one possesses i And for b i (a) i +1) = b i ×(a i +1) is used for calculation and sent to all servers (i=1,2,3).

[0127] [Transformation generated using a random array]

[0128] 1. TTP generates k random numbers e from group g. h，0 e h，1 、···、e h，k-1

[0129] [Formula 3]

[0130] Calculate the following for e h (h=1, ..., g) are secretly distributed to obtain group g of [e] h ] j (j=0, ..., n-1), and distributed to each server S j (j=0, ..., n-1).

[0131] [Formula 4]

[0132] 2 Therefore, server S j The following information was available prior to the secret calculation.

[0133] b i (a) i +1), b i，j eh，j , [e h ] j (i=1,...,3,h=1,...,g)

[0134] [Deleted using random number calculation]

[0135] 1 Server S j Generate random number d j The following calculations are performed and sent to one server (here, let's call it server S0), and the result is calculated for d. j Save it.

[0136] [Formula 5]

[0137] 2. Server S0 multiplies the received values ​​to calculate the following, and then sends it to all servers.

[0138] [Formula 6]

[0139] [Hidden Computation]

[0140] All servers S j Perform calculations on the following:

[0141] [Formula 7]

[0142] [recovery]

[0143] The restorers from k servers S j (j=0, ..., n-1) Collect [d(a1a2+a3)] j d j Then, restore d(a1a2+a3) and obtain the result a1a2+a3 based on the following:

[0144] [Formula 8]

[0145] In the TUS method, it is initially assumed that each server has a random array for conversion. However, since TTP is not used, it is difficult for each server to have a random array for conversion based on common calculations. Therefore, in this description, it is assumed that TTP generates the random array for conversion. However, in the [random array generation for conversion] performed by TTP, since n random arrays for conversion are distributed to each server S j(j=0, ..., n-1), therefore, even if the information flowing through the communication path is encrypted, if it can be deciphered by a quantum computer or the like, the secret information in the TUS method will be leaked. Furthermore, since this applies to all servers S... j (j=0, ..., n-1) also performs b in [concealing secret information] i，j The distribution or [restore] of [d(a1a2+a3)] j d j Therefore, the collection of secret information or calculation results can also be leaked through the communication path.

[0146] In summary, the problems with the TUS method can be summarized as follows: the distribution of random arrays from TTP to each server, the distribution of random numbers after concealing secret information, and the collection of calculation results during the restoration process.

[0147] Therefore, in this embodiment, for simplicity, we first consider the case where an individual user performs secret computation via TUS. In this case, the secret distribution device 100 shown in FIG1 performs the concealment of secret information and the generation of a random array for conversion as follows.

[0148] [Secret Deployment 12: Concealing Secret Information (Personal Use)]

[0149] 1. When the variables (n, k, p) required for secret distribution are set in the setting control unit 12A from the input unit 15, the setting control unit 12A retrieves the true random number sent from the true random number generation unit 10 with p bits, and sets it for each secret information a i (i=1,2,3) Use a truly random number as b i Send to Computing Department 12B.

[0150] 2. The calculation unit 12B uses the b sent from the setting control unit 12A. i And for b i (a) i The calculation is performed using +1)(i=1,2,3).

[0151] (a) i The "1" in +1) is an example of the "constant determined by the range of secret information and calculation results" in this disclosure. In the TUS method, the range of secret information is set to integers greater than or equal to 0, therefore the constant is determined by the input value and the range of non-zero calculation results. In this example, the constant is set to "1" for ease of calculation. Details will be described later.

[0152] b i This is an example of the "second random number" of the disclosed technology.

[0153] 3. Calculation unit 12B to b i The reciprocal is calculated and sent to the storage unit 14, which stores it.

[0154] 4. The computing unit 12B transmits b via the communication unit 16. i (a) i +1) is sent to an external server, which then saves it.

[0155] [Secret Dispersal Unit 12: Conversion using random array generation (personal use)]

[0156] 1. When the variables (n, k, p) required for secret distribution are set in the setting control unit 12A from the input unit 15, the setting control unit 12A extracts k random numbers e from g groups in p-bit units based on the true random numbers sent from the true random number generation unit 10. h，0 e h，1 、···、e h，k-1

[0157] [Formula 9]

[0158] Send to Computing Department 12B.

[0159] k random numbers e h，0 e h，1 、···、e h，k-1 One of them is an example of the "first random number" of the technology disclosed herein.

[0160] 2. The calculation unit 12B uses the g group e sent from the setting control unit 12A. h，0 e h，1 、···、e h，k-1 Calculate equation (5) and apply the formula to e. h (h=1, ..., g) are secretly dispersed to obtain [e h ] j (j=0, ..., n-1).

[0161] [Formula 10]

[0162] 3. Calculation Unit 12B to e h，j The reciprocal of the given value is used to calculate k random arrays (1 / e) for conversion, which are then combined with the dispersed value. h，j , [e h ] j (j=0, ..., k-1). Furthermore, (1 / e) h，q , [e h ] q(q=1, ..., k-1) is sent to the external server S via the communication unit 16. q (q=1, ..., k-1), and the calculation unit 12B will b i (a) i +1), 1 / b i 1 / e h，0 、[e h ] j Send to storage department 14.

[0163] Unlike the TUS method, in [Secret Computing Unit 18: Concealment of Secret Information (Personal Use)], the random numbers generated after concealing the secret information are not distributed to other servers. Similarly, in [Secret Distribution Unit 12: Generation of Random Arrays for Conversion (Personal Use)], since k-1 or more elements of the random array for conversion are not output externally, the problem is solved. Furthermore, if the user's device is [restored], then due to the device's [d(a1a2+a3)]... j d j It will not output to the outside, thus achieving information security. That is, it can be like... Figure 9 That rather than Figure 8 The structure includes two servers, 210 and 220, for secret computation.

[0164] Furthermore, in the TUS method, [concealing secret information], [generating a random array for conversion], and [calculating deletion using random numbers] are pre-calculated before the [secret calculation] which takes processing speed into account, so processing speed is not a major concern. However, the [secret calculation unit 18: concealing secret information (for personal use)] reduces the amount of computation, communication, and storage compared to the TUS method, thereby achieving efficiency. That is, the number of truly random numbers taken is reduced, and the calculation of equation (4) is also eliminated. In addition, since division over a finite field is not integer division, it is necessary to prepare a reciprocal table in advance or use the extended Euclidean algorithm for calculation. In the case of p large (e.g., 128 bits), the reciprocal table becomes huge, and the calculation based on the extended Euclidean algorithm is labor-intensive. In the "secret calculation" of the TUS method, the division operation is performed, but in the above case, the workload is not fully reflected in the [secret calculation] which takes processing speed into account, but it is performed in the [concealing secret information] which can be processed in advance, and its reciprocal is stored in the storage unit 14, thereby speeding up the processing of the [secret calculation]. The random numbers contained in the random array used for conversion are also saved by storing the reciprocal, thus eliminating division and achieving high speed. Furthermore, in this process, compared to the TUS method, the storage capacity of storage unit 14 or the external server is reduced, and the amount of communication with the outside world is also reduced. Hidden secret information b i (a) i+1) The information is sent to an external server, thereby achieving information-theoretical security. That is, if an attacker does not possess information about the device of this disclosure and information about the external server, they cannot obtain the secret information, even if they know the information stored on the external server. i (a) i +1), if you don't know b i If the secret information cannot be obtained, the security of information theory can be maintained.

[0165] However, in cases where an individual uses their own confidential information for secret computation, a more efficient method than the TUS method described above is shown below. The structure of the technology disclosed in this case is shown below. Figure 10 The difference from Figure 1 is the addition of a secret calculation unit 18. However, the structure of the secret distribution unit 12 is the same as... Figure 2 The same applies. The device structure can also be entirely connected via a bus, allowing for external program input.

[0166] The following are Figure 10 The processing of the secret computing unit 18 will be explained. Regarding the concealment of secret information, it is assumed that the [secret distribution unit 12: concealment of secret information (for personal use)] is performed. The structure or processing of the true random number generation unit 10 or storage unit 14 and communication unit 16 are the same as in the first embodiment, so the description is omitted. It is assumed that it is insecure for an external server not to use the technology disclosed herein.

[0167] In contrast, the processing corresponding to the [pre-calculation], [secret calculation], and [restoration] of the TUS method is performed as follows. Compared to the TUS method, the computational and communication loads are significantly reduced. In particular, the workload of [generating a random array for conversion] or [restoration] is eliminated, and the calculation results can be obtained directly.

[0168] [Secret Computing Department 18: Personal Use]

[0169] 1. The secret computing unit 18 obtains b from the storage unit 14. i Furthermore, the form of secret calculation is also determined by the form of the formula.

[0170] 2. The secret computing unit 18 obtains b from an external server. i (a) i +1), and calculate one of the following.

[0171] [Formula 11]

[0172] However, the [Secret Computation Unit 18: Personal Use] is limited to cases where the user is a single individual and is not used in a general form like the TUS method. While the TUS method only assumes the communication path to be secure and does not consider the information-theoretical security of the communication, the apparatus using the technology of this disclosure can include communication and perform information-theoretically secure secret computation. Furthermore, the TUS method performs division in secret computation, but the algorithm pre-computes b before secret computation. i or e h，j The reciprocal is calculated and stored, so division is achieved efficiently through direct multiplication of the reciprocals. A general secret computation using the TUS method is shown in the third implementation.

[0173] In addition, due to secret information a i The range is set to integers greater than or equal to 0. Therefore, values ​​greater than or equal to 0, including the calculated result, will not be considered as 'a'. i +1=0. However, in a i And when the calculation result is in the range of u-1 to -u+1, if P is set to a prime number where P ≥ 2u and a i +1 is set as a i If we add u, the result of the calculation, including the input, will not be 0. Therefore, in the case of repeated calculations, the result will not be 0 in the middle. Thus, for example, if we perform secret calculations with the restored result being d(a1a2+a3+u), we can directly use the restored result for repeated calculations. However, in order to set the input to a i +u and perform secret calculations in the manner of restoring the result to d(a1a2+a3+u), then replace equation (3) and calculate the following content.

[0174] a1a2+a3+u=(a1+u)(a2+u)-u(a1+u)-u(a2+u)+u 2 +(a3+u)

[0175] Furthermore, if a1 and the calculation result are within the range of u1-1 to -u2+1, and if we set P≧u1+u2, and a i +1 is set as a i If we add u2, the result will not be 0. Furthermore, without knowing a... i If the range of the calculation results is large enough to determine the value of P, then u can be set to P / 2. Furthermore, in a... i In cases where the calculation result is an integer greater than or equal to 1, u can also be set to 0.

[0176] Furthermore, if the value added to the secret information is set to a random number instead of a constant, it can be done as follows.

[0177] In a iIf the calculation result is in the range of u1-1 to -u2+1, then let P≧2(u1+u2) and let a be the result. i +r. Where r is a random number within the range from u1+2u2 to u2. Therefore, a i +r becomes a range from 2(u1+u2)-1 to 1, and the calculation result will not become 0. These are examples of the "constant or random number including 0 determined by secret information and the range of the calculation result" of the technique disclosed herein.

[0178] Therefore, it can be said that this embodiment is as secure as the first embodiment in terms of the preservation and recovery of secret information, and information theory security can be achieved even for secret computation. Therefore, it can be said that even if the technology of this disclosure is installed in a SIM card or SD card and... Figure 3 In such an environment, secret computations can be performed, including communication paths, thereby achieving information theory security.

[0179] <Third Implementation Form>

[0180] The second embodiment illustrates a case where a user performs secret computation using their own data, which has been secretly distributed and stored. In this embodiment, multiple users are shown jointly performing secret computation using their respective secret information. However, the random array used for conversion is pre-distributed to the participants in the secret computation, including those using the technology of this disclosure, using the method described later in the fourth embodiment.

[0181] The following describes the processing of [Secret Distribution Unit 12: Concealment of Secret Information (Multi-user)] and [Secret Computation Unit 18: Multi-user] during multi-user operation. Regarding the processing of [Secret Distribution Unit 12: Concealment of Secret Information (Multi-user)], for example, if user A, user B, and user C respectively possess secret information a1, secret information a2, and secret information a3, the processing differs slightly from that of [Secret Distribution Unit 12: Concealment of Secret Information (Individual User)]. Furthermore, the processing of [Secret Computation Unit 18: Multi-user] differs from the TUS method; the random numbers used to conceal secret information are not decomposed, thus reducing communication, computation, and storage requirements compared to the TUS method.

[0182] The following illustrates the process of concealing the secret information of a user with secret information a1 in a device equipped with the technology of this disclosure, while other users have secret information a2 and a3, and each user performs secret information concealment processing. Finally, the storage unit 14 and the external server have the following 5. (Assuming that a random array for conversion has been stored).

[0183] The overall process from secret distribution to the restoration of the secret computation / operation result is shown in Figure 11 .

[0184] In step 72, the secret distribution unit 12 sets variables and conceals the secret information as described later in [Secret Distribution Unit 12: Concealment of Secret Information (Multi-user)].

[0185] In step 74, the communication unit 16 sends the concealed secret information to an external server, obtains a conversion random array from the TTP and sends it to the storage unit 14, and the storage unit 14 stores the concealed secret information and the sent conversion random array.

[0186] In step 76, the secret calculation unit 12 uses the stored secret information to perform the secret calculation described later in [Secret Calculation Unit 18: Multi-user]. Furthermore, other servers also perform the calculations separately.

[0187] In step 78, the communication unit 16 collects k calculation results (dispersion values), and the secret calculation unit 18 performs the restoration shown in [Secret Dispersion Unit 12: Restoration] described later.

[0188] The following is a detailed explanation. The following explanation is a simplified version of [Secret Computation Unit 18: Multi-user] and [Secret Distribution Unit 12: Restore] with reduced computational complexity, assuming n=k=3. However, in the presence of a restorer, the data is sent covertly using a Finum cipher based on the fourth implementation (details will be described later).

[0189] [Secret Deployment 12: Concealing Secret Information (Multi-player)]

[0190] 1. For secret information a1, a random number b1 is extracted from the true random number generation unit 10 and sent to the calculation unit 12B.

[0191] 2. The calculation unit 12B uses b1 sent from the setting control unit 12A to calculate b1(a1+1) on the secret information a1.

[0192] 3. After calculating the reciprocal of b1, the calculation unit 12B sends 1 / b1 to the storage unit 14 and discloses b1(a1+1) to the user who performed the secret calculation via the communication unit 16.

[0193] 4. The computing unit 12B will display b as disclosed by other users. i (a) i +1)(i=2,3) are sent to the receiving and storage unit 14 via the communication unit 16.

[0194] 5. If the conversion of group g is transmitted from TTP using a random array according to the fourth embodiment, then the apparatus based on the technology of this disclosure has b. i (a) i +1), 1 / b1, ([e) h ]j 1 / e h，j (i=1, 2, 3, h=1, ..., g). However, the device of the present disclosure with secret information a1 will be referred to as S0, and other user devices with a2 and a3 will be referred to as S1 and S2.

[0195] Furthermore, if the form of the following expression is, for example, the form of the expression for calculating a1a2+a3, then using (a) as in equation (3) i +1) The calculated expansion is determined. However, the actual expansion is determined by b. i Hidden b i (a) i +1), therefore, if formula (3) is calculated directly, the following can be calculated.

[0196] b1(a1+1)b2(a2+1)-b1(a1+1)-b2(a2+1)+b3(a3+1)

[0197] Therefore, as the random number for deletion, 1 / (b1b2) needs to be generated in the first term of the above formula, 1 / b1 in the second term, 1 / b2 in the third term, and 1 / b3 in the fourth term, followed by multiplication. However, if it is directly multiplied by 1 / b1, etc., the concealed secret information b1 will be revealed. Therefore, the random number d described later is used... j And 1 / e of the random array used for conversion h，j For b i After concealment, multiplication is performed. This will be applied to the b... i The product of concealed random numbers is called a deletion random number slice, and the product of these slices is called the deletion random number. However, 1 / e h，j 1 / e after multiplication h It is removed by multiplying by the scattered values ​​contained in the random array. Therefore, the formula for secret calculation is as shown in equation (7).

[0198] [Secret Computing Department 18: Multi-user]

[0199] 1. The secret computing unit 18 obtains b from the storage unit 14. i (a) i +1), 1 / b1, (1 / e) h，j , [e h ] j (i=1, 2, 3, h=1, ..., g). In addition, the form of deletion using random number slices and the form of secret calculation shown in equation (7) are also determined according to the form of the formula.

[0200] 2 User Equipment S j ( j(i = 0, ..., k-1) Obtain random numbers d from the true random number generator 10. j The deletion is calculated using a random number and sent to user device S0. However, the reciprocal of the random number 1 / b, which conceals the secret information, is used. i And the reciprocal of the random number contained in the random array used for conversion, 1 / e h，j It is stored in the storage unit 14, so the following operations are performed only by multiplication.

[0201] [Formula 12]

[0202] The conversion is done by taking the reciprocal of the random numbers contained in the random array, 1 / e. h，j This is an example of the "reciprocal of the first random number" in the technique disclosed herein. The reciprocal 1 / e h，j It can also be provided externally via input unit 15. The reciprocal of the random number 1 / b, which conceals the secret information. i This is an example of the "reciprocal of the second random number" of the disclosed technique. Random number d j This is an example of the "third random number" of the technology disclosed herein.

[0203] 3. User equipment S0 sends the value received via communication unit 16 to secret calculation unit 18. In secret calculation unit 18, the following deletion is calculated using random numbers and then sent to user equipment S0 via communication unit 16. q (q=1,…,k-1).

[0204] [Formula 13]

[0205] 4 User Equipment S j The secret computation unit 18 (j=0,…,k-1) uses deleted random numbers, scattered values, and concealed secret information to perform the following [d(a1a2+a3)] without performing division. j To conduct secret calculations.

[0206] [Formula 14]

[0207] Secret Calculation Department 18 is an example of a "secret calculation department that performs secret calculations".

[0208] [Secret Dispersal Unit 12: Restoration]

[0209] k-1 user equipment S q [d(a1a2+a3)] j and d jThe information is sent to S0. The calculation unit 12B of S0 receives this information via the communication unit 16, restores d(a1a2+a3), calculates the following content to obtain the operation result a1a2+a3, and sends the operation result to the storage unit 14 or the communication unit 16 as needed.

[0210] [Formula 15]

[0211] In summary, it can be seen that information theory security can be achieved by including communication in situations where multiple people use their own secret information for secret calculations. It is also clearly possible to extend this beyond n=k=3. Furthermore, the TUS method also shows the calculation during repeated operations, but since the addition operation of the constant 1 in [Secret Distribution Unit 12: Multiple Use] replaces the addition operation of random numbers, and the processing in [Secret Distribution Unit 12: Concealment of Secret Information (Multiple Use)] and [Secret Calculation Unit 18: Multiple Use] treats the added random numbers as secret information and performs the same processing, it is clear that repeated operations can also be performed in the same way. Furthermore, if the range of the secret information or the calculation result is known, the operation can be directly repeated by simply setting u or r as shown in the second embodiment and adding them. Additionally, in the TUS method, if the number of participants in the secret calculation changes, it is necessary to redistribute b, which has concealed the secret information. i，j In this embodiment, since b is not distributed i，j Therefore, this is unnecessary. Furthermore, in the TUS method, reciprocal calculations are required in the secret computation, but in the algorithm described above, all of this can be performed efficiently using multiplication.

[0212] However, the participants, including the restorer, need to be at least two legitimate users. For example, in the second embodiment, it is secure because the server performing the secret computation is the same as the restorer. The restorer is an attacker attempting to learn the input user's secret information independently, but even if one input user cooperates, as long as the remaining two input users are not attackers, the secret information of the legitimate input user cannot be decomposed into individual values, thus ensuring security. Therefore, it can be said that secret computation with information theory security in terms of the system as a whole is achieved.

[0213] <Fourth Implementation Form>

[0214] As described below, the fourth embodiment exhibits a structure that achieves information-theoretical security for the entire system, including communication, and easily shares the random numbers of the Fehenm cipher under the second condition described in the second embodiment. Specifically, as Figure 13The diagram illustrates a structure for distributing truly random numbers to sender device 302 and receiver device 304 via TTP 300. The advantages of this structure are: it eliminates the workload of each sender device 302 and receiver device 304 generating and exchanging truly random numbers, and it allows for easy cryptographic communication with anyone based on the Fehenme cipher, provided that the truly random numbers are shared only with TTP 300. However, users who wish to distribute truly random numbers must become users of the structure operated by TTP 300 and sign a contract for periodic distribution of truly random numbers (or distribution can be done only once).

[0215] and Figure 1A Similarly, the secret distribution device 100 shown includes a secret distribution unit, a storage unit, and a communication unit, among others. The TTP 300, transmitter device 302, and receiver device 304 also include a secret distribution unit, a storage unit, and a communication unit. It can also be... Figure 1B and Figure 1C The server in other implementations also has the same structure.

[0216] TTP 300 includes a first embodiment (see Figure 1) (or Figure 10 The transmitter device 302 and receiver device 304 each include a true random number generation unit 10, a communication unit 16, a storage unit 14, a conversion random array generation unit, a management unit, and a concealment unit.

[0217] TTP 300 is an example of a “support device” for the technology disclosed herein.

[0218] Figure 13 The [number] corresponds to the following order.

[0219] [Registration Processing]

[0220] [1] The sender device 302 and receiver device 304, who wish to use the Finum cipher to become users of the structure operating the TTP 300, specify the interval or number of true random number distributions, etc.

[0221] [2] The TTP 300 stores a predetermined number of truly random numbers (referred to as the first random number) from the truly random number generation unit into a storage medium such as a SIM card, SD card, Universal Serial Bus (USB), or compact disc read-only memory (CD-ROM) for the registered user (i.e., the sender device 302 and the receiver device 304) and sends them to the user (i.e., the sender device 302 and the receiver device 304) by mail or the like. The first random number sent to the sender device 302 is different from the first random number sent to the receiver device 304.

[0222] The first random number sent to the sender device 302 is an example of the "first sender random number" of the present disclosure. The first random number sent to the receiver device 304 is an example of the "first receiver random number" of the present disclosure.

[0223] The sender device 302 stores the first random number sent from the TTP 300 in its storage unit 14, and the receiver device 304 stores the first random number sent from the TTP 300 in its storage unit 14 (for example, if the sent storage medium and the secret distribution device of the first embodiment are inserted into the sender device 302 and the receiver device 304, the program that automatically transfers the first random number to the sender device 302 and the receiver device 304 can be stored in the sent storage medium).

[0224] [3] TTP 300 sends true random numbers to the user periodically according to the method described in (2).

[0225] [4] The management unit of TTP 300 records and manages the first random number sent to each user (i.e., sender device 302 and receiver device 304) in the storage unit 14 of TTP 300. Specifically, the management unit can know how many numbers each user used by marking the first random number with a number. Letters may also be used. The number is also sent to the user (i.e., sender device 302 and receiver device 304) along with the first random number mentioned in [2][3].

[0226] The number and letters are examples of the "identification codes" of the technology disclosed herein.

[0227] Thus, the storage unit 14 of TTP 300 stores the first random number sent to the sender device 302 and the first random number sent to the receiver device 304. The storage unit 14 of the sender device 302 stores the first random number sent from TTP 300, and the storage unit 14 of the receiver device 304 stores the first random number sent from TTP 300. That is, the first random number sent from TTP 300 to sender device 302 is shared by both TTP 300 and sender device 302. The first random number sent from TTP 300 to receiver device 304 is shared by both TTP 300 and receiver device 304.

[0228] [Cryptographic Communication Processing]

[0229] [5] The communication unit 16 of the sender device 302 notifies the receiver device 304 to conduct cryptographic communication based on the Finum cipher.

[0230] [6] The communication unit 16 of the sender device 302 requests the required number of true random numbers (called the second random number) for the Fenum cipher from the TTP 300.

[0231] [7] The concealment unit of TTP 300 conceals (Fenham encryption) the second random number of the requested quantity from the true random number generation unit using the first random number of the sender device 302. The communication unit 16 sends the second random number concealed (Fenham encryption) using the first random number, and the information that the second random number is encrypted using the first random number of which number, to the sender device 302.

[0232] [8] The concealment unit of TTP 300 uses the first random number of receiver device 304 to conceal (Fenham encryption) the second random number (not concealed) sent to sender device 302. The communication unit 16 sends the second random number (concealed by Fenham encryption) and the information encrypted by the first random number of receiver device 304 to receiver device 304.

[0233] [9] After sending the second random number to the sender device 302 and the receiver device 304 (i.e., [7] and [8]), the TTP 300 immediately deletes the second random number.

[0234]

[10] Upon receiving the information [7] (i.e., indicating which first random number was used to encrypt the second random number), the decryption unit of the sender device 302 uses the first random number shared with the TTP 300 from the specified number to decrypt and automatically retrieves the second random number.

[0235]

[11] Upon receiving the information in [8], the decryption unit of receiver device 304 also decrypts the information using a first random number shared with TTP 300 from the specified number and automatically retrieves a second random number.

[0236]

[12] The concealment unit of the sender device 302 automatically conceals (Fenham encryption) the communication content indicated by the sender device 302 using the second random number taken in

[10] , and the communication unit 16 sends it to the receiver device 304.

[0237]

[13] The decryption unit of the receiver device 304 automatically decrypts the communication content using the second random number extracted in

[11] and displays it on a display unit not shown.

[0238] TTP 300 is a device different from the secret distribution device 100 in the first embodiment, but includes the constituent elements of the secret distribution device 100.

[0239] The processing described in [1] to [3] includes user correspondence or mailing of storage media, etc. The TTP 300 performs settings for each user (i.e., each of the sender device 302 and receiver device 304) in [1]. See Figure 1 or... Figure 10 The true random number generation unit 10 of the device of the present disclosure shown performs the first random number generation in [2] and [3], and outputs it to a SIM card, SD card, USB or CD-ROM, etc. via the communication unit 16. In addition, the management of the numbering of the first random number based on each user in [4] can also be performed by the setting control unit 12A, etc. In addition, when the first random number is a large number, the first random number can also be managed for each user by a large-capacity external server disconnected from the outside. In [6], whenever the user requests the second random number, the TTP 300 is called. The TTP 300 obtains the necessary first random number and hides the second random number. Then, the TTP 300 disconnects the external server again and distributes it to the user in [6]. In addition, the processing in [7] to [9] can also be performed automatically according to the requirements of [6]. That is, the true random number generation unit 10 generates the second random number, hides the second random number using the stored first random number, and sends it via the communication unit 16.

[0240] The processing of the sender device 302 or the receiver device 304 can also be described in Figure 1 or Figure 10 The secret distribution device 100 shown is used to achieve this. However, since a true random number generation unit 10 is not required, therefore... Figure 12 The structure shown can also be simplified as follows: the true random number generation unit 10 is removed, the first random number sent via the communication unit 16 is sent to the storage unit 14, and the secret distribution unit 12 is dedicated to the processing of

[10] to

[13] . In addition, even if the TTP 300 does not directly communicate with the receiver device 304, the second random number hidden by the first random number of the receiver device 304 can be sent to the sender device 302 and sent from the sender device 302. In addition, the tens or hundreds of bits at the specified positions of the information sent in [7] and [8] can be encrypted into information indicating the legality of the sent information, such as information indicating who communicated from whom, information indicating the date and time of sending, etc., which can be verified by the sender device 302 and the receiver device 304.

[0241] Alternatively, the distribution of the random array used for conversion when multiple people are performing secret calculations can also be performed as follows (the registration process is the same). Here, the user performing the secret calculation is defined as a user of the TTP 300 operating structure.

[0242] As explained above, this embodiment can achieve information theory security for the entire system, including communications.

[0243] [The conversion is handled using random number distribution]

[0244]

[21] The representative user device of the multiple secret calculations notifies the communication unit 16 of the other user devices performing secret calculations that secret calculations are being performed.

[0245]

[22] The communication unit 16 representing the user device notifies the TTP 300 of parameters such as (n, k, p), the number of necessary conversion random arrays, and the users participating in the secret calculation, and requests the generation / distribution of the conversion random arrays.

[0246]

[23] The true random number generation unit 10 of TTP 300 generates k random numbers for each of the conversion random arrays of the requested quantity. The conversion random array generation unit multiplies the k random numbers and performs secret distribution. It combines the reciprocal of the k random numbers with each of the k distribution values ​​to form k sets of conversion random arrays.

[0247] The random array used for the transformation of k groups is an example of the "supporting value" of the technique disclosed herein.

[0248]

[24] The concealment unit of TTP 300 conceals the conversion random array using the first random number of each user device participating in the secret calculation (Fenham encryption), and the communication unit 16 sends the concealed conversion random array and the information encrypted using the first random number starting from a certain number to each user device participating in the secret calculation.

[0249]

[25] TTP 300 quickly deletes the random array of conversions after sending it to each user device.

[0250]

[26] The secret computing unit of each user device uses a first random number shared with TTP 300 from the designated number to retrieve a random array for conversion.

[0251]

[27] The secret computing unit of each user device performs secret computing using the extracted conversion random array.

[0252] Clearly, the TTP 300 is also implemented using the secret distribution device of the first embodiment. Furthermore, if each user device also has a secret distribution device of the third embodiment, then after receiving the conversion random array from the TTP 300, multi-user secret computation as shown in the third embodiment can be performed. In this embodiment, the communicated information is encrypted using Fehnham encryption with true random numbers, thus achieving information-theoretical security.

[0253] Furthermore, the structure is not limited to the distribution of random arrays for conversion in the TUS method, but can also be used for the distribution of random values ​​of multiplication triples (SPDZ method) as shown in Non-Patent Document 2. In this case, simply change the term "random array for conversion" in the order to "multiplication triples", and change

[23] to "TTP 300 generates two random numbers a and b for each of the requested number of multiplication triples, calculates their product c=ab, and secretly distributes each of a, b, and c to form a group of distributed values".

[0254] [Formula 16]

[0255] The TTP 300 at this time includes: a secret distribution unit, which, after storing the first user random numbers to be stored by the plurality of user devices in the storage unit, performs a multiplication operation on two true random numbers obtained from the true random number generation unit, thereby calculating the multiplication value, and calculating each of the k distribution values ​​based on each of the two true random numbers and the multiplication value; a constituting unit, which constituts a multiplication triplet composed of three groups of k distribution values, one of each group; and a concealment unit, which conceals the multiplication triplet using the first user random numbers of each of the plurality of user devices, and the communication unit sends the information obtained as a result of the concealment to each of the plurality of user devices.

[0256] In this embodiment, as an example of a support value, the conversion of k groups is calculated using a random array, but the technology disclosed herein is not limited to this. For example, there are multiplication triples shown in Non-Patent Document 2 or first dispersion values ​​shown in the fifth embodiment (the second dispersion value is calculated based on the same structure as the first dispersion value).

[0257] Obviously, in addition to this, the TTP of this embodiment can also be applied to the situation of distributing data generated from a common structure individually and securely.

[0258] <Fifth Implementation Form>

[0259] In public-key cryptography, there exists a structure known as Public Key Infrastructure (PKI): A Certificate Authority (CA) at the top level guarantees the legitimacy of the public key (information such as the key owner, key value, or the CA providing the guarantee) through a public key certificate. PKI then guarantees the legitimacy of the user's public key by having the CA attach a digital signature to the public key certificate. However, this is contingent on the user trusting the CA.

[0260] Consider constructing the same structure through secret distribution. In the fifth embodiment, a TTP 300 is included for implementing the Fenham cipher shown in the fourth embodiment (the user device participating in the structure performs the [registration process] shown in the fourth embodiment).

[0261] In the fifth implementation form, Figure 13 The sender device 302 shown is user device A, and the receiver device 304 corresponds to user device B. User device A has the same structure as sender device 302, and user device B has the same structure as receiver device 304.

[0262] If the public key certificate relative to the public key of user device A is set to K, then TTP 300 issues the certificate as follows. Since n=k=2, the solution can be found by combining the two dispersion values: S1 (the dispersion value using the random number as the direct dispersion value is called the first dispersion value) and S2 (the dispersion value calculated by the method described below is called the second dispersion value).

[0263] [Certificate Issuance Processing]

[0264]

[31] When user device A wants to send K to user device B, the following processing is performed using the concealment unit: the communication unit 16 notifies the TTP 300 of the numbers of the two random numbers (S1, x1) used in the first random number.

[0265] (1) The hidden part of user device A calculates a1 based on S1=K+a1x0 (S1, K, x0 are determined) which is equivalent to the first dispersion value.

[0266] (2) The hidden part of user device A calculates S2=K+a1x1, which is equivalent to the second dispersion value, and sends S2 to user device B.

[0267] (3) The concealment part of TTP 300 uses the first random number of user device B to conceal (S1, x1) used by user device A and sends it together with the information of user device A.

[0268]

[32] User equipment B restores K according to S1 and S2.

[0269] The reason for using secret distribution is that fixed information such as public key certificates can easily be used to infer the content of K (the name of user device A or its public key, CA name, etc.). Similarly, when K is sent using a Fenum cipher, the ciphertext is K+S1 (in this case, S1 is not a distribution value but is only used as a random number). If an attacker can infer the value or position of K in the ciphertext, they can easily tamper with it by adding a difference value (for example, if K is written in American Standard Code for Information Interchange (ASCII) code, the value of K is added to the difference in ASCII code).

[0270] In contrast, under the condition of secret distribution, even if an attempt is made to tamper with K, which is a constant term of S2, the attacker, unaware of S1 and x1, cannot obtain the desired value based on S1 and S2, thus failing to correctly restore the information. Therefore, if user device B trusts TTP 300, and the restored K is not abnormal, the sent information is from user device A as indicated by TTP 300 and has not been tampered with. This simultaneously achieves user authentication and message authentication, serving the same function as an electronic signature.

[0271] The above is not limited to public key certificates and can be used to prove that information sent by user device A to user device B is legitimate.

[0272] Furthermore, if user device A and user device B share the second random number, similar to the fourth embodiment, then even if TTP 300 does not send (S1, x1) every time, it will send the number of the second random number used by user device A (in this case, the second random number is also labeled with a number) to user device B. If there is no abnormality in the information restored by user device B using the random number with the number, then the information received by user device B is the information from user device A that shares the second random number via TTP 300 and has not been tampered with. Thus, user authentication and message authentication can be achieved simultaneously at any time.

[0273] However,

[31] (1) a1 becomes a1=(S1-K) / x0, so if x0=1 is set or 1 / x0 is sent to the calculation unit 12B, there is no division operation, which can improve the processing efficiency.

[0274] However, similar to the case of the Fanum cipher, the first or second random number can only be used once. This is because when K is made public, a1 can be calculated from S2, and then S1, which is the value of the random number used, can be known. Therefore, if S1 is used multiple times, an attacker can also use it to tamper with it. Thus, if S1 is not used multiple times, K can be made public.

[0275] Furthermore, since the structure of the second dispersion value becomes more complex, making it more difficult to tamper with, the number of times the first dispersion value is sent can also be increased.

[0276] User device A (i.e., sender device 302) includes: a random number calculation unit that uses a necessary number of random numbers from the first sender random numbers as a first dispersion value, and calculates a random number of times a coefficient other than the constant term used as the first dispersion value, based on the first dispersion value and secret information possessed by the sender device; and a dispersion value calculation unit that uses the secret information possessed by the sender device, the random numbers, and a random number of times the random number is set as a coefficient to calculate a second dispersion value. Communication unit 16 transmits the second dispersion value to user device B (i.e., receiver device 304).

[0277] Specifically, in the [certificate issuance process] described above, although n=k=2, if n=k=3 for example, the random number calculation unit uses k-1 random numbers (two in this case) starting from the first random number (the first sender's random number), and sets them as S1 and S2 as follows. These are then solved to obtain a1 and a2 (S1, S2, K, x0, and x1 are determined). The dispersion value calculation unit uses a1 and a2 to obtain S3 as follows (in this case, S3 is the second dispersion value; where x1 is set as a constant, and x2 is determined by the first random number and shared with user device B).

[0278] S1=K+a1x0+a2x0 2

[0279] S2=K+a1x1+a2x1 2

[0280] S3=K+a1x2+a2x2 2

[0281] In this case, since n=k=3, even if K is disclosed, a1 and a2 will not be leaked from S3, and security is improved because the value of the random number used is unknown. In this case, S1 and S2 are referred to as the first dispersion value.

[0282] Alternatively, it can be configured as follows: User device A will generate fewer than k-1 random numbers (one in this case) starting from the first random number and set them as S1. User device A will generate a new random number that is different from the sent random number and set it as a1. Based on S1, a2 will be calculated (S1, K, a1, and x0 are determined). This will be used to calculate S2 and S3 and then sent to user device B.

[0283] User device B (i.e., receiver device 304) includes a recovery unit that recovers the secret information based on the second dispersion value sent from user device A (i.e., sender device 302), the first dispersion value sent from TTP 300 (i.e., a reliable third-party device), and the number of times the random number used in the second dispersion value is set as a coefficient. Specifically, the recovery unit of user device B calculates K based on S1 obtained from TTP 300 and S2 and S3 sent from user device A. This allows for a more complex structure of the dispersion value and reduces the number of random numbers used from TTP 300. In this case, S2 and S3 are referred to as the second dispersion value.

[0284] <Sixth Implementation Form>

[0285] In the second embodiment, an application example of the TUS method when the number of users is limited to one is shown. In the sixth and seventh embodiments, application examples of the TUS method when the number of users is limited to two are shown. Therefore, this embodiment does not use TTP or Fenum ciphers, such as... Figure 14 As shown, it includes a prover device 402 and a verifier device 404. The prover device 402 and the verifier device 404 are... Figure 1A The covert distribution device 100 shown also includes a covert distribution unit, a storage unit, and a communication unit. Other embodiments of the server also have the same structure.

[0286] The prover device 402 is an example of a "verification request device" of the technology disclosed herein.

[0287] In this embodiment, the following personal authentication is achieved by using secret distribution: In order to prove that the certifier device 402 is the person who registered authentication information such as password in the verifier device 404, it secretly sends information to the verifier device 404, which is the registration destination, indicating that it is the person who knows the authentication information, so that the verifier device 404 can perform authentication without concealing the information.

[0288] For simplicity, the prover device 402 and the verifier device 404 are configured with the same structure as the secret distribution device 100 in the third embodiment. In the case of self-authentication, the following explanation is provided: n=k=2, the key (equivalent to the cipher key) and x0 (random number) (equivalent to the server ID) are pre-defined between the prover device 402 and the verifier device 404 and set in the setting control unit 12A. Furthermore, i represents the number of times, initially set to i=1 and already registered. The following indicates the i-th processing.

[0289] [My authentication order]

[0290]

[41] The proof-prover device 402 generates a random array for conversion (1 / e) i，0 , [e i ]0), (1 / e i，1 , [e i ]1). The prover device 402 transmits the conversion random array (1 / e) via the communication unit 16. i，0 , [e i ]0) Send to the verifier device 404.

[0291] Verifier device 404 will (1 / e) i，0 , [e i ]0) Stored in storage unit 14.

[0292] The prover device 402 will use its own transformation with a random array (1 / e) i，1 , [e i 1) Stored in the storage unit 14 of the proof device 402.

[0293]

[42] The setting control unit 12A of the prover device 402 extracts a random number b. i Using the computing unit 12B to process b i (Key+i), [e i ]1 (Key+i) is calculated and sent to the verifier device 404 via the communication unit 16, and 1 / b i The calculations are performed and stored in the storage unit 14.

[0294] (Key+i) is an example of "information that combines authentication information with different information each time it is sent" in the technology disclosed herein.

[0295] b i (Key+i) is an example of a "modified transmission of information" of the technology disclosed herein.

[0296]

[43] The setting control unit 12A of the proof device 402 extracts a random number d. i Using the secret computing unit 18 to d i / b i d i / e i，1 The calculation is performed and transmitted to the verifier device 404 via the communication unit 16.

[0297] Additionally, the prover device 402 is updated to i = i + 1.

[0298]

[44] In the sent d i / b i =0、d i / e i，1 When the value is 0, the secret calculation unit 18 of the verifier device 404 does not authenticate as improper behavior (the random number used in the secret calculation does not use 0).

[0299]

[45] Verifier device 404 generates a random array (1 / f) for conversion. i，1 , [f i ]1), (1 / f i，0 , [f i ]0), and store it in the storage unit 14.

[0300]

[46] Verifier device 404 extracts a random number c i And the following content is calculated using the secret calculation unit 18.

[0301] (c) i d i ) / (f i b i =c i / f i ×d i / b i , (c) i d i ) / e i =c i / e i，0 ×d i / e i，1

[47] The verifier device 404 sends the registration information Key and i stored in the setting control unit 12A to the secret computing unit 18 to generate c. i d i [A]0's second half Key+i, and use the secret calculation unit 18 to calculate the following.

[0302] c i d i [A]0=b i (Key+i)×(c) i d i ) / (b i fi )×[f i ]0-(Key+i)×(c i d i ) / e i ×[e i ]0

[0303] c i d i [A]1=b i (Key+i)×(c) i d i ) / (b i f i )×[f i ]1-[e i ]1 (Key+i) × (c i d i ) / e i

[0304] The calculation (subtraction) performed by the secret calculation unit 18 is an example of the "secret subtraction operation" of the technology disclosed herein.

[0305]

[48] ​​The secret calculation unit 18 of the verifier device 404 restores d[A]0 and d[A]1. If it is 0, the verifier device 402 is certified. If it is not 0, it is rejected.

[0306] The secret computing unit 18 of the verifier device 404 is an example of the "verification unit" of the technology disclosed herein.

[0307]

[49] When the authentication is successful, the setting control unit 12A of the verifier device 404 updates i to i=i+1.

[0308] The process is as follows: Verifier device 404 subtracts the value sent by prover device 402 from the registered correct value. i (Key+i) to confirm whether the prover device 402 knows the correct value.

[0309]

[47] of c i d i The second half of [A]0, (Key+i), is generated using the registration information, and therefore will not be 0 if it differs from the first half sent.

[0310] In addition, if the communication includes

[41] to

[43] , then only one communication is needed.

[0311] In addition, although the Key can be set as a password, it can also be set as biometric information such as fingerprints or image information.

[0312] However, since different Key' and i' may accidentally become Key+i=Key'+i', if two different codes, Key and Key0, are set to perform the same processing, then Key+i and Key0+i will not be 0 at the same time.

[0313] Additionally, if the verifier device 404 returns a signal indicating the situation to the prover device in

[49] if the authentication is successful, the prover device 402 update i=i+1 in

[43] can also be performed after receiving the signal.

[0314] [Security Proof]

[0315] Assuming that the prover device 402 and the verifier device 404 do not engage in improper behavior and securely manage the registered information, etc., in this case, an attacker attempts to obtain the registration information represented by the Key from the information flowing through the communication path between the prover device 402 and the verifier device 404. If the attacker can obtain the information, the attack is considered successful. Therefore, the attacker obtains the following information in the i-th communication.

[0316] Ai = {(1 / e)} i，0 , [e i ]0), b i (Key+i), [e i ]1(Key+i)d i / b i d i / e i，1}

[0317] The variables other than Key and i are truly random numbers and are different each time; the combinations of these variables cannot be decomposed into individual values. However, b i (Key+i), [e i ]1 (Key+i) uses the same value twice. Comparing these values ​​yields b. i / [e i ]1, can also be combined with d i / b i Combining is possible, but it cannot be decomposed into individual values. Furthermore, since i is updated with i = i + 1, a retransmission attack is not possible, although this can be known from the aforementioned subtraction (bi - [e... i ]1)(Key+i), but since the next value is chosen independently, for example for b i+1 The calculation is performed using (Key+i+1), making impersonation impossible. Therefore, the attacker cannot obtain information from Ai, and the following holds true.

[0318] [Formula 17]

[0319] Therefore, according to this implementation, it can be said that information theory security has been achieved.

[0320] Additionally, if the validator device 404 is not expected to know the Key, the prover device 402 registers the following content with the validator device 404 in place of the Key.

[0321] [Formula 18]

[0322] In this case, in

[43] except for d1 / b i d1 / e i，1 In addition to performing calculations, the following are also calculated and sent to the verifier device 404.

[0323] [Formula 19]

[0324] In addition,

[47] as follows.

[0325] The verifier device 404 stores the registration information [Key]1d in the setting control unit 12A. 1，i Send to the secret computing department 18, and generate c based on the registration information. i d i [A]1's latter half of [Key]1d i，i The following content is calculated using the secret calculation unit 18.

[0326] [Formula 20]

[0327] In the above, [Formula 21]

[0328] The information is sent as separate pieces of information, therefore it cannot be separated. However, If [Equation 22]

[0329] Divide by

[0330] [Formula 23]

[0331] Then [e] can be obtained i ]1,e i Leakage, from ([Key]0xe i +i×[e i [0] can obtain [Key]0.

[0332] However, since [Key]1d1 is not exposed to the outside, the Key will not be leaked. Therefore, equation (8) holds, and information theory security can be maintained. To improve security, the 1 added to the initial i is set to a random number, or not only the server ID x0, but also x1 can be set to a secret random number.

[0333] <Seventh Implementation Form>

[0334] This embodiment is also an application example of the TUS method when the number of users is limited to two. Therefore, this embodiment does not use TTP or Fenum ciphers, such as... Figure 15 The diagram shows a first user device 502 for user A and a second device 504 for user B. In this embodiment, the first user device 502 and the second device 504 use a secret distribution method to communicate secret information from the first user device 502 to the second device 504 while maintaining information theory security. However, the first user device 502 and the second device 504 include the same secret distribution structure as in the third embodiment. The first user device 502 and the second device 504... Figure 1A The covert distribution device 100 shown also includes a covert distribution unit, a storage unit, and a communication unit. Other embodiments of the server have the same structure.

[0335] As a cryptosystem with information theory security, as mentioned above, the Fenham cipher is known. However, the Fenham cipher requires a large number of truly random numbers to be shared between the sending and receiving devices in advance, which is laborious.

[0336] In contrast, in this embodiment, secret information can be shared with less information sharing while maintaining information theory security. However, assuming n=k=2, and as follows, the second device 504 pre-sets ([e1]1, e 1，1 The form of d1) shares three random numbers with the first device 502.

[0337] [e1]1 is an example of the "first registration information" of the technology disclosed herein.

[0338] d1 is an example of the "second registration information" of the technology disclosed herein.

[0339] e 1，1 This is an example of "third registration information" of the disclosed technology.

[0340] The following shows the case of the i-th communication.

[0341] [Secret Branch 12: Concealment of Secret Information (for Secret Communication)]

[0342]

[51] The first user device 502 targets the secret information a i Random number b is taken from the true random number generator 10. i And send it to the computing unit 12B.

[0343]

[52] The computing unit 12B of the first user device 502 uses the transmitted b i Regarding secret information a i And for b i (a) i +1) to perform the calculation.

[0344]

[53] The computing unit 12B of the first user device 502 corresponds to b i Calculate using the reciprocal of 1 / b i Send to storage unit 14, and transmit b via communication unit 16 i (a) i +1) is sent to the second device 504.

[0345] [Covered Computing Unit 12B: Secret Communications]

[0346]

[61] The first user device 502 generates a random number e i From the provided [e1]1 and according to the following, r i Perform calculations and use them on [e] i ]0=e i +r i x0 performs calculations and sends the results to the second device 504.

[0347] [e1]1=e i +r i x1

[0348]

[62] The first user device 502, based on the shared d1, e 1，1 For d1 / b i e i，0 =(d1×e 1，1 ) / (b i ×e i The calculation is performed and sent to the second device 504.

[0349]

[63] The second device 504 retrieves a random number c from the true random number generation unit 10. i Using the secret computing unit 18 to target c i / e 1，1 Perform the calculations, and use random numbers to calculate the following deletions.

[0350] [Formula 24]

[0351]

[64] The secret calculation unit 18 of the second device 504 corresponds to the following [c] i d1(a) i +1)]0、[c i d1(a) i +1)]1 is used for calculation.

[0352] [Formula 25]

[0353] Use b i (a) i +1), (c) i d i ) / (b i e i ) and [e i The calculation of ]0 and [e1]1 is an example of the secret calculation described in the fourth invention of the fourteenth invention of the present disclosure.

[0354] [recovery]

[0355] The second device 504's calculation unit 12B corresponds to c. i d i (a) i +1) Perform restoration and obtain the secret information a of the first user device 502 based on the following: i .

[0356] [Formula 26]

[0357] b sent in

[53] i (a) i If a in +1) i If the integer is set to be positive, then it is not 0, therefore it can also be set to b. i a i In this case, it is not necessary to subtract 1 from [Restore].

[0358] [Security Proof]

[0359] Assuming that the first user device 502 and the second user device 504 do not engage in improper behavior and are unable to perform internal parsing, an attacker intends to obtain secret information from the information circulating in the communication path. If the attacker can obtain the information, the attack is considered successful. The attacker obtains the following content in the i-th communication.

[0360] Bi={b i (a) i +1), [e i ]0, d1 / b i e i，0}

[0361] In Bi, b i a i It is arbitrarily defined. Furthermore, the conversion uses a random array ([e1]1, 1 / e...). 1，1 ) is fixed, e i These are different true random numbers each time, which are then transformed into another random array ([e i ]0,1 / e i，0 ) Perform the calculation. In this case, if we set [e1]1=t, then it becomes the following.

[0362] t=e1+r1x1,[e1]0=e1+r1x0(9)

[0363] t=e2+r2x1, [e2]0=e2+r2x0 (10)

[0364] t=e3+r3x1,[e3]0=e3+r3x0(11)

[0365] According to equation (9), e1 = t - r1x1, therefore [e1]0 = t + r1(x0 - x1). According to equation (10), e2 = t - r2x1, therefore [e2]0 = t + r2(x0 - x1). According to equation (11), e3 = t - r3x1, therefore [e3]0 = t + r3(x0 - x1). Therefore, [e1]0-r1(x0-x1)=[e2]0-r2(x0-x1)=[e3]0-r3(x0-x1)···.

[0366] [e1]0, [e2]0, [e3]0, and (x0-x1) are known, therefore if an r i That is, an e i If leaked, then all e i It will be leaked. (In e) i It is a secret message. i In the case of an a i If it is made public, all the secret information will be leaked. However, e i This value, which is a combination with other random numbers and is deleted during the restoration process, will not be leaked from Bi. Furthermore, even if b is known... i a i The next bi+1 a i+1 It is also defined independently of these, and therefore is safe relative to known plaintext attacks, even if b is known. i e i It will not be from d1 / b i e i，0 Leakage. Therefore, in order to know e i It is necessary to know the e generated within the device of the first user device 502. i Or, they may know [e1]1 set in the first user device 502 or the second user device 504. However, even with a Fehnham cipher, if the random number set in the device is known, the secret information will be leaked. Therefore, if the shared ([e1]1, e 1，1 If d1 is not disclosed, then it can be said to be secure in information theory. Furthermore, d1 is also fixed, but because c... i b i e i，0 Each change occurs, therefore d1 is unknown. Therefore, if ([e1]1, e) is unknown... 1，1 ,d1), then the following can be said, therefore the secret information a of this embodiment can be said. i Communication can be conducted under conditions that ensure information theoretical security. However, [e1]1 and e can also be used. 1，1 Let [e1]0, e i，0 To perform the inverse operation.

[0367] [Formula 27]

[0368] Furthermore, if the shared ([e1]1, e) is unknown... 1，1 If x0 or x0, x1 can be used as a random number and combined with ([e1]1, e1), then the attacker will be unable to send the desired secret information. Additionally, to improve security, x0 or x0, x1 can also be used as a random number and combined with ([e1]1, e1)1, e1)1, e2)1, e3)1, e4)1), e5)1), e1)1), e1)1), e1)1)1)2)" 1) " 2)" 1)" 2)" 2 " 2'" " 2' d1)" " " d1) ...d1) "" d1) d1) d1) 1，1 ,d1) were also initially shared.

[0369] In addition, the three a's sent i Can be used as a new ([e1]1,e) 1，1 In this case, if the original ([e1]1, e) is unknown, 1，1 If d1), then the secret information will not be leaked from the information before the update.

[0370] Furthermore, in [Hidden Computing Unit 12B: Secret Communication], [e1]1 can be used as multiple first distributed values ​​in the fifth embodiment, and [e] i ]0 is a plurality of second dispersion values ​​in the fifth implementation form.

[0371] Furthermore, this embodiment can be said to be suitable for cryptographic communication of Internet of Things (IoT) devices. For example, in the case of cryptographic communication using Fehnham cipher, the IoT device needs to have a large number of truly random numbers in advance; if the random numbers are exhausted, cryptographic communication cannot be performed. In contrast, in this embodiment, if the first user device 502 is set as the IoT device and the second device 504 is set as the receiving device for receiving information from the IoT device, then if (d1, [e1]1, e) is initially set / shared in the IoT device, 1，1 Then, by sending the information in [Secret Information Concealment] 3, and sending [e1]0 and d0 / (b1e) in [Secret Calculation] 1 and 2. 1，0 Thus, even without using the Fenum cipher, theoretically secure cryptographic communication can be achieved later. However, if the first user device 502, as an IoT device, is deciphered, the secret information will be leaked, as is the case with the Fenum cipher. Furthermore, as mentioned above, if the attacker cannot send the desired secret information or is unaware of ([e1]1, e... 1，1 The case where the previous secret information is not leaked due to the value update is the same as that of the Finum cipher.

[0372] <Other Implementation Forms>

[0373] In this embodiment, the calculation / communication of input or distribution values ​​to the setting control unit 12A is performed only by authorized users. This can also be done on a mobile phone or PC with a device incorporating the technology disclosed herein.

[0374] Furthermore, the input secret information is securely managed through methods such as the second embodiment until it is input into the apparatus of the present disclosure. In the case of input from an external source, the secret information is transmitted using a Fenum cipher based on the fourth embodiment.

[0375] Furthermore, in the aforementioned embodiment, for the sake of simplicity, n=k=2 and so on have been fixed, but it is obvious that it can also be extended to other values.

[0376] Furthermore, if the external server is tampered with or the device of the technology disclosed herein is lost, the confidential information will be lost. Therefore, the external server or the device of the technology disclosed herein needs to be backed up regularly.

[0377] In addition, in order to detect tampering with the external server, b1(a1+1) is secretly distributed with n=k=2, for example, [b1(a1+1)]1 is stored together with b1(a1+1) on the external server, and [b1(a1+1)]0 is stored in the device of the technology disclosed herein. If the data is restored and consistent when used, it can be confirmed that it has not been tampered with.

[0378] Furthermore, the Shamir method was used in the described embodiment, but it is clear that it can also be achieved using the additive secret dispersion method.

[0379] Specific application examples (modifications) of the apparatus of this disclosure are shown below. Figures 16-19 .

[0380] Figure 16 The following scenario illustrates how, by inserting the secret distribution device 100 shown in the first embodiment into a mobile phone, an individual can secretly manage personal information such as blood pressure or blood sugar levels. A server managed by the individual or a hospital is used as server 110. Thus, personal information can be managed simply while maintaining information security. Furthermore, it is clearly not limited to blood pressure or blood sugar levels; money management or the management of daily information can also be performed using the device based on the technology disclosed herein while maintaining information security.

[0381] Figure 17 The following scenario illustrates a doctor (DC) inserting the secret distribution device 100 shown in the second embodiment into a PC to perform statistical processing on data from multiple patients under their care. Patient data is input by the doctor and processed as shown in the [Secret Distribution Unit 12: Concealment of Secret Information (Personal Use)] of the second embodiment, and securely stored. Statistical processing can be performed without restoring the concealed stored data via TUS. However, when statistical processing is performed using a device employing the technology disclosed herein for personal use, calculations can also be performed via [Secret Calculation Unit 18: Personal Use]. However, when using data from other doctors, secret calculations for multiple users as shown in the third embodiment can be performed. In the case of repeated calculations, the obtained calculation results are not restored; calculations can be performed by repeating the calculations. Furthermore, this is clearly not limited to medical data, but also applicable to internal data of companies, etc.

[0382] Figure 18 The following scenario illustrates how, using the fourth embodiment to share a random array for conversion, data comparisons or statistical calculations can be performed between organizations 600A and 600D without disclosing their internal data through the third embodiment. Each organization 600A to 600D inserts the secret distribution device 100 into a PC with which they communicate, sharing the random array for conversion shown in the fourth embodiment. Subsequently, the distribution value of the calculation result obtained via the communication unit 16 in the third embodiment is executed. If this value is restored in each organization 600A to 600D, the same result is shared. Furthermore, communication between each 600A to 600D can be securely performed using the Fenham cipher shown in the fourth embodiment.

[0383] Figure 19 This indicates the use of the sixth embodiment for self-authentication. According to this embodiment, self-authentication can also be achieved without TTP while maintaining information theory security.

[0384] Figure 20 This refers to the case of data collection from IoT devices using the seventh embodiment. It can also be implemented without TTP while maintaining information theory security.

[0385] Furthermore, according to the fifth implementation, user authentication and message authentication are also implemented simultaneously while maintaining information theory security. However, this requires a TTP (Transactions Per Transaction).

[0386] <Variation Example>

[0387] (A variation of the third implementation)

[0388] As described above, the third embodiment illustrates a scenario where multiple users jointly perform secret computation using their respective secret information. However, the fourth embodiment, described later, distributes a conversion random array to the participants in the secret computation, including those using the technology of this disclosure, beforehand. This invention is not limited to this. The seventh embodiment or variations thereof, described later, may also be used beforehand to distribute the conversion random array to the participants in the secret computation, including those using the technology of this disclosure.

[0389] As described above, in the simplified version of [Secret Computation Unit 18: Multi-user] and [Secret Distribution Unit 12: Restore] where n=k=3 is set in step 78 to reduce computational complexity, in the presence of a restorer, the Fenham cipher based on the fourth embodiment (details will be described later) is used for concealed transmission. The present invention is not limited to this. In the presence of a restorer, the Fenham cipher based on the seventh embodiment or a variant of the seventh embodiment described later (details will be described later) can also be used for concealed transmission.

[0390] As described above, in the third embodiment, in section 5 of [Secret Distribution Unit 12: Concealment of Secret Information (for Multiple Users)], a conversion random array for group g is transmitted via TTP according to the fourth embodiment. The present invention is not limited thereto. The conversion random array for group g can also be transmitted via TTP according to the seventh embodiment or a variation thereof described later.

[0391] As described above, in the third embodiment, in step 2 of [Secret Calculation Unit 18: Multi-user], a random number chip for deletion is calculated and sent to the user device S0. The present invention is not limited to this. Furthermore, the device for sending the random number chip for deletion is not limited to the user device S0; value exchange is also possible.

[0392] (A variation of the sixth implementation form)

[0393] As described above, in the sixth embodiment, the prover device 402 and the verifier device 404 are... Figure 1A The secret distribution device 100 shown also includes a secret distribution unit, a storage unit, and a communication unit, etc. The present invention is not limited thereto. The prover device 402 and the verifier device 404 can also be used with... Figure 10 The secret distribution device 100 shown also includes a secret distribution unit, a storage unit, a secret computing unit, and a communication unit.

[0394] As described above, in the sixth embodiment, in

[48] of [personal authentication order], the secret calculation unit 18 of the verifier device 404 restores d[A]0 and d[A]1. If the result is 0, the verifier device 402 is authenticated; if it is not 0, it is rejected. 0 is a value indicating consistency. Here, 0 is a value indicating consistency.

[0395] As described above, in the sixth embodiment, [the order of personal authentication]

[47] of c i d i The latter half of [A]0, (Key+i), is generated using registration information, and therefore will not be 0 if it differs from the first half sent. It will not be 0 and therefore inconsistent if it differs from the first half sent.

[0396] As described above, in the sixth embodiment, Key is set as a password, but it can also be set as biometric information such as fingerprints or image information. However, since different Key' and i' may accidentally become Key+i=Key'+i', if two different passwords, namely Key and Key0, are set and the same processing is performed, Key+i and Key0+i will not both be 0. In this case, Key and i can also be concatenated as Key|i (| indicates concatenation), and the processing to prevent accidental consistency is not limited to these. In addition, the verifier device generates a random array for conversion (1 / f i，1 , [f i ]1), (1 / f i，0 , [f i ]0) or c i However, it can also be set to f. i，1 =f i，1 =c i =1 and omit the related processing.

[0397] As described above, in the sixth embodiment, a process is specified in which the verifier device 404 is not expected to know the Key. The present invention is not limited thereto. In this case,

[42] to

[47] may also be as follows.

[0398]

[42] The setting control unit 12A of the prover device 402 extracts a random number b. i Using the computing unit 12B to process b i (Key+i) is calculated and sent to the verifier device 404 via the communication unit 16, and 1 / b is also calculated. i The calculations are performed and stored in the storage unit 14.

[0399] (Key+i) is an example of "information that combines authentication information with different information each time it is sent" in the technology disclosed herein.

[0400] b i (Key+i) is an example of a "modified transmission of information" of the technology disclosed herein.

[0401]

[43] The setting control unit 12A of the proof device 402 extracts a random number d. i ', and set it as d i =d i '+d1, the following content is calculated using the secret calculation unit 18 and sent to the verifier device 404 via the communication unit 16. Additionally, the verifier device 402 is updated to i=i+1.

[0402] d i / b i [Key]1d i ',d i ([Key]0+i×1 / e) i ×[e i ]0), (d i / e i ×[e i ]1)

[0403]

[44] The secret computing unit 18 of the verifier device 404 is in [Key] 1d i If all values ​​sent except for ' are 0, it is not considered an improper act (the random number used in secret computation does not use 0).

[0404]

[45] The verifier device 404 stores the registration information [Key]1d in the setting control unit 12A. 1，i Send to the secret calculation unit 18, and use the secret calculation unit 18 to calculate the following.

[0405] d i [A]0=b i (Key+i)×d i / b i -d i ([Key]0+i×1 / e) i ×[ei ]0)

[0406] d i [A]1=b i (Key+i)×d i / b i -([Key]1d1+[Key]1d i ')+i×(d i / e i ×[e i ]1)

[0407] The calculation (subtraction operation) performed by the secret calculation unit 18 is an example of the "secret subtraction operation" of the technology disclosed herein.

[0408]

[46]

[47] are omitted.

[0409] In the above, due to d i ([Key]0+i×1 / e) i ×[e i ]0), (d i / e i ×[e i ]1) The information is sent as one piece by one, so it cannot be decomposed. Therefore, equation (8) holds, which can maintain the security of information theory. In order to improve security, the 1 added to the initial i is used as a random number, or not only the server ID x0, but also x1 can be used as a secret random number.

[0410] (A variation of the seventh implementation)

[0411] As described above, in the seventh embodiment, the first user device 502 and the second device 504 are... Figure 1A The secret distribution device 100 shown also includes a secret distribution unit, a storage unit, and a communication unit, etc. The present invention is not limited thereto. The first user device 502 and the second device 504 and... Figure 10 The secret distribution device 100 shown also includes a secret distribution unit, a storage unit, a secret computing unit, and a communication unit, etc., and the server in other embodiments may also have the same structure.

[0412] As mentioned above, Phenomenon ciphers are known as a type of cryptography with information theory security. However, Phenomenon ciphers require a large number of truly random numbers to be shared beforehand between the sending and receiving devices, which is labor-intensive. In contrast, in the seventh embodiment, secret information can be shared with information theory security with relatively little information sharing.

[0413] In the seventh embodiment, [e1]1 is an example of the "first registration information" of the present disclosure, d1 is an example of the "second registration information" of the present disclosure, and e 1，1 This is an example of "third registration information" in the technology disclosed herein. Alternatively, ([e1]1, e 1，1 d1) is the fifth random number registered.

[0414] In the seventh implementation, in [Secret Distribution Unit 12: Concealment of Secret Information (for Secret Communication)]

[52] , b i It is the sixth random number used to conceal secret information.

[0415] In the seventh implementation, e in [Secret Distribution Unit 12: Concealment of Secret Information (for Secret Communication)]

[62] i It is used to generate random numbers c for deletion. i d1 / b i e i The seventh random number.

[0416] In the seventh implementation, if the shared ([e1]1, e) is unknown... 1，1 If x0 or x0, x1 can be used as a random number and combined with ([e1]1, e1), then the attacker will be unable to send the desired secret information. Additionally, to improve security, x0 or x0, x1 can also be used as a random number and combined with ([e1]1, e1)1, e1)1, e1)1, e2)1), e3)1), e1)1), e1)1), e1)1)1)2)" d1) 1，1 d1) was also initially shared. Additionally, the three a's sent... i Can be used as a new ([e1]1,e) 1，1 In this case, if the original ([e1]1, e) is unknown, 1，1 If d1), then the secret information will not be leaked from the information before the update.

[0417] However, it can also be set to d1=c1=1. In this case, what is shared is ([e1]1, e 1，1 ).

Claims

1. A secret dispersion device, comprising: The true random number generation unit generates true random numbers; and The calculation unit secretly distributes the value obtained by multiplying k (k>1) true random numbers from the true random number generation unit, sets one of the k true random numbers as the first random number, calculates its reciprocal, and combines the reciprocal with one of the secretly distributed values ​​to calculate the conversion of the k groups using a random array.

2. A secret dispersion device, comprising: The true random number generation unit generates true random numbers; and The calculation unit performs a secret calculation on the secret information by adding the secret information to a constant or random number, which is determined by the range of the secret information and the calculation result of the secret calculation, including 0, and multiplies the addition value with a true random number from the true random number generation unit as a second random number, thereby performing a secret calculation on the secret information.

3. The secret dispersion device according to claim 2, wherein, The calculation unit calculates the reciprocal of the second random number. The secret dispersion device also has a storage unit for storing the reciprocal of the second random number.

4. The secret distribution device according to claim 2 further comprises a secret calculation unit, which performs secret calculation using a deletion random number obtained by multiplying a deletion random number slice used to delete the second random number in the secret information, the distribution value according to claim 1, and the secret information after secret calculation, without performing a division operation, wherein the deletion random number slice used to delete the second random number in the secret information is obtained by multiplying the reciprocal of the first random number according to claim 1 or the reciprocal of the first random number provided from an external source, a third random number obtained from the true random number generation unit, and the reciprocal of the second random number.

5. A support device for supporting a sender device and a receiver device engaged in cryptographic communication, comprising: The true random number generation unit generates true random numbers. The storage unit stores the true random numbers generated by the true random number generation unit that are sent and stored in the sender device as a first sender random number group, and stores the true random numbers that are sent and stored in the receiver device that are different from the first sender random number group as a first receiver random number group. The secret calculation unit performs secret calculations on the second random number group using the first sender random number group and on the second random number group using the first receiver random number group. The second random number group is a true random number generated by the true random number generation unit and used by the sender device and the receiver device for cryptographic communication. as well as The communication unit sends the second random number group, which is secretly calculated using the first sender's random number group, to the sender device, and also sends the second random number group, which is secretly calculated using the first receiver's random number group, to the receiver device.

6. The support device according to claim 5, wherein, The storage unit stores the first user random number set to be stored by each of the multiple user devices participating in secret computation based on secret distribution. The support device also includes: The support value calculation unit calculates the support values ​​required by each of the user devices participating in the secret calculation; and The secret calculation unit secretly calculates the calculated support value using the first user random number group of each of the plurality of user devices. The communication unit sends the secretly calculated support value to each of the plurality of user devices.

7. The support device according to claim 6, wherein, The support value calculation unit sets each of the k true random numbers as k first random numbers, calculates the reciprocal of the k first random numbers, and combines each of the reciprocals of the k first random numbers with each of the distributed values ​​obtained by secretly dispersing the multiplication operation values ​​of the k first random numbers. Then, it calculates the k groups of transformations using a random array to obtain the support value.

8. The support device according to claim 6, comprising: The secret dispersion unit, after storing the first user random number group to be stored by each of the plurality of user devices in the storage unit, performs a multiplication operation on the two true random numbers obtained from the true random number generation unit, thereby calculating the multiplication operation value, and calculates the k dispersion values ​​of the three groups based on each of the two true random numbers and the multiplication operation value. The constitutive part constitutes a multiplicative triplet formed by combining each of the three groups of dispersed values; as well as The secret computation unit performs secret computation on the multiplication triples using the first user random number from each of the plurality of user devices. The communication unit will send the information obtained as a result of the secret calculation to each of the plurality of user devices.

9. The support device according to claim 6, comprising an identification code attachment section, The identification code appending unit appends an identification code to the first user random number group of each of the plurality of user devices, so as to know the usage status of the first user random number group of each of the plurality of user devices. The communication unit will send the information obtained as a result of the secret calculation, along with the identification code, to each of the plurality of user devices.

10. A user equipment, comprising: The receiving unit receives information obtained as a result of the secret calculation and the identification code from the support device according to claim 9; as well as The secret decryption unit uses a first user random number with the attached identification code to decrypt the information obtained as a result of the secret calculation.

11. A transmitter device, characterized in that... have: The random number calculation unit sets a required number of random numbers from the first sender random number group or the second sender random number group according to claim 5 as a first dispersion value group, and calculates random numbers that are used as coefficients of the number of times other than the constant term of the first dispersion value group based on the first dispersion value group and the secret information possessed by the sender device. The dispersion value calculation unit calculates the second dispersion value group using the secret information possessed by the sender device, the random number, and the random number as the number of times the random number is set as a coefficient; as well as The communication unit sends the second distributed value group to the receiving device.

12. A receiver device, comprising a recovery section, The restoration unit restores the secret information based on the required number of random numbers from the second dispersion value group sent from the sender device according to claim 11, the first sender random number group or the second sender random number group sent from the support device according to claim 5, i.e., the first dispersion value group, and the number of times the random number used in the second dispersion value group is set as a coefficient.

13. A verification request device, for requesting verification that one is the person registered with authentication information in a verifier device, characterized in that... include: The deformation section deforms the transmitted information in a manner that can be verified using secret computation. The transmitted information is a transmitted information after secret computation of information composed of authentication information registered in the verifier device and information that is different each time it is transmitted. as well as The sending unit transmits the modified transmission information to the verifier device. The modified sending information is modified such that the result of the secret subtraction operation is a value indicating consistency only when the registered authentication information, the information that is different each time it is sent, and the modified sending information are consistent through a secret subtraction operation based on secret dispersion.

14. A verifier device for registering authentication information according to claim 13, comprising: The receiving unit receives the modified transmitted information; as well as The verification unit performs the secret subtraction operation according to claim 13 on the registered authentication information, the different information sent each time, and the modified sent information in the received sent information, and verifies whether the result of the secret subtraction operation is a consistent value.

15. A transmitting device for transmitting secret information of the device to a receiving device, comprising: The sharing unit shares a portion of multiple random numbers from the true random number generation unit as a fifth random number with the receiving device; as well as The transmitting unit performs a secret calculation on the secret information by multiplying the secret information with a sixth random number from the true random number generation unit and sends the result to the receiving device. It also sends a deletion random number, which is a deletion of the sixth random number based on a seventh random number generated from the true random number generation unit and a registered fifth random number, to the receiving device.

16. A covert dispersion device, comprising: The computing unit performs secret calculations on the secret information by multiplying the secret information with a truly random number from the truly random number generation unit. Based on the first dispersion value group, which serves as the first registration information, and the fourth random number from the true random number generator, random numbers are calculated for coefficients other than the constant term used in the first dispersion value group. The second dispersion value group is calculated using the fourth random number and the calculated random number. The following deletion random number is used: a deletion random number obtained by multiplying the product of the second registration information and the third registration information and the reciprocal of the product of the fourth random number and the true random number; a first dispersion value and a second dispersion value; and the secret information after secret calculation are used for secret calculation without performing division. The communication unit transmits the values ​​calculated by the calculation unit.

17. A secret distribution program that causes a computer to perform the following processing: The value obtained by multiplying k (k>1) truly random numbers from the truly random number generator is secretly distributed. One of the k truly random numbers is set as the first random number, and its reciprocal is calculated. The reciprocal is combined with one of the dispersion values ​​after the secret dispersion to calculate the transformation of k groups using a random array.

18. A secret distribution program that causes a computer to perform the following processing: The secret information is added to a constant or random number, which includes 0 and is determined by the range of the calculation result from the secret information and the secret calculation. A true random number from the true random number generator is used as a second random number and multiplied with the addition value to perform a secret calculation on the secret information.

19. The secret distribution procedure according to claim 18, wherein, The process also includes: Calculate the reciprocal of the second random number; and The reciprocal of the second random number is stored in the storage unit.

20. The secret distribution procedure according to claim 17, wherein, The process also includes: Secret calculation is performed without performing division operations using the deletion random number obtained by multiplying the deletion random number slice used to delete the second random number in the secret information, the dispersion value according to claim 16, and the secret information after secret calculation. The deletion random number slice used to delete the second random number in the secret information is obtained by multiplying the reciprocal of the first random number according to claim 17 or the reciprocal of the first random number provided from an external source, the third random number obtained from the true random number generation unit, and the reciprocal of the second random number.

21. A support program for enabling a computer to perform processing that supports a sender device and a receiver device engaged in cryptographic communication with each other. The process includes: The true random numbers generated by the true random number generation unit of the sender device and sent to and stored in the sender device are stored as a first sender random number group, and the true random numbers that are sent to and stored in the receiver device and are different from the first sender random number group are stored as a first receiver random number group in the storage unit. The first sender random number group is used to secretly calculate the second random number group, and the first receiver random number group is used to secretly calculate the second random number group. The second random number group is a true random number generated by the true random number generation unit and used by the sender device and the receiver device for cryptographic communication. as well as The second random number group, which is secretly calculated using the first sender's random number group, is sent to the sender device via the communication unit, and the second random number group, which is secretly calculated using the first receiver's random number group, is sent to the receiver device via the communication unit.

22. The support procedure according to claim 21, wherein, The process also includes: In the storage unit, a first set of user random numbers to be stored for each of the multiple user devices participating in the secret computation based on secret distribution is stored. The required support values ​​for each of the user devices participating in the secret calculation are calculated. The calculated support value is secretly calculated using the first user random number group of each of the plurality of user devices; and The secretly calculated support value is sent to each of the plurality of user devices via the communication unit.

23. The support procedure according to claim 22, wherein, The support value is calculated as follows: each of the k true random numbers is set as a k first random number, and the reciprocal of the k first random numbers is calculated. Each of the reciprocals of the k first random numbers and each of the dispersed values ​​obtained by secretly dispersing the multiplication operation value of the k first random numbers are combined into one. Then, the transformation of the k groups is calculated using a random array to serve as the support value.

24. The support procedure according to claim 22, wherein, The process also includes: After storing the first user random number group to be stored for each of the plurality of user devices in the storage unit, a multiplication operation is performed on the two true random numbers obtained from the true random number generation unit, thereby calculating the multiplication value, and calculating the k dispersion values ​​of the three groups based on each of the two true random numbers and the multiplication value. This constitutes a multiplicative triplet, which is formed by combining one of the three groups of dispersed values. Secret computation is performed on the multiplication triple using the first user random number from each of the plurality of user devices; and The information obtained as a result of the secret calculation is transmitted to each of the plurality of user devices via the communication unit.

25. The support procedure according to claim 22, wherein, The process also includes: An identification code is appended to the first user random number of each of the plurality of user devices to know the usage status of the first user random number of each of the plurality of user devices; and The information obtained as a result of the secret calculation, along with the identification code, is transmitted to each of the plurality of user devices via the communication unit.

26. A user device program that causes a computer to perform the following processes, The process includes: Receive the information obtained as a result of the secret calculation and the identification code sent by the processing of the support program according to claim 25; as well as The information obtained as a result of the secret calculation is decrypted using the first user random number with the attached identification code.

27. A sender program that causes a computer to perform the following processing: The process includes: The desired number of random numbers in the first sender random number group or the second sender random number group according to claim 21 is set as the first dispersion value group. Based on the first dispersion value group and the secret information possessed by the sender device, random numbers that are used as coefficients of the number of times other than the constant term of the first dispersion value group are calculated. The second dispersion value group is calculated using the secret information possessed by the sender device, the random number, and the random number as the number of times the random number is set as a coefficient; as well as The second set of dispersed values ​​is sent to the receiving device.

28. A receiver program that causes a computer to perform processing including the following: The secret information is restored based on the second dispersion value group according to claim 26 sent from the sender device, the first sender random number group or the second sender random number group in the processing of the support program according to claim 20, the required number of random numbers, i.e., the first dispersion value group, and the number of times the random numbers used in the second dispersion value group are set as coefficients.

29. A verification request procedure, wherein a computer executes a verification request procedure to verify that it is the person for whom authentication information is registered in a verifier device, wherein... The process includes: The transmitted information is modified in a manner verifiable using secret computation, wherein the transmitted information is a transmitted information resulting from the secret computation of information combining authentication information registered in the verifier device with information different each time it is transmitted; and The modified message is sent to the verifier device. The modified sending information is modified such that the result of the secret subtraction operation is 0 only when the registered authentication information, the information that is different each time it is sent, and the modified sending information are consistent through a secret subtraction operation based on secret dispersion.

30. A validator program for causing a computer to perform the verification process according to claim 29, wherein, The process includes: Receive the modified transmitted information; and The received sending information includes the registered authentication information, the information different each time it is sent, and the modified sending information. The secret subtraction operation according to claim 28 is then performed, and the result of the secret subtraction operation is verified to be 0.

31. A transmitting program, for causing a computer to execute a process of transmitting secret information to a receiving device, wherein, The process includes: A portion of the multiple random numbers from the true random number generator is shared with the receiving device as a fifth random number; and A secret calculation is performed on the secret information by multiplying it with a sixth random number from the true random number generation unit, and the result is sent to the receiving device. A deletion random number, which is a deletion of the sixth random number based on a seventh random number generated from the true random number generation unit and a registered fifth random number, is also sent to the receiving device.

32. A secret distribution program that causes a computer to perform the following processes: The process includes: Secret calculations are performed on the secret information by multiplying it with a truly random number from a truly random number generator. Based on the first dispersion value group, which serves as the first registration information, and the fourth random number from the true random number generation unit, a random number is calculated for the coefficient of the number other than the constant term used in the first dispersion value group. The second dispersion value group is calculated using the fourth random number and the calculated random number. The following deletion random number is used: a deletion random number obtained by multiplying the product of the second registration information and the third registration information and the reciprocal of the product of the fourth random number and the true random number; a first dispersion value and a second dispersion value; and the secret information after secret calculation are used for secret calculation without performing division. The calculated value is transmitted via the communications unit.

33. A covert dispersion device, comprising: The true random number generation department uses natural phenomena that cannot be controlled by humans to generate true random numbers; as well as The secret dispersion unit directly obtains multiple truly random numbers from the truly random number generation unit. Using one or more of these truly random numbers and based on a secret message, it calculates n dispersion values. If k (n ≥ k > 1) of the calculated n dispersion values ​​are collected, the secret message can be restored; otherwise, the secret message cannot be restored if there are fewer than k-1 dispersion values. The true random number generator and the secret distribution unit are constructed on a semiconductor.

Images