Asymmetric secret sharing apparatus and asymmetric secret sharing program

Abstract

An asymmetric secret sharing device is a device for asymmetric secret sharing in a system in which n is set to an integer of 2 or more, k is set to an integer of 2 or more and n or less, one secret information is shared into n shared values, and the secret information can be restored as long as k or more shared values are collected, and cannot be restored if k-1 or less shared values are collected, characterized by comprising: a calculation section that, in the case of n=k, is set to k≧3, 1≦t≦k-2, and calculates u=n-t shared values from k-t-1 true random numbers, t pseudo random numbers, and one secret information.

Description

Technical Field

[0001] The technology disclosed herein relates to an asymmetric secret distribution device, a secret information recovery device, an asymmetric secret distribution program, and a secret information recovery program. Background Technology

[0002] In recent years, cloud computing has gained attention as a new network technology. Cloud computing is a technology that distributes and stores user-held data across multiple virtual, high-capacity storage devices on a network called the cloud. Users can access this data from anywhere on the network as needed. However, for security reasons, it is desirable to encrypt information stored in the cloud. Furthermore, there is a desire not only to encrypt and store data but also to perform covert computation using the data distributed and stored in the cloud—that is, to perform various processing tasks while keeping the data anonymous. Moreover, with the increasing prevalence of Internet of Things (IoT) devices in recent years, there is also a demand for security technologies that enable secure and covert communication of information from IoT devices.

[0003] To achieve this kind of concealed storage and computation, the use of secret distribution methods has attracted attention. The so-called secret distribution method is a technique characterized by converting a secret message into n (i.e., natural number) values ​​(hereinafter referred to as distribution values). By collecting k (i.e., natural number) of these distribution values ​​(k≦n), the original secret message can be recovered. No information related to the secret message can be obtained from fewer than k distribution values. Furthermore, Shamir's (k,n) threshold secret distribution method (hereinafter referred to as Shamir's method) and the additive secret distribution method, as described below, are well-known. Conventional secret distribution systems, including Shamir's method, include n data servers storing the distribution values, a distributor of the distributed secret message (i.e., a communication terminal), and a restorer of the recovered secret message (i.e., a communication terminal). That is, during distribution, the holder of the secret message becomes the distributor, or entrusts the distribution of the secret message to a distributor that only exists during secret distribution. The distributor performs secret distribution processing, calculates n distribution values, and distributes and stores these values ​​on n data servers respectively. On the other hand, restoration is the process by which the restorer collects k of the n dispersed values ​​and restores the original state.

[0004] The Charmilles method is carried out in the following manner.

[0005] [Chamirfa]

[0006] [dispersion]

[0007] 1. The distributor chooses any prime number p such that s (i.e., the secret information) < p and n < p.

[0008] 2. The distributor selects n distinct x from Z / pZ (i.e., the residual ring).i (i=1, 2, ..., n), which are published as server identification (ID) (i.e. sent to the restorer).

[0009] 3. The distributor selects k-1 random numbers a from Z / pZ. l (l=1, 2, ..., k-1), generating the following formula (hereinafter referred to as the distributed formula).

[0010] W i =s+a1x i +a2x i 2 +…+a k-1 x i k-1 (modp)(1)

[0011] 4. The distributor substitutes each server ID into x in equation (1). i Calculate the dispersion value W i and (x) i W i Distribute to each server.

[0012] [decoding]

[0013] 1. Set the scatter value used for decoding to W. i (i=1, 2, ..., k). Furthermore, the server ID corresponding to the aforementioned dispersion value is set to x. i (i=1, 2, ..., k).

[0014] 2. The restorer collects k (x) i W i ), x i With W i Substituting the equations into the scatter equations, we solve the k simultaneous equations to obtain s. When reconstructing s, it is convenient to use the Lagrange interpolation formula.

[0015] Furthermore, the additive secret dispersion method is as follows. The following explanation addresses the case where n=k.

[0016] [The Secret of Addition and Dispersion]

[0017] [dispersion]

[0018] 1. The distributor generates k-1 random numbers S1 to S2. k-1 .

[0019] 2. The distributor calculates the following for the secret information s.

[0020] Sk = s - S1 - ... - S k-1

[0021] 3. The distributor selects an identification code x for k servers. i (i=1, 2, ..., k), and S i Distributed as a distribution value to server x i .

[0022] [decoding]

[0023] 1. The restorer collects k S. i And calculate s = S1 + ... + Sk, and restore the secret information s.

[0024] With n=k+1, the distributor will... i S i+1 Distributed to server x i However, for convenience, Sk+1 will be regarded as S1.

[0025] However, a problem with secret distribution methods is that since one secret piece of information becomes n distributed values, the memory capacity (in other words, the server capacity) increases. To address this, a ramp-type secret distribution method, as shown in Non-Patent Document 1, is known, which divides the secret information into coefficients of 1 / L, which are then distributed. This allows for miniaturization of the distributed values, reducing memory capacity. Furthermore, a method called asymmetric secret distribution, as shown in Japanese Patent No. 6893708, has also been proposed. The asymmetric secret distribution method reduces memory capacity (number of servers) by reducing the number of distributed values ​​stored rather than their size. The following shows an asymmetric secret distribution method relative to the Charmille method (the asymmetric secret distribution method can also be adapted to additive secret distribution methods).

[0026] (Non-patent literature 1)

[0027] Hiroshi Yamamoto. “(k, L, n) Threshold Secret Distributed System”. Journal of the Electron Communications Society. Vol. J68-A, no. 9, pp. 945-952 (1985)

[0028] [Asymmetric Secret Dispersion Method]

[0029] From the n servers constituting the cloud system, select t (i.e., a natural number) servers (t < k) as key servers. These key servers do not store the distributed values, but only possess the keys used to generate pseudo-random numbers. Servers other than the key servers are called data servers; they store the distributed values ​​sent from users (i.e., communication terminals) acting as distributors. Furthermore, for r (i.e., a natural number) users distributing secret information, assign an ID[y] (y = 1, ..., r) to each user y to identify the user, and assign m secret information s1, ..., s2 to each user y. m Also assign dID[s] to each i(i=1, ..., m) are used to identify data. Furthermore, Enc(a, b) represents the process of encrypting a using a key called b. The following explains the case where user y becomes the distributor and performs asymmetric secret distribution.

[0030] [dispersion]

[0031] 1. User y sends its own ID[y] to key server x1, ..., key server x t .

[0032] 2. The key server receiving ID[y] uses its own cryptographic device and key. j (j=1, ..., t), generate Eid(y, j) according to equation (2) and send it to user y.

[0033] Eid(y,j)=Enc(ID[y],key j (j=1、…、t)(2)

[0034] 3. The user y who receives it uses a data identifier dID[s] associated with their own secret information. i (i=1, ..., m), generate pseudo-random numbers q according to equation (3). ij .

[0035] q ij =Enc(dID[s i ],Eid(y,j))(3)

[0036] 4. User y first uses true random numbers to determine the coefficient vector A(i) of the k-1 degree dispersion of equation (1) for each i. i a i1 ... a ik-1 ] T The partial vector A(i) of degree k-1-t in the equation. k-1-t =[a it+1 ... a ik-1 ] T Subsequently, the pseudo-random number sequence Q=[q] generated t times according to the sequence (3) is used. i1 , ..., q it ] T The following is calculated from the ID sequence of the key server.

[0037] [Formula 1]

[0038]

[0039] The remaining partial vectors A(i) are calculated for each i according to the following formula (4). t =[a i1... a it ] T .

[0040] [Formula 2]

[0041]

[0042] Here, in the above formula, if we set S=[s] i 、…、s i ] T ,but

[0043] A(i) k-1 =X' -1 (QS)(5)

[0044] Therefore, the user can determine the coefficient vector A(i) = [s] for all k-1 degree dispersions. i a i1 ... a ik-1 ] T .

[0045] 5. Furthermore, the user uses the coefficient matrix generated in sequence (4) to calculate the value of the data server x using the same sequence as the (k, n) threshold secret dispersion method (refer to the Charmille method [dispersion] 4). t+1 ..., data server x n The relevant dispersion value W it+1 ..., dispersion value W in .

[0046] 6. User y will generate the dispersion value W. 1j ..., dispersion value W mj (j=t+1, ...,n) are sent to each data server.

[0047] [recovery]

[0048] 1. Restore secret information s i Users from n servers x1, ..., x n Select any k servers and send the user y's ID[y] and secret information s to the selected servers. i Data Identifier dID[s i ].

[0049] 2. In the key server, receive (ID[y], dID[s]). i The key server uses the key it holds. j And a cryptographic device, generating Eid(y,j) according to equation (2), and generating a pseudo-random number q according to equation (3). ij And send it to the user.

[0050] 3. In the data server, receive (ID[y], dID[s]). i The data server will distribute the information W corresponding to these IDs. ij Send to the user.

[0051] 4. Users who receive the distributed information and pseudo-random numbers generated by the server use them and, in the same way as the (k,n) threshold secret distribution method, distribute the secret information s. i recovery.

[0052] The asymmetric secret distribution method, for example, in the case of t=k-1, generates t=k-1 q keys using t key servers using their own keys. ij (j=1, ..., t) are used as dispersion values, and a is calculated based on them and the secret information to satisfy equation (1). ij The coefficients (j=1, ..., k-1). When t < k-1, first determine k-1-t a's based on truly random numbers. ij (j=1, ..., k-1-t), find the remaining coefficients that satisfy equation (1), and calculate all a. ij If we assume the holder manages the key that the key server possesses... j In this case, a physical server, referred to as a key server, is not required. Therefore, the number of physical servers can be set to nt instead of n, thereby reducing the memory capacity (number of servers). In this scenario, the restoration of secret information has the following characteristic: it cannot be performed if there is no distributed value generated based on the key managed by the holder. Summary of the Invention

[0053] The problem that the invention aims to solve

[0054] In recent years, research on quantum computers has been progressing rapidly. If a quantum computer is realized, it is believed that it will be possible to easily analyze current cryptography that only possesses computational security. Furthermore, computational security refers to security that can be cracked by an attacker with the assumed computational power, while security that cannot be cracked even by an attacker with unlimited computational power due to insufficient information is called information theory security.

[0055] For example, in the asymmetric secret distribution method, for a secret message s1, the key server uses a cryptographic device to generate a pseudo-random number q. 1j Based on this, the dispersion value W stored on the data server is calculated. 1，t+1 ..., dispersion value W 1，n And save. It is known that the Charmille method or the ramp-type secret distribution method has information-theoretic security (however, the security of the ramp-type secret distribution method deteriorates in stages depending on the number of distribution values ​​collected), but the asymmetric secret distribution method depends on the generation of q. ijThe computational security of the cryptographic device is not information theory security. Therefore, the asymmetric secret distribution method is vulnerable to analysis by quantum computers. For example, in the case of n=k=2, based on q1 generated by the key server for the secret information s1, expressed in equation (6), W1 is calculated and sent to the data server via equation (7) as in equation (8). For simplicity, expressions such as j or (modp) are omitted. The following equation (6) is obtained from equation (4). In the case of n=k=2, equation (4) becomes q i1 =s1+x1a1, so if we transform it to a1=, it becomes equation (7). Moreover, the data server ID in equation (8) is x2, so as in 5 of the asymmetric secret distribution method, we use the obtained a1 for calculation. If we transform it similarly to a1=, we can obtain another equation of equation (7).

[0056] q1=s1+a1x1(6)

[0057] a1=(q1-s1) / x1=(W1-s1) / x2(7)

[0058] W1=s1+a1x2(8)

[0059] The values ​​of q1 and a1 in equations (6) and (7) are known only to the distributor, but the attacker knows W1 in equation (8) sent to the data server. Here, consider the case where the secret information s1, which is equivalent to a known-plaintext attack, is made public. In this case, the attacker can determine a1 (W1, x2 are known) according to equation (7) and know the value of q1 according to equation (6). For example, if dID[s1] is the public information, then q1 is the value obtained by encrypting dID[s1]. If multiple secret information s2, ..., s m If the key is made public, then it is possible to determine the encryption key using analysis methods such as quantum computers. j The possibility of this. If the key is determined, it will reveal secret information that could be used subsequently. m+1 q m+1 Therefore, even if it is not made public m+1 It will also be due to the W sent. m+1 With the determined q m+1 And leaking secret information m+1 .

[0060] In contrast, previous secret distribution methods designated a1 as a truly random number. Therefore, even if the secret information s1 is disclosed, the key will not be analyzed because the next s2 uses a different truly random number. Even if s2, ..., s1 are disclosed... m It can also maintain s m+1 Security.

[0061] Therefore, it is necessary to improve the security of asymmetric secret distribution methods to make the analysis of secret information more difficult.

[0062] The purpose of this disclosure is to provide an asymmetric secret distribution device, a secret information recovery device, an asymmetric secret distribution program, and a secret information recovery program that make the analysis of secret information more difficult than existing technologies.

[0063] Technical means to solve the problem

[0064] The first embodiment of the technology disclosed herein is an asymmetric secret distribution device, which is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values, but cannot be recovered if there are k-1 or fewer. The asymmetric secret distribution device is characterized by comprising: a generation unit that obtains one or more true random numbers as the first secret information, and generates t (< k) distributed values ​​for each true random number according to a first key; and a calculation unit that calculates nt distributed values ​​according to the t distributed values ​​and the first secret information.

[0065] The second embodiment is an asymmetric secret distribution device, which is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values, and the secret information cannot be recovered if there are k-1 or less of them. The asymmetric secret distribution device is characterized by including: a first concealment part, which conceals a true random number as the first secret information; and a second concealment part, which uses the first secret information to conceal the second secret information in a form different from the first secret information.

[0066] The third embodiment is a secret information restoration device in the system of the first embodiment, characterized in that it includes: a first restoration unit for restoring first secret information; and a second restoration unit for restoring second secret information of the second embodiment using the restored first secret information.

[0067] The fourth embodiment is a secret information recovery device, which is a secret information recovery device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is dispersed into n dispersed values, and the secret information can be recovered by collecting k dispersed values. If there are k-1 or less dispersed values, the secret information cannot be recovered. The secret information recovery device is characterized by including: a recovery unit, which sequentially changes and combines t dispersed values ​​and nt dispersed values ​​generated according to the key of the first embodiment to recover the secret information.

[0068] The fifth embodiment is an asymmetric secret distribution device, which is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values, but cannot be recovered if there are k-1 or less. The asymmetric secret distribution device includes: a first calculation unit, which calculates t (< k) distributed values ​​according to a key; and a second calculation unit, which calculates nt distributed values ​​according to the calculated t distributed values ​​and the secret information. The secret distribution device further includes: a true random number generation unit, which generates true random numbers using natural phenomena that cannot be controlled by humans, and at least one of the t distributed values ​​and the nt distributed values ​​is calculated using the true random numbers.

[0069] The asymmetric secret distribution procedure of the sixth embodiment enables the computer of the asymmetric secret distribution device to function as both a generation unit and a calculation unit. The asymmetric secret distribution device is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distribution values, and the secret information can be recovered by collecting k of the distribution values. If there are k-1 or fewer distribution values, the secret information cannot be recovered. The generation unit obtains one or more true random numbers as the first secret information, and generates t (< k) distribution values ​​for each true random number according to the first key. The calculation unit calculates nt distribution values ​​based on the t distribution values ​​and the first secret information.

[0070] The asymmetric secret distribution procedure of the seventh embodiment enables the computer of the asymmetric secret distribution device to function as the first concealment unit and the second concealment unit. The asymmetric secret distribution device is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values. If there are k-1 or fewer distributed values, the secret information cannot be recovered. The first concealment unit conceals a true random number as the first secret information, and the second concealment unit uses the first secret information to conceal the second secret information in a form different from the first secret information.

[0071] The secret information restoration procedure of the eighth embodiment enables the computer of the secret information restoration device in the system of the first embodiment to function as a first restoration unit and a second restoration unit. The first restoration unit restores the first secret information, and the second restoration unit uses the restored first secret information to restore the second secret information of the second embodiment.

[0072] The secret information recovery procedure of the ninth embodiment enables the computer of the secret information recovery device to function as the recovery unit. The secret information recovery device is a secret information recovery device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values. If there are k-1 or fewer distributed values, the secret information cannot be recovered. The recovery unit will restore the secret information by sequentially changing and combining the t distributed values ​​and nt distributed values ​​generated according to the key of the first embodiment.

[0073] The asymmetric secret distribution procedure of the tenth embodiment enables the computer of the asymmetric secret distribution device to function as both a generation unit and a calculation unit. The asymmetric secret distribution device is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret message is distributed into n distribution values, and the secret message can be recovered by collecting k of these distribution values; if there are k-1 or fewer distribution values, the secret message cannot be recovered. The generation unit generates t (< k) distribution values ​​based on the key, and the calculation unit calculates nt distribution values ​​based on the calculated t distribution values ​​and the secret message. The asymmetric secret distribution device further includes: a true random number generation unit that generates true random numbers using natural phenomena that cannot be controlled by humans, and at least one of the t distribution values ​​and the nt distribution values ​​is calculated using true random numbers.

[0074] The asymmetric secret distribution device of the eleventh embodiment is an asymmetric secret distribution device, which is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values. If there are k-1 or fewer distributed values, the secret information cannot be recovered. The asymmetric secret distribution device is characterized by including: a calculation unit, which sets k ≥ 3 and 1 ≤ t ≤ k-2 when n = k, and calculates u = nt distributed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret information.

[0075] The asymmetric secret distribution device of the twelfth embodiment is an asymmetric secret distribution device, which is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values. If there are k-1 or fewer distributed values, the secret information cannot be recovered. The asymmetric secret distribution device is characterized by including: a calculation unit, which is set to k ≥ 4 and k-2 ≥ t > n-k+1 when n > k, and calculates u = nt distributed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret information.

[0076] The thirteenth embodiment is an asymmetric secret distribution program used to enable the computer of the asymmetric secret distribution device to function as a computing unit. The asymmetric secret distribution device is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values. If there are k-1 or fewer distributed values, the secret information cannot be recovered. The computing unit is set to k ≥ 3 and 1 ≤ t ≤ k-2 when n = k, and calculates u = nt distributed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret information.

[0077] The fourteenth embodiment is an asymmetric secret distribution program used to enable the computer of the asymmetric secret distribution device to function as a computing unit. The asymmetric secret distribution device is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values. If there are fewer than k-1 distributed values, the secret information cannot be recovered. The computing unit is set to k ≥ 4 and k-2 ≥ t > n-k+1 when n > k, and calculates u = nt distributed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret information.

[0078] The effects of the invention

[0079] The technology disclosed herein can make the analysis of secret information more difficult by improving the security of asymmetric secret distribution methods. Attached Figure Description

[0080] [ Figure 1 [] is a block of the distribution and decoding system 10 of the first embodiment.

[0081] [ Figure 2 [] is the block diagram of holder 12R1.

[0082] [ Figure 3A [ ] is a flowchart of the distributed procedure 26P1 in the first embodiment.

[0083] [ Figure 3B [ ] is a diagram showing the processing of the first embodiment of the distribution section 22A.

[0084] [ Figure 4A [ ] is a flowchart of the restoration procedure 26P2 of the first embodiment.

[0085] [ Figure 4B [] is a diagram showing the processing of the first embodiment of the restoration section 22B.

[0086] [ Figure 5[ ] is a flowchart of the distribution procedure 26P1 in the second embodiment.

[0087] [ Figure 6 [ ] is a flowchart of the restoration procedure 26P2 of the second embodiment.

[0088] [ Figure 7 [ ] is a flowchart of the restoration procedure 26P2 of the fourth embodiment.

[0089] [ Figure 8 [ ] is a flowchart of the distribution procedure 26P1 in the fifth embodiment.

[0090] [ Figure 9 [ ] is a flowchart of the restoration procedure 26P2 of the fifth embodiment. Detailed Implementation

[0091] Hereinafter, an example of an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

[0092] <First Implementation>

[0093] The following describes a method for converting a dispersion value calculated using a computationally secure cryptography into a dispersion value with information theory security. First, for simplicity, let n=k=2, and provide an overview of this implementation.

[0094] [dispersion]

[0095] 1. The holder generates a non-zero true random number (true random number) r1 as the first secret information, and distributes the true random number r1 asymmetrically.

[0096] 2. The holder uses the key. 2j The generated pseudo-random number q1 plus r1 is used as the dispersion value to perform asymmetric secret dispersion of the second secret information s1.

[0097] [recovery]

[0098] 1. The restorer restores the first secret information r1.

[0099] 2. The restorer uses the key. 2j The generated pseudo-random number q1 plus r1 is used as the dispersion value to restore the second secret information s1.

[0100] In the above, a true random number r1 is used as the first secret information, and the holder's secret information s1 is used as the second secret information. The dispersion and restoration are carried out in two stages: r1 and s1. First, in the [dispersion]1 of the dispersion of r1, if a1 in the asymmetric secret dispersion is represented as ar1, q1 as qr1, and W1 as Wr1, then equation (7) can be written in the following form.

[0101] ar1=(qr1-r1) / x1=(Wr1-r1) / x2(9)

[0102] Here, the first secret information r1 is a truly random number. Therefore, ar1 becomes a form that uses the truly random number r1 to conceal the pseudo-random number qr1. Like the Vernam cipher, ar1 itself can be considered a truly random number, providing no information related to qr1. That is, the attacker also knows Wr1, x1, and x2, but for all values ​​of r1, the attacker can assume ar1, thus preventing the narrowing of the range of ar1's values ​​and the range of values ​​related to qr1. In other words, it possesses information theory security.

[0103] Therefore, Wr1 calculated using ar1 and r1 in equation (8) can also be considered a truly random number. Thus, attackers cannot infer the first secret information r1 or qr1 from the sent Wr1, and the information theory security can be considered valid. From another perspective, if the truly random number r1 is used as the coefficient of the linear term instead of the constant term, it becomes as follows.

[0104] qr1=a0+r1x1(10)

[0105] a0 = qr1 - r1x1 (11)

[0106] Wr1=a0+r1x2(12)

[0107] Equations (10) and (12) become the previous secret distribution form of concealing the secret information a0 represented by equation (11). According to equation (11), the secret information a0 includes the pseudo-random number qr1, which becomes the value concealed by the true random number r1x1. Moreover, according to equations (11) and (12), if a0 is regarded as a distribution value, it becomes the form of directly concealing the secret information qr1 by using equations (11) and (13) (x2 is regarded as x1-x2).

[0108] Wr1=qr1-r1(x1-x2)(13)

[0109] Therefore, it can be considered that in [Dispersion]1, as with previous secret dispersions, information theory security holds, and no information related to qr1 is provided (the first secret information can be used as a coefficient of a term of degree one or more, rather than a constant term). Furthermore, since Wr is independent of s1, the following holds even if Wr1 and s1 are known in [Dispersion]1. In addition, H(x) represents the amount of information or entropy related to x.

[0110] [Formula 3]

[0111]

[0112] Let y represent the conditional information related to x under the premise of knowing information y. Therefore, equation (14) means that even if Wr1 and s1 are known, the information related to qr1 remains unchanged. That is, it means that even if Wr1 obtained by the attacker based on [dispersion]1 is known, it is of no use for analyzing qr1, and it has information theoretical security.

[0113] [Formula 4]

[0114] H(qr1)=H(qr1|Wr1,s1) (14)

[0115] Subsequently, in the [distribution]2 of s1, based on the key... 2j The calculated q1 is hidden by the first secret information r1, which is a true random number, and like the Fornum cipher, it does not provide any information related to q1. That is, the dispersion value in [dispersion]2 becomes as in equations (15) and (17) via equation (16).

[0116] q1+r1=s1+a1x1(15)

[0117] a1={(q1+r1)-s1} / x1(16)

[0118] W1=s1+a1x2(17)

[0119] Here, since the first secret information r1 is a truly random number, a1 becomes a form that uses the truly random number r1 to conceal the pseudo-random number q1, and can be regarded as a truly random number like the Fornum cipher. Therefore, it can be considered that the equations (15) and (17) calculated using the aforementioned a1 have the same information theory security as previous secret distributions. That is, the attacker cannot infer the second secret information s1 or q1 from the sent W1, and can assume all s1 or q1.

[0120] Here, if the second secret information s1, ..., the second secret information s m If made public, then according to equation (17), a1, ..., a will be leaked. m However, it will not disclose the first secret information r1, ..., the first secret information rm Therefore, q1, ..., q will not be known. m Moreover, it can be assumed that although q1+r1 can be obtained according to equation (15), q1 will not be obtained. Therefore, equation (18) holds, and it can be assumed that [distributed]2 also has information theory security.

[0121] [Formula 5]

[0122] H(q1)=H(q1|W1,s1) (18)

[0123] Based on the above, it can be considered that the proposal method is effective even if an attacker obtains the communication path and all data server information W1, ..., information W... m The information is theoretically secure, and therefore even if the secret information s1, ..., secret information s is made public, it is still secure. m It will not be analyzed as a pseudo-random number, nor will the next secret information s be analyzed. m+1 It is just as safe as the previous secret distribution.

[0124] Next, the specific details of how the holder manages the key of the dummy key server will be explained.

[0125] Figure 1 This is a block of the distribution and decoding system 10 of the first embodiment. The distribution and decoding system 10 is a system in which n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distribution values, and the secret information can be recovered by collecting k of the distribution values, and the secret information cannot be recovered if there are k-1 or fewer distribution values.

[0126] The distributed decoding system 10 includes r (i.e., natural number) holders 12R1 to 12Rr and nt data servers 14Kt+1 to 14Kn. Holders 12R1 to 12Rr and data servers 14Kt+1 to 14Kn are connected to each other in a manner that enables them to communicate with each other via a network 16 (e.g., the Internet).

[0127] User y is referred to as the holder.

[0128] Data servers 14Kt+1 to 14Kn include a storage device 14M for storing their own IDs. For example, the storage device 14M of data server 14Kt+1 includes a storage device that stores xt+1 as the ID and stores the distributed value sent by the holder.

[0129] Holders 12R1 to 12Rr are examples of the "asymmetric secret distribution device" and "secret information recovery device" of the present disclosure. Furthermore, in the present disclosure, holders 12R1 to 12Rr have the function of the "asymmetric secret distribution device" of the present disclosure, and the distribution and decoding system 10 may also include a recovery device (an example of a "secret information recovery device") different from holders 12R1 to 12Rr.

[0130] Figure 2 This is the block diagram of holder 12R1. Furthermore, the structures of other holders 12R2 to 12Rr are identical to those of holder 12R1, therefore their descriptions are omitted.

[0131] Holder 12R1 includes a computer. Holder 12R1 is a communication terminal. Specifically, holder 12R1 includes a central processing unit (CPU) 22, random access memory (RAM) 24, storage device 26, true random number generator 28, and communication device 30. CPU 22, RAM 24, storage device 26, true random number generator 28, and communication device 30 are connected to each other in a manner that enables them to communicate with each other via bus 32.

[0132] CPU 22 includes a distribution section 22A and a recovery section 22B.

[0133] Storage device 26 includes storage of secret information S i Data Identifier dID[S i The storage device 26 includes a secret information storage area 26M1. The storage device 26 stores the keys managed by the overhead key servers 14K1 to 14Kt. 1j key 2j Key storage areas 26M2 and 26M3 (j=1, ..., t) are used for storing keys. Storage device 26 includes a program storage area 26MP for storing the scattering program 26P1 and the restoration program 26P2. Storage device 26 also includes storage areas for storing the IDs (x1, ..., x) of key servers 14K1 to 14Kt and data servers 14Kt+1 to 14Kn. t x t+1 x t+2The ID storage area 26M4 (...xn) is used. However, only the IDs required for calculating the distribution value, including those for the data server, need to be stored; it is not necessary to store all IDs. Furthermore, each time secret information is generated, the distribution value is saved to the data server via this proposal, and the secret information is restored by retrieving the distribution value as needed. Moreover, once the structure of the data identification code is determined, the storage area for the data identification code in 26M1 does not need to be stored. For example, if secret information is generated periodically, the data identification code can be generated from a determined date and time. Furthermore, a storage key is generated based on a key key. 1j key 2j In the case of key storage area 26M2 and key storage area 26M3, the holder can pre-store the key, so the storage unit is not necessary.

[0134] Distributed procedure 26P1 is an example of an "asymmetric secret distribution procedure" of the present disclosure. Restored procedure 26P2 is an example of a "secret information restoration procedure" of the present disclosure.

[0135] The CPU 22 functions as the dispersion unit 22A and the restoration unit 22B by reading the dispersion program 26P1 and the restoration program 26P2 from the program storage area 26MP to the RAM 24 and executing them.

[0136] The communication device 30 transmits and receives data via the network 16.

[0137] Holder 12R1 secretly holds the keys managed by key servers 14K1 to 14Kt. 1j key 2j (j=1, ..., t), as dID[s i The encryption key Eid(y,j) is used. 1j ,key 2j It can be generated by a key. j The generated values ​​are generated. Furthermore, the dispersion values ​​Wr1 and W1 obtained from [Dispersion]1 and [Dispersion]2 can be sent separately, but to reduce the number of communications, they are sent simultaneously. Also, when t > 1, ideally, t pseudo-random numbers generated by the key server would be hidden using t truly random numbers. However, even if only one truly random number is generated and the same truly random number is used for hiding, there is no problem as described below. Therefore, for ease of understanding, the number of truly random numbers hidden from the pseudo-random numbers generated by the key server is set to one.

[0138] When using different true random numbers to conceal the pseudo-random numbers generated by the key server, it can be set up as shown in the second embodiment. Everything else is the same as the asymmetric secret distribution method.

[0139] <Dispersed>

[0140] Then, referring to Figure 3A and Figure 3B The scatter procedure 26P1 will be explained. Figure 3A This is a flowchart of the distributed procedure 26P1 in the first embodiment. Figure 3B This diagram illustrates the processing of the first embodiment of the distribution unit 22A. The distribution process is performed by executing the distribution program 26P1 via the CPU 22.

[0141] [Dispersed 1]

[0142] In step 42, the distribution unit 22A, regarding its own secret information s i A true random number r is obtained from the true random number generator 28. i As the first secret information.

[0143] In step 44, the distribution unit 22A uses its own secret information s i Related data identification code dID[s i (i=1, ..., m), generate pseudo-random numbers qr in the following manner. ij (j=1, ..., t). Hereafter, qr will be used. ij As t dispersion values.

[0144] qr ij =Enc(dID[s i ], key 1j (19)

[0145] The key key1,j is an example of the "first key" of the present disclosure. The processing in step 44 is an example of the processing in the "generation section" of the present disclosure.

[0146] In step 46, the dispersion unit 22A distributes the secret information s shown by the asymmetric secret dispersion method. i Let r be a truly random number. i qr is a pseudo-random number (t scattered values). ij Let q be the value of q. ij The asymmetric secret dispersion method [dispersion] is used to process steps 4 and 5, based on t dispersion values ​​qr. ij With the first secret information r i Calculate nt dispersion values ​​Wr i，t+1 ...,Wr i，n .

[0147] The processing in step 46 is an example of the processing of the "computing unit" of the technology disclosed herein.

[0148] As described above, in Dispersion 1, Dispersion Unit 22A directly uses the pseudo-random number qr.ij Conceal the true random number (the first secret information).

[0149] The processing of Dispersion 1 is an example of the processing of the "first concealment unit" of the present disclosure. The dispersion unit 22A of Dispersion 1 is an example of the "generation unit" and "computation unit" of the present disclosure.

[0150] [Dispersed 2]

[0151] In step 48, the distribution unit 22A uses the data identification code dID[s] i (i=1, ..., m), according to the following equation (20), by the key 2，j Generate t pseudo-random numbers q ij The following will also include q. ij Used as t scattered values. However, in the truly random number r that is [scattered 1] i Hidden q ij +r i In the form of t dispersion values.

[0152] q ij =Enc(dID[s i ], key 2j (20)

[0153] key2,j is an example of a “second key” in the technology disclosed herein.

[0154] In step 50, the distribution unit 22A sets its own secret information (i.e., the second secret information) as s. i Set the scatter value of the key server to q. ij +r i The asymmetric secret dispersion method [dispersion] is used to process steps 4 and 5, based on t dispersion values ​​q. ij With the second secret message i Calculate nt dispersion values ​​W i，t+1 ... W i，n .

[0155] As mentioned above, in Dispersion 2, Dispersion Unit 22A does not directly use the pseudo-random number q. ij Instead, it uses true random numbers to conceal the distributed values, thereby concealing the secret information. This aspect differs from the form of distributed 1.

[0156] In step 52, the dispersion section 22A distributes dID[s] i The calculated dispersion value W i，t+1 ..., dispersion value W i，n and the dispersion value Wr i，t+1 ..., dispersion value Wr i，n Send to data server x t+1..., data server x n Therefore, the execution of the distributed program 26P1 is terminated.

[0157] The data server will dID[s i ]、Wr i，t+1 ...,Wr i，n and W i，t+1 ... W i，n Establish a connection and save it.

[0158] The processing of Dispersion 2 is an example of the processing of the "second concealment part" of the present disclosure. The dispersion part 22A of Dispersion 2 is an example of the "second concealment part" of the present disclosure.

[0159] As described above, the distributed unit 22A is an example of the "first concealment unit" (specifically, the "generation unit" and the "computation unit") and the "second concealment unit" of the technology disclosed herein.

[0160] <Restoration>

[0161] Then, referring to Figure 4A and Figure 4B The restoration procedure 26P2 will be explained. Figure 4A This is a flowchart of the restoration procedure 26P2 of the first embodiment. Figure 4B This diagram illustrates the processing of the first embodiment of the restoration unit 22B. The restoration process is performed by executing the restoration program 26P2 via the CPU 22.

[0162] [Restored 1]

[0163] In step 62, the recovery unit 22B aims to recover the secret information s. i The holder of the data server x t+1 ... xn sends dID[s i In step 64, the dispersed value Wr, which was saved to establish the association, is received. i，t+1 ..., dispersion value Wr i，n and dispersion value W i，t+1 ..., dispersion value W i，n .

[0164] In step 66, the recovery unit 22B uses the key it manages. 1j qr is calculated according to equation (19) ij , and Wr i.t+1 ...,Wr i，n Merge and restore the first secret information r i .

[0165] [Restored 2]

[0166] In step 68, the recovery unit 22B uses the key it manages. 2j q is calculated according to equation (20). ij Set the scatter value generated by the key server as q. ij +r i , with W i，t+1 ... W i，n Merge and restore the secret information. i .

[0167] The following is a more detailed explanation.

[0168] With n=k=2, the number of key servers is one, so as mentioned above, information-theoretical security can be achieved through a truly random number.

[0169] With n=k=3, the number of key servers is t<k, so one or two can be selected. If t=1 is set in [Distributed]1, then a pseudo-random number qr is generated. i1 It is generated by the key server and uses A(i) with asymmetric secret distribution [distribution]4. k-1-t A corresponding additional truly random number r2 is added, and Wr is calculated according to the asymmetric secret distribution method 4. , as shown below. i2 Wr i3 And send it to data server x2 and data server x3. Here, qr i1 Wr i2 Wr i3 The relationship becomes as follows, as described above. If we change r1 and ar2 to be considered, it becomes the same form as the previous secret distribution, and the information theory security can be considered to be valid.

[0170] (Formula 6)

[0171] qr i1 =r1+r2x1+ar2x1 2 (twenty one)

[0172] Wr i2 =r1+r2x1+ar2x2 2 (twenty two)

[0173] Wr i3 =r1+r2x1+ar2x3 2 (twenty three)

[0174] If we set t=2, then the two pseudo-random numbers qr i1 qr i2 It is generated by the key server, and according to the processing of asymmetric secret distribution 4, through the following ar1, ar2, the Wr of formula (26) is calculated.i3 And send it to the data server x3 (without using an appended true random number r2).

[0175] [Formula 7]

[0176]

[0177] In this case, the only truly random number is r1, but one truly random number is retained, thus maintaining information theory security. Furthermore, since there is only one data server, it is impossible to delete more than one truly random number; similarly, information theory security holds true as in the case of t=1.

[0178] Subsequently, in [Distribution 2], with t=2, the pseudo-random numbers q1 and q2 generated by the key server are set as q1+r1 and q2+r1, respectively, resulting in the following relationship.

[0179] [Formula 8]

[0180]

[0181] The attacker only knows Wr i3 (W) i3 Therefore, it can be considered that even if the true random number is one, there is no problem (a1 and a2 in equations (27) to (29) are formed by setting qr1 and qr2 in equations (24) and (25) to q1+r1 and q2+r1). Then, in [Dispersion 2], even if it is set to t=1, with the addition of the random number, qr in equation (21) i1 It becomes q1+r1, but it can be considered that there is no problem either.

[0182] Furthermore, in [Dispersion 2], the first secret information r, which serves as a true random number, is utilized. i will use key 2j The generated t pseudo-random numbers q ij Concealed, but not necessarily related to q ij Instead of adding, it generates a truly random number r. i The t dispersion values ​​are used directly. In this case, to change the value of the dispersion value, the same number of true random numbers as the number of key servers are required. For example, in equations (27) to (29), even if q1+r1 is set as r1 and q2+r1 is set as r2, it becomes the same form as the previous secret dispersion and no problem will occur. Moreover, r1 and r2 can be used instead of a1 and a2. In this case, it can be set as a normal secret dispersion and not as an asymmetric secret dispersion. Furthermore, the concealment of secret information can be achieved by performing the secret dispersion itself.

[0183] Based on the above, it can be considered that the proposal method of the technology disclosed herein can arbitrarily set n, k, and t, and can achieve security equivalent to information theory security in the same way as n=k=2.

[0184] <Second Implementation>

[0185] Next, the second embodiment will be described. The structure of the second embodiment is the same as that of the first embodiment, therefore its description is omitted. The operation of the second embodiment will be explained below.

[0186] As a method for making the asymmetric secret distribution method secure in information theory, in addition to the processing of the first embodiment, the following exists.

[0187] In the Charmilles method, when calculating the dispersion value using equation (1), the known x, which serves as the server ID, is used. i Substituting into equation (1), we obtain the corresponding dispersion value W. i Typically, if publicly known information about x is unavailable... i Even if k dispersion values ​​are collected, the original structure cannot be recovered. Therefore, by proceeding in the following manner, even if the second secret information s1 is known, the asymmetric secret dispersion method can be made secure in terms of information theory. For simplicity, the following is a summary description assuming n=k=2.

[0188] [dispersion]

[0189] The holder obtains a truly random number r1 that is not 0 and has x1 and x2, and then distributes the truly random number r1 asymmetrically in secret.

[0190] The holder sets r1 to x2 and performs asymmetric secret distribution of the secret information s1. Hereafter, we will assume r1 = x2'.

[0191] [recovery]

[0192] The restorer will restore x2'.

[0193] The restorer sets the restored x2' to x2 and restores the secret information s1.

[0194] In this embodiment, the true random number r1 is set as the first secret information, and the holder's secret information s1 is set as the second secret information. Dispersion and restoration are carried out in two stages: r1 and s1. Similar to the first embodiment, it can be seen that information theory security can be achieved for the first secret information r1. Therefore, if r1=x2' is not known, equation (1) cannot be solved. For all x2', the second secret information s1 has a solution, so the information theory security can be considered to be established. Moreover, even if the second secret information s1 is deduced or disclosed, although a1x2' is known according to equation (8), x2' is not known. Therefore, since a1 is not known, q1 is not known, equation (17) is established, and the information theory security is guaranteed.

[0195] Furthermore, in this description, only x2 is set as the first secret information x2', but x1 can also be set as the first secret information x1', or both x1' and x2' can be set as the first secret information. The detailed algorithm is shown below. In the first embodiment, although multiple first secret information are selected, the second secret information s... i Set only to r i In this embodiment, the first secret information can also be selected entirely as x1', ..., x' as the server ID. n However, even without knowing only one server ID, the secret information cannot be obtained. Therefore, similar to the first embodiment, the first secret information can be set to a server ID. However, here, in order to create a difference from the first embodiment, the number of first secret information in [distribution] 1 is set to nt, which is the same as the number of data servers. Thus, using nt truly random numbers as the first secret information, asymmetric secret distribution is repeatedly performed. However, when t=k-1, the number of data servers becomes 1, so the number of first secret information becomes 1, the same as the first embodiment. Other settings are the same as the first embodiment.

[0196] Then, referring to Figure 5 The distributed procedure 26P1 is explained (see also [reference]). Figure 3B ). Figure 5 This is a flowchart of the distribution procedure 26P1 in the second embodiment.

[0197] [Dispersed 1]

[0198] In step 72, the distribution unit 22A, regarding its own secret information s i Obtain a truly random number r from the truly random number generator 28 that is inconsistent with 0 and the server ID. i，h (h = t + 1, ..., n).

[0199] In step 74, the dispersion section 22A uses r i，h Related data identification code dID[ri，h Generate pseudo-random numbers qr in the following manner. ihj (j=1, ..., t). As mentioned above, the pseudo-random number qr ihj These can be used as t dispersed values ​​for each of the first secret information ri and h.

[0200] qr ihj =Enc(dID[r i，h ], key 1j (30)

[0201] In step 76, the distribution unit 22A sets the first secret information as r. i，h (h=t+1、…、n), qr ihj Let q be the value of q. ij Repeat step 4 of the asymmetric secret distribution method, and then calculate and send the result to the data server x. t+1 ..., data server x n The dispersion value Wr i，h，t+1 ..., dispersion value Wr i，h，n (h = t + 1, ..., n).

[0202] [Dispersed 2]

[0203] In step 78, the distribution unit 22A uses the second secret information s i Related data identification code dID[s i (i=1, ..., m), generate pseudo-random numbers qij.

[0204] q ij =Enc(dID[s i ], key 2j (31)

[0205] Key 2i This is an example of the "second key" of the technology disclosed herein.

[0206] In step 80, the distributed unit 22A sends the data server x h The IDs of (h=t+1, ..., n) are set to truly random numbers r. i，h That is, using truly random numbers r i，h As variables in the dispersion formula (1), the asymmetric secret dispersion method is processed in steps 4 and 5, based on t dispersion values ​​q. ij With the second secret message i Calculate nt dispersion values ​​W i，t+1 ..., W i，n .

[0207] Use a truly random number r i，h The aspect of the server ID is different from the form of scatter 1.

[0208] In step 82, the distribution unit 22A sends data to the data server x t+1 ..., data server x n Send dID[s i ]、Wr i，h，t+1 ...,Wr i，h，n and W i，t+1 ..., W i，n .

[0209] The data server establishes associations and saves these data.

[0210] Then, referring to Figure 6 The restoration procedure 26P2 is explained (see also [reference]). Figure 4B ). Figure 6 This is a flowchart of the restoration procedure 26P2 in the second embodiment.

[0211] [Restored 1]

[0212] To recover the secret information i In step 92, the holder's restoration part 22B will restore dID[s] i Send to nt data server x t+1 ... x n In step 94, the dispersed value Wr, which was saved to establish the association, is received. i，h，t+1 ..., dispersion value Wr i，h，n and dispersion value W i，t+1 ..., dispersion value W i，n .

[0213] In step 96, the recovery unit 22B uses the key it manages. 1j qr is obtained from equation (30) ihj , and Wr i，h，t+1 ...,Wr i，h，n Merge, and transfer the first secret information r i，h (h=t+1、…、n) Restore.

[0214] [Restored 2]

[0215] In step 98, the recovery unit 22B uses the key it manages. 2j q is obtained from equation (31) ij Data server x h Let the ID of (h=t+1, ...,n) be r. i，h , with W i，t+1 ..., W i，n Merge, and transfer the second secret information s i recovery.

[0216] In this description, only the data server ID is hidden, but the key server ID may also be hidden.

[0217] Furthermore, when using true random numbers to determine all server IDs, the true random number must be non-zero or the same value.

[0218] <Third Implementation Method>

[0219] Next, the third embodiment will be described. The structure of the third embodiment is the same as that of the first embodiment, therefore its description is omitted. The function of the third embodiment will be explained below.

[0220] In this embodiment, a method is shown that is secure even when the confidential information is disclosed in a form different from that of the second embodiment. Hereinafter, for simplicity, n=k=2 will be used as an example to provide a general overview.

[0221] In asymmetric secret distribution, the holder uses a fixed key. 1j key 2j Encrypt (j=1, ..., t) and calculate qr. ij q ij Here, several qr can be extrapolated by analogy. ij q ij In the case where a key exists 1j key 2j The possibility of being analyzed. Therefore, the following shows how the key in [distribution]2 is changed each time. 2j The method to improve security is described in the same manner as the first embodiment, with n=k=2.

[0222] [dispersion]

[0223] 1. The holder generates a true random number r1, and the distribution unit 22A performs asymmetric secret distribution of the first secret information r1.

[0224] 2. Dispersion section 22A with key 2j +r1 is used as the new key. 2j Calculate q ij The second secret information s1 is asymmetrically distributed.

[0225] As described above, the distribution unit 22A uses a true random number r1 as the key to generate pseudo-random numbers. 2j Generate t dispersion values, and calculate nt dispersion values ​​based on the t dispersion values ​​and the secret information.

[0226] In the third embodiment, a true random number r1 is used as the key to generate a pseudo-random number. 2jThe aspect is different from that of dispersed 1.

[0227] [recovery]

[0228] 1. Restoration Unit 22B restores the first secret information r1.

[0229] 2. Restoration section 22B with r1+key 2j As a new key 2j Calculate q ij The second secret information s1 is restored.

[0230] In the above, q is generated ij key 2j Each time based on a truly random number r j However, changes occur, so even if we can analyze q based on past data transmission, etc. ij It can analyze the generation of q ij key 2j It's meaningless. Regarding a secret message s i Generate the first secret information r respectively j And change the key 2j In this case, the detailed algorithm, besides the key 2j Set as r1+key 2j Except for the first implementation method, it is the same. Each time the key is changed... 2j In the case of a set of dID[s], even if i ] and q ij The key is known, and it cannot be used afterward; therefore, it can be considered to achieve security equivalent to information theory security. Analysis requires multiple sets of dIDs[s]. i ] and q ij In the case of multiple s within the range, j Change the key respectively 2j That's it. In the above situation, each time the key is changed... 2j That is, the process of [distribution][restoration] is performed. Therefore, in this case, the number of times asymmetric secret distribution is performed or the number of distributed values ​​stored in the data server is less than in the first embodiment. However, in the first and second embodiments, even if the first secret information is not asymmetrically distributed every time, it is possible to target multiple s j The process is performed separately. Furthermore, in this embodiment, the asymmetric secret distribution of the first secret information each time is largely the same as in the first embodiment. Moreover, when the first secret information is updated multiple times, [Distribution 1] [Restore 1] can be performed at this time. Therefore, detailed algorithms are omitted.

[0231] Furthermore, if two truly random numbers r are combined... 1jr 2j Set as the first secret information, and set the key 1j Set as key 1j +r 1j , key 2j Set as key 2j +r 1j Even if the key is analyzed 1j It's useless.

[0232] Furthermore, it is also possible to avoid including the first secret information and the key. 1j ,key 2j They are added together and used directly as the update key.

[0233] <Fourth Implementation>

[0234] Next, the fourth embodiment will be described. The structure of the fourth embodiment is the same as that of the first embodiment, except that the holder includes a display device (not shown), so its description is omitted. Hereinafter, the operation of the fourth embodiment will be explained.

[0235] In the first embodiment, it is shown that even if the distributed values ​​stored in the data server are leaked, the secret information can be protected with the same security as information theory security. In this embodiment, in the case of asymmetric secret distribution where the data server is tampered with by an attacker, a method for verification is shown. First, let n=4, k=3, t=2, and the number of data servers be u=nt=2, and a summary will be given. Furthermore, let x1 and x2 be the IDs of the key servers, and x3 and x4 be the IDs of the data servers. If k=3, then it can be restored as long as three distributed values ​​are collected. Therefore, for the distributed values ​​generated by the keys of the two key servers held by the holder, the data server's distributed values ​​are replaced one by one while being restored, and if the results are consistent, it is assumed that the data server has not been tampered with.

[0236] [dispersion]

[0237] 1. The distribution unit 22A sets the true random number r1 to n=4, k=3, t=2, u=2 and performs asymmetric secret distribution.

[0238] 2. Dispersion section 22A is composed of key 2j The generated pseudo-random number q1 plus r1 is used as the dispersion value to perform asymmetric secret dispersion of the second secret information s1.

[0239] [recovery]

[0240] 1-1. The restoration unit 22B sets the secret information restored using the distributed values ​​of servers x1, x2, and x3 as r1'.

[0241] 1-2. The restoration unit 22B sets the secret information restored using the distributed values ​​of servers x1, x2, and x4 as r1".

[0242] 1-3. In the restoration section 22B, if r1'=r1", it is set as no tampering; if r1'≠r1", it is set as tampering and processing is stopped.

[0243] 2-1. The restoration unit 22B sets the secret information restored using the distributed values ​​of servers x1, x2, and x3 as s1'.

[0244] 2-2. The restoration unit 22B sets the secret information restored using the distributed values ​​of servers x1, x2, and x4 as "s1".

[0245] 2-3. In the restoration section 22B, if s1'=s1", then it is set as untampered and adopted; if s1'≠s1", then it is set as tampered.

[0246] In the [distributed] 1, key server x1 and key server x2 generate pseudo-random numbers q1 and q2 respectively, and data server x3 and data server x4 calculate and save W3 and W4 respectively.

[0247] [Formula 9]

[0248]

[0249] a1 and a2 are calculated as in equations (24) and (25) based on q1 and q2 generated by t=2 key servers, but they become values ​​including r1, and are therefore considered true random numbers.

[0250] Therefore, W1 and W2 calculated based on r1, a1, and a2 can also be considered truly random numbers, providing no information related to q1 and q2. Furthermore, since k=3, it is impossible to solve for W3 and W4, which are known to the attacker, and thus calculate r1. Moreover, by subtracting W4 from W3, the constant term r1 can be removed, but a1 and a2, as described above, include r1, thus satisfying the information theory security requirements.

[0251] In contrast, in [Restore] 1, the combination of data servers is changed and r1 is restored twice. If the results are consistent, it is set as no tampering; if they are inconsistent, it is set as tampering. Typically, the dispersion value becomes the coordinate x of equation (1). iThe y-coordinates at points r1, q1, and q2 are used to construct a curve in two dimensions, as shown in equation (1). In the asymmetric secret distribution, k=3, so the holder calculates the curve passing through the three points r1, q1, and q2 (r1 becomes the y-coordinate when the x-coordinate is 0), sets the y-coordinates at x3 and x4 on the curve as W3 and W4, and stores them in the data server. However, the attacker only knows the two points W3 and W4, and therefore cannot know the curve. Thus, even if the attacker tampers with W3 to W3', the attacker does not know the curve passing through q1, q2, and W3', and therefore cannot accurately determine W4' on the tampered curve. Therefore, W3 and W4 are combined with q1 and q2 in sequence to restore the curve. If the restoration result is consistent, it means that the curve passing through q1, q2, and W3 is consistent with the curve passing through q1, q2, and W4, and there is no tampering. However, if the operation is performed on modp, it is assumed that W4' is coincidentally consistent on the false curve with a probability of 1 / p. However, if p is set to a sufficiently large value, 1 / p becomes a negligible probability, thus maintaining security.

[0252] As can be seen from the first embodiment, the processing performed in [dispersion][restoration] 2 also has the same security as 1. Furthermore, if the restoration result is consistent, it can be considered that the restored second secret information s1 has not been tampered with, just like [dispersion][restoration] 1.

[0253] Then, referring to Figure 7 The restoration procedure 26P2 is explained (see also [reference]). Figure 4B The distributed program is set to values ​​capable of detecting tampering with the settings of n, k, and t, and performs the same processing as in the first embodiment for these settings. The settings capable of tamper detection require a data server count u of 2 or more, and are settings that cannot be recovered from the data server; therefore, 1 < u = nt < k (where t < k). Thus, if k = 2, there are no n and t that satisfy the above equation, so the minimum settings are k = 3 and nt = 2, resulting in t = 2 and n = 4. Figure 7 This is a flowchart of the restoration procedure 26P2 in the fourth embodiment.

[0254] For simplicity, let t = k-1. When t < k-1, verification is performed while changing the combination of scatter values ​​from the data server. Other than this, the prerequisites are the same as in the first implementation method, and therefore omitted.

[0255] [Restored 1]

[0256] In step 102, the recovery unit 22B sends data to the u-type data server x. n-u+1 ... x n Send dID[s i ].

[0257] In step 104, the recovery unit 22B retrieves data from the u-server x. n-u+1 ... x n Receive the scattered value Wr saved during the establishment of the association i，n-u+1 ..., dispersion value Wr i，n and dispersion value W i，n-u+1 ..., Dispersion value Wi ，n .

[0258] In step 106, the recovery unit 22B uses the key it manages. 1j From Equation 19, we obtain k-1 qrij (j=1, ..., k-1), and Wr i.n-u+1 ...,Wr i，n Combining them one by one, and then the secret information r i，n-u+1 ... secret information r i，n recovery.

[0259] In step 108, the restoration unit 22B determines r. i，n-u+1 ... r i，n Does anyone agree with this?

[0260] In r i，n-u+1 ... r i，n In the case where there are consistent parties, the restoration unit 22B will restore r in step 110. i，n-u+1 ... r i，n Let the consistent ones be r. i .

[0261] [Restored 2]

[0262] In step 112, the recovery unit 22B uses the key. 2j q is obtained from equation 20 ij (j=1, ..., k-1), and W i，n-u+1 ..., W i，n Combining them one by one, and then the secret information s i，n-u+1 ... secret information i，n recovery.

[0263] In step 114, the restoration unit 22B determines s i，n-u+1 、…、s i，n Does anyone agree with this?

[0264] If s i，n-u+1 、…、s i，n If there are consistent ones, then the restoration part 22B adopts s in step 116. i，n-u+1 、…、s i，n The one that matches the previous one is considered the correct answer.

[0265] If the determination in step 108 or step 114 is negative, the display device will show that the device has been tampered with.

[0266] In this description, the tampering confirmation in [Restore 1] can be omitted. The reason for this is that if the results of [Restore 1] are inconsistent, then the results of [Restore 2] will also be inconsistent, so only [Restore 2] needs to be confirmed. Accordingly, [Dispersion 1] and [Restore 1] can be set to be the same as in the first embodiment.

[0267] If the same verification is performed on the second and third implementation methods, it can be verified whether the restoration result has been tampered with.

[0268] Furthermore, security can be improved by increasing n and k. For example, if n=6, k=4, and t=3, the number of data servers becomes 3. Here, the probability of tampering with three scattered values ​​from the data servers and accidentally making them coincident becomes 1 / p. 2 This improves security.

[0269] <Fifth Implementation>

[0270] Next, the fifth embodiment will be described. The structure of the fifth embodiment is the same as that of the fourth embodiment, therefore its description is omitted. The operation of the fifth embodiment will be explained below.

[0271] In the above embodiment, a two-stage dispersion and restoration process is performed. In this embodiment, a method requiring only a single dispersion and restoration is shown. Its general structure is as follows: restrictions are imposed on n, k, and t so that the dispersion includes more than one truly random number while still allowing for the disclosure of secret information. In this case, if k=2 or 3, the introduction of truly random numbers or the disclosure of secret information cannot be tolerated; therefore, when n=k, restrictions are imposed such that k≧4 and 2≦t≦k-2. Furthermore, the number of data servers u is u=nt, obtained by subtracting the number of key servers t from the total number of servers n. Therefore, the minimum setting is n=k=4, t=2, u=2. Hereinafter, the algorithm in the minimum setting will be explained with the secret information set as s1.

[0272] Figure 8 This is a flowchart of the distributed procedure 26P1 in the fifth embodiment. Figure 9 This is a flowchart of the restoration procedure 26P2 in the fifth embodiment. The restoration can be a single restoration.

[0273] [dispersion]

[0274] Reference Figure 8 The decentralized processing is explained.

[0275] In step 122, the dispersion unit 22A generates kt-1 truly random numbers r.h (In the given configuration, kt-1=4-2-1=1, therefore h=1).

[0276] 2. In step 124, the dispersion unit 22A generates t pseudo-random numbers q. j (j=1, ...,t) are used as the dispersion values ​​of equations (34) and (35). Based on equations (34) and (35), the secret information s1 in the dispersion formula is calculated and the kt-1 true random numbers r generated in step (122) are used. h The coefficients other than t (in the above setting, a2 and a3 according to t=2) are asymmetrically secret distributed. That is, u=nt=4-3=2 W3 and W4 are calculated as equation (36) (37) and sent to the data server.

[0277] [recovery]

[0278] 1. The restoration unit 22B restores the secret information s1.

[0279] In this scenario, the two key servers calculate q1 and q2 and send them to the recovery unit, while the data server sends W2 and W3, obtained during the distributed processing, to the recovery unit. The relationship between q1, q2, W3, and W4 is as follows.

[0280] q1=s1+r1x1+a2x1 2 +a3x1 3 (34)

[0281] q2=s1+r1x2+a2x2 2 +a3x2 3 (35)

[0282] W3 = s1 + r1x3 + a2x3 2 +a3x3 3 (36)

[0283] W4 = s1 + r1x4 + a2x4 2 +a3x4 3 (37)

[0284] Among them, a2 and a3 are calculated according to equations (34) and (35) and become the following.

[0285] a2={(q1x2)} 3 -q2x1 3 )-s1(x2 3 -x1 3 -r1(x1x2) 3 -x2x1 3} / ((x1 2 x2 3 -x22 x1 3 ))(38)

[0286] a3={(q1x2)} 2 -q2x1 2 )-s1(x2 2 -x1 2 -r1(x1x2) 2 -x2x1 2} / ((x1 3 x2 2 -x2 3 x1 2 ))(39)

[0287] Therefore, even if an attacker knows the dispersion values ​​and secret information s1 of equations (36) and (37), removing one coefficient from equations (36) and (37) leaves two unknowns. Moreover, these coefficients, as in equations (38) and (39), become a form that uses a true random number r1 to conceal a pseudo-random number, thus preventing the attacker from obtaining information related to the pseudo-random number without knowing the true random number r1. This situation is not limited to the stated case, but applies to the cases where k ≥ 4 and 2 ≤ t ≤ k-2. Therefore, the following can be considered: x i It is set as public knowledge.

[0288] H(q) j ) = H(q) j |W t+1 ..., W n ,s1)(40)

[0289] Based on the above, when equation (1) includes true random numbers, even if the secret information is disclosed, the attacker cannot know the pseudo-random number that is the output of the cryptographic device. If the output of the cryptographic device cannot be predicted, it is considered that the asymmetric secret distribution method cannot be solved. The same applies even if the attacker has infinite computing power. That is, if the attacker has infinite computing power, he can know all the corresponding outputs by trying all the keys on the input of the cryptographic device, but since there is a solution for all the outputs, it is unknown which output to use. Moreover, even if the attacker has infinite computing power, he cannot calculate the pseudo-random number that is the output of the cryptographic device based on kt distribution values. Therefore, it can be considered that if the output cannot be predicted based solely on the input of the cryptographic device when the key of the cryptographic device is unknown, then even if the attacker has infinite computing power, he cannot obtain the secret information. That is, the proposal method can have the same security as information theory security.

[0290] Furthermore, it is known that the asymmetric secret distribution method using truly random numbers is secure against both chosen-plaintext and chosen-ciphertext attacks. Conversely, without considering the disclosure of secret information, the value of k can be reduced by 1. For example, with n=k, the constraint becomes k≧3, 1≦t≦k-2. The minimum setting in this case is k=3, t=1, and the distribution values ​​become as follows (in this case, the number of truly random numbers also becomes kt-1=3-1-1=1, and the number of distribution values ​​sent to the data server becomes u=nt=3-1=2, i.e., W2, W3).

[0291] q1=s1+r1x1+a2x1 2 (41)

[0292] W2=s1+r1x2+a2x2 2 (42)

[0293] W3 = s1 + r1x3 + a2x3 2 (43)

[0294] Furthermore, when n > k, the restrictions become k ≥ 5 and k-2 ≥ t > n-k+1. Therefore, if the dispersion is performed with the minimum set n = 6, k = 5, t = 3, u = 3, the result is as follows.

[0295] q1=s1+r1x1+a2x1 2 +a3x1 3 +a4x1 4 (44)

[0296] q2=s1+r1x2+a2x2 2 +a3x2 3 +a4x2 4 (45)

[0297] q3 = s1 + r1x3 + a2x3 2 +a3x3 3 +a4x3 4 (46)

[0298] W4 = s1 + r1x4 + a2x4 2 +a3x4 3 +a4x4 4 (47)

[0299] W5 = s1 + r1x5 + a2x5 2 +a3x5 3 +a4x5 4 (48)

[0300] W6 = s1 + r1x6 + a2x6 2 +a3x63 +a4x6 4 (46)

[0301] Among them, a2, a3, and a4 are calculated according to equations (44) to (46), including t pseudo-random numbers q. j (j=1, ..., t) and kt-1 true random numbers r1, secret information s1 (that is, the coefficients of the distributed formula (1) become t+(kt-1)+1=k).

[0302] In equations (44) to (46), even if three dispersion values ​​and secret information are known, the coefficients of equation (1) cannot be analyzed due to the presence of four unknowns. The situation described is not limited to the minimum setting, but applies to the cases where k ≥ 5 and k-2 ≥ t > n-k+1.

[0303] Furthermore, disregarding the limitation of public disclosure of secret information, under the condition n > k, k ≥ 4, k-2 ≥ t > n-k+1, the minimum setting becomes n=5, k=4, t=2, and the dispersion values ​​become as follows. In this case, the number of truly random numbers also becomes kt-1=4-2-1=1. The number of dispersion values ​​sent to the data server becomes u=nt=5-2=3 (W3, W4, W5).

[0304] q1=s1+r1x1+a2x1 2 +a3x1 3 (47)

[0305] q2=s1+r1x2+a2x2 2 +a3x2 3 (48)

[0306] W3 = s1 + r1x3 + a2x3 2 +a3x3 3 (49)

[0307] W4 = s1 + r1x4 + a2x4 2 +a3x4 3 (50)

[0308] W5 = s1 + r1x5 + a2x5 2 +a3x5 3 (51)

[0309] Furthermore, when n > k, tampering detection can also be performed in the following manner.

[0310] Let k=5, n=6, t=3, and the number of data servers be u=nt=3. Asymmetric secret distribution is performed, and the tamper detection process is explained. Furthermore, x1, x2, and x3 are set as the IDs of the key servers, and x4, x5, and x6 are set as the IDs of the data servers. If k=5, then recovery is achieved by collecting all five distribution values. Therefore, for the distribution values ​​generated by the keys of the three key servers held by the holder, recovery is performed by replacing and combining the distribution values ​​of the data servers in pairs. If the results are consistent, it is assumed that the data servers have not been tampered with. In the case of n=k, the solution is determined by a single decoding operation.

[0311] [recovery]

[0312] Reference Figure 9 The restoration process is explained.

[0313] 1-1. In step 132, the restoration unit 22B restores the secret information s1 using the k dispersion values ​​from the data servers (dispersion values ​​from data servers x4 and x5 in the above setting), in addition to a portion of the dispersion values ​​generated using its own key (dispersion values ​​from data servers x1, x2, and x3 in the above setting). The value restored in step 132 is set as the secret information s1'.

[0314] 1-2. In step 134, the restoration unit 22B restores the secret information s1 using a combination of dispersion values ​​from data servers (x4, x6) that is different from the combination in step 132, in addition to the dispersion values ​​generated using its own key (dispersion values ​​of data servers x1, x2, and x3). The value restored in step 134 is set as the secret information s1''.

[0315] 1-3. In step 136, the restoration unit 22B, in addition to using the dispersion values ​​of x1, x2, and x3 generated using its own key, also uses the dispersion values ​​from data servers x5 and x6 in other combinations to restore the secret information s1. The value restored in step 136 is set as the secret information s1'''.

[0316] 1-4. In step 138, the restoration unit 22B determines whether there are any consistent values ​​among s1', s1'', and s1'''. If there are consistent values ​​among s1', s1'', and s1''', the restoration unit 22B sets the consistent value without tampering as the solution in step 140. If all values ​​are inconsistent, the restoration unit 22B displays tampering on the display device in step 142, sets it as tampered, and does not use it.

[0317] If the distribution value from the key server is restored by changing the combination of the distribution values ​​from the data server in such a way that the total number of distribution values ​​is k, then it can also be applied to cases other than the minimum settings of k=5, n=6, t=3.

[0318] <Other Implementation Methods>

[0319] It is understood that the four implementation methods can be combined. For example, the first to third implementation methods can use different first secret information to simultaneously conceal the dispersion value relative to the second secret information, the server ID, and the pseudo-random number generation key, and one of them can also be used as the fourth implementation method for tamper detection. Moreover, in the above implementation method, the second secret information is set to s. i However, various other values ​​can also be used as second secret information.

[0320] (Non-patent document 2)

[0321] Keiichi Iwamura and Ahmad Akmal Aminuddin Mohd Kamal, “Communication-Efficient Secure Computation of Encrypted Inputs Using (k, n) Threshold Secret Sharing,” IEEE Access, May 2023.

[0322] For example, if r1(s1+1) and other values ​​used in the secret computation shown in Non-Patent Document 2 are set as secret information, their restored values ​​can be directly used for secret computation. Furthermore, the second secret information s1 can be set as r1+s1 using the first secret information r1 and sent, similar to a Fornum cipher. Moreover, the pseudo-random number qr can also be set using the first secret information r1 on the sending side. 1j Like the Fornum cipher, conceal r1+qr 1j The sending and receiving sides use the shared key. 1j Get qr 1jThe first secret information r1 is extracted, and the second secret information s1 is sent using r1 as in the first to fourth embodiments. However, if the second secret information s1 is sent in the same way as the first secret information using a Fornum cipher, it becomes r1+s1, and loses its true randomness through the following calculation.

[0323] (r1+qr1)+(r1+s1)=qr1+s1

[0324] Therefore, the first secret information and the second secret information need to be concealed differently. In the first embodiment, the first secret information is used in the form of a concealed distribution value; in the second embodiment, it is used as a server ID; and in the third embodiment, it is used for key updates. Since different concealments are applied, no problems arise. That is, the essence of this invention is: to use a truly random number as the first secret information for communication, and to use the first secret information to conceal the second secret information in a form different from the first secret information. However, one or both of them use an asymmetric secret distribution.

[0325] Furthermore, the key held by the holder is set as the key. 1j ,key 2j However, the same key can also be used. j Encryption is performed. In this case, to change the encryption result, a specific value can be applied to the encrypted data identifier or concatenation can be performed to change the data. Moreover, in the first embodiment, when the dispersion value relative to the second secret information is directly set as the first secret information, a key is not required. 2j Therefore, key 1j You can use the key directly. j .

[0326] Furthermore, in the first embodiment, when n=k=2, the number of distributed values ​​stored in the data server becomes two, and no reduction in memory capacity is achieved compared to the conventional secret distribution method. However, for example, if n=k=3 and t=k-1, the number of data servers becomes one, and the number of distributed values ​​stored becomes two. In the conventional secret distribution method, three distributed values ​​are stored, so the overall memory capacity becomes 2 / 3. Therefore, in the first to third embodiments, if n and k are increased, the overall memory capacity becomes 2 / n compared to the conventional secret distribution method, and the rate of reduction in memory capacity can be increased.

[0327] On the other hand, an advantage of asymmetric secret distribution methods, besides reducing memory capacity, is the ease of managing the distributed values ​​for the holder. Specifically, in conventional secret distribution methods, n data servers are required. If k of these servers are attacked without the holder's knowledge, the distributed values ​​are leaked, posing a risk of the attacker gaining knowledge of the secret information. In contrast, in asymmetric secret distribution methods, the holder can generate at most k-1 distributed values ​​from the key, thus allowing the number of data servers to be set to k-1 (minimum one) or less. Therefore, even if an attacker attacks at most k-1 data servers without the holder's knowledge, the secret information will not be leaked as long as no distributed value generated by the holder is available. Thus, secret information will not be leaked without the holder's knowledge.

[0328] Based on the above, if t = k-1, the data server can be a single cloud instance. As long as the holder uses a smartphone or PC (i.e., a personal computer) with the function of generating truly random numbers for dispersion and reconstruction, even a large amount of secret information can be managed using only a smartphone or PC. Furthermore, in conventional asymmetric secret dispersion methods, if an attacker can deduce the dispersion value generated by the key based on the transmitted information, quantum computers and other technologies can lead to the leakage of secret information. In contrast, in this invention, the security of the transmitted information achieves information theory security; therefore, even if an attacker uses a quantum computer, they cannot know the dispersion value generated by the holder, which can be considered a significant improvement in security.

[0329] Furthermore, in traditional secret distribution methods, to securely send two distributed values ​​even with the minimum k=2, additional encryption construction, such as the Fornum cipher, is required, making it unsuitable for communication. In contrast, asymmetric secret distribution methods, if t=k-1, can be used for the exchange of a single distributed value, thus enabling communication. That is, if n=k=2, the sender and receiver share a common key. 1j key 2j The sending side generates a truly random number and simultaneously sends a dispersion value relative to both the first and second secret information, thus enabling cryptographic communication that achieves information-theoretical security in a single communication. Furthermore, as shown in the fourth embodiment, if n=4, k=3, and t=2, sending two different dispersion values ​​for the same secret information allows verification of whether tampering has occurred on the communication path through the secret dispersion with verification functionality.

[0330] Furthermore, if n=k=2, and the processing is distributed among IoT devices, Wr i，2 W i，2 Send to the receiving terminal, where the receiving terminal will use the shared key. 1jkey 2j The restoration process can then be handled very easily, enabling secure communication in terms of information theory by IoT devices. Therefore, the proposal method can also be used for communication.

[0331] Furthermore, if the secret information is set as a password shared by both the sender and receiver (i.e., PW), then the sender can authenticate the user simply by sending the PW as the secret information to the receiver. However, this would result in the same information being sent every time. Therefore, if a new true random number is sent as the appended first secret information, and the value obtained by applying the true random number to the PW is sent as the second secret information, then different information can be used for authentication each time. The appended true random number can also be sent from the receiver, and the sender can restore it and return the value obtained by applying it to the PW as the second secret information.

[0332] Furthermore, there are cases where the holder and the restorer are the same person. However, if the holder entrusts another restorer to restore the secret information, there are also cases where the holder informs the restorer of a combination of pseudo-random numbers or true random numbers generated relative to the second secret information. In such cases, it is necessary to change the first secret information and update the scatter values ​​stored on the data server to avoid a second restoration.

[0333] CPU 22 is an example of a "processor" of the technology disclosed herein. In addition to CPU 22, other processors may include, for example, field-programmable gate arrays (FPGAs), programmable logic devices (PLDs), or application-specific integrated circuits (ASICs), which are dedicated circuits that have circuit structures specifically designed to perform specific processes.

[0334] The hardware resources for performing distributed processing and recovery processing may include one of the various processors mentioned above, or a combination of two or more processors of the same or different types (e.g., a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Furthermore, the hardware resources for performing distributed processing and recovery processing may also be a single processor.

[0335] As an example including a processor, firstly, there is a form where a processor is composed of a combination of one or more CPUs and software, and the processor functions as a hardware resource for performing distributed processing and recovery processing. Secondly, there is a form using a processor such as a System-on-a-chip (SoC), where the overall system functionality, including multiple hardware resources for performing distributed processing and recovery processing, is implemented through a single integrated circuit (IC) chip. As described above, distributed processing and recovery processing are implemented using one or more of the aforementioned processors as hardware resources.

[0336] Furthermore, as a hardware structure for the various processors, more specifically, circuits composed of circuit elements such as semiconductor elements can be used. Moreover, the distributed processing and the recovery processing are ultimately examples. Therefore, it is possible to delete unnecessary steps, add new steps, or change the processing order without departing from the main point.

[0337] Storage device 26 is a non-transitory storage medium. An example of storage device 26 is a hard disk drive (HDD). However, HDD is only one example; other types of storage devices, such as solid state drives (SSDs), may also be used.

[0338] The descriptions and illustrations above are detailed explanations of a portion of the technology disclosed herein, and are merely one example of the technology disclosed herein. For example, the descriptions related to the structure, function, role, and effect are only one example of the structure, function, role, and effect of a portion of the technology disclosed herein. Therefore, it is natural that, without departing from the spirit of the technology disclosed herein, unnecessary parts may be deleted, or new elements may be added or replaced in the descriptions and illustrations above. Moreover, to avoid complexity and to make the technology disclosed herein easier to understand, descriptions related to common technical knowledge that does not require special explanation in implementing the technology disclosed herein have been omitted from the descriptions and illustrations above.

[0339] All documents, patent applications and technical standards described herein are incorporated herein by reference to the same extent as in the cases described below, where each document, patent application and technical standard is incorporated by reference separately.

[0340] <Note>

[0341] Based on the above disclosure, the following notes are provided.

[0342] (Note 1)

[0343] An asymmetric secret distribution device is provided, which is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret message is distributed into n distributed values, and the secret message can be recovered by collecting k of the distributed values; if there are k-1 or fewer distributed values, the secret message cannot be recovered.

[0344] The asymmetric secret dispersion device includes a processor.

[0345] The processor performs the following processing: with n=k, set k≧3 and 1≦t≦k-2, calculate u=nt dispersed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret message.

[0346] (Note 2)

[0347] An asymmetric secret distribution device is provided, which is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret message is distributed into n distributed values, and the secret message can be recovered by collecting k of the distributed values; if there are k-1 or fewer distributed values, the secret message cannot be recovered.

[0348] The asymmetric secret dispersion device includes a processor.

[0349] The processor performs the following processing: under the condition that n > k, k ≧ 4 and k-2 ≧ t > n-k+1, calculate u = nt dispersed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret information.

Claims

1. An asymmetric secret distribution device, comprising the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret message is distributed into n distributed values, and the secret message can be recovered by collecting k of the distributed values; if there are k-1 or fewer distributed values, the secret message cannot be recovered. The asymmetric secret dispersion device is characterized by comprising: The calculation unit, with n=k set to k≧3 and 1≦t≦k-2, calculates u=nt dispersed values ​​based on kt-1 true random numbers, t pseudo random numbers, and a secret message.

2. An asymmetric secret distribution device, comprising the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret message is distributed into n distributed values, and the secret message can be recovered by collecting k of the distributed values; if there are k-1 or fewer distributed values, the secret message cannot be recovered. The asymmetric secret dispersion device is characterized by comprising: The calculation unit, under the condition that n > k, sets k ≥ 4 and k-2 ≥ t > n-k+1, calculates u = nt dispersed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret message.

3. An asymmetric secret distribution program, used to enable the computer of an asymmetric secret distribution device to function as a computing unit, wherein the asymmetric secret distribution device is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, the secret information can be recovered by collecting k of the distributed values, and the secret information cannot be recovered if there are k-1 or fewer distributed values. The calculation unit is set to k≧3 and 1≦t≦k-2 for n=k. Based on kt-1 true random numbers, t pseudo random numbers and a secret message, it calculates u=nt dispersed values.

4. An asymmetric secret distribution program for enabling the computer of an asymmetric secret distribution device to function as a computing unit, wherein the asymmetric secret distribution device is an asymmetric secret distribution device in the following system: n is set to an integer greater than or equal to 2, k is set to an integer with a minimum value of 2 and a maximum value of n, a secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values; if there are k-1 or fewer distributed values, the secret information cannot be recovered. The calculation unit is set to k≧4 and k-2≧t>n-k+1 under n>k, and calculates u=nt dispersed values ​​based on kt-1 true random numbers, t pseudo random numbers and a secret information.

Images