Key distribution system, key distribution method and program

Abstract

Provided are a key delivery system and the like improving validity verification and a method of collecting shares at the time of decryption, and reducing interception risks. Provided is a key delivery system comprising a key issuance device, a distribution device, and decryption devices, the distribution device comprising: a split data generation unit that splits an encryption key by using a secret sharing scheme; a transmission destination verification unit that verifies the validity of a transmission destination when transmitting the split data thereto; and a split data transmission unit that transmits the split data if the result of verification is valid, the decryption devices each comprising: a transmission source verification unit that verifies the validity of a transmission source when receiving the split data; a split data reception unit that receives the split data if the result of verification is valid; and a decryption unit that decrypts the encryption key with the split data as an input value.

Description

[Technical Field]

[0001] The present invention relates to a key distribution system, a key distribution method, and a program. [Background technology]

[0002] Traditionally, when managing confidential data such as authentication keys, the data is stored in a tamper-resistant storage device to prevent analysis by malicious third parties (hereafter referred to as attackers). A device specifically designed for key management is called a Key Management System (KMS). KMS is characterized by a centralized structure, and is implemented independently by each vendor using a server-client model. In recent years, key management system vendors and a standards organization called OASIS have been working together to standardize KMS.

[0003] In recent years, there has been an increasing need for distributed backup management across multiple locations from the perspective of business continuity. However, conventional key management systems are not designed for distributed management. Furthermore, distributed management of confidential cryptographic keys presupposes that sufficient security measures are in place at each location, and there is a risk that confidential information may be leaked to attackers. Secret sharing is one effective technology for mitigating this risk.

[0004] [Overview of secret sharing method] Secret sharing is an encryption technique that electronically splits target data into multiple pieces of data, making it impossible to obtain information about the original data from a single piece of data. Examples of secret sharing include visual secret sharing, which splits data into multiple pieces of image data and then overlays all of the photo data to decrypt it back to the original image data, and auditory secret sharing, which splits data into multiple audio data and overlays all of the audio data to decrypt it back to the original data.

[0005] Secret sharing schemes can be commonly defined as follows: Distribution stage: Device D in charge of distribution converts the encryption key data s to be distributed into n pieces of data and distributes them to each device. (These converted divided data will be referred to as installment data hereafter.) Decryption stage: k devices out of n devices participate in the decryption process and provide their own k installment data to decrypt the original encryption key data s.

[0006] The simplest secret sharing scheme is one in which all n installment data from the sharing stage can be decrypted only after collecting them (the decryption stage is k=n, and this is called the unanimous method). However, the unanimous method has the problem that if for some reason the installment data cannot be obtained from the device, the original encryption key data s cannot be decrypted. A protocol that solves this problem is the (k,n) threshold secret sharing scheme (hereinafter referred to as the (k,n) threshold scheme).

[0007] [(k,n) Threshold Secret Sharing Scheme Overview] The (k,n) threshold scheme is a secret sharing scheme that satisfies the following conditions: 1. If any k installment data out of n installment data are collected, the original data s can be decrypted. 2. With k-1 or fewer installment data, the original data s cannot be decrypted, and even fragmentary information of the original data cannot be obtained. In the (k,n) threshold method, even if nk installment data cannot be obtained, the original data can be decrypted from the remaining k data. There are multiple methods for the (k,n) threshold method, but a representative method is Shamir's (k,n) threshold method described in Non-Patent Document 1. First, an example of the (2,n) threshold method will be described, and then Shamir's (k,n) threshold method will be described in detail.

[0008] [(2,n) Threshold Secret Sharing Scheme] As shown in Figure 8, the (2,n) threshold method utilizes the theorem that "if the coordinates of two independent points are given, the linear polynomial ax+b (straight line) is uniquely determined." The (2,n) threshold method performs distribution and decoding in the following steps.

[0009] Dispersion stage: 1. Device D in charge of distribution creates a first-order polynomial y=ax+s, with the encryption key data s to be distributed as the intercept and the coefficient a selected randomly using random numbers. 2. Device D calculates the coordinates (i, f(x)) of n points that pass through the polynomial (i=1,...,n), and distributes these coordinates to each device as installment data.

[0010] Decryption stage: 1. When decrypting, collect two or more points of installment data (coordinates) distributed to each device, calculate the original polynomial, and obtain the original encryption key data s. In the decryption stage, if one installment data point is acquired, the original data s cannot be obtained because there are an infinite number of linear lines passing through one point. On the other hand, if two installment data points are acquired, the linear line passing through the two points is uniquely determined, and the original key data s (= f(0)) can also be obtained.

[0011] [Proof of the polynomial coincidence theorem used in the (k,n) threshold method] The theorem used in the (2,n) threshold method, "if the coordinates of two independent points are given, the linear polynomial ax+b (straight line) is uniquely determined," can be generalized as follows: This generalized theorem is used in Shamir's (k,n) threshold method in Non-Patent Document 1, which will be described later. If the coordinates of k+1 independent points are given, a k-th degree polynomial is uniquely determined. The above means that "For example, if there are two polynomials f and g of degree k or less, then k+1 real numbers a1, a2, ..., a (k+1) For f(a1)=g(a1), f(a2)=g(a2), …, f(a (k+1) )=g(a (k+1) ) always holds, then f and g are the same polynomial.

[0012] The polynomial coincidence theorem can be proved as follows. Considering F(x)=f(x)-g(x), f(a1)=g(a1), f(a2)=g(a2), ..., f(a (k+1) )=g(a (k+1) ), F(a1)=0, F(a2)=0, ...F(a (k+1)) = 0. Then, F(a1) = 0, F(a2) = 0, ...F(a (k+1) )=0 are roots of the polynomial, so by the factor theorem, F(x)=(x-a1)(x-a2)…(xa (k+1) )G(x) is obtained. Since F(x) is the difference between polynomials f and g of degree k or less, F(x) itself is also a polynomial of degree k or less. Furthermore, (x-a1)(x-a2)…(xa (k+1) ) is a polynomial of dimension k+1, so no matter what values ​​are substituted into the variables, G(x)=0. This means that F(x)=(x-a1)(x-a2)…(xa (k+1) )G(x)=(x-a1)(x-a2)…(xa (k+1) )·0, and so F(x)=0⇒f(x)=g(x). This polynomial coincidence theorem shows that if there are k+1 real numbers, then a polynomial of dimension k or less can be uniquely determined.

[0013] [Shamir's (k,n) threshold secret sharing scheme] The Shamir's (k,n) threshold secret sharing scheme (hereinafter referred to as the (k,n) threshold scheme) in Non-Patent Document 1 uses a secret sharing scheme that utilizes the theorem that "if there are coordinates of k+1 independent points, a k-th degree polynomial can be uniquely determined." Shamir's (k, n) threshold secret sharing scheme performs sharing and decryption in the following steps.

[0014] Dispersion stage: 1. The device D in charge of distribution selects a prime number p greater than max(s,n), where s is the original key data and n is the degree. (p is not secret information, but a pre-defined common parameter.) 2. The device D in charge of distribution randomly selects coefficients and creates a k-th degree polynomial on GF(p) shown in Equation 1, with the original key data s as the intercept. 3. Device D in charge of distribution uses i=1,...n as ID, calculates f(i) where i is x, and distributes (i,f(i)) to each device. 4. The device D in charge of distribution is the parameters a1 to a of the k-th degree polynomial created in 2. k Discard.

[0015]

number

[0016] Decryption stage: 1. Obtain k+1 distributed coordinates (i, f(i)) from k+1 devices out of n devices. 2. Decrypt the k-th degree polynomial created during distribution. When decrypting, Lagrange interpolation is used to calculate the value at f(0) = the original key data s.

[0017] Shamir's (k,n) threshold method ensures security in the following two senses. First, it eliminates the need to rely on the security of a single specific location. Even if secret information at one location is exploited, it becomes meaningless data, reducing the risk of secret information being leaked and increasing reliability in terms of confidentiality. Second, even if one piece of distributed secret information is lost, it can be decrypted using other data, increasing reliability in terms of redundancy.

[0018] Many similar (k,n) threshold schemes have been disclosed that are improvements on Shamir's (k,n) threshold scheme. For example, to strengthen data security in secret sharing schemes, several improved methods (verifiable secret sharing schemes) have been disclosed that verify whether the distributor and recipient have created shares using legitimate procedures.

[0019] Lagrange Interpolation In Shamir's (k,n) threshold method in Non-Patent Document 1, Lagrange interpolation (Lagrange's interpolation polynomial) is used when determining only the original key data s. The reason for this is that Lagrange interpolation allows the original key data s to be determined more easily than simultaneous equations. In simultaneous equations, the kth order polynomial f is calculated once from (k+1) coordinates, and then f(0)=s is determined. However, with Lagrange interpolation, the intercept s can be calculated directly from (k+1) installment data. The formula for Lagrange interpolation can be derived as follows:

[0020] The coordinates of k+1 independent real points (a1, f(a1)), (a2, f(a2)), ..., (a (k+1) , f(a (k+1) )) where L i Let us put a polynomial p(x) in Equation 2, which consists of products and sums of polynomials in (x).

[0021]

number

[0022] Here, when x=a1, in order for p(x)=f(x) to hold, it is sufficient to satisfy Equation 3.

[0023]

number

[0024] If we think about it in the same way, we can see that in order for p(x) = f(x) to always hold, we need to satisfy all of Equation 4. The reason is that if the above is satisfied, (a1, f(a1)), (a2, f(a2)), ..., (a (k+1) , f(a (k+1) )) satisfies p(x) = f(x), and furthermore, by the polynomial coincidence theorem, it can be shown that p and f are the same polynomial.

[0025]

number

[0026] By the factor theorem, we obtain Equation 5. Here, d1, d2, d3, ..., d(k+1) are constants, and L1(a1)=1, L2(a2)=1, L3(a3)=1, ..., L (k+1) (a (k+1)) = 1, we obtain Equation 6. From the above, we can derive the Lagrange interpolation formula in Equation 7. In Shamir's (k,n) threshold method, after substituting the value of each installment data into the Lagrange interpolation formula, f(0) = s is calculated.

[0027]

number

[0028]

number

[0029]

number

[0030] [Finite field] The (k,n) secret sharing scheme has the following problems when actually implemented on a computer. The first issue is that while the polynomial coincidence theorem and Lagrange interpolation are designed for real numbers, the computers used to implement them cannot handle "infinity" in the same way as real numbers. To use values ​​that are infinitely close to infinity, it is necessary to use multi-precision integers, which entails enormous computational costs. Furthermore, it is not possible to generate "uniform random numbers in an infinite space" on a computer, resulting in biased random number generation within a finite range of values.

[0031] Second, since the (k,n) secret sharing scheme involves division operations, there is a possibility of floating-point errors. Therefore, care must be taken in the implementation to complete the scheme using integer arithmetic. Shamir's (k,n) threshold method introduces the finite field GF(p) modulo a prime number p greater than max(s,n). It is an algebraic system consisting only of {0,1,2,…,p}, and the results of arithmetic operations are also expressed only in {0,1,2,…,p}. By introducing the finite field GF(p), the problems of computational cost, random number problems, and floating-point error are solved.

[0032] Furthermore, to implement Shamir's (k,n) threshold scheme in the finite field GF(p), the block length on a computer needs to be p bits, but since 1 byte = 256 bits is not a prime number, it is computationally inefficient. However, Non-Patent Document 2 discloses an improved method that generalizes and improves the finite field GF(q) into a secret sharing scheme on the m-th order extension field GF(q^m), realizing a flexible configuration in terms of the number of administrators and implementation on a computer. [Prior art documents] [Non-patent literature]

[0033] [Non-Patent Document 1] A. Shamir, “How to share a secret,” Communication of the ACM, vol. 22, no. 11, pp. 612-613, 1979. [Non-patent document 2] ED Karnin, JW Greene, ME Hellman, “On Secret Sharing Systems,” IEEE Transaction on Information Theory, vol. 29, no. 1, pp. 35-41 Summary of the Invention [Problem to be solved by the invention]

[0034] The disclosures of the above prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0035] The (k, n) threshold secret sharing scheme of Shamir in Non-Patent Document 1 has the following three major problems.

[0036] [Issue 1] If an attacker eavesdrops on communications before the decryption device, there is a risk that all installment data necessary for decryption may be exploited. If an attacker exploits the installment data necessary for decryption, the original data will be decrypted, leading to information leakage.

[0037] [Problem 2] The legitimacy of the sender and receiver is not guaranteed. The reason is that there is no procedure to verify that the device that sends and receives installment data is a legitimate device. This verification method is generally called authentication, but Non-Patent Document 1 only provides a mechanism for secret sharing and does not include an authentication mechanism.

[0038] [Problem 3] There is no way to detect if fraudulent installment data has been mixed in with the installment data handled in the decryption process. This is because there is no function to verify whether the installment data is correct.

[0039] Issue 1 concerns wiretapping, which can be divided into two causes:

[0040] The (k, n) threshold method described in Non-Patent Document 1 is a method in which the installment data used for decryption is sent to one device as decodable data, so if the number of installment data required for decryption is exploited by eavesdropping on the communication just before the decrypting device, there is a risk that an attacker will be able to decrypt the data back to the original data.

[0041] The (k, n) threshold method described in Non-Patent Document 1 is a method in which the installment data used for decryption is collected in one device and then decrypted. Therefore, if an attacker eavesdrops on the communication just before the device that performs the decryption accesses the data, there is a risk that all the installment data necessary for decryption may be exploited.

[0042] An object of the present invention is to provide a key distribution system, a key distribution method, and a program that improves the method of verifying authenticity and collecting installment data during decryption, thereby reducing the risk of eavesdropping on the communication channel.

[0043] As a means of solving problem 1, installment data is encrypted in advance and then distributed to each device. Furthermore, instead of collecting all installment data in one place on one device, interpolation is applied in a distributed serial process based on the polynomial parameters obtained by the interpolation method of the previous device, the x-coordinate, and the installment data of the device itself.

[0044] As a means for solving problem 2, a verification method is used in which a key for authenticating between devices is distributed at the very beginning, and a key is not sent or received between devices, and it can be verified that the device has the ability to perform secret sharing.

[0045] As a means of solving problem 3, the distributed serial processing in a finite field performed in the decryption process is repeatedly performed using a different device each time to verify the inclusion of fraudulent installment data.

[0046] [The function of the means to bring about an effect] [Countermeasure 1: A countermeasure against the risk of an attacker in Issue 1 eavesdropping on communications before the decryption device exploiting all installment data necessary for decryption] The first countermeasure is to encrypt the installment data before distributing it to each device. This means that even if the installment data and the intermediate formulas of the interpolation method are intercepted on the communication path, the original data cannot be decrypted by an attacker due to the encryption. Furthermore, by using a cryptosystem with additive and multiplicative homomorphism properties, the data is encrypted from the distribution stage and then distributed to each device, and interpolation is applied while the data remains encrypted, and decryption is performed at the end of the decryption stage.

[0047] The second solution is to apply interpolation in a distributed serial process using multiple devices, instead of collecting all installment data in one place, based on the polynomial parameters and x-coordinates obtained by the interpolation method of the previous device and the installment data of the device itself. Conventional Lagrangian interpolation requires k+1 installment data for one interpolation calculation. In this invention, this is changed to Newtonian interpolation. Each device calculates the interpolation polynomial parameters one by one, starting with the lowest-order term, and then transmits and receives these parameters and x-coordinates between devices to obtain the distributed stage polynomial.

[0048] Newton Interpolation Newton interpolation, also known as Newton's quotient difference interpolation, is an interpolation method for finding k+1 independent real coordinates (a1, f(a1)), (a2, f(a2)), …, (a (k+1) , f(a (k+1))), the kth degree polynomial passing through k+1 points can be expressed as in Equation 8.

[0049]

number

[0050] Here, the parameters of each term in Equation 8 are c0 = f(a1), c1 = f(a1, a2), c2 = f(a1, a2, a3), ..., c (k-1) =f(a1, a2, …, a (k-1) ), c k =f(a1, a2, …, a k ) The first-order difference quotient c1 is defined as f(a1, a2) = (f(a2) - f(a1)) / (a2 - a1), and is the slope of the line connecting the two points (a1, f(a1)) and (a2, f(a2)). The second-order difference quotient c2 is defined as Formula 9 using the first-order difference quotient c1 = f(a1, a2) = (f(a2) - f(a1)) / (a2 - a1). It is the difference quotient obtained by subtracting the first-order difference quotient between a1 and a2 and the first-order difference quotient between a1 and a0.

[0051]

number

[0052] k-th order difference quotient c k =f(a1, a2, …, a k ) is defined by Equation 10. a2~a k The n-1th difference quotient of a1~a (k-1) The difference quotient is obtained by subtracting two of the n-1th order difference quotients.

[0053]

number

[0054] This Newton's quotient difference interpolation formula, by the definition of quotient difference, adds the coordinates of each point one by one to the polynomial parameters c0, c1, ...c k can be obtained.

[0055] [Countermeasure 2: Countermeasure to the issue of issue 2, where the legitimacy of the sender and receiver is not guaranteed] To address issue 2, we use an authentication method that distributes a key for verifying between devices at the very beginning, does not require sending or receiving keys between devices, and can verify that the devices have the ability to perform secret sharing.In this method, one-time verification installment data created based on the secret sharing scheme is sent to one device, and it is verified whether the opposing device returns a response based on the secret sharing scheme.In addition, the response data is encrypted and decrypted using a verification key distributed in advance, thereby verifying the legitimacy of both devices.

[0056] [Countermeasure 3: A countermeasure to the lack of a way to detect if fraudulent installment data is mixed in with the installment data handled in the decryption process of Issue 3] As a countermeasure to issue 3, the distributed serial processing in a finite field that is performed in the decryption process will be performed multiple times using different devices each time, and the results will be compared to verify whether the results are always the same, thereby verifying the inclusion of fraudulent installment data. [Means for solving the problem]

[0057] According to a first aspect of the present invention and disclosure, there is provided a key distribution system including: a distribution device having a key issuing device that generates and issues an encryption key; an installment data generation unit that electronically installs the encryption key to installment data using a secret sharing method; a destination verification unit that verifies the legitimacy of the destination when sending the installment data; and an installment data transmission unit that transmits the installment data to the destination if the verification result by the destination verification unit is valid; and a decryption device having a source verification unit that verifies the legitimacy of the sender when receiving the installment data; an installment data receiving unit that receives the installment data from the sender if the verification result by the source verification unit is valid; and a decryption unit that decrypts the encryption key using the received installment data as an input value.

[0058] According to a second aspect of the present invention or disclosure, there is provided a key distribution method including the steps of generating and issuing an encryption key, electronically distributing the encryption key to a plurality of installment data using a secret sharing scheme, mutually verifying the authenticity of both the source and destination when distributing the plurality of installment data, distributing the plurality of installment data, and decrypting the encryption key using the plurality of installment data as input values.

[0059] According to a third aspect of the present invention or disclosure, there is provided a program for causing a computer to execute the following processes: a process of generating and issuing an encryption key; a process of electronically paying the encryption key to multiple installment data using a secret sharing method; a process of verifying the legitimacy of both the source and destination of delivery when delivering the multiple installment data; a process of delivering the multiple installment data; and a process of decrypting the encryption key using the multiple installment data as input values. [Effects of the Invention]

[0060] According to each aspect of the present invention and disclosure, the present invention provides a key distribution system, key distribution method, and program that improves authenticity verification and installment data collection methods during decryption, and reduces the risk of eavesdropping on communication channels. [Brief explanation of the drawings]

[0061] [Figure 1] 1 is a block diagram illustrating an example of the configuration of a key distribution system according to an embodiment. [Figure 2] FIG. 1 is a schematic diagram illustrating an overview of the processing of a key distribution system according to a first embodiment. [Figure 3] FIG. 4 is another schematic diagram illustrating an overview of the processing of the key distribution system according to the first embodiment. [Figure 4] 10 is a flowchart illustrating an example of processing in a key distribution system according to an embodiment. [Figure 5] 1 is a block diagram showing an example of a system configuration of a key distribution system according to a first embodiment. [Figure 6]FIG. 3 is a schematic diagram showing the flow of data in the decryption process of the key distribution system in the first embodiment. [Figure 7] FIG. 3 is a conceptual diagram showing a data division method when generating a polynomial in distributed processing of the key distribution system in the first embodiment. [Figure 8] FIG. 3 is a conceptual diagram showing a method for creating verification installment data in the verification process of the key distribution system in the first embodiment. [Figure 9] FIG. 4 is a sequence diagram showing interactions between a sending device and a receiving device in a verification process of the key distribution system according to the first embodiment. [Figure 10] 1 is a schematic diagram showing the hardware configuration of a key distribution system that embodies the key distribution system according to a first embodiment. [Figure 11] FIG. 10 is a schematic diagram showing an aspect of a decryption process in a key distribution system according to another embodiment of the present invention. [Figure 12] FIG. 10 is a schematic diagram showing another aspect of the decryption process of the key distribution system according to another embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0062] First, an overview of one embodiment will be described. Note that the reference numerals in the drawings attached to each element in this overview are added for convenience as an example to facilitate understanding, and the description of this overview is not intended to be limiting in any way. Furthermore, the connection lines between blocks in each figure include both bidirectional and unidirectional. Unidirectional arrows are used to schematically indicate the flow of the main signal (data) and do not exclude bidirectionality. Furthermore, although not explicitly shown in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, etc. shown in this disclosure, input ports and output ports exist at the input and output ends of each connection line. The same applies to input / output interfaces.

[0063] First, as an overview of one embodiment, an example of the configuration of a key distribution system will be described using a block diagram. Fig. 1 is a block diagram showing an example of the configuration of a key distribution system according to one embodiment. As shown in this diagram, the key distribution system according to one embodiment includes a key issuing device 10, a distribution device 11, and a decryption device 12. The distribution device 11 further includes an installment data generation unit 14, a destination verification unit 15, and an installment data transmission unit 16. The decryption device 12 further includes a destination verification unit 17, an installment data reception unit 18, and a decryption unit 19.

[0064] Although not shown, the distribution device 11 may have a decryption unit 19 and may function as a decryption device during decryption.

[0065] As shown in the figure, the key issuing device 10 may be a device separate from the distribution device 11, or the key issuing device 10 and the distribution device 11 may be integrated.

[0066] The key issuing device 10 generates and issues an encryption key. In the distribution device 11 adjacent to the key issuing device 10, the installment data generation unit 14 electronically installs the issued encryption key to the installment data using a secret sharing scheme. The destination verification unit 15 verifies the legitimacy of the destination when transmitting the generated installment data. If the verification result by the destination verification unit 15 is valid, the installment data transmission unit 16 transmits the installment data to the destination. In the decryption device 12-1 opposite the distribution device 11, the destination verification unit 17 verifies the legitimacy of the sender when receiving installment data. If the verification result by the destination verification unit 17 is valid, the installment data reception unit 18 receives the installment data from the sender. The decryption unit 19 decrypts the encryption key using the received installment data as an input value.

[0067] There may be multiple decryption devices 12 (decryption device 1 to decryption device N) as shown in Fig. 1. When distributing installment data, the installment data is transmitted from distribution device 11 to decryption devices 1 to N after mutually verifying their legitimacy.

[0068] Figure 2 is a diagram showing an overview of the processing of a key distribution system at the decryption stage in one embodiment. During decryption, decryption devices 1 to N are arranged so that data flows serially, and a distributed serial processing is executed in which installment data is decrypted sequentially starting from any decryption device. In Figure 2, decryption processing is executed sequentially from decryption device 1 holding installment data 1 to decryption device N holding installment data N.

[0069] Fig. 3 is a diagram showing an outline of another process of the key distribution system at the decryption stage in one embodiment. In this system, multiple decryption devices are divided into m groups, each containing the minimum number of devices capable of restoring data (k devices in Fig. 3), and each group executes a decryption process and collates the data with each other.

[0070] [Explanation of operation] FIG. 4 is a flowchart showing an example of the operation of a key distribution system according to an embodiment. As shown in this figure, first, an encryption key is generated and issued (step S41). Next, the encryption key is electronically distributed to multiple installment data using a secret sharing scheme (step S42). Next, the sender and recipient verify each other to verify their legitimacy (step S43). If the verification shows that either the sender or recipient is invalid, the process ends (step S44, N). If both the sender and recipient are valid (step S44, Y), the multiple installment data are distributed (step S45). When decrypting, the encryption key is decrypted using the distributed multiple installment data as input values ​​(step S46).

[0071] By verifying the mutual legitimacy between the distribution device and the decryption device when distributing the installment data, it is possible to prevent some devices from exploiting the installment data by masquerading or spoofing. Also, by distributing the installment data and processing it serially to avoid concentrating all the installment data on one device, it is possible to prevent unauthorized decryption or exploitation of key data. Furthermore, by dividing the decryption process into multiple groups and repeatedly executing it, it is possible to detect the presence of unauthorized installment data in the decryption device.

[0072] Specific embodiments will be described in more detail below with reference to the drawings. Note that the same components in each embodiment are denoted by the same reference numerals, and the description thereof will be omitted.

[0073] [First embodiment] In the system configuration of the first embodiment, the distribution device arranged in series with the key issuing device is, in terms of physical configuration, solely responsible for the function of the installment data sender, but the internal configuration and functions of the device are common to both the installment data sender and the installment data receiver. Therefore, in the following description, it will be referred to as the distribution / decryption device and will switch roles depending on external processing requests and settings.

[0074] [Premise] The extension field GF(2^8) is assumed for distribution and decoding. The extension field is an algebraic system consisting of {0,1,...255}, and the results of the calculations are also expressed in {0,1,...,255}. The reason for this assumption is to take into account floating-point numbers and carryover caused by arithmetic operations when performing the interpolation method, as well as to take into account computer performance.

[0075] [Information to be distributed and pre-configured to devices] To implement the (k,n) threshold secret sharing scheme, the numbers k and n are defined and set in advance for the entire system. n is the number of sharing / decryption devices that send and receive installment data during one sharing within the system. k is the minimum number of installment data required to decrypt the original data, and is the number for which the equation n>k holds.

[0076] Two types of homomorphic encryption keys are used for data encryption: an encryption key and a verification key. The encryption key here is different from the encryption key distributed in advance for the delivery of installment data; it is the key used when encrypting the installment data. The verification key is used when encrypting the verification data. The encryption key and verification key are distributed in advance to the fully distributed decryption device. The encryption method uses a public key encryption method that combines additive homomorphic encryption and multiplicative homomorphic encryption, which allow addition and multiplication to be performed while the data is encrypted. One of the reasons for using homomorphic encryption is that by performing interpolation while the installment data is encrypted, the data, including the intermediate results of the decryption process, is kept confidential.

[0077] [Configuration Description] Referring to Figure 5, an embodiment of the present invention has a key issuing device and multiple distribution / decryption devices. The key issuing device is connected in series to one distribution / decryption device, and that distribution / decryption device is connected to other distribution / decryption devices via a communication network. The distribution / decryption device connected in series to the key issuing device is called the installment data sender because it plays a role (hereinafter referred to as the role) of distributing installment data during distribution. On the other hand, the distribution / decryption device at the other end of the communication network is called the installment data receiver because it plays a role of receiving the distributed installment data.

[0078] 6, the data flow in the distributed serial processing in the decoding stage of the present invention shows that decoding is performed by executing distributed serial processing in which multiple distributed decryption devices are processed in series, starting from an arbitrary distributed decryption device. Here, the starting distributed decryption device is called the decryption commander because it is in charge of commanding the decryption process.

[0079] The operation in the distribution phase of the present invention is performed by converting the issued key into distributed installment data using a distribution / decryption device adjacent to the key issuing device shown in Fig. 5. Referring to Fig. 7, the distributed serial processing in the distribution phase of the present invention is performed by the decryption commander dividing the original data into 1-byte units and assigning them as polynomial parameters for each term other than the polynomial intercept. In the example of Fig. 7, the 4 bytes of parameters a, b, c, and d of a 4-dimensional polynomial are assigned in order from the original data.

[0080] In the conventional Shamir's (k,n) threshold secret sharing scheme, the intercept is used as the original data s, and f(0) = s is calculated directly using Lagrange interpolation. In the case of a scheme that uses only the intercept of a polynomial as the original data, if multiple installment data are intercepted, it may be possible to predict it using approximation or interpolation. In addition, since Shamir's (k,n) threshold scheme assigns one piece of original data to the intercept, the number of parameters obtained per calculation is limited to one.

[0081] In the key distribution system of this embodiment, compression efficiency is improved by assigning multiple parameters to each term of a polynomial, rather than to the intercepts of the polynomial, and doubling the original data obtained in one calculation (in the example of FIG. 7, there are four points a, b, c, and d, which is four times the amount obtained in the conventional method). During decryption, the original polynomial is obtained from each coordinate using interpolation, and the parameters of each term of the polynomial are obtained and decrypted to the original data.

[0082] In the key distribution system of this embodiment, the number of compression efficiencies of the original data obtained in one calculation depends on the value of k in the (k, n) threshold method. The recommended value of k in the best mode is defined below.

[0083] The value of k and the degree of the polynomial increase the calculation cost in high dimensions, even if the effect of error is ignored due to the finite field. For example, if Newton interpolation is performed for each coordinate, the number of arithmetic operations is as follows:

[0084] Newtonian interpolation with 5 points: 10 divisions, 20 subtractions, 4 multiplications, 8 additions 10-point Newtonian interpolation: 45 divisions, 90 subtractions, 9 multiplications, 18 additions Newtonian interpolation with 15 points: 105 divisions, 210 subtractions, 14 multiplications, 28 additions Newtonian interpolation with 20 points: 190 divisions, 380 subtractions, 19 multiplications, 38 additions

[0085] Furthermore, when performing interpolation in GF(2^8), addition and multiplication are performed using exclusive OR (XOR), while multiplication and division are performed using table lookup. Considering the exponentially increasing number of divisions, the recommended value is up to k=20.

[0086] The operation in the verification phase of the key distribution system of this embodiment is performed by a distribution / decryption device adjacent to the key issuing device shown in Figure 5, which mutually verifies that the distribution / decryption device is a legitimate device and then sends the installment data created in the distribution phase to another distribution / decryption device installed at the opposite site. During verification, the distribution / decryption device of the installment data sender creates installment data for verification, and mutually verifies that the devices are legitimate by calculating specific coordinates from polynomials obtained by both the installment data sender and the installment data receiver. After verification is complete, the installment data sender sends the installment data created in the distribution phase to the opposite installment data receiver.

[0087] Referring to Figure 8, the verification data creation process in the verification stage of the key distribution system of this embodiment involves creating verification data (coordinate data) encrypted with a verification key, and then the decryption commander creates an l-dimensional polynomial g with the verification data ENC(Y0) as an intercept, and L verification coordinate data coordinates that pass through that polynomial.

[0088] Due to the computational complexity issue mentioned above, it is desirable to limit the polynomial degree l to 20 points (k=20). The parameters of each term other than the polynomial intercept are determined by random numbers using any method. The number of coordinate data for verification, L, is set to the number l+1 or more from the polynomial degree.

[0089] 9 shows the flow of processing after sending L pieces of verification coordinate data and the encrypted x-coordinate ENC(x0) to the other device in the verification stage of the key distribution system of this embodiment, in which legitimacy is verified between the other device and the other device. In steps 1 to 3 of FIG. 9, the receiver creates a Y-coordinate y0 and an arbitrary value x1 corresponding to ENC(x0) based on the interpolation polynomial g' obtained from the verification coordinate data and the verification key distributed in advance, and presents these to the sender to demonstrate the receiver's legitimacy. The sender verifies the receiver's legitimacy by verifying whether g(x0), obtained based on the polynomial g and the verification key distributed in advance, is the same value as y0.

[0090] In steps 4 and 5 of Figure 9, the sender presents the encrypted value ENC(y1) of the Y coordinate corresponding to the X coordinate x1 from the receiver, demonstrating the sender's legitimacy. At the same time, the encrypted installment data generated in the distribution stage and the timestamp of the installment data generation are distributed together. The receiver verifies the sender's legitimacy by confirming that g(x1), created from the interpolation polynomial obtained from the verification coordinate data, is the same as y1.

[0091] In the operation at the decryption stage of the present invention, distributed serial processing is carried out in cooperation with multiple distributed decryption devices, starting from any one of the distributed decryption devices (decryption commander) among the distributed decryption devices including the installment data sender and the installment data receiver shown in Figure 5.

[0092] Referring to FIG. 6, in the distributed serial processing in the decryption stage of the key distribution system of this embodiment, the decryption commander as the starting point issues a decryption command to the subsequent devices, and the first-layer distributed-decryption device uses one installment data distributed to each device to calculate the parameter c0 of the interpolation polynomial of the Newton interpolation method and transmits the x-coordinate of the installment data and c0 to the subsequent device. This is repeated, and the subsequent k-1th layer distributed-decryption device similarly calculates the differential quotient and then transmits the x-coordinate of the installment data owned by the 1st to k-1th layer distributed-decryption devices to the subsequent devices. (k-2) The differential quotient of is sent to the decryption commander, who then uses the information sent and the installment data he or she owns to calculate c (k-1) This is done by calculating and expanding the equation to obtain the original polynomial of the dispersion stage and the parameters of each term of the polynomial.

[0093] Furthermore, referring to Figure 6, the distributed serial processing in the decryption stage of the key distribution system of this embodiment starts from the decryption commander as the starting point, and repeatedly performs the distributed serial processing (hereinafter referred to as trials) along multiple paths in the data flow, and verifies whether or not fraudulent installment data has been mixed in the distributed serial processing by comparing the trial results.

[0094] The number of trials, m, is limited to a maximum of 12. The reason for this is that if duplicate installment data, i.e., duplicate devices that own installment data, are not allowed, the maximum number of installment data is 256, up to {0, 1, 2, 3, ..., 255}, according to GF(2^8), and the number of devices that own that installment data is 256. If the maximum value of k in the (k, n) threshold method is 20, then 256 ÷ 20 = 12, remainder 16.

[0095] Another desirable mode for implementing the invention is to ensure security by combining it with existing security technologies. For example, in the case of this method, distributed processing does not include measures to deal with cases where communication messages are tampered with on the communication path. However, a desirable mode would be to further enhance security by using well-known technologies such as encrypted communication, such as TLS (Transport Layer Security) communication or IPsec (Security Architecture for Internet Protocol), measures to prevent communication message tampering using digital signatures, and security fortification of the device itself.

[0096] [Hardware configuration] The key distribution system of this embodiment can be executed by an information processing device (computer), and the key issuing device 10 and multiple sharing / decryption devices 13-1 to 13-N that make up the system have the configuration exemplified in Fig. 10. The key issuing device 10 and sharing / decryption devices 13-1 to 13-N each include a CPU (Central Processing Unit) 101, memory 102, input / output interface 103, and a NIC (Network Interface Card) 104 that serves as communication means, all of which are connected to each other via an internal bus 105.

[0097] However, the configuration shown in Fig. 10 is not intended to limit the hardware configuration of the key distribution system. The key issuing device 10 and the distribution / decryption devices 13-1 to 13-N may include hardware not shown, and may not be equipped with the input / output interface 103 as necessary. Furthermore, the number of CPUs and other components included in these devices is not intended to be limited to the example shown in Fig. 10; for example, multiple CPUs may be included in the key issuing device 10 and the distribution / decryption devices 13-1 to 13-N.

[0098] The memory 102 is a RAM (Random Access Memory), a ROM (Read Only Memory), or an auxiliary storage device (such as a hard disk).

[0099] The input / output interface 103 is a means for interfacing with a display device and an input device (not shown). The display device is, for example, a liquid crystal display. The input device is, for example, a device that accepts user operations, such as a keyboard or a mouse.

[0100] The functions of the key issuing device 10 and the distribution / decryption devices 13-1 to 13-N are realized by a group of programs (processing modules) stored in the memory 102, such as a key issuing program, an installment data generation program, a verification program, a delivery program, and a decryption program, and a group of data, such as parameters used by each program. The processing modules are realized, for example, by the CPU 101 executing each program stored in the memory 102. The programs can be downloaded via a network or updated using a storage medium that stores the programs. Furthermore, the processing modules may be realized by semiconductor chips. That is, it is sufficient if there is some means for executing the functions performed by the processing modules using some kind of hardware and / or software.

[0101] [Hardware operation] [Dispersion stage] First, in the key issuing device 10, a key issuing program is called from the memory 102 and executed by the CPU 101. This program generates an encryption key using a predetermined key issuing algorithm and outputs it to the distribution / decryption devices 13-1 to 13-N to issue it. Next, in the distribution / decryption device 13-1, for example, an installment data generation program is called from the memory 102 and is executed by the CPU 101. This program divides the issued encryption key and assigns it to parameters other than the intercept of the polynomial, which are temporarily stored in the memory 102.

[0102] Next, in the distribution / decryption device 13-1, the verification program is called from the memory 102 and is put into execution state by the CPU 101. This program creates verification data (coordinate data) (ENC(X0), ENC(Y0)) encrypted with a verification key generated in advance and stored in the memory 102, and then generates an l-th degree polynomial g with ENC(Y0) as an intercept and L verification coordinate data coordinates that pass through this polynomial, and transmits these together with ENC(X0) via the NIC 104 to another distribution / decryption device, for example, the distribution / decryption device 13-2.

[0103] In the distribution / decryption device 13-2, the verification program has been called from memory 102 and is running on the CPU 101. The program finds the formula g from L pieces of coordinate data and calculates ENC(Y0) from ENC(X0). Next, it decrypts Y0 using a verification key that has been distributed in advance and stored in memory 102. Next, the program sends Y0 and an arbitrary X1 to the distribution / decryption device 13-1 via the NIC 104. The verification program in the distribution / decryption device 13-1 receives this, substitutes X0 for g stored in memory 102, and verifies whether it matches the received Y0.

[0104] If it matches Y0, the verification program of the distribution / decryption device 13-1 calculates the encrypted value ENC(Y1) of the Y coordinate corresponding to the X coordinate X1 transmitted from the verification program of the distribution / decryption device 13-2. The verification program of the distribution / decryption device 13-2 verifies whether g(X1), created from the interpolation polynomial obtained from the verification coordinate data, is equivalent to Y1. At the same time, a delivery program is called from the memory 102 and executed by the CPU 101, which delivers the encrypted installment data generated in the distribution stage and the installment data generation timestamp to the distribution / decryption device 13-2 via the NIC 104. The distribution / decryption device 13-2 stores this delivered data in the memory 102.

[0105] [Decryption stage] In the decoding stage, decoding processing is executed with one of the distribution / decryption devices 13-1 to 13-N as the decoding commander, which is the starting point. Here, as an example, the distribution / decryption device 13-2 is set as the starting point (end point), and processing will be described in the case where five installment data (N=5) are generated (i.e., when the distribution / decryption devices 13-1 to 13-5 exist). In the distribution / decryption device 13-2, when a decoding program is called from the memory 102 and executed by the CPU 101, Newton's interpolation method is performed using the installment data stored in the memory 102. As a result, a parameter c0 of the interpolation polynomial is first calculated. The calculated c0 is transmitted via the NIC 104 to, for example, the distribution / decryption device 13-3 together with the x-coordinate of the installment data. In the distribution / decryption device 13-3, the decoding program executed by the CPU 101 receives it and calculates the differential quotient c1. The verification program repeats this calculation in the distribution / decryption devices 13-4 and 13-5, calculating differential quotients c2 and c3, which are then sent to the distribution / decryption device 13-2, which is the starting point, via the NIC 104. In the distribution / decryption device 13-2, the decryption program receives this data via the NIC 104, and the CPU 101 calculates c4 using the received c0 to c3 and the installment data. The program performs equation expansion using c0 to c4 and the installment data to obtain the original cubic polynomial and the parameters for each term of the polynomial. This allows the program to decrypt the encryption key, which is secret information, from the parameters.

[0106] [Effect description] As described above, by introducing a verification process based on the threshold method in the distributed stage, it is possible to verify that the sender and receiver possess the capabilities required for the system and a verification key that cannot be known by third parties, thereby identifying devices that have been disguised or spoofed by an attacker and confirming the legitimacy of the data and the sender and receiver.

[0107] Furthermore, distributed serial processing at the decryption stage can prevent all installment data from being collected by a single device. Although there is a possibility that information about the calculation process could be stolen by eavesdropping on the communication channel, the exploitation of the installment data of the decryption commander can be prevented, reducing the risk of an attacker decrypting and exploiting key data.

[0108] Furthermore, in the decryption process, by performing decryption on different sets of installment data and comparing the results obtained, and for example adopting the most common result, it is possible to detect the inclusion of fraudulent installment data even if fraudulent installment data is mixed in during decryption.

[0109] [Another embodiment of the invention] [Alternative form 1: Decryption process using tree-type structure] Referring to Figure 11, in the distributed serial processing of the decoding stage of the present invention, the data flow at k=7 is shown, which is an improved version of the single column data flow used in the single distributed serial processing of the decoding commander in Figure 6 mentioned above, with a tree-type data flow.

[0110] In Figure 11, the decoding commander sends decoding commands to the four devices in the first stage. Each distribution / decoding device in the first stage sends its own installment data to the device in the second stage. The three devices in the second stage calculate the difference quotient using their own installment data and the installment data sent from the first stage as input, and send the result to the final decoding commander. The decoding commander creates the final Newton interpolation polynomial using the difference quotient sent from the three devices in the second stage, the x-coordinate, and its own installment data as input.

[0111] The method in Fig. 11 improves the problem of network delay compared to the serial implementation in Fig. 6. However, because installment data is sent and received between the devices in the first and second stages, the risk of communication eavesdropping and encryption being compromised is higher than in Fig. 6, so the method in Fig. 11 is intended to be used on closed networks other than public networks.

[0112] [Alternative form 2: Distributed processing using reducible polynomials and decoding processing using a tree-type structure] When using polynomials with k = 10 to 20, for example, it is more efficient to define the polynomial in the dispersion stage in advance as a reducible polynomial expressed as f(x) h(x) ... A reducible polynomial is a polynomial that can be factorized, and can be expressed as the product of multiple polynomials.

[0113] For example, if you perform Newton interpolation on a 19-dimensional polynomial with k=20, 190 divisions, 380 subtractions, 19 multiplications, and 38 additions for 20-point Newton interpolation However, in the case of a reducible polynomial consisting of two 9-dimensional polynomials, For Newtonian interpolation at 10 points Division 45 x 2, Subtraction 90 x 2, Multiplication 9 x 2, Addition 18 x 2 The amount of calculation can be reduced by expressing it in advance as a product of low-dimensional polynomials through factorization.

[0114] Figure 12 shows the data flow when using a reducible polynomial consisting of two polynomials in the distributed serial processing of the decoding stage of this invention. Of the polynomials, the devices holding the installment data for f(x) are grouped in the upper part of the figure, while the devices holding the installment data for g(x) are grouped in the lower part of the figure. Each polynomial forms a tree-like data flow structure, and after calculating the differential quotient, the final decoding commander calculates the original f(x) g(x).

[0115] Also, like Figure 11, the method in Figure 12 improves the problem of network delay compared to the serial implementation in Figure 6. However, because installment data is sent and received between the devices in the first and second stages, the risk of wiretapping and encryption being compromised is higher than in Figure 6, so the method in Figure 12 is intended to be used on a closed network other than a public network.

[0116] [Alternative form 3: Distributed processing and decryption processing using portable storage media] As an embodiment of the present invention, the configuration diagrams shown in Figures 5 and 6 are based on the premise that data is sent via a network, but form 3 is a form in which data is sent and received using portable storage media such as USB memory, CD, DVD, etc. as an alternative to a network.

[0117] 5, the embodiment of the present invention includes a key issuing device and multiple distribution / decryption devices. The key issuing device is connected in series to one distribution / decryption device, and the distribution / decryption device is connected to other distribution / decryption devices via a communication network.

[0118] Configuration 3 is a configuration based on the configuration of FIG. 5, in which the network between the distribution and decoding devices is replaced with a data flow via a portable storage medium (hereinafter referred to as an air gap).

[0119] In the distribution stage of Form 3, the installment data and verification tool are stored on a portable storage medium, which is transported as a carrier and stored in the distribution / decryption device at the opposing site. Also, in the verification stage of Form 3, the portable storage medium is connected to the opposing distribution / decryption device, the verification tool is executed, and the sequence shown in Figure 9 is carried out between the portable storage medium and the connected distribution / decryption device to verify their mutual legitimacy, and then the installment data is distributed to the distribution / decryption device.

[0120] Furthermore, in the decryption stage in form 3, a portable storage medium is connected to the distribution / decryption device, and a decryption process is requested via a verification tool. The distribution / decryption device responds with the calculation results of the distributed serial processing, stores the results in the portable storage medium, and repeats this process until the distribution / decryption device that is the decryption commander performs the final calculation to obtain the original polynomial.

[0121] The portable storage medium stores a verification tool that verifies the connected control terminal and the portable storage medium, and in the verification and decryption stages, the verification tool is executed, the sequence shown in Figure 9 is carried out, and then installment data is distributed and calculation requests for distributed serial processing are made.

[0122] Here, the subject of the system that runs the verification tool can be broadly considered in two ways: for example, a portable storage medium may be an embedded device that has an SoC in addition to a storage area, and the verification tool is executed by this SoC; or the portable storage medium does not include a control unit including an SoC, and the verification tool is executed by a control terminal to which the portable storage medium is connected. Form 3 covers both cases. In the latter case, the control terminal may be incorporated into the distribution / decryption device, or may be separated from the distribution / decryption device and located adjacent to it, and both cases are also covered.

[0123] Some or all of the above-described embodiments can also be described as in the following supplementary notes. However, the following supplementary notes are merely examples of the present invention, and the present invention is not limited to such cases. [Appendix 1] This is the same as the key distribution system according to the first aspect described above. [Appendix 2] The installment data generation unit of the distributed device has preset values ​​of an integer n equal to or greater than 2 and a threshold k of an integer equal to or greater than 2 and equal to or less than n, which is the minimum number required to reconstruct the encryption key, and constructs a k-1 degree polynomial in an extension field by fitting the encryption key to the polynomial parameters of each term other than the intercept with a block length of k-1 bytes, and converts the encryption key into k or more coordinates that pass through the polynomial curve to generate electronic installment data, preferably a key distribution system as described in Appendix 1. [Appendix 3] The decryption unit of the decryption device obtains a Newton interpolation polynomial by calculating a difference quotient using k pieces of electronic installment data as input values ​​one by one, and decrypts the encryption key by obtaining the polynomial when electronic installments are made, preferably a key distribution system as described in Appendix 2. [Appendix 4] A key distribution system, preferably any of Appendices 1 to 3, in which a destination verification unit of the sharing device verifies the legitimacy of the destination, and a source verification unit of the decryption device verifies the legitimacy of the source, and verifies that both the source and the destination possess secret sharing capability and possess a verification key that has been distributed in advance using data presented for verification. [Appendix 5] Preferably, the key distribution system of Appendix 4, wherein the destination verification unit of the sharing device and the source verification unit of the decryption device each create a response to a one-time message created by both the source and the destination based on a secret sharing scheme, and verify the legitimacy of both the source and the destination. [Appendix 6] a plurality of decoding devices; Each decoder is connected in series and sequentially decodes the installment data. Preferably, the key distribution system of any of claims 1 to 5. [Appendix 7] Preferably, the key distribution system described in Appendix 6, wherein the multiple decryption devices perform multiple operations to decrypt the encryption key from multiple sets of installment data consisting of different installment data, and verify the authenticity of the installment data. [Appendix 8] Preferably, the key distribution system of appendix 6 or 7, wherein the plurality of decryption devices execute a plurality of decryption processes in a distributed manner in series, and decrypt the encryption key by repeatedly executing the decryption processes. [Appendix 9] This is the same as the key distribution method according to the second aspect described above. [Appendix 10] This is the same as the program related to the third perspective mentioned above. [Appendix 11] A key distribution system preferably according to any one of appendices 6 to 8, comprising a plurality of decryption devices, each of which is connected to another decryption device in a one-to-many relationship, and which performs decryption processing by distributed processing of the plurality of devices forming a tree structure to decrypt an encryption key. [Appendix 12] Preferably, the key distribution system of Appendix 2, wherein the electronic installment data generation unit replaces the polynomial of the secret sharing scheme with a reducible polynomial that is expressed in advance as a product of multiple polynomials according to the factor theorem. [Appendix 13] 9. A key distribution system preferably according to any one of appendices 6 to 8, in which a plurality of distributed devices and decryption devices located at different spatial locations transmit and receive data between the devices using a portable storage medium. [Appendix 14] A key distribution system, preferably as described in Appendix 1, in which electronic installment data and a program for causing a computer to execute a process for verifying the legitimacy of both the delivery destination and the delivery source are stored on a portable storage medium from one distribution device or decryption device, and delivered by transporting the data to another decryption device. [Appendix 15] A key distribution system preferably according to appendix 14, wherein the program stored on a portable storage medium is executed, and verification is performed between the program and a distribution / decryption device in accordance with the verification process of appendix 4 and appendix 5. [Appendix 16] A key distribution system preferably according to appendix 14 or 15, including a method of storing the installment data and the program on a portable storage medium, transporting the stored installment data and the program to another decryption device, and decrypting the data according to the secret sharing decryption method of appendix 3. [Appendix 17] A key distribution system according to claim 1, which preferably includes a method of encrypting the electronic installment data using homomorphic encryption having properties of additive homomorphism and multiplicative homomorphism, and performing decryption at the end of the decryption process.

[0124] The disclosures of the above-cited non-patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including each element of each claim, each embodiment, each element of each embodiment, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally includes various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims. In particular, with regard to the numerical ranges set forth herein, any numerical value or subrange included within the range should be construed as being specifically set forth, even if not otherwise specified. [Explanation of symbols]

[0125] 10: Key issuing device 11: Dispersion device 12, 12-1 to 12-N: Decryption device 13-1 to 13-N: Distributed and Decoder 14: Installment data generation unit 15: Destination verification section 16: Installment data transmission unit 17: Sender verification unit 18: Installment data receiving unit 19: Decryption unit 101:CPU 102: Memory 103: Input / output interface 104:NIC 105: Internal bus

Claims

1. a key issuing device that generates and issues encryption keys; an installment data generation unit that electronically installs the encryption key to installment data using a secret sharing scheme; a destination verification unit that verifies the legitimacy of a destination when transmitting the installment data; an installment data transmitting unit that transmits the installment data to the destination when the verification result by the destination verifying unit is valid; a dispersion device having a sender verification unit that verifies the legitimacy of a sender when receiving the installment data; an installment data receiving unit that receives the installment data from the sender when the verification result by the sender verification unit is valid; a decryption unit that decrypts the encryption key using the received installment data as an input value; a decoding device having Including, The installment data generation unit of the distributed device has preset values ​​of an integer n of 2 or more and a threshold k of an integer between 2 and n, which is the minimum number required to reconstruct the encryption key, and constructs a k-1 degree polynomial in an extension field by fitting the encryption key to the polynomial parameters of each term other than the intercept, with k-1 bytes as the block length, and converts it into k or more coordinates that pass through the polynomial curve to generate electronic installment data. A key distribution system.

2. 2. The key distribution system of claim 1, wherein the decryption unit of the decryption device obtains a Newton interpolation polynomial by calculating a difference quotient using the k electronic installment data as input values ​​one by one, and decrypts the encryption key by obtaining the polynomial when the electronic installment is made.

3. a plurality of the decoding devices; Each decoding device is connected in series and sequentially decodes the installment data.

3. The key distribution system according to claim 1 or 2.

4. 4. The key distribution system according to claim 3, wherein the plurality of decryption devices perform a plurality of operations to decrypt the encryption key from each of a plurality of sets of installment data consisting of different installment data, and verify the authenticity of the installment data.

5. 5. The key distribution system according to claim 3, wherein the plurality of decryption devices execute a plurality of decryption processes in a distributed manner in series, and decrypt the encryption key by repeatedly executing the decryption processes.

6. generating and issuing a cryptographic key; an installment data generation step of electronically paying the encryption key to a plurality of installment data by using a secret sharing scheme; a step of verifying the authenticity of the plurality of installment data between the source and the destination when the plurality of installment data are delivered; If both the delivery source and the delivery destination are legitimate, delivering the plurality of installment data; decrypting the encryption key using the plurality of installment data as an input value; Including, In the installment data generation step, an integer n of 2 or more and a threshold k of an integer of 2 or more and n or less, which is the minimum number required to reconstruct the encryption key, are set as preset values, the encryption key is constructed according to a k-1 degree polynomial in an extension field, with k-1 bytes as the block length, and fitted to the polynomial parameters of each term other than the intercept, and the encryption key is converted into k or more coordinates passing through the polynomial curve, thereby generating electronic installment data.

7. A process of generating and issuing a cryptographic key; an installment data generation process for electronically paying the encryption key to a plurality of installment data using a secret sharing scheme, in which an integer n of 2 or more and a threshold k of an integer between 2 and n, which is the minimum number required to reconstruct the encryption key, are preset as values, and the encryption key is converted into k or more coordinates passing through the polynomial curve to generate electronic installment data; a process of verifying the authenticity of the plurality of installment data between the source and the destination when the installment data is delivered; If both the delivery source and the delivery destination are legitimate, a process of delivering the plurality of installment data; a process of decrypting the encryption key using the plurality of installment data as an input value; A program that causes a computer to execute the following.

Images