Private key management system

Abstract

To provide a private key management system interlocked to a private information restorable value distribution system which manages a security level more highly by combining processing for authenticating validity of an own user generating a private key.SOLUTION: In a private key management system, a data terminal 1 connected with server devices 1001 and 1002 via a network 1003 comprises a first registration section 11A for registering one distributed value in a storage section for data terminal management in (n) pieces of distributed values obtained by distributing generated private key information. Each server device independently comprises a second registration section 12A for acquiring from the data terminal a distributed value, which is allocated for management of each server device, excluding the distributed value for data terminal management in the distributed values distributed from the private key information and different biometric information, which can be acquired from a user operating the data terminal, and registering both the acquired biometric information and the distributed value for management of each server device into a storage section for server device management that each server device comprises.SELECTED DRAWING: Figure 16

Description

[Technical field]

[0001] The present invention relates to a secret information restorable value distribution system and method, and in particular to a private key management system that cooperates with a secret information restorable value distribution system in which secret information restorable values ​​(shares) for restoring secret information are distributed and stored on physical storage media. [Background technology]

[0002] Computer systems are used to conduct transactions online through public networks such as the Internet. Examples of such computer systems include a virtual currency management system called Bitcoin (registered trademark), which is a peer-to-peer (P2P) payment network. Bitcoin (registered trademark) uses public key cryptography, which encrypts and decrypts data using two pairs of keys.

[0003] Below is a simple explanation of the process of sending virtual currency using Bitcoin (registered trademark). First, the party paying the virtual currency (sender) generates a pair of public and private keys (1). Next, the sender generates an address (account number) from the public key (2). A collection of these addresses forms a wallet.

[0004] The sender signs the remittance information (the Bitcoin (registered trademark) to be sent, transaction history information such as addresses, etc.) using their own private key (3). The sender broadcasts the remittance information to the P2P network (4). The party receiving the virtual currency (recipient) verifies that the transaction is correct by comparing the public key and the signed remittance information included in the transaction (5).

[0005] In Bitcoin (registered trademark), remittance information is signed using a private key that is known only to the sender, so the private key must be managed with a high level of secrecy. For this reason, the Bitcoin (registered trademark) system poses the issue of how to manage the private key.

[0006] For security reasons, a 64-digit private key consisting of random alphanumeric characters is generally used, so if the private key is forgotten, the Bitcoin (registered trademark) in that address can never be used again. Therefore, some users manage their private keys using various devices and services.

[0007] For example, there are users who have multiple Bitcoin (registered trademark) accounts depending on their intended use, and manage each account in a different way, taking into account factors such as convenience and security. [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] Hiroshi Doi, "Secret Sharing and Its Applications," Journal of Information Security, Vol. 4, [online], November 2012, Graduate School of Information Security, [Retrieved August 30, 2017], Internet〈URL:https: / / www.iisec.ac.jp / proc / vol0004 / doi.pdf〉 [Non-Patent Document 2] GR Blakley, Safeguarding cryptographic keys, Proc. of the National Computer Conference, Vol.48, pp.313-317, 1979, <URL:https: / / www.computer.org / csdl / proceedings / afips / 1979 / 5087 / 00 / 50870313.pdf> Summary of the Invention [Problem to be solved by the invention]

[0009] When using Bitcoin (registered trademark), users need to use computer terminals (such as smartphones, tablet computers, and personal computers) connected to the P2P network. As long as these terminals are connected to the network, it is impossible to completely eliminate the risk that the private key will be leaked to a third party due to malicious third parties illegally accessing the computer terminal.

[0010] Non-Patent Document 1 discloses Shamir's threshold method. In Shamir's threshold method, n unique shares are generated based on the secret information, and these unique shares are distributed to n sharers. Then, by using k (k < n) of the n shares, the original secret information can be restored. That is, even if n - k unique shares are lost, the secret information can be restored using the remaining k unique shares. This means that the information cannot be restored even if k - 1 shares are used. By using this technology, the shares for restoring the secret information can be dispersed.

[0011] However, even if the shares are dispersed, for example, when these shares are stored in a storage device connected to the network, there is a risk that k shares will be leaked due to a third party illegally accessing the storage device. Therefore, it may not be possible to appropriately protect the secret information even when using the technology disclosed in Non-Patent Document 1.

[0012] In particular, when k shares are stored in a storage device located in the same LAN, it has been pointed out that there is a problem that all k shares may be easily leaked to the third party if the third party passes through the Gateway (Firewall) that serves as the entrance to the LAN.

[0013] On the other hand, an ultimate method for appropriately protecting confidential information would be, for example, to write down the values ​​of at least k shares on paper or the like and store the paper in a safe or the like. Since the shares are stored on paper, the share information will not be accessed over a network, and the possibility of the k shares being leaked to a third party can be reduced. However, it has been pointed out that this method has the problem of increasing the information management burden on users.

[0014] In addition, with the recent advancement of the network environment in virtual currency transactions, in light of the current situation in which information on the network can easily be leaked, there is a strong demand for a more advanced private key management system than the secret information recovery value distribution system that uses different memory resources as hardware.

[0015] The present invention has been made to solve the above-mentioned problems, and aims to provide a private key management system that works in conjunction with a private information recoverable value distribution system that can properly protect secret information while reducing the information management burden on users, and that can manage the security level more highly by combining a process to authenticate the legitimacy of the user who generates the private key. [Means for solving the problem]

[0016] The private key management system of the present invention is a private key management system in which a data terminal that performs a process for generating private key information communicates with a plurality of server devices via a predetermined communication medium to manage the distributed values ​​of the private key information, wherein the data terminal is provided with a first registration means for registering one of the n distributed values ​​obtained by distributing the generated private key information in a storage unit for data terminal management, and each server device is independently provided with a second registration means for acquiring from the data terminal distributed values ​​assigned for each server device management, excluding the distributed value for data terminal management, out of the distributed values ​​distributed from the private key information, and different biometric authentication information that can be acquired from a user operating the data terminal, and registering the acquired biometric authentication information together with the distributed value for each server device management in a storage unit for server device management provided in each server device. Effect of the Invention

[0017] According to the present invention, users can appropriately protect secret information without the need for information management that places a heavy burden on the users. In particular, since shares are stored in a distributed manner on multiple server devices, even if one of the distributed and stored shares is leaked, the secret information can be protected as long as all of the k shares are not leaked. [Brief description of the drawings]

[0018] [Figure 1] FIG. 1 is a diagram showing a graph passing through coordinates corresponding to private key values ​​calculated according to Shamir's (k, n) threshold method according to the prior art. [Diagram 2] FIG. 1 is a diagram showing a graph passing through coordinates corresponding to private key values ​​calculated according to Shamir's (k, n) threshold method according to the prior art. [Diagram 3] FIG. 1 is a diagram showing a graph passing through coordinates corresponding to private key values ​​calculated according to Shamir's (k, n) threshold method according to the prior art. [Figure 4] FIG. 1 is a diagram showing an example of the overall configuration of a computer system that constitutes a secret-recoverable value distribution system according to an embodiment of the present invention. [Diagram 5]FIG. 2 is a block diagram showing an example of a detailed configuration of a data terminal constituting the secret-recoverable value distribution system according to the present embodiment. [Figure 6] FIG. 1 is a block diagram showing an example of a share generation process executed by the secret-recoverable value distribution system according to the present embodiment. [Figure 7] FIG. 2 is a block diagram showing an example of a secret recovery process executed by the secret recovery value distribution system according to the embodiment; [Figure 8] FIG. 13 is a diagram showing an example of a combination of multiple physical storage devices in which shares are stored in a distributed manner. [Figure 9] FIG. 13 is a diagram showing an example of a combination of multiple physical storage devices in which shares are stored in a distributed manner. [Figure 10] FIG. 13 is a diagram showing an example of a combination of multiple physical storage devices in which shares are stored in a distributed manner. [Figure 11] 1 is a block diagram illustrating a configuration of a private key management system according to an embodiment of the present invention. [Figure 12] FIG. 2 is a block diagram illustrating the configuration of a server device in the private key management system according to the embodiment. [Figure 13] 4 is a flowchart showing data processing in the private key management system according to the embodiment; [Figure 14] 4 is a flowchart showing data processing in the private key management system according to the embodiment; [Figure 15] 4 is a flowchart showing data processing in the private key management system according to the embodiment; [Figure 16] 1 is a block diagram illustrating a configuration of a private key management system according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] [Configuration of a secret recovery value distribution system] Hereinafter, a secret recovery value distribution system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. Note that this system may be configured as a system that cooperates with a data processing system corresponding to an embodiment described later, or as a system that incorporates a data processing system described later into the secret recovery value distribution system.

[0020] The secret recovery value distribution system according to the present invention distributes secret recovery values ​​(shares) by utilizing the Shamir's threshold scheme (secret sharing scheme) according to the conventional technology.

[0021] Here, Shamir's threshold scheme defines k (threshold), which is the number of shares that can restore the secret information, and n (number of shares), which is the number by which the shares are distributed. In addition to the above, the secret information recoverable value distribution system according to the present invention may use any other secret sharing scheme that can arbitrarily determine a set of shares that can / cannot restore the information (see Non-Patent Document 2).

[0022] [Overview of Shamir's threshold method] First, an overview of the Shamir's threshold method according to the prior art will be described with reference to FIGS.

[0023] Shamir's threshold scheme (hereafter referred to as the "(k,n) threshold scheme") assumes that secret information S is shared among n people. Each of the n people is given n shares generated using a specific polynomial, and secret information S can be restored using k of those shares.

[0024] In other words, the generated n shares are shared among n people, and the secret information S can be restored by using k shares owned by k people. In this specification, this number n is referred to as the number of shares, and the number k is referred to as the threshold.

[0025] Here, when generating shares, an arbitrary k-1th degree polynomial with a constant term S is used. For example, the threshold k is set to "3", n is set to "4" (i.e., four shares are generated, and the secret information S can be restored by using three of them), and the secret information is set to "9". Therefore, a k-1th degree polynomial, that is, an arbitrary quadratic polynomial with a constant term of "9" is used. For example, the coefficient of the first term is set to 2, and the coefficient of the second term is set to 7 to define the following equation (1). f(x)=2x2-7x+9 (1) Let us assume that.

[0026] When generating n=4 shares, assigning the share numbers {1, 2, 3, 4} and substituting f(1), f(2), f(3), and f(4) into equation (1) results in a set of n share values, n={(1, 4), (2, 3), (3, 6), (4, 13)}.

[0027] <System configuration> [First embodiment] Figure 1 shows a graph in which the share values ​​calculated as described above are used as coordinates, and a curve passing through each coordinate is drawn. The curve shown in Figure 1 passes through four coordinates corresponding to the four share values. This curve represents the quadratic polynomial of equation (1). In the (k,n) threshold method, secret information can be restored by using k=3 shares out of n=4. In other words, a similar curve can be drawn by passing through any three of the four coordinates shown in Figure 1.

[0028] On the other hand, the secret cannot be restored by using k-1 shares, i.e., a similar curve cannot be drawn by passing through any two of the four coordinates shown in Figure 1.

[0029] Figure 2 shows a graph in which the values ​​of k=3 shares are plotted as coordinates, and a curve passing through each coordinate is drawn. As can be seen from Figure 2, if the coordinates of the k=3 threshold points are known, it is possible to plot the same curve as the curve shown in Figure 1.

[0030] Fig. 3 shows a graph in which the values ​​of k-1=2 shares are used as coordinates, and a curve passing through each coordinate is drawn. As can be seen from Fig. 3, using only the coordinates of the point where the threshold value k-1=2 is used, it is possible to draw a curve such as the dashed line, and it is not necessarily possible to draw the same curve as the curve shown in Fig. 1. In other words, by using k-1(2) shares, it is not possible to derive the quadratic polynomial shown in equation (1), and therefore it is not possible to restore the secret information S.

[0031] The secret information can be restored from the values ​​of the k shares by using polynomial interpolation, and the specific calculation formula is shown below.

[0032] First, since the threshold k = 3, it can be seen that the polynomial generating the shares is a quadratic polynomial, y = x2 + x + constant term. Then, by replacing the coefficients of each term with a, b, and c, making y = a2 + b + c, and substituting k = 3, a set of share values, k = {(1, 4), (2, 3), (3, 6)}, we can derive equations (2) to (4) as follows, respectively. c=-a-b+4 (2) c=-4a-2b+3 (3) c=-9a-3b+6 (4)

[0033] Next, by substituting equation (2) into equation (3) and equation (4), respectively, a (i.e., the coefficient of the first term of the quadratic polynomial shown in equation (1)) can be derived via equations (5) and (6) as follows: 3a=-b-1 (5) 8a=-2b+2 (6) a=2

[0034] Since the value of coefficient a can be derived from the above equation, by substituting the derived value of a into equations (2) and (3), it is possible to derive b (i.e., the coefficient of the second term of the quadratic polynomial shown in equation (1)) via equations (7) and (8) as follows. c=-b+2 (7) c=-2b-5 (8) b=-7

[0035] Finally, by substituting the derived values ​​of coefficient a and coefficient b into equation (2), it is possible to derive c=9 (i.e., the value of the constant term of the quadratic polynomial shown in equation (1)).

[0036] It can be seen that by substituting the coefficient values ​​derived as described above into the quadratic polynomial, it is possible to restore the quadratic polynomial shown in formula (1), that is, the secret information S. A specific formula for restoring this secret information S is publicly known, for example, as disclosed in Non-Patent Document 1, and therefore will not be described in detail in this specification.

[0037] The secret recovery value sharing system according to the present invention generates n shares using any secret sharing scheme including the above-mentioned (k,n) threshold scheme, and recovers the secret using k shares. In the (k,n) threshold scheme, n>k, but depending on the secret sharing scheme used, n=k may also be satisfied, and it should be noted that the secret recovery value sharing system according to the present invention can be applied in such cases as well.

[0038] In the following, in this specification, the formula used to generate n shares using the secret sharing scheme is referred to as the secret information recovery value (share) generation formula, and the formula used to recover secret information using k shares out of the generated n shares is referred to as the secret information recovery formula.

[0039] When the secret-recoverable value sharing system according to the present invention uses the (k, n) threshold scheme, the share generation formula and the secret recovery formula are calculated using the formulas shown in Non-Patent Document 1. When the secret-recoverable value sharing system according to the present invention uses another secret sharing scheme in addition to the (k, n) threshold scheme, the share generation formula and the secret recovery formula corresponding to that secret sharing scheme are used.

[0040] Next, referring to Fig. 4, an example of the overall configuration of a computer system constituting a secret-recoverable value distribution system according to an embodiment of the present invention is shown. The secret-recoverable value distribution system according to this embodiment is not used alone, but is premised on the existence of a service (computer system) that uses the secret-recoverable value distribution system. However, the above-mentioned computer system may be a system in which the secret-recoverable value distribution system according to this embodiment is implemented.

[0041] In the following embodiment, an example will be described in which the secret information recoverable value distribution system of the present invention works in conjunction with a computer system (hereinafter, a payment system) that provides payment services using virtual currencies such as Bitcoin (registered trademark).

[0042] In this example, when making a payment (remittance) using virtual currency, the user (sender) generates a private key and signs the transaction history information of the virtual currency using the generated private key. Based on this, the private information recoverable value distribution system according to the present invention generates n shares based on the private key generated in the payment system, and recovers the private key based on the k shares.

[0043] As shown in Figure 4, the secret recoverable value distribution system of this embodiment includes a data terminal 1 and a server computer 2, which are connected via a network 3 (a public network such as the Internet, in this embodiment a P2P network).

[0044] The data terminal 1 is a computer device that implements the secret-recoverable value distribution system according to the present invention, and is implemented, for example, in a smartphone, a tablet computer, a personal computer, etc. A user generates n shares by inputting predetermined information using the data terminal 1, and uses k shares among them to restore the secret information.

[0045] The server computer 2 is a computer device that executes a function of providing a payment service or the like by utilizing the secret-recoverable value distribution method according to the present invention. In this embodiment, the data terminal 1 generates n shares by itself and executes the process of recovering the secret information, but the data terminal 1 and the server computer 2 may work together to implement a secret-recoverable value distribution system. In this case, the server computer 2 generates n shares in response to a request from the data terminal 1.

[0046] Next, an example of a detailed configuration of a data terminal 1 constituting a secret recoverable value distribution system according to an embodiment of the present invention will be described with reference to Fig. 5. The data terminal 1 includes a control device 11, a memory 12, a storage device 13, an input driver 16, an input device 15, an output driver 18, and an output device 17.

[0047] The control device 11 is implemented by a processor or the like, and may include a central processing unit (CPU), a graphic processing unit (GPU), and one or more control device cores. The control device 11 executes a predetermined program (OS and application program). The memory 12 may include a volatile or non-volatile memory, for example, a random access memory (RAM), a dynamic RAM, or a cache memory. The memory 12 temporarily stores program data executed by the control device 11.

[0048] The storage device 13 is a storage device built into the data terminal 1, and may include, for example, a hard disk drive, a solid state drive, an optical disk, and a flash drive. The storage device 13 stores one of the n generated shares. The communication device 14 is implemented by a network interface card (for example, a LAN card) or the like, and transmits and receives data via the network 3.

[0049] The input devices 15 may include a keyboard, a keypad, a touch screen, a touch pad, a microphone, an accelerometer, a gyroscope, a biometric scanner, etc. The input devices 15 receive user input and communicate it to the controller 11 via an input driver 16.

[0050] The output device 17 may include a display, a speaker, a printer, etc. The output device 17 receives output from the control device 11 via an output driver 18 and outputs it (visual output via a display, audio output via a speaker, etc.).

[0051] A removable storage device 19 is connected to the data terminal 1. When the removable storage device 19 is connected, information from the removable storage device 19 is communicated with the control device 11 via the input driver 16. Also, output from the control device 11 is output (stored) in the removable storage device 19 via the output driver 18. The removable storage device 19 includes any removable and non-volatile storage device 13, such as a flash memory such as a USB memory and an SD card, an optical storage medium such as a CD-ROM and a DVD, a magnetic storage medium such as a floppy disk, or a USB type memory that accommodates an SSD.

[0052] As described above, the secret recovery value distribution system according to this embodiment works in conjunction with a specific computer system. That is, an application program provided by the specific computer system is executed on the data terminal 1. It is desirable that the secret recovery value distribution system according to this embodiment is executed independently for each service corresponding to the application program executed on the data terminal 1.

[0053] For example, when the data terminal 1 runs the operating system "iOS" (registered trademark) made by Apple Inc. (such as iPhone), the storage device 13 configures a logically independent storage area for each service. In this case, for example, when the data terminal 1 runs a plurality of application programs and each application program works with a secret information restorable value distribution system, a logically independent storage area can be used for each service corresponding to the application program. This means that when shares, which will be described later, are stored in the storage device 13, they can be stored in a logically independent area for each application program to be executed, which further enhances security.

[0054] When the data terminal 1 runs an operating system other than iOS (such as Windows (registered trademark) and Android (registered trademark)), for example, a container-type virtualization technology can be used to provide an independent storage area for each service or each user. In this way, when multiple application programs are executed and each application program works with a secret information restorable value distribution system, further security can be ensured by implementing independent storage areas.

[0055] Next, a secret-recoverable value (share) generation process executed by the secret-recoverable value distribution system according to the embodiment of the present invention will be described with reference to FIG.

[0056] In this embodiment, an example will be described in which a private key used in the above-mentioned payment service is treated as private information, shares are generated based on the private key, and the shares are distributed and stored.

[0057] In this case, the application program providing the payment service and the secret information recovery value distribution system are linked, and hereinafter, the application program providing the payment service is referred to as a payment application. The payment service is performed by exchanging information between the data terminal 1 and the server computer 2.

[0058] As shown in Fig. 6, the control device 11 of the data terminal 1 executes a predetermined program on the memory 12 to execute a share generation process including steps 61 to 64. In step 61, the control device 11 executes a payment application to generate a private key. This process includes a process of generating a private key used when transferring virtual currency in a payment service according to the conventional technology, and the generated private key is stored in the memory 12 and / or the storage device 13 using, for example, three memory resources.

[0059] In step 62, the control device 11 generates the number of shares (n) using the share generation formula described above based on the private key generated in step 61. In this embodiment, n=3, and shares are represented as shares 1 to 3 to identify each share. Also, the threshold k(n-1)=2.

[0060] Here, the share generated in step 62 is, for example, a file with a ".txt" extension, and a value calculated based on the secret sharing scheme is written into the file. The file name may be, for example, "UUID_share number.txt". The UUID is generated uniquely for each application program according to an arbitrary version. That is, in this embodiment, a unique UUID is generated for each application that works with the secret information recoverable value distribution system. Since the UUID is a unique number each time it is generated, the file name of the share is unique for each application program and each time it is generated. By assigning file names in this manner, the independence of the application programs is further increased.

[0061] Note that the use of UUID in the file name is merely an example, and is not limited to such a format. Any unique numerical value may be generated for each service that is linked to the secret information restorable value distribution system according to this embodiment, and the numerical value may be used in the file name. In addition, as will be described later, the generated share is deleted every time the secret information is restored. The unique numerical value such as UUID used in the file name may be assigned a new numerical value every time the secret information is restored, or a new numerical value may be assigned only when the share is lost.

[0062] In this embodiment, the processes of steps 61 and 62 are executed by the data terminal 1, but are not limited to this format. The processes of steps 61 and / or 62 may be executed by the server computer 2. In this case, for example, in response to a request from the data terminal 1, the server computer 2 generates a private key and / or a share and transmits them to the data terminal 1. When the private key and / or a share are generated by the server computer 2, they are deleted from the memory area 13 of the server computer 2 after being transmitted to the data terminal 1.

[0063] In step 63, the control device 11 stores the three shares generated in step 62 in the predetermined storage area 13. Here, the predetermined storage area 13 includes the predetermined area of ​​the storage device 13 of the data terminal 1 as well as the removable storage medium 19 described above. In other words, the n shares are stored separately in a plurality of independent physical storage devices (media). The removable storage medium 19 includes, for example, a USB memory and an SD card.

[0064] The combinations of the multiple physical storage devices in which the shares are distributed and stored are not limited to the above-mentioned combinations, and may include, for example, the combinations shown in Figures 8 to 10 below.

[0065] The combination shown in Fig. 8 indicates that share 1 is stored in storage device 13, share 2 is stored in a USB memory, and share 3 is stored in an SD card. Storage device 13 is a storage device 13 built into a data terminal 1 connected to network 3, and is therefore connected to network 3 via data terminal 1. On the other hand, removing the USB memory and SD card will cut them off from network 3. For this reason, storing shares in a removable storage device 19 such as a USB memory provides higher security.

[0066] As described above, in the secret recovery value distribution system according to this embodiment, the secret cannot be recovered even if k-1 shares are used. In other words, by preventing leakage of n-(k-1) shares, leakage of the secret can be prevented. In the combination shown in FIG. 8, each of n-(k-1) (i.e., 2) shares is stored in a removable storage device 19 that can be disconnected from the network 3, which is a preferable combination in terms of ensuring security.

[0067] In this embodiment, in order to ensure that n shares are stored in a plurality of independent physical storage devices, it may be determined whether the removable storage device 19 is connected to the data terminal 1 before executing step 61 or step 62. In this process, the control device 11 can recognize whether the removable storage device 19 is connected by executing a device control API such as UsbDevice that is provided as standard in the Android operating system. If the control device 11 determines through this process that the removable storage device 19 is not connected to the data terminal 1, it may notify the user of an error message (via the output device 17). On the other hand, if the control device 11 determines that the removable storage device 19 is connected to the data terminal 1, it notifies the user of a message to that effect, and transitions to the process of the subsequent step 64.

[0068] Furthermore, by executing the device control API, it is possible to determine the type of device connected to the data terminal 1. Therefore, in order to ensure that n-(k-1) shares are stored in the removable storage devices 19, it may be determined whether n-(k-1) removable storage devices 19 are connected to the data terminal 1. In the combination shown in Fig. 8, it is determined whether an SD card and a USB memory are each connected.

[0069] In addition to the combinations shown in Figure 8, the following combinations can also ensure similar security.

[0070] 9 shows that share 2 and share 3 are stored in two independent USB memory sticks. In this way, when multiple independent physical storage devices are the same type of removable storage device 19, after storing the share in the first physical storage device, the user needs to remove the physical storage device and newly connect the second physical storage device.

[0071] In this way, to ensure that shares are stored in separate, independent physical storage devices of the same type, when a second physical storage device is connected, it may be determined whether it is a different physical storage device from the first physical storage device. This process is performed by executing the device control API described above to identify each of the physical storage devices (such as by the serial number of the connected device). If the control device 11 determines through this process that the second physical storage device is the same physical storage device as the first physical storage device, it may notify the user of an error message (via the output device 17). On the other hand, if the control device 11 determines that the second physical storage device is a different physical storage device from the first physical storage device, it notifies the user of a message to that effect, and proceeds to the process of the subsequent step 64.

[0072] In addition, the following combinations are also possible:

[0073] The combination shown in Fig. 10 indicates that share 1 is stored in storage device 13, share 2 is stored in an external storage device connected to the network such as a NAS or SAN, and share 3 is stored in a USB memory. This combination has inferior security compared to the combinations shown in Figs. 8 and 9, since k shares are normally stored in a storage device that is not blocked from the network 3.

[0074] The combination of storage devices 13 in which the shares are distributed and stored may be predefined in the secret recovery value distribution system, or the user may set the combination at any time. Similarly, the number of shares and the threshold number may be predefined in the secret recovery value distribution system, or the user may set the number at any time.

[0075] In step 64, the private key generated in step 61 and stored in memory 12 and / or storage device 13 is deleted. This process results in no private information existing in data terminal 1, and n shares being stored in a distributed manner. If removable storage device 19 is not removed a certain period of time after the shares were stored, a message to that effect may be sent to the user. This makes it possible to ensure that removable storage device 19 is removed from data terminal 1, i.e., that the stored shares are disconnected from network 3.

[0076] Next, a secret information recovery process executed by the secret information recoverable value distribution system according to the present invention will be described with reference to Fig. 7. The secret information recovery process described in this embodiment is a process for recovering the secret information generated in the share generation process described in Fig. 6 in normal use. In other words, this is an example of recovering the private key used to sign transaction history information of virtual currency when transferring virtual currency in the above-mentioned payment service without leaking or losing a single share.

[0077] There are two types of private information restoration processes: the first is the restoration process for normal use as described above, and the second is the restoration process in the event of share leakage, loss or replacement of a computer terminal, etc. These two types of restoration processes can be selected on a menu screen (not shown) displayed on the output device 17 (such as a display) of the data terminal 1 (the former type is called "normal restoration mode" and the latter type is called "recovery mode"). The purpose of recovery mode is not to restore private information, but to regenerate shares.

[0078] 7, the control device 11 of the data terminal 1 executes a predetermined program to execute a private information restoration process including steps 71 to 73. In step 71, the control device 11 reads a threshold (k) number of shares from any of a plurality of physical storage devices. In this embodiment, k=2, and share 1 is read from the storage device 13, and share 2 is read from the USB memory.

[0079] In the process of step 71, it may be determined whether the shares are being read from the same physical storage device as when the shares were stored in step 63 in the share generation process described in FIG. 6. As described above, the physical storage device can be identified by executing the device control API, so this determination can be made by storing the identifiers of the respective physical storage devices at the time when the control device 11 stores n shares. If this process determines that the shares have been obtained from a physical storage device different from when they were stored, an error message may be notified to the user (via the output device 17). This can further reduce the possibility that confidential information will be restored by a third party even if the shares are leaked.

[0080] In step 72, the control device 11 restores the secret information using the above-mentioned secret information restoration formula based on the k shares acquired in step 71. The restored secret information is used in cooperation with the application 1 to sign transaction history information of the virtual currency in the payment service.

[0081] In step 73, the control device 11 deletes the shares stored in each physical storage device. If the above-mentioned recovery mode is selected, the corresponding shares are deleted from at least the k physical storage devices in which the k shares acquired in step 71 are stored. On the other hand, if the normal recovery mode is selected, the corresponding shares are deleted from the n physical storage devices in which n shares are stored. When this deletion process is performed, depending on the mode selected by the user, Accordingly, it may be determined whether a predetermined number of shares have been removed.

[0082] Furthermore, in step 73, the control device 11 deletes the private key restored in step 72. This deletion process may be performed by setting a timer at the timing when the private key is restored, and deleting the private key in response to the timer having reached a predetermined time period. This process deletes the restored private key from the data terminal 1 when the predetermined time period has passed, thereby further reducing the possibility that private information will be leaked to a third party.

[0083] In this way, the security of the secret information can be further ensured since the shares are deleted every time the secret information is generated and restored. If the above-mentioned recovery mode is selected, the control device 11 controls the execution of the share generation process described in FIG. 6 after step 73, and generates shares based on the secret information restored in step 72. For example, different shares can be generated by changing the coefficients of the first term and the second term in the quadratic polynomial shown in equation (1). This process allows a new share to be generated again even if one of the shares is lost.

[0084] [Effects of the first embodiment] According to this embodiment, the generated shares are stored in a physical storage device, so that the load of managing the private key used in the payment service is reduced. In addition, when the secret information restorable value distribution system according to the present invention is applied to an authentication system using an ID and a password, for example, and the password is used as the secret information, the risk of the password being leaked can be avoided by reusing the same or similar password in all services.

[0085] Furthermore, by implementing storage device 13 storing the shares in removable storage device 19 and removing it from the computer terminal, the shares can be blocked from network 3. In the secret-recoverable value distribution system according to the present invention, the secret cannot be recovered unless k shares are collected, so extremely high security can be ensured by storing at least n-(k-1) shares in removable storage device 19 and removing them from the computer terminal for storage.

[0086] [Configuration of private key management system] Second Embodiment Fig. 11 is a block diagram for explaining the configuration of the private key management system according to the present embodiment. In Fig. 11, 1000 denotes a communication unit that transmits private key information, which includes the generated share, to a first server device 1001 or a second server device 1002 that stores the generated share, using a predetermined protocol, via a network 1003. The first server device 1001 or the second server device 1002 includes hardware resources, which will be described later.

[0087] Reference numeral 1100 denotes a biometric information reader that reads a unique vein image from the user's wrist using, for example, a vein scanning function. The read vein image is linked to predetermined identification information and registered in the storage device 13 as personal authentication information.

[0088] The first server device 1001 receives the generated share S2 and the biometric authentication information from the data terminal 1 via the network 1003, and registers and manages them in the storage unit 2004 shown in FIG.

[0089] The second server device 1002 receives the generated share S3 and the biometric authentication information from the data terminal 1 via the network 1003, and registers and manages them in the storage unit 2004 shown in Fig. 12. Note that the biometric authentication is not limited to wrist vein information, and may be retinal information, or may be managed as a combination of these as biometric authentication information.

[0090] The business operators of the first server device 1001 and the second server device 1002 are to be the same or to be affiliated with each other, and thus a subordinate relationship between them is to be excluded. This makes it possible to prevent a situation in which a person in charge of the same business operator obtains shares generated from private key information in excess of the management limit, thereby being able to restore private key information.

[0091] In addition, in this embodiment, a case is shown in which two servers, a first server device 1001 and a second server device 1002, are connected to the network 1003, but the number of servers connected to the network 1003 may be two or more. Fig. 12 is a block diagram for explaining the configuration of the first server device 1001 and the second server device 1002 shown in Fig. 11. The same reference numerals are used to denote the same components as in Fig. 11.

[0092] In FIG. 12, reference numeral 2001 denotes a CPU, which performs overall control of I / O 1101 with each device as hardware connected to an internal bus based on a BIOS stored in a ROM 2002 .

[0093] Reference numeral 2003 denotes a RAM, which functions as a work memory for applications executed by the CPU 2001, and is configured so that its storage capacity can be expanded. Reference numeral 2004 denotes a storage unit formed of a non-volatile memory medium, in which an area is reserved for storing shares generated from private key information received from the data terminal 1, and biometric authentication information for identifying the user operating the data terminal 1.

[0094] The RAM 2003 of the server devices 1001, 1002 in the private key management system configured in this manner stores a program that functions as a second registration unit 12A that acquires from the data terminal 1 the distributed values ​​(shares S2, S3) assigned for each server device management among the distributed values ​​(shares S2, S3) distributed from the private key information, excluding the distributed value for data terminal management (share S1), as well as different biometric authentication information that can be acquired from the user operating the data terminal 1, and registers the acquired biometric authentication information together with the distributed value for each server device management in a storage unit for server device management (corresponding to the memory unit 2004 in this embodiment) provided in each server device 1001, 1002.

[0095] The data terminal 1 also has a first registration unit 11A that registers one of the n distributed values ​​obtained by distributing the generated private key information in a storage unit for data terminal management (secured on the memory device 13), and a first restoration unit 11B that extracts the distributed value for terminal management (share S1) registered in the memory device 13, and obtains distributed values ​​for server device management (shares S1, S2) that are separately registered from either of the server devices 1001, 1002 authenticated by the registered biometric authentication information BIO, and restores the private key information.

[0096] Furthermore, the data terminal 1 is provided with a first discarding unit 11C that discards the restored private key information and the distributed value (shares S2, S3) for server device management obtained from either of the server devices 1001, 1002 after the first restoration unit 11B restores the private key information.

[0097] Furthermore, the data terminal 1 is equipped with a judgment unit 11D that judges whether or not either of the selected server devices 1001, 1002 is a server device in which the same distributed value for server device management as the distributed value for server device management distributed from the same private key information has already been registered, for example by referring to the IP address or MAC address, and an exclusion unit 11E that excludes the server device from the registration destinations for distributed values ​​for server device management when the judgment unit 11D judges that the same distributed value for server device management (shares S2, S3) is the same as that of an already registered server device.

[0098] Figures 13 to 15 are flowcharts showing an example of a data processing procedure in the private key management system of this embodiment, where the process shown in Figure 13 corresponds to the data processing procedure ((1) to (13)) of the data terminal 1, the process shown in Figure 14 corresponds to the data processing procedure ((21) to (25)) of the first server device 1001, and the process shown in Figure 15 corresponds to the data processing procedure ((31) to (35)) of the second server device 1002.

[0099] [Data processing on Data Terminal 1 side] First, the control device 11 of the data terminal 1 generates a private key in accordance with the processing of the embodiment described above (1). Similarly, the control device 11 generates multiple shares, three shares S1 to S3 in this embodiment, on the storage device 13 (2). The user places their wrist on the biometric information reading unit 1100 connected to the data terminal 1 and issues a scan instruction, performs specified image processing to generate biometric authentication information (BID), and then registers the share S1 managed by the data terminal 1 and the BID that authenticates the user of the data terminal 1 in the storage device 13 (3).

[0100] Next, the control device 11 reads out the share S2 and BID registered in the storage device 13, and transmits them to the first server device 1001 via the network 1003 (4). Then, the control device 11 receives a registration completion notice from the first server device 1001 indicating that the share S1 and BID have been registered in the storage unit 2004 (5).

[0101] Next, the control device 11 reads out the share S3 and BID registered in the storage device 13, and transmits them to the second server device 1002 via the network 1003 (6). Then, the control device 11 receives a registration completion notification from the second server device 1002 indicating that the share S1 and BID have been registered in the storage unit 2004 (7).

[0102] As a result, of the multiple shares S1 to S3 generated, the control device 11 retains share S1 in the data terminal 1, registers share S2 and the BID, which is biometric authentication information, in the memory unit 2004 of the first server device 1001, and registers share S3 and the BID, which is biometric authentication information, in the memory unit 2004 of the second server device 1002.In other words, shares S2 and S3 can be distributed and registered and managed in the first server device 1001 and the second server device 1002.

[0103] In addition, in preparation for private key restoration, shares S2 and S3 can be registered and managed in a distributed state in the first server device 1001 and the second server device 1002 in combination with biometric authentication information that cannot be used by anyone other than the user of the data terminal 1.

[0104] On the other hand, when restoring the private key in the data terminal 1, if the user operating the data terminal 1 is successfully authenticated by the first server device 1001 using the registered biometric authentication information (8), the share S2 registered in the memory unit 2004 is read from the first server device 1001 and sent to the data terminal 1, and the control device 11 obtains the share S2 from the first server device 1001 via the network 1003 (9).

[0105] Similarly, if a user operating the data terminal 1 is successfully authenticated by the second server device 1002 using the registered biometric authentication information (10), the share S3 registered in the memory unit 2004 is read from the second server device 1002 and sent to the data terminal 1, and the control device 11 obtains the share S3 from the second server device 1002 via the network 1003 (11).

[0106] Next, the control device 11 executes a process of recovering the private key from the share S1 registered in the storage device 13, the share S2 acquired from the first server device 1001, and the share S3 acquired from the second server device 1002 (12).

[0107] Next, the control device 11 discards the share S1 registered in the storage device 13, the share S2 acquired from the first server device 1001, and the share S3 acquired from the second server device 1002 (13), and ends the process.

[0108] The data terminal 1 discards all registered shares S1 to S3 and does not reuse them each time a private key restoration process is performed using shares S1 to S3, making it possible to manage shares S1 to S3 without reducing their reliability.

[0109] [Data processing on the first server device 1001 side] In FIG. 14, the CPU 2001 of the first server device 1001 receives (21) the BID and share S2 sent in step (4) shown in FIG. 13, and after registering them in the memory unit 2004 (22), notifies the data terminal 1 via the network 1003 that share S2 has been registered (23).

[0110] Thereafter, when a request to restore the private key occurs on the data terminal 1 side, the CPU 2001 determines whether the user of the data terminal 1 is the user who registered share S2 by checking whether the BID of the registered user matches the BID obtained from the data terminal 1, and determines whether the authentication is OK (24). If the CPU 2001 determines that the authentication is not OK, it does not respond to the request from the data terminal 1 and terminates the processing.

[0111] On the other hand, if the CPU 2001 determines in step (24) that the authentication is OK, it reads out the share S2 registered in the storage unit 2004 and transmits it to the data terminal 1 via the network 1003 (25), and the process ends. When transmitting and receiving the share S2, it is optional to incorporate a process for transmitting and receiving data as a file using a specified encryption technology.

[0112] [Data processing on the second server device 1002 side] In FIG. 15, the CPU 2001 of the second server device 1002 receives (31) the BID and share S3 sent in step (6) shown in FIG. 13, and after registering them in the memory unit 2004 (32), notifies the data terminal 1 via the network 1003 that share S3 has been registered (33).

[0113] Thereafter, when a request to restore the private key occurs on the data terminal 1 side, the CPU 2001 determines whether the user of the data terminal 1 is the user who registered the share S3 by checking whether the BID of the registered user matches the BID obtained from the data terminal 1, and determines whether the authentication is OK (34). If the CPU 2001 determines that the authentication is not OK, it does not respond to the request from the data terminal 1 and terminates the processing.

[0114] On the other hand, if the CPU 2001 determines in step (34) that the authentication is OK, it reads out the share S3 registered in the storage unit 2004 and transmits it to the data terminal 1 via the network 1003 (35), and the process ends. When sending and receiving share S3, it is optional to incorporate a process for performing data sending and receiving processing as a file using a specified encryption technology.

[0115] [Effects of the second embodiment] According to this embodiment, multiple shares generated from the generated private key can be registered and managed in multiple server devices distributed over a network, thereby significantly improving reliability and convenience compared to systems that manage shares as a memory medium.

[0116] Third Embodiment FIG. 16 is a block diagram for explaining the configuration of a private key management system according to this embodiment, in which the same components as those in FIG. 12 are given the same reference numerals. 12 in that the present embodiment includes a second restoration unit 11B-1 and a second destruction unit 11C-1. In the present embodiment, the second restoration unit 11B-1 restores the private key in three restoration modes.

[0117] Specifically, the second restoration unit 11B-1 restores the private key from share S1 and share S2 of share S1 registered in the data terminal 1, share S2 registered in the first server device 1001, and share S3 registered in the second server device 1002 (first restoration mode).

[0118] On the other hand, the second restoration unit 11B-1 restores the private key from share S1 and share S3 of share S1 registered in the data terminal 1, share S2 registered in the first server device 1001, and share S3 registered in the second server device 1002 (second restoration mode).

[0119] In addition, the second restoration unit 11B-1 restores the private key from shares S2 and S3 of the share S1 registered in the data terminal 1, the share S2 registered in the first server device 1001, and the share S3 registered in the second server device 1002 (third restoration mode).

[0120] Moreover, the second discard unit 11C-1 discards all of the shares S1 to S3 used in the restoration process in accordance with the above-mentioned first to third restoration modes.

[0121] [Effects of the third embodiment] According to this embodiment, the private key can be effectively restored by simply combining at least two available shares among the shares S1 to S2 distributed and registered by the first server device 1001 and the second server device 1002.

[0122] This makes it possible to reliably restore the private key even if any of the server devices on the network in which the share is registered becomes unavailable (system down, maintenance), enabling flexible response to system conditions.

[0123] [Fourth embodiment] In the above embodiment, an example was described in which no restrictions were placed on the operator of the server device that distributes and registers the generated shares S2 and S3. However, if the server devices are managed by the same operator, the possibility cannot be denied that a systems engineer (SE) could maliciously obtain shares S2 and S3, leading to a situation in which a third party could easily restore the private key.

[0124] Therefore, an application that determines whether the server devices for shares S2 and S3 in which data terminals 1 are distributed are installed in the system, and a process can be incorporated that evaluates the similarity of URL information and vulnerabilities, and controls the registration of shares only for server devices that have obtained an evaluation value that allows them to be recognized as server devices operated by different operators.

[0125] Specifically, the data terminal 1 is configured to incorporate a program that executes a function to determine whether the server device selected by the control device 11 is a server device in which the same distributed value for server device management as the distributed value for server device management distributed from the same private key information has already been registered, and a function to exclude the server device from the registration destinations for distributed values ​​for server device management if it is determined that the server device is a server device in which the same distributed value for server device management has already been registered.

[0126] [Effects of the fourth embodiment] According to this embodiment, each share generated can be registered on server devices operated by multiple different operators, and a system can be constructed in which malicious SEs or administrators within the operator cannot restore private keys from each registered share. The disclosure regarding the present invention described above can be summarized at least as follows.

[0127] (1) A private key management system in which a data terminal that performs a process for generating private key information communicates with a plurality of server devices via a predetermined communication medium to manage the distributed values ​​of the private key information, the data terminal having a first registration means for registering one of the n distributed values ​​obtained by distributing the generated private key information in a storage unit for data terminal management, and each server device independently having a second registration means for acquiring from the data terminal distributed values ​​assigned for each server device management among the distributed values ​​distributed from the private key information, excluding the distributed value for data terminal management, and different biometric authentication information that can be acquired from a user operating the data terminal, and registering the acquired biometric authentication information together with the distributed value for each server device management in a storage unit for server device management provided in each server device.

[0128] (2) The data terminal is characterized in that it has a first restoration means for extracting a distributed value for terminal management registered in the storage unit, and acquiring a distributed value for server device management registered in any of the server devices authenticated with different biometric authentication information to be notified to any of the server devices, thereby restoring the private key information.

[0129] (3) The data terminal is characterized in that it has a second restoration means for extracting a distributed value for terminal management registered in the storage unit, and acquiring a distributed value for server device management registered in any of the server devices authenticated with different biometric authentication information to be notified to any of the server devices, thereby restoring the private key information.

[0130] (4) The present invention is characterized in that it includes a first discarding means for discarding the restored private key information and a distributed value for server device management obtained from any of the server devices after the first restoration means has restored the private key information.

[0131] (5) The present invention is characterized in that it includes a second discarding means which discards the restored private key information and the distributed values ​​for server device management obtained from all server devices after the second restoration means restores the private key information. (6) Each provider of each server device is characterized by being an exclusive business entity.

[0132] (7) The data terminal is characterized in that it comprises a judgment means for judging whether the selected server device is a server device in which a distributed value for server device management identical to the distributed value for server device management distributed from the same private key information has already been registered, and an exclusion means for excluding the server device from the registration destinations for the distributed value for server device management when the judgment means judges that the server device is a server device in which the distributed value for server device management has already been registered. [Industrial Applicability]

[0133] In this embodiment, the present invention has been described as being applied to a system that uses virtual currency, but it is expected that the reliability of private key generation and restoration processes can be significantly improved by incorporating this system into systems other than those described above as long as the system is capable of using private keys. [Explanation of symbols]

[0134] 1001 First server device 1002 Second server device 1003 Network 1100 Biometric information reader

Claims

1. A private key management system for managing shared values ​​of private key information distributed by communication between a data terminal that performs a process of generating private key information and a plurality of server devices via a predetermined communication medium, comprising: The data terminal comprises: a first registration means for registering one of n shared values ​​obtained by distributing the generated private key information in a storage unit for managing the data terminal; Each server device A private key management system characterized in that it is characterized by independently comprising a second registration means for acquiring from the data terminal, among the shared values ​​distributed from the private key information, shared values ​​assigned for managing each server device, excluding the shared value for managing the data terminal, and different biometric authentication information that can be acquired from a user operating the data terminal, and registering the acquired biometric authentication information together with the shared value for managing each server device in a storage unit for managing the server device provided in each server device.

2. The data terminal comprises: The private key management system according to claim 1, further comprising a first restoration means for extracting a shared value for terminal management registered in the storage unit, and acquiring a shared value for server device management registered in any of the server devices authenticated with different biometric authentication information to be notified to any of the server devices, thereby restoring the private key information.

3. The data terminal comprises: The private key management system according to claim 1, further comprising a second restoration means for extracting a shared value for terminal management registered in the storage unit, and acquiring a shared value for server device management registered in any of the server devices authenticated with different biometric authentication information to be notified to any of the server devices, thereby restoring the private key information.

4. 3. The private key management system according to claim 2, further comprising a first discarding means for discarding the restored private key information and a shared value for server device management acquired from any of the server devices after the first restoration means has restored the private key information.

5. 4. The private key management system according to claim 3, further comprising a second discarding means for discarding the restored private key information and the shared values ​​for server device management acquired from all server devices after the second restoration means restores the private key information.

6. 2. The private key management system according to claim 1, wherein each of the server devices is provided by an exclusive business entity.

7. The data terminal comprises: a determination means for determining whether the selected server device is a server device in which the same server device management share value as the share value for server device management distributed from the same private key information has already been registered; an exclusion means for excluding the server device from the registration destinations of the server device management variance value when the determination means determines that the server device is a server device in which the same server device management variance value has already been registered; 2. The private key management system according to claim 1, further comprising:

Images