Threshold secret recovery method and apparatus

Abstract

This invention provides a threshold-based secret recovery method and apparatus that improves the recoverability of secrets even when shares are lost. [Solution] The method includes the steps of acquiring first shares generated by a first share generation structure from participants, determining whether the number of acquired first shares is equal to or greater than a first threshold, recovering the secret by a threshold secret recovery method if the number of first shares is equal to or greater than the first threshold, acquiring second shares generated by a second share generation structure from participants if the number of acquired first shares is less than the first threshold, and recovering the secret using the acquired first and second shares. The critical share set is determined such that the number of shares in the critical share set, which is a subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure, is equal to or greater than a critical threshold less than the first threshold.

Description

Technical Field

[0001] The present invention relates to a threshold secret recovery method and apparatus, and more particularly, to a threshold secret recovery method and apparatus that can improve the recoverability of secrets.

Background Art

[0002] Threshold secret recovery means that a plurality of participants store shares determined by a share structure, and a method of recovering a secret by collecting shares (a total of n shares) held by the plurality of participants and the number of shares (t shares) required for secret recovery from the participants. Here, t, which is the minimum number of shares required for secret recovery, corresponds to the threshold value.

[0003] In 1979, Shamir proposed a secret sharing and recovery method in the Communications of the ACM journal. The threshold secret sharing method proposed by Shamir randomly selects the remaining coefficients except the constant term used for the secret to determine a (t-1)-degree polynomial, and determines n shares from n points passing through this polynomial. The (t-1)-degree polynomial corresponds to the share structure, and if t shares can be found among the n shares, the secret corresponding to the constant term can be found.

[0004] Such a threshold secret sharing and recovery method provides perfect security. Perfect security means the property that no information about the secret S can be found with (t-1) or fewer shares. The secret included in the polynomial is S, which is the constant term. However, for any point (0, S') where S'≠S, there always exists a (t-1)-degree polynomial passing through this point and (t-1) points, so the attacker cannot find any information about S.

[0005] On the other hand, there are methods that utilize geometric properties as a share structure, such as the Blakely secret sharing method presented at the 1979 International Workshop on Managing Requirements Knowledge. In this method, a lower-dimensional plane or line is used in a vector space, and the intersections of these planes or lines are defined as secrets. For example, the intersection Q of a known line and a (t-1)-dimensional hyperplane can be defined as a secret, and n points on the hyperplane can be used as shares. The hyperplane can be determined using t points from the n points, and the secret can be restored by finding the intersection Q of the determined hyperplane and the known line. Alternatively, the intersections of hyperplanes can be defined as secrets, each hyperplane can be generated as a share, and then the secret can be restored from the t hyperplanes.

[0006] This (t, n) threshold secret recovery method enhances the security of secrets because the secret can only be known if an attacker seizes t or more shares out of n shares. Furthermore, even if some participants who are holding shares lose some shares, the secret can be recovered at any time as long as t or more shares are maintained.

[0007] However, since losing more than (nt) shares makes it impossible to recover the secret, participants must take extra care not to lose any shares. That said, increasing the number of shares (n) or decreasing the threshold number of shares (t) to prepare for the possibility of the secret becoming unrecoverable would also increase the likelihood of an attacker finding the secret, thus creating a trade-off problem. [Overview of the project] [Problems that the invention aims to solve]

[0008] An embodiment of the present invention proposes a threshold-based secret recovery method that can improve the recoverability of secrets even when shares are lost, taking into account the characteristics of participants in secret sharing.

[0009] Furthermore, the embodiment of the present invention proposes a threshold-based secrecy recovery method that can improve the secrecy recovery capability by using other forms of secrecy recovery methods even when secrecy recovery using a specific share structure is impossible due to the loss of numerous shares. [Means for solving the problem]

[0010] The threshold-based secrecy recovery method according to the present invention includes the steps of: (a) acquiring first shares generated by a first share generation structure from participants; (b) determining whether the number of acquired first shares is equal to or greater than a first threshold t; (c) recovering the secrecy by the threshold-based secrecy recovery method if the number of first shares is equal to or greater than the first threshold t (t, n); (d) acquiring second shares generated by a second share generation structure from participants if the number of acquired first shares is less than the first threshold t; and (e) recovering the secrecy using the acquired first shares and the acquired second shares, wherein the critical share set is determined such that the number of shares in the critical share set, which is a subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure, is equal to or greater than a critical threshold r which is smaller than the first threshold.

[0011] The first threshold t for desecrating the confidentiality of the first share generation structure is set to be greater than the number of participants who may betray the group to which the first share was allocated.

[0012] A copy share set is determined, which is a subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure. The intersection of the copy share set and the critical share set is an empty set, and the union of the copy share set and the critical share set is the intersection of the first share set and the second share set.

[0013] The second share set includes the critical share set, the copy share set, and an additional share set determined by the second share generation structure.

[0017] The aforementioned copy-share set and the aforementioned additional share set will be distributed to participants who are less likely to lose them.

[0014] The number of intersections between the set of shares allocated to the potentially unfaithful participants and the critical share set is set to be less than the critical threshold r.

[0015] The second share generation structure is determined to have a different structure from the first share generation structure by utilizing the critical share set and the copy share set included in the first share.

[0016] If all shares in the first share set belong to the union of the critical share set and the copy share set, the second share generation structure is determined identically to the first share generation structure.

[0017] The second threshold value of the second share generation structure is set to be greater than or equal to the number of elements in the union of the critical share set and the copy share set.

[0018] According to another aspect, the threshold secret recovery device according to the present invention includes a processor and at least one memory connected to the processor, wherein the processor performs the steps of: (a) acquiring first shares generated by a first share generation structure from participants; (b) determining whether the number of acquired first shares is greater than or equal to a first threshold t; (c) recovering the secret by a threshold secret recovery method if the number of first shares is greater than or equal to the first threshold t (t, n); (d) acquiring second shares generated by a second share generation structure from participants if the number of acquired first shares is less than the first threshold t; and (e) recovering the secret using the acquired first shares and the acquired second shares, wherein the critical share set is determined such that the number of shares in the critical share set, which is a subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure, is greater than or equal to a critical threshold r which is smaller than the first threshold. [Effects of the Invention]

[0019] This invention has the advantage of improving the recoverability of secrets even when shares are lost, by taking into account the characteristics of participants in secret sharing.

[0020] Furthermore, the present invention has the advantage of improving the recoverability of secrets by using other forms of secret recovery methods even when secret recovery using a specific share structure is impossible due to the loss of numerous shares. [Brief explanation of the drawing]

[0021] [Figure 1] This is a block diagram showing the structure of a threshold secret recovery device according to one embodiment of the present invention. [Figure 2] This diagram illustrates an example of determining shares using a polynomial share generation structure. [Figure 3] This flowchart shows the overall flow of a share generation structure and share generation method for recovering confidentiality according to one embodiment of the present invention. [Figure 4] A drawing showing an example of a share set generated according to an embodiment of the present invention. [Figure 5] A table showing the preferences of participants according to an embodiment of the present invention. [Figure 6] A drawing showing a share set for threshold secret sharing. [Figure 7] A flowchart showing the overall flow of a threshold secret recovery method according to an embodiment of the present invention.

Embodiments for Carrying Out the Invention

[0022] Hereinafter, specific embodiments according to embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to assist in a comprehensive understanding of the methods, apparatuses, and / or systems described herein. However, this is merely an example and the present invention is not limited thereto.

[0023] In the description of the embodiments of the present invention, when it is determined that a specific description of a known technique related to the present invention may unnecessarily obscure the gist of the embodiments, the detailed description thereof will be omitted. And the terms described below are terms defined in consideration of the functions in the present invention, which may vary depending on the intentions or conventions of users, operators, etc. Therefore, the definition should be given based on the content throughout this specification. The terms used in the detailed description are merely for describing an embodiment and should never be restrictive. Unless clearly used differently, the singular form of an expression includes the meaning of the plural form. In this description, expressions such as "including" or "comprising" are for indicating any characteristics, numbers, steps, operations, elements, parts thereof, or combinations thereof, and should not be construed as excluding the existence or possibility of one or more other characteristics, numbers, steps, operations, elements, parts thereof, or combinations thereof other than those described.

[0024] Prior to a detailed description of the configuration of the present invention, the present invention is an improved method of the existing threshold-based secrecy recovery method, the (t, n) recovery method, and in this embodiment, the threshold-based secrecy recovery method of the present invention is defined as the (t, (r, Sc), n) recovery method. The threshold-based secrecy recovery method of the present invention can be defined as a method that allows participants to share shares using multiple share generation structures, and in order to share shares through such multiple share generation structures, in addition to t (threshold for the number of shares for secrecy recovery) and n (number of shares), r and Sc are additionally defined and used for secrecy recovery. The definitions of r and Sc and the specific threshold-based secrecy recovery method of the present invention will be described in detail below with reference to the drawings.

[0025] Figure 1 is a block diagram showing the structure of a threshold security recovery device according to one embodiment of the present invention.

[0026] Referring to Figure 1, a threshold security recovery device according to one embodiment of the present invention includes a share acquisition module 100 and a security recovery module 150. The threshold security recovery device of the present invention can include all kinds of computing devices. For example, the threshold security recovery device of the present invention may be one of the terminal devices storing shares, or it may be a separate server device for security recovery.

[0027] The share acquisition module 100 has the function of acquiring shares 100 from the terminals of multiple participants in order to recover the secret. In order to recover the secret, it is necessary to acquire shares that are distributed and stored on multiple participant terminals, and the share acquisition module 100 is the module that performs this function.

[0028] In a preferred embodiment of the present invention, the share acquisition module 100 includes a first share acquisition module 102 and a second share acquisition module 104. In the traditional threshold secret recovery method, (t, n) threshold secret sharing and recovery, a single share generation structure is used, and shares are generated from this single share generation structure. However, in the present invention, multiple share generation structures are used, and in this embodiment, the case in which two share generation structures are used will be described as an example.

[0029] The first share acquisition module 102 has the function of acquiring the first share, which is determined from the first share generation structure, from the participant terminal that stores the share. Here, various forms of known share generation structures can be used as the first share generation structure. For example, a higher-order polynomial, such as the Shamir formula, can be used as the first share generation structure. Of course, a geometric structure may also be used as the first share generation structure.

[0030] Figure 2 is a diagram illustrating an example of determining shares using a polynomial share generation structure.

[0031] Referring to Figure 2, a cubic polynomial graph is illustrated. In the illustrated cubic polynomial graph, the secret is the constant term S, which is the y-intercept in the illustrated graph. Since it is a cubic polynomial, at least 4 shares are required to obtain the secret S, and t is defined as 4. The number of shares, n, is arbitrarily determined to be greater than t, and Figure 2 illustrates the case where the total number of shares is 5. In other words, the threshold secret sharing structure illustrated in Figure 2 is a (4, 5) secret sharing structure.

[0032] In Figure 2, the total shares are (1, f(1)), (2, f(2)), (3, f(3)), (4, f(4)), and (5, f(5)).

[0033] For example, if the polynomial shown in Figure 2 is the first share generation structure, the shares determined from the first share generation structure are distributed and stored on the terminals of multiple participants. For example, (1, f(1)) is stored on the first participant's terminal, and (2, f(2)) is stored on the second participant's terminal.

[0034] The first share acquisition module 102 has the function of acquiring shares of the first share generation structure, which is stored distributed across the terminals of multiple participants, in order to recover confidentiality.

[0035] The second share acquisition module 104 is a module that acquires shares generated through the second share generation structure. The shares of the second share generation structure acquired by the second share acquisition module 104 are used when confidentiality cannot be restored using only the shares of the first share generation structure.

[0036] As mentioned above, the present invention improves confidentiality by utilizing a second share generation structure, which is another share generation structure, in addition to the first share generation structure. Below, we will first examine the second share generation structure and the method for generating shares in the second share generation structure in detail, and then proceed with the explanation of Figure 1.

[0037] Figure 3 is a flowchart showing the overall flow of a share generation structure and share generation method for confidentiality recovery according to one embodiment of the present invention, and Figure 4 is a diagram showing an example of a share set generated by one embodiment of the present invention.

[0038] Referring to Figure 3, the first share generation structure is determined (step 300). The first share generation structure is determined arbitrarily; as mentioned above, a polynomial share generation structure may be used, or a geometric structure may be used. The user sets the threshold value t for the number of shares in the share generation structure and the total number of shares (n), so that a corresponding share generation structure is arbitrarily determined. For example, if the user sets the threshold value t to 4, a cubic polynomial first share generation structure may be generated.

[0039] Once the first share generation structure is generated, the first shares are generated from the first share generation structure (step 310). The number of shares n in the first share generation structure is arbitrarily set to be greater than t, and if the first share generation structure is a polynomial, an arbitrary n x-coordinates are determined to generate n first shares consisting of (x, y).

[0040] When the first share is generated in the first share generation structure, the generated first share is distributed to the participants' terminals so that the first share is distributed and stored on the participants' terminals (step 320).

[0041] The procedures from steps 300 to 320 may be the same as the existing method of generating shares using (t, n) threshold secret sharing and distributing them to the participants' terminals. However, in this invention, shares can be distributed to participants taking into account the participants' preferences.

[0042] Figure 5 is a table showing the participants' tendencies according to one embodiment of the present invention.

[0043] Referring to Figure 5, participants' orientations can be categorized into LS / CH (Loss-Strong and Consistently Honest), LW / AH (Loss-Weak and Consistently Honest), LS / PD (Loss-Strong and Potentially Dishonest), and LW / PD (Loss-Weak and Potentially Dishonest).

[0044] If there are honest LS / CH participants who are unlikely to lose their shares, then the shares can be distributed only to LS / CH participants to reduce the likelihood of losing or leaking secrets. However, if there are no LS / CH participants and only the remaining types of participants exist, securely managing secrets becomes a complex problem. Even if LS / CH type participants exist, if access is poor, it may not be desirable to distribute shares only to such participants using a secret-sharing application.

[0045] In particular, when allocating shares to participants with a high probability of betrayal (PD type), it is preferable to set limiting conditions.

[0046] Referring to Figure 4, the first share generation structure is SF, and the figure illustrates the case where a total of 10 first shares are generated from the first share generation structure (SF).

[0047] In Figure 4, there are four participants with a PD type that are highly likely to betray. In this case, the threshold share number t must be set to be greater than the number of users of the PD type that are highly likely to betray among the participants in the first share generation structure. In short, the number of shares included in S(F, PD) must be less than t.

[0048] Once the generation of the first share is complete, the Critical Share Set is determined from the first share (step 330). The Critical Share Set is a subset that belongs to both the first share generation structure (SF) and the second share generation structure (SG) (a subset of the intersection of the share sets of the first share generation structure and the share sets of the second share generation structure), and is the set of shares necessary to recover the secret in an exceptional situation (fallback case).

[0049] In this embodiment, the critical share set is defined as Sc, and the number of shares belonging to the critical share set is determined based on r. In this embodiment, r is defined as the critical threshold, and r should be set to be less than t, so that secrecy can be recovered using r critical shares even if the number of shares in the first share generation structure is less than t. The number of shares belonging to the critical share set is set to be greater than or equal to r. In short, Sc is specified such that |Sc|≧r is satisfied. r may also be defined as the minimum number of shares required to recover secrecy through the second share generation structure because secrecy cannot be recovered from the shares in the first share generation structure. On the other hand, when determining the critical share set (Sc), the number of intersections of the share set of participants likely to betray (S(F, PD)) and the critical share set (Sc) is determined to be less than r. If Sc∩S(F,PD) contains r or more shares, then participants of the PD type who are likely to betray can recover the secret using only the share allocated to them. Therefore, it is preferable to determine that the number of intersections between the set of shares of participants likely to betray (S(F,PD)) and the critical share set (Sc) is less than r.

[0050] Referring to Figure 4, the critical share set Sc is shown, which is a subset of the intersection of the shares of the first share generation structure and the shares of the second share generation structure, and the number of Sc is set to 3. In this case, r can be 2 or 3. On the other hand, referring to Figure 3, the intersection of the critical share set and the share set that is likely to betray is 1, which is set to be less than r.

[0051] Once the critical share set is determined, a copy share set (Sdup) is determined that is a subset of the intersection of the shares of the first share generation structure (SF) and the shares of the second share generation structure (SG), but does not overlap with the critical share set (Sc) (step 340). The union of the copy share set (Sdup) and the critical share set (Sc) can be defined as the intersection of the first share set of the first share generation structure and the second share set of the second share generation structure. According to a preferred embodiment of the present invention, it is preferable that the shares of the copy share set and the critical share set be allocated to participants of LS type who are less likely to lose their shares.

[0052] Once the critical share set and the copy share set are determined, a second share generation structure is generated that can have shares from the critical share set and shares from the copy share set as shares (step 350). The second share generation structure must be different from the first share generation structure and must be able to have shares from the critical share set and shares from the copy share set as shares. The reason for using a share generation structure different from the first share generation structure as the second share generation structure is to prevent other shares that do not belong to Sc∪Sdup from being used to recover the secret.

[0053] The threshold and the number of shares must also be determined for the second share generation structure. The threshold of the second share generation structure must be the same as or greater than |Sc∪Sdup|, which is the intersection of the shares of the first and second share generation structures. According to one embodiment of the present invention, the threshold of the second generation structure can be determined using a threshold adjustment constant α. For example, the threshold of the second share generation structure may be set to (r+|Sdup|+α), and the threshold adjustment constant α is appropriately selected so that the threshold of the second share generation structure is different from that of the first share generation structure.

[0054] Furthermore, the number of shares in the second share generation structure can be determined using the share number adjustment constant δ. The number of shares in the second share generation structure is set to be greater than the threshold value of the second generation structure, and can be set to (|Sc|+|Sdup|+α+δ).

[0055] If the second share generating structure is a polynomial, the degree of the polynomial is set to be less than 1 less than the threshold of the determined second share generating structure.

[0056] Even if the threshold for the second share generating structure is determined, the shares shared with the first share generating structure (Sc∪Sdup) alone may not be sufficient to uniquely determine the second share generating structure. In this case, the remaining elements for determining the second share generating structure (for example, coefficients of a polynomial, points passing through the polynomial, points on a hyperplane, or coefficients of the hyperplane equation) can be randomly selected to determine the second share generating structure.

[0057] On the other hand, if all elements of the first share generation structure belong to either the copy share set (Sdup) or the critical share set (Sc), that is, if the first share generation structure is SF = Sc∪Sdup, then a second share generation structure is generated that can generate all shares of Sc∪Sdup while having a threshold of |Sc∪Sdup| or greater. However, in this case, the condition that the second share generation structure must be different from the first share generation structure does not need to be satisfied.

[0058] Once the second share generation structure is determined in this way, the set of additional shares (Sadd) belonging to the second generation structure is determined (step 360). The number of additional shares belonging to the set of additional shares will be determined based on the total number of shares in the second generation structure. If the second share generation structure is a polynomial, additional points can be arbitrarily specified to determine the shares belonging to the set of additional shares.

[0059] Once the additional share set (Sadd) is determined, the shares of the second share generation structure are allocated to the participants (step 370). Since Sc and Sdup, which are shares shared with the first share generation structure, have already been allocated to specific participants, allocation is made only to the shares belonging to the additional share set (Sadd). According to a preferred embodiment of the present invention, the shares belonging to the additional share set (Sadd) are allocated to LS-oriented participants who are less likely to lose their shares.

[0060] As detailed above, the first share generation structure, the second share generation structure, the shares belonging to the first share generation structure, the shares belonging to the second share generation structure, and the shares shared by the first and second share generation structures are determined by the method shown in Figure 3.

[0061] Referring again to Figure 1, the second share acquisition module 104 acquires a share belonging to the second share generation structure. The second share acquisition module 104 is activated and operates only when it is not possible to recover the secret from the first share of the first share generation structure. The second share acquisition module 104 acquires the second share from the participant's terminal that has the specified share stored in the second share generation structure.

[0062] The confidentiality recovery module 150 recovers confidentiality using the share acquired by the share acquisition module 100. The confidentiality recovery module 150 includes a general case confidentiality recovery module 152 and a fallback case confidentiality recovery module 154.

[0063] The general case confidentiality recovery module 152 recovers the confidentiality using the (t, n) confidentiality recovery method when confidentiality can be recovered using only the shares of the first share generation structure. When it is possible to acquire shares of the first share generation structure equal to or greater than the threshold value t, the general case confidentiality recovery module 152 recovers the confidentiality using the (t, n) confidentiality recovery method.

[0064] The fallback case secret recovery module 154 has the function of recovering secrets when normal secret recovery is impossible due to the loss of shares in the first share generation structure. The fallback case secret recovery module 154 recovers secrets by combining r shares from the critical share set Sc and (|Sdup|+α) shares from the copy share set and the additional share set (Sadd). The total number of combined shares is (r+|Sdup|+α), which is the minimum number of shares required to recover secrets in a (r+|Sdup|+α, |Sc|+|Sdup|+α+δ) threshold secret sharing.

[0065] Below, we will examine in detail the threshold secrecy recovery method of the present invention, using an example that utilizes a share generation structure with a polynomial derived from the Shamir method.

[0066] Figure 6 is a diagram showing the share set for threshold secret sharing, which will be discussed later.

[0067] Assuming secret S=3, and that participants X1, X2, and X3 of the LW / CH type, participants Y4 and Y5 of the LW / PD type, and participant Y6 of the LS / PD type participate in (t, (r,Sc), n) threshold secret sharing and recovery, we will describe the (3, (1,Sc), 5) threshold secret recovery method, assuming parameters t=3, r=1, and n=5.

[0068] First, we generate the first share generating structure. Since t=3, the first generating structure is a quadratic polynomial with a constant value (secret) of 3. The other coefficients of the quadratic polynomial are arbitrarily or randomly specified, and we assume that the first share generating structure is f(x)=x²+9x+3.

[0069] Since n=5, a total of 5 first shares are acquired. These 5 first shares are defined as V1, V2, V3, V4, and V5. In short, the set of first shares SF, which is the first share generation structure, is SF={V1, V2, V3, V4, V5}.

[0070] The shares are allocated such that the number of shares in S(F, PD) is less than t. To satisfy this, V1, V2, V3, V4, and V5 are allocated to X1, X2, Y4, X3, and Y5 respectively. In this case, S(F, PD) = {V3, V5}. On the other hand, a set of critical shares (Sc) used for security recovery is specified as a fallback case, for example, Sc = {V1, V2}. The number of critical shares must be greater than r, so |Sc| = 2 and r = 1.

[0071] Next, specify the copy share set and set Sdup={V3}. Since Sdup must be distributed to participants of the LS type, it will be distributed to Y4.

[0072] Once the critical share set and copy share set are specified, the second share generation structure is determined. This is explained using the example where the second share generation structure is also a polynomial. The threshold for the second share generation structure is set to (r+|Sdup|+α), and if the second share generation structure is a polynomial, its degree is set to (r+|Sdup|+α-1), and α=3 is selected to set the degree of the polynomial of the second share generation structure to 4.

[0073] The second share generating structure must be capable of generating shares {V1, V2, V3} belonging to Sc∪Sdup. Therefore, the second share generating structure is a quartic polynomial passing through the three points V1, V2, and V3. Using the three points V1, V2, and V3 and a randomly generated value of 1 as the coefficient of the highest degree term, we can obtain the second share generating structure g(x) = x⁴ + x³ + 4x² + 4x + 3.

[0074] Once the second share generation structure is generated, the additional share set Sadd is determined using this structure. The number of Sadd is determined by (α+δ), and if δ=0, then |Sadd|=3. Three distinct points (4, g(4)), (5, g(5)), and (6, g(6)) passing through the second share generation structure g(x) are selected to define the additional shares A4, A5, and A6. The additional shares are allocated to participant Y6 of the LS / PD type, who is less likely to be lost.

[0075] Figure 7 is a flowchart illustrating the overall flow of a threshold secret recovery method according to one embodiment of the present invention.

[0076] Referring to Figure 7, shares are generated using the first share generation structure (step 700). As mentioned above, the first shares are generated based on the threshold t and the number of shares n.

[0077] Once the first share is generated, the second share is generated using the second share generation structure (step 710). As mentioned above, a portion of the second share overlaps with the first share, and additional shares are generated after the second share generation structure is determined.

[0078] The first share generation structure determines whether the available shares are greater than the threshold t (step 720).

[0079] If the number of available shares in the first share generation structure is greater than the threshold t, the secret is recovered using only the first share of the first share generation structure (stage 730).

[0080] If the number of shares available in the first share generation structure is less than the threshold t, the secret is recovered using the additional share set, critical share set, and copy share set of the second generation structure (stage 730). When recovering the secret using the additional share set of the second generation structure, the secret is recovered by selecting the shares that have not been lost from the additional share set, critical share set, and copy share set (stage 740).

[0081] On the other hand, a computing device that performs the threshold secret recovery method of the present invention may include a processor and memory, and the processor may perform the method of the present invention by executing one or more programs stored on a computer-readable storage medium.

[0082] Although the present invention has been described with reference to the embodiments shown in the drawings, these are merely illustrative, and a person with ordinary skill in the art will understand that a variety of modifications and equivalent other embodiments are possible. Therefore, the true scope of technical protection of the present invention should be determined by the technical idea of ​​the appended claims.

Claims

1. (a) The first share generated by the first share generation structure is acquired from the participants. (b) A step in determining whether the number of first shares acquired is equal to or greater than the first threshold t. If the number of the first shares is equal to or greater than the first threshold t, (t, n) step of recovering the secret by the threshold secret recovery method (c), If the number of first shares obtained is less than the first threshold t, the second share generated by the second share generation structure is obtained from the participants (d), and This includes (e) the step of recovering the secret using the first share and the second share acquired, A threshold-based security recovery method characterized in that the critical share set is determined such that the number of shares in the critical share set, which is a subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure, is greater than or equal to a critical threshold r which is smaller than the first threshold.

2. The threshold-based secrecy recovery method according to claim 1, characterized in that the first threshold (t) for recovering the secrecy of the first share generation structure is set to be greater than the number of participants who may betray the first share among the participants to whom the first share has been allocated.

3. The threshold secrecy recovery method according to claim 1, characterized in that a copy share set is determined which is a subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure, the intersection of the copy share set and the critical share set is an empty set, and the union of the copy share set and the critical share set is the intersection of the first share set and the second share set.

4. The threshold secret recovery method according to claim 3, characterized in that the second share set includes the critical share set, the copy share set, and an additional share set determined by the second share generation structure.

5. The threshold secret recovery method according to claim 4, characterized in that the aforementioned copy share set and the aforementioned additional share set are distributed to participants who are less likely to lose their shares.

6. The threshold secret recovery method according to claim 2, characterized in that the number of intersections of the set of shares allocated to the potentially unfaithful participants and the critical share set is set to be less than the critical threshold r.

7. The threshold secret recovery method according to claim 4, characterized in that the second share generation structure is determined to have a structure different from the first share generation structure using the critical share set and the copy share set included in the first share.

8. The threshold secret recovery method according to claim 4, characterized in that if all shares in the first share set belong to the union of the critical share set and the copy share set, the second share generation structure is determined to be the same as the first share generation structure.

9. The threshold-based security recovery method according to claim 4, characterized in that the second threshold of the second share generation structure is set to be equal to or greater than the number of elements in the union of the critical share set and the copy share set.

10. Processor, Includes at least one memory connected to the aforementioned processor, The aforementioned processor (a) The first share generated by the first share generation structure is acquired from the participants. (b) A step in determining whether the number of first shares acquired is equal to or greater than the first threshold t. If the number of the first shares is greater than or equal to the first threshold t (t, n), the secret is recovered by the threshold secret recovery method (c). If the number of first shares obtained is less than the first threshold t, the second share generated by the second share generation structure is obtained from the participants (d), and Step (e) is performed to recover the secret using the first share and the second share acquired. A threshold-based security recovery device characterized in that the number of shares in a critical share set, which is a subset of the intersection of a first share set generated by the first share generation structure and a second share set generated by the second share generation structure, is determined such that the number of shares in the critical share set is greater than or equal to a critical threshold r which is smaller than the first threshold.

11. The threshold-based secrecy recovery device according to claim 10, characterized in that the first threshold (t) for secrecy recovery of the first share generation structure is set to be greater than the number of participants who may betray the first share among the participants to whom the first share has been allocated.

12. The threshold security recovery device according to claim 10, characterized in that a copy share set is determined which is a subset of the intersection of the first share set generated by the first share generation structure and the second share set generated by the second share generation structure, the intersection of the copy share set and the critical share set is an empty set, and the union of the copy share set and the critical share set is the intersection of the first share set and the second share set.

13. The threshold confidentiality recovery device according to claim 12, characterized in that the second share set includes the critical share set, the copy share set and an additional share set determined by the second share generation structure.

14. The threshold secret recovery device according to claim 13, characterized in that the copy share set and the additional share set are distributed to participants who are less likely to lose their shares.

15. The threshold secret recovery device according to claim 11, characterized in that the number of intersections of the set of shares allocated to the potentially unfaithful participants and the critical share set is set to be less than the critical threshold r.

16. The threshold confidentiality recovery device according to claim 13, characterized in that the second share generation structure is determined to have a structure different from the first share generation structure using the critical share set and the copy share set included in the first share.

Images