Secret distribution method, secret distribution system, and secret distribution program

Abstract

The present invention achieves both confidentiality and availability of a secret sharing method. The present invention includes a distribution step in which a distributed data generation unit 14 generates distributed piece data from data to be distributed, and a reconstruction step in which a data restoration unit 15 reconstructs the data to be distributed by using the distributed piece data. In the distribution step, k distributed pieces and (one or two) spare distributed pieces are generated from the data to be distributed and are stored in each of a plurality of storage units 22. In the reconstruction step, when a group of distributed pieces collected from the storage units 22 satisfies a reconstruction distribution number, the data to be distributed is reconstructed by using the group of collected distributed pieces. However, when the reconstruction distribution number is not satisfied, the spare distributed pieces are used when reconstructing the data to be distributed.

Description

Secret sharing method, secret sharing system, secret sharing program

[0001] The present invention relates to a secret sharing method (hereinafter referred to as a secret sharing method) that secretly shares secret information of data to be shared into multiple pieces of data, and reconstructs and restores the data to be shared once the pieces of data are collected, as well as a secret sharing system and a secret sharing program.

[0002] Secret sharing schemes (SSS) are widely used as coding methods for protecting important information (secret information) from threats such as destruction and leakage.

[0003] However, according to Non-Patent Document 1, when secret sharing is used for shared processing, the total amount of shared data increases to varying degrees, which may result in a decrease in memory usage efficiency for shared storage when handling large amounts of data.

[0004] Therefore, Non-Patent Document 12 proposes "n-multiplex (n, n) threshold secret sharing scheme" (hereinafter referred to as "MSSS"), and Non-Patent Document 13 shows that it can be practically implemented.

[0005] Shamir, Adi, “How to Share a Secret,” Commun. ACM, vol. 22, no. 11, pp. 612-613, Nov. 1979. Internet URL: <http: / / doi.acm.org / 10.1145 / 359168.359176> ISO / IEC, “Information technology—Security techniques—Secret sharing—Part 2: Fundamental mechanisms,” ISO / IEC 19592-2, Oct. 2017. Yamazawa, Masao, Tsunoda, Takeshi, Saisho, Toshiaki, Gotaishi, Nao, Sato, Shigeo Tsujii, Keiichi Noda, “MELT-UP Activities for Improving the Reliability of Cryptocurrency (Bitcoin) and Blockchain—Focusing on Private Key Management,” Proc. SCIS2018, 4F2-2. Jan. 2018. M. Yamazawa, M. Gotaishi, H. Yamamoto, S. Tsujii, S. Minami, K. Yoshimitsu, and K. Noda, "On Private Key Protection in Secure Distributed PDS Systems," Proc. SCIS2020, 2C2-2. Jan. 2020. M. Yamazawa, M. Gotaishi, H. Yamamoto, Y. Matsumoto, K. Shiramizu, T. Toyoshima, K. Sese, K. Kondo, and S. Tsujii, "A Study on Requirements of Secret Sharing Schemes for Authenticating Distributed Populations," Proc. SCIS2020, 4G-1, pp.688-692, June 2020. M. Gotaishi, M. Yamazawa, H. Yamamoto, R. Fujita, Y. Matsumoto, K. Shiramizu, T. Toyoshima, K. Sese, K. Kondo, and S. Tsujii, "On Secret Sharing Schemes for Authenticating Distributed Populations," Proc. SCIS2020,4G-2, pp.693-697, June 2020. M. Yamazawa, T. Yonezu, M. Gotaishi, H. Yamamoto, S. Tsujii, “On the Applications and Implementation Requirements of Secret Sharing Libraries,” “Proceedings of the Symposium on Multimedia, Distributed Collaboration and Mobile 2021,” Proc. DICOMO2021,1G-3, pp.163-164, June 2021. M. Yamazawa, T. Yonezu, M. Gotaishi, H. Yamamoto, R. Fujita, S. Tsujii, “Consideration of Implementation Requirements for Secret Sharing Libraries,” “Proceedings of the Symposium on Multimedia, Distributed Collaboration and Mobile (DICOMO2022),” Proc. DICOMO2022,1D-1, pp.51-54, July 2022.Okamoto Tatsuaki and Yamamoto Hirosuke, "Modern Cryptography," Sangyo Tosho Co., Ltd., June 30, 1997 (first edition), June 30, 2000 (first printing). Hirosuke Yamamoto, "(k, L, n) Threshold Secret Sharing System," Transactions of the Institute of Electronics and Communication Engineers, vol. J68-A, no. 9, pp. 945-952, Sep. 1985. [English translation: Electronics and Communications in Japan, Part I, vol. 69, no. 9, pp. 46-54, (Scripta Technica, Inc.), Sep. 1986] Mikihiko Nishishin and Katsunori Takizawa, "Strong Ramp Threshold Secret Sharing Scheme Using Polynomial Interpolation," Transactions of the Institute of Electronics and Communication Engineers, vol. J92-A, no. 12, pp. 1009-1013, Dec. 2009. Hirosuke Yamamoto, "Multiple Secret Sharing Scheme," Proc. The 44th Symposium on Information Theory and its Applications (SITA2021), Nishinomiya, Hyogo, Japan, Dec. 8-10, 2021. Masao Yamazawa, Takeshi Yonezu, Masashi Gotaishi, Hirosuke Yamamoto, Ryo Fujita, Shigeo Tsujii, "Empirical Study of Requirements for the Implementation of Secret Sharing Libraries," Proc. SCIS2023, 2B2-4, Jan. 24-27, 2023. Dai Igarashi, Kota Tsuyuzaki, Yuto Kawahara, "SHH: An Ultra-High-Speed ​​Secret Sharing Library for Object Storage," IPSJ Technical Report Vol. 2015-CSEC-70 No. 26, Vol. 2015-SPT-14 No. 26, July 3, 2015. "[Windows 11] Calculating MD / SHA-1 / SHA-256 Hash Values ​​to Verify File Identity," [online], [Retrieved November 2, 2023], Internet<URL:1714031509391_0.html> .

[0006] Secret sharing schemes are characterized by their ability to meet the conflicting requirements of security, which protects important information from risk, and availability, which allows the system to continue operating. However, there is a risk that the "MSSS" scheme in Non-Patent Document 12 may impair the requirement for availability.

[0007] The present invention has been made to solve such conventional problems, and aims to improve availability while maintaining the high-speed computational performance of "MSSS" in Non-Patent Document 12, thereby achieving both confidentiality and availability in secret sharing schemes.

[0008] One aspect of the present invention is a method for executing a secret sharing system comprising: a shared data generation unit that generates a set of shared pieces obtained by coding and sharing data to be shared; a plurality of storage units that respectively store each of the shared pieces; and a data recovery unit that collects the shared pieces stored in each storage unit and decrypts and reconstructs the shared data based on a predetermined number of shares to be reconstructed, the method comprising: a shared data generation step in which the shared data generation unit generates a plurality of shared piece sets from the shared data to be shared according to the number of shares to be reconstructed and spare shared pieces that have been made redundant from the shared piece sets, and distributes and stores the generated shared pieces and the spare shared pieces in the storage units; and a reconstruction step in which the data recovery unit collects the shared pieces and the spare shared pieces from the storage units, and if the collected shared piece sets satisfy the number of shares to be reconstructed, reconstructs the shared data using the shared piece sets, while if the collected shared pieces do not satisfy the number of shares to be reconstructed, uses the existing shared pieces and the spare shared pieces to find the non-existent shared pieces and reconstructs the shared data.and a data recovery unit that collects the shared pieces stored in the storage units and decrypts and reconstructs the shared data based on a predetermined number of shares for reconstruction, the method comprising: a shared data generation step in which the shared data generation unit generates from the shared data a plurality of shared piece sets corresponding to the number of shares for reconstruction and spare shared pieces (one or two) that have been made redundant from the shared piece sets, and distributes and stores the generated shared pieces and the spare shared pieces in the storage units; and a reconstruction step in which the data recovery unit collects the shared pieces and the spare shared pieces from the storage units, and reconstructs the shared data using the shared piece set if the collected shared piece sets satisfy the number of shares for reconstruction, or reconstructs the shared data using the spare shared pieces if the collected shared pieces do not satisfy the number of shares for reconstruction. The shared data generation step includes a first step of reading each piece of information from a shared data function that stores information on the reconstruction share number (k), the number of spare shared pieces (r), the data length (L) of the data to be shared, and the data to be shared; a second step of generating a random number and creating a data string S (number of bytes = a multiple of "k x 8") of the generated random number, the data length (L), and the data to be shared; and a third step of dividing the data string S into "k x 8" blocks, performing an operation on each divided block, and obtaining a shared piece "W", wherein the third step uses equations (28) and (29) when "the number of spare shared pieces (r) = 1", while S ｘｙ : xth value (x=1, 2, 3...k) of block number y (8 bytes) W ｚｙ : The value of the fragment of block number y and fragment number z (z = 1, 2, 3...k) (8 bytes) W （ｋ＋１）ｙ : the spare dispersion piece When "the number of spare dispersion pieces (r) = 2", the formulas (30) and (31) are used. S ｘｙ: xth value (x=1, 2, 3...k) of block number y (8 bytes) W ｚｙ : The value of the fragment of block number y and fragment number z (z = 1, 2, 3...k) (8 bytes) W （ｋ＋１）ｙ , W （ｋ＋２）ｙ : the spare dispersion piece

[0009] and a data recovery unit that collects the shared pieces stored in each of the storage units and decrypts and reconstructs the shared data based on a predetermined number of shares for reconstruction, wherein the shared data generation unit generates from the shared data a number of shared pieces corresponding to the number of shares for reconstruction and spare shared pieces obtained by making the shared piece sets redundant, and distributes and stores the generated shared pieces and spare shared pieces in each of the storage units; and the data recovery unit collects the shared pieces and the spare shared pieces from the storage units, and if the collected shared piece sets satisfy the number of shares for reconstruction, it uses the shared piece sets to reconstruct the shared data, while if the collected shared pieces do not satisfy the number of shares for reconstruction, it uses the existing shared pieces and the spare shared pieces to find a non-existent shared piece to reconstruct the shared data.

[0010] The present invention may also be configured as a secret sharing program that causes a computer to execute the secret sharing method.

[0011] According to the present invention, it is possible to achieve both confidentiality and availability in a secret sharing scheme.

[0012] 1 is a conceptual diagram of a secret sharing scheme; 2 is an explanatory diagram of the "(k, n) threshold method"; 3 is a graph showing the principle of restoring secret key information S; 4 is a graph showing the case where restoration is not possible; 5 is a system configuration diagram for implementing a secret sharing scheme according to an embodiment of the present invention; 6 is a computer configuration diagram; 7 is a conceptual diagram of system processing; 8 is a processing diagram of the sharing step; 9 is a processing diagram of the independent uniform distribution; and 10 is a processing diagram of the restoration step.

[0013] A secret sharing scheme according to an embodiment of the present invention will be described below. This secret sharing scheme relates to the "k-multiplex (k, k+1) and (k, k+2) threshold scheme" which is an application of the "MSSS" scheme described in Non-Patent Document 12. Here, it will be abbreviated as "Extended Multiplex Secret Sharing Scheme," or "AMSSS."

[0014] <<Explanation of AMSSS>> First, let's explain the basic concept of secret sharing schemes. The following points must be considered when implementing a secret sharing library: A: The size of the data to be shared (data to be shared); B: The number of shares (number of shares); C: The operation mode of the shares used in data reconstruction; D: The processing time (speed) required for secret sharing and reconstruction; E: The security strength required for randomness, etc.; F: The types of errors expected during operation; G: The types of attacks expected against the library functions and applications that use them; H: The security and functionality that must be guaranteed when providing the library to users as a product, the functions that must be supported, and the functions that should be limited or removed to prevent user confusion and poor response. Regarding point H, particular consideration must be given to availability requirements. In other words, when implementing a secret sharing library, it is necessary to balance the conflicting requirements of security and availability mentioned above.

[0015] When considering the risks to "important information" based on Figure 1, it is common to expect the risk of information being lost due to "failure or destruction" and the risk of information being stolen by an unwanted party due to "leakage."

[0016] To prepare for "failure and destruction," it is effective to have redundancy. In other words, replicas are made to spread the risk. On the other hand, to counter the risk of "leakage," replicas should be avoided because they increase the risk. Or, even if a part of the information is seized, it should not be leaked.

[0017] The former is a measure aimed at increasing availability, while the latter is a measure aimed at increasing confidentiality, and these two are contradictory requirements. This dilemma can be alleviated by using secret sharing schemes, as shown in Non-Patent Documents 1 and 2.

[0018] 1. Overview of Secret Sharing Schemes As shown in Non-Patent Document 9, information security measures require the realization of "confidentiality, availability, and integrity." In Figure 1, measures against "leakage" correspond to the realization of confidentiality, and measures against "failure and destruction" correspond to the realization of availability.

[0019] Confidentiality and availability are contradictory requirements, and although implementation requires considerable technology, encryption is usually used to emphasize confidentiality. However, when considering how to deal with compromise and availability in encryption, secret sharing schemes are superior.

[0020] (1) Shamir's Secret Sharing Scheme One of the secret sharing schemes is the "(k, n) threshold scheme, n>k≧2" described in Non-Patent Document 1. Intuitively, this scheme utilizes the theorem that states that there exists exactly one "function of degree k or less" that passes through (k+1) distinct points on the "x, y" plane.

[0021] For example, as shown in FIG. 3, when "k=1", secret information (shared data) S is placed on the y-axis, a line with a slope of "a" is drawn through the point (0, S), and a different point "x" on the x-axis is drawn. ｉ , (i = 1, n)" is given, the corresponding y-coordinate value "y ｉ , (i=1, n) can be calculated using equation (1).

[0022] Here, "i = 1, n (n ≡ "dispersion piece number"), "a" is an arbitrary number. As shown in equation (2), each "x ｉ " corresponds to "y ｉ " combination is used as the dispersion piece.

[0023] When restoring, as shown in formulas (3-1) and (3-2), two dispersion pieces with different dispersion numbers, "W ｐ ", "W ｒ " is arbitrarily selected and then "a" is eliminated by performing simultaneous calculations. This gives the secret information S as shown in equation (4).

[0024]

[0025] On the other hand, as shown in Figure 4, a straight line cannot be fixed with only one dispersed piece, and the secret information S cannot be restored. When the threshold value "k" is "3 or more", the function used is a (k-1)th order function, that is, "f(t): (k-1)th order function of t".

[0026] Although the above explanation was given in the real plane for the sake of intuitive understanding, the calculations are carried out in a finite field, i.e., the Galois field GF(q), in the program implementation. First, as shown below, let S be the secret information to be shared, and let U be the random number group used for secret sharing coding.

[0027] Secret information: S∈GF(q) Random number: U=(U １ , U ２ , U ３ , ..., U k-1 ∈GF(q) Using these, f(t) is defined as in equation (5).

[0028] "α ｉ ∈GF(q), i = 1, 2, ..., n (where, for i ≠ j, α ｉ ≠α ｊ Using the dispersion piece {W １ , W ２ , W ３ , ..., W ｎ} is encoded and decoded as follows: ｉ = f (α ｉ ) ∈GF(q) Decoding: By Lagrange interpolation. Ik = {i １ , i ２ , i ３ , ..., i ｋ}

[0029] From equation (5), "S=f(0)" is obtained. Therefore, decoding can be performed using equation (7) based on equation (6-2).

[0030]

[0031] (2) Characteristics of the threshold method According to this "(k, n) threshold method," f(t) can be determined using any "k" number of variance pieces, and S can be restored. On the other hand, S cannot be determined at all using any (k-1) number of variance pieces.

[0032] Furthermore, even if "n-k" pieces are lost, S can be restored, and even if "k-1" pieces are stolen, no information about S will be leaked. In other words, confidentiality is guaranteed while the availability of S is ensured. This feature has been used to distribute important PKI information, control access rights (Non-Patent Documents 4-6), and protect cryptocurrencies (Non-Patent Document 3), among other applications.

[0033] 2. Secret sharing scheme and total data volume In the “(k, n) threshold secret sharing scheme,” secret information S is divided into n sharing pieces “W ｊ , ｊ = 1, 2, ..., n". Meanwhile, each W ｊ The bit length (amount of data) of needs to be at least the same as that of S.

[0034] Therefore, the total data amount of all distributed pieces is n times the data amount of S. This characteristic does not pose a problem if the size of the data to be distributed is small, because the cost of storing the distributed pieces is relatively small.

[0035] On the other hand, problems arise when you want to store large amounts of data in a distributed manner. The cost of storing several times the amount of data that is originally large becomes extremely high. Therefore, a method to reduce the total amount of data is important for practical use.

[0036] (1) Sharing Method and Data Amount Non-Patent Document 2 proposes a method for reducing the amount of data and a method for simplifying calculations as secret sharing methods.

[0037] The former is proposed as a "(k, L, n) ramp threshold secret sharing scheme" (Scheme 3 in Table 1) with a "Shamir-type" configuration, while the latter is proposed as an "(n, n) threshold secret sharing scheme" (Scheme 2 in Table 1).

[0038] According to the former, the total data volume of the sharing results is n / L times the data volume of the secret information S, which can be reduced to 1 / L of the Shamir-type (k, n) threshold secret sharing scheme.

[0039] However, in the "Shamir" scheme, if "L = n", there is a risk that security against leakage cannot be guaranteed. Therefore, the total number of shared pieces will always exceed the data volume of S. On the other hand, if the method of Non-Patent Documents 10 and 11 (method 5 in Table 1) is used, "k = L = n" can be set, and the total data volume of shared pieces can be encoded so that it is the same as the data volume of S. However, this method has the disadvantage of requiring a large amount of calculation. Furthermore, while the amount of calculation required for the "(n, n) threshold secret sharing scheme" is extremely small, like the "Shamir" scheme, the total data volume increases by n times the data volume of S, and there is a disadvantage that the data volume cannot be reduced like the ramp scheme.

[0040] Therefore, it is difficult to achieve both data volume reduction and computational complexity reduction in methods 1 to 5 in Table 1. In contrast, "MSSS" (method 6 in Table 1) in Non-Patent Document 12 has the advantage of being superior in both computational complexity and data reduction performance, as reported in Non-Patent Document 13, where the implementation results are presented.

[0041] (2) Consideration of the method for creating spare fragments In method 6 in Table 1, the original secret information S cannot be restored unless all the fragments are collected (if even one fragment is missing). This is a natural property from an information theoretical perspective, since the total data volume of the fragments is the same as the data volume of S.

[0042] However, when considering applications such as backup systems for large amounts of data, this presents a drawback in system design as it cannot address the risk of failure or destruction, and a method that allows for the creation of spare distributed pieces is desirable.

[0043] Although it is true that the above problem can be solved by using a general strongly secure "(k, L, n) threshold method" or "k-multiplexed (k, n) threshold method," there is a risk that the amount of calculation required for encoding and decoding will increase.

[0044] On the other hand, in practice, the number of spare dispersion pieces (n-k) is often sufficient if it is around "1 or 2." Therefore, in the following, it is preferable to derive the spare dispersion pieces using "k-multiplexed (k, n) threshold" for the case of (n-k = 1, 2), i.e., "AMSSS."

[0045] 3. Encoding and Decoding by AMSSS For the calculation of encoding and decoding by "AMSSS", the number field is "q = 2 ｍ " is used, where "m>3k" is set and "α" is a primitive element of "GF(q)". A "k×(k+2)" matrix G is defined by equation (8).

[0046] In addition, "GF (2 ｍ In the operation "+", since "-1 = 1", all of the subtraction "-" signs in the equation can be replaced with "+" signs.

[0047] (1) Encoding calculation (encoding calculation of preliminary 2) First, the secret information is １ , S ２ , ..., S ｋ ), S ｉ ∈GF(q)」, and the distribution share is defined as “(W １ , W ２ , ..., W ｋ＋１ , W ｋ＋２ ), W ｊ ∈GF(q) and G is a k×(k+2) matrix having elements on GF(q). In this case, encoding is performed using equation (9).

[0048]

[0049] At this time, "W ｊ , j=1, 2, . . . , k" can be calculated using equations (11) and (12).

[0050]

[0051] Also, W ｋ＋１ , W ｋ＋２ can be obtained from equations (9) and (10) using equations (13) and (14).

[0052]

[0053]

[0054] (2) Decryption calculation (decryption calculation of preliminary 2) Next, consider decryption. １ , W ２ , ..., W ｋ" is given, then "S １ , S ２ ,...S ｋ " can be obtained.

[0055]

[0056] The relationship of equation (16) is obtained from equations (11), (12), and (15) because the relationship of equation (17) holds.

[0057] Also, "W ｋ＋１ Consider the case where "W" is used for decoding. ｋ＋１ " can be calculated from equations (9) to (16) using equation (18) (here, the case where "k" is an even number is shown. When "k" is an odd number, "(α-1)" can be calculated according to equation (16). -１ " to "α -１ ").

[0058] Furthermore, "β ｋ " is defined by equation (19).

[0059] At this time, "W ｋ＋１ " is given by equation (20).

[0060] Similarly, "γ ｋ " is defined by equation (21).

[0061] Then "W ｋ＋２ " is given by equation (22).

[0062]

[0063] (3) Restoration when the intermediate dispersion piece is broken (lost) "W ｊ , 1≦j≦k” are lost will be explained for Cases 1 and 2.

[0064] <Case 1> "W ａ , 1≦a≦k” does not exist, the decoding method is to obtain “W ａ " is obtained and then decoded using equation (16).

[0065]

[0066] <Case 2> "W ａ , W ｂ , 1≦a≦b≦k" does not exist, the decoding method is expressed by equations (25) and (26).

[0067]

[0068]

[0069] At this time, according to equation (27), "W ａ , W ｂ After obtaining ", it is decoded using equation (16).

[0070] In the above, the case of the k-multiple (k, k+2) threshold method has been explained. In the case of the k-multiple (k, k+1) threshold method, ｋ＋２ That is, the processing of equations (21) and (22) can be omitted in the encoding process, and equations (15) and (16) or equation (23) in case 1 can be performed in the decoding process.

[0071] According to the asymmetry of the matrix "G" in equation (10) used for encoding, "W １ , W ２ , ..., W ｋ " is given, decoding can be done quickly, but if not, the decoding time will be a little slower. １ , W ２ , ..., W ｋ , W ｋ＋１ , W ｋ＋２ If all of the above are available, select "W １ , W ２ , ..., W ｋ " can be used to perform high-speed decoding.

[0072] (3) Recovery procedure depends on the missing part. "k+2" pieces are generated. Even if two of them are lost, the original information S can be restored. The restoration procedure differs depending on which pieces are lost, as in Cases 1 and 2. However, in both cases, the original information S can be restored (reconstructed) by matrix calculation.

[0073] As an example, an application example using "AMSSS" in a data center backup system will be described. Specifically, when a secret sharing scheme is adopted in a backup system for large-volume data, the absence of spare secret fragments can lead to difficulties in data recovery due to system design. Therefore, in this example, a backup system using spare secret fragments is constructed using "AMSSS," an extension of Scheme 6 "MSSS" in Table 1, to ensure data redundancy. Attempting to create a "threshold secret sharing scheme" with the same functionality as this example using conventional technology (e.g., Scheme 7 in Table 1) requires complex calculations such as the Vandermonde determinant shown in Equation 27 of Non-Patent Document 10, resulting in a large computational burden and making practical application difficult. This example focuses on solving this problem and employs "AMSSS," an extension of Scheme 6 "MSSS" in Table 1. This allows for the calculation of Equation 10, enabling high-speed processing and facilitating implementation.

[0074] <System Configuration Example> An example configuration of a secret sharing system that executes the secret sharing method of this embodiment will be described with reference to Figures 5 and 6. This system 1 is built in a data center as a cloud-based storage service, and by adopting the aforementioned "AMSSS", it takes advantage of the high speed of the multiple secret sharing method "MSSS" and creates one or two spare shares. In this embodiment, if the required number of shares is all available (if all exist), the data to be shared is reconstructed using them. On the other hand, if the required number is not all available (if none exist), the remaining shares and the spare shares are used to find the missing shares, and then the data to be shared is reconstructed.

[0075] Specifically, as shown in Fig. 5, the system 1 is configured by a storage server device 2 and is connected to a network 4 (see Fig. 6). This storage server device 2 may be a single device, or the system may be configured as a group of multiple storage server devices 2. Note that Fig. 5 shows a system configuration with a single storage server device 2 as an example.

[0076] The storage server device 2 is equipped with a communication unit 21, storage storage devices 3-1 to 3-n, a distributed data generation unit 14, a data recovery unit 15, and a random number generation unit 16. The distributed data generation unit 14 generates a group of distributed fragment data (multiple distributed fragments and spare distributed fragments) by distributing the code of the data to be distributed (confidential information S), and distributes and stores each of the distributed fragments in the storage units 22 of the storage storages 3-1 to 3-n. When multiple storage server 2 groups are used, the distributed fragment data can be distributed and stored in the storage storage 3 of each storage server 2.

[0077] When restoring the secret information S, the data restoration unit 15 collects the fragment data from the storage 3-1 to 3-n and restores the data to be distributed. However, as shown in Non-Patent Document 13, since each fragment is transferred via communication and written to and read from memory, it cannot be said to be error-free, and there may be cases where data is missing or missing. It is therefore commonly recognized by those skilled in the art that some kind of error detection means should be added at the application level. Therefore, in this embodiment, an error detection code (EDC), i.e., a checksum, is added to each fragment to perform error checking.

[0078] If the collected fragments are free of any missing pieces and meet the required number, the secret information S is restored using the collected fragments. On the other hand, if the collected fragments are missing or damaged and do not meet the required number, the existing fragments and spare fragments are used to find the missing (missing) fragments, and then the secret information S is restored.

[0079] The random number generation unit 16 generates a random number (8 bytes) in response to a command from the distributed data generation unit 14. As shown in Figure 6, the storage server device 2 is mainly composed of a computer and includes a communication device 51, an input device 52, a memory (main storage device) 53, an auxiliary storage device (SSD, HDD, etc.) 54, a CPU 55, and an output device 56. The hardware components 51 to 56 are connected via a bus 57, and the above-mentioned units 3, 14, 15, 16, 21, and 22 are implemented by cooperation between the hardware and software.

[0080] <Processing Contents of Shared Data Generation Unit 14 and Data Restoration Unit 15> The shared data generation unit 14 has a shared data generation function (function: amsss_generate) that generates shared pieces and spare shared pieces from the data to be shared (secret information S).

[0081] On the other hand, the data restoration unit 15 has a reconstruction function (function: amsss_reconstruct) that reconstructs and restores the data to be distributed using the distributed fragment group and spare distributed fragments. Here, "AMSSS" is used for the distributed data generation function and reconstruction function. Details will be explained below with reference to FIG. 7.

[0082] (1) Distributed data generation function The distributed data generation unit 14 uses the distributed data generation function to generate distributed pieces (1) to (k) and spare distributed pieces (k+1) and (k+2) from the data to be distributed, as shown by arrows A and B in Figure 7.

[0083] The distributed data generation function (function) uses the first address of the one-dimensional array of arguments (inputs) "Si (unsigned char ＊ The shared pieces of the data to be shared (secret information S) are stored in the shared data (secret information S) file Si), and the following information is set by specification: A: The number of shared pieces required to reconstruct the data to be shared (a so-called threshold value "range of 2 to 6": hereinafter referred to as the number of reconstructed shared pieces) B: The number of spare shared pieces (range of 1 to 2: hereinafter referred to as the spare shared pieces) C: The data length of the data to be shared (1 to 2 ５０ Byte range) In addition, the distributed data generation function (function) sets the first address of the two-dimensional array of the argument (output) "Sni (unsigned char ＊ In each line of "Sni"), "shared number (1 byte) + shared piece data (total number of blocks x 8) bytes" is set.

[0084] The total number of blocks is calculated as "(length of data to be distributed + 16) ÷ (number of reconstructed shares × 8)". Here, "(length of data to be distributed + 16) ÷ (number of reconstructed shares × 8)" is a number rounded up to the nearest whole number. In this embodiment, a hash value is used as the checksum for each piece of distributed data. Calculating a hash value to check the identity of a file is well known to those skilled in the art from publicly known documents such as Non-Patent Document 15, but as will be described later, it is set up as a means of checking whether the distributed pieces are normal or abnormal. For example, if the number of reconstructed shares is "3", the number of spare shares is "2", and the two-dimensional array is [Sni], then: Sni[0]: Share number 1 + share piece data (share piece) of share number 1 + hash value Sni[1]: Share number 2 + share piece data (share piece) of share number 2 + hash value Sni[2]: Share number 3 + share piece data (share piece) of share number 3 + hash value Sni[3]: Share number 4 + share piece data (spare share piece) of share number 4 + hash value Sni[4]: Share number 5 + share piece data (spare share piece) of share number 5 + hash value

[0085] Therefore, the number of rows and columns of the two-dimensional array are: Number of rows in two-dimensional array = number of reconstructed shares + number of preliminary shares Number of columns = total number of blocks x 8 + 1 (bytes) The processing contents (S01 to S06) by the distributed data generation function will be explained below with reference to Figure 8.

[0086] S01: When processing starts, the distributed data generation unit 14 reads the number of reconstruction shares (k: 1 byte), the number of preliminary shares (r: 1 byte), the data length of the data to be distributed (L: 8 bytes), and the data to be distributed (L bytes) set in the one-dimensional array Si of the distributed data generation function.

[0087] S02: The hash value (SHA-256 of OpenSSL) of the data to be distributed is calculated. The calculated hash value is stored in the first address of the one-dimensional array of the distributed data generation function, "CS (unsigned character ＊ CS)).

[0088] S03: A command is output to the random number generation unit 16 to generate a random number (8 bytes) based on the time. At this time, the random number is generated using the function "clock_gettime()" that acquires the time.

[0089] The generated random number is obtained and a data string of "random number + data length L to be distributed + data to be distributed" is created. At this time, if the number of bytes of the created data string is not a multiple of "k x 8", "x'00'" is padded at the end of the data string to make it a multiple of "k x 8".

[0090] S04: The data string created in S03 is converted into an independent uniform distribution as described below.

[0091] S05: Divide the data sequence S that has been distributed independently and uniformly in S04 into blocks of “k×8”, and apply the “GF(2 ６４ ) and perform the following calculation to obtain the dispersed piece data "W (W zｙ In this case, "α" is calculated as "GF(2 ６４ ) as a primitive element of

[0092] Specifically, the preliminary distribution number r read in S01 is checked, and if "preliminary distribution number r=1", then equations (28) and (29) are used.

[0093]

[0094] On the other hand, if the "preliminary distribution number r=2", then equations (30) and (31) are used.

[0095]

[0096] In formulas (28) and (29), S xｙ :xth value of block number y (8 bytes) W zｙ : Block number y, distribution number z distribution piece value (8 bytes) zｙ , z=1, 2, 3, . . . k" are calculated by the calculations of equations (32) and (33).

[0097]

[0098] Also, "W （ｋ＋１）ｙ ", "W （ｋ＋２）ｙ " can be calculated from equations (28) to (31) using equations (34) and (35).

[0099]

[0100] S06: Each dispersed piece data "W zｙ " is calculated. Then, each piece of distributed data "W zｙ " and the hash value are set in the two-dimensional array "Sni" of the shared data generation function. At this time, the shared piece data and hash value of shared piece number i are assigned to the i-th row of the two-dimensional array "Sni", for example, if the shared piece number is 2, it is assigned to the second row.

[0101] Then, each dispersed piece data "W zｙ " are distributed and stored in the storage units 22 of the storages 3-1 to 3-n. Note that FIG. 8 shows the case where "preliminary distribution number r=2", and when "preliminary distribution number r=1", the calculation formula in S05 is replaced from formula (30) to formula (28), and the two-dimensional array "Sni" in S06 loses the last (k+2)th row and remains up to the (k+1)th row.

[0102] (2) Details of S04 According to "MSSS", the algorithmic constraint for achieving security is "S (secret information: data to be distributed) = (S １ｙ , S ２ｙ , ..., S ｘｙ ) for each "S ｘｙ " must be independent and uniformly distributed. Therefore, in S04, the following independent and uniformly distributed processes (S11 to S14) are performed.

[0103] S11: When the process starts, multiplication is performed with an appropriate matrix in a finite field. For example, as shown in equation (36), ６４ The elements of matrix A are determined by random numbers on the 64-bit (1 word) system, and the inverse matrix B is calculated. The inverse matrix B is a matrix whose determinant |A| is 2 ６４ " can be found if they are relatively prime, i.e., odd numbers.

[0104] "mod2 ６４ ” = Law 2 ６４ S12: For the data sequence before it is made into an independent uniform distribution, "modulus 2" is applied from the front to the back. ６４ " is operated on matrix A to generate a new data string.

[0105] A processing example will be described based on equation (37). Here, the data sequence before being converted into an independent uniform distribution is expressed as data sequence X (X （１） X （２） X （３） X （４） X （５） X （６） ・・・・・・・X （M-2） X （M-1） X （M） ) and the new data string is represented as data string Y (Y （１） Y （２） Y （３） Y （４） Y （５） Y （６） ....Y （M-2） Y （M-1） Y （M） ) and each X and Y is 8 bytes. ６４ " is used to perform operations on matrix A.

[0106] First, (X （１） X （２） X （３） ) is calculated as shown in equation (37-2) to obtain (Y （１） Y （２） Y （３） )

[0107] Next, the data string (Y （１） Y （２） Y （３） X （４） X （５） X （６） ・・・・・・・X （M-2） X （M-1） X （M） ) in (Y （２） Y （３） X （４） ), as shown in equation (37-4), the above calculation is performed to obtain (Y （２） Y （３） Y （４） ) to obtain the data string (Y （１） Y （２） Y （３） Y （４） X（５） X （６） ・・・・・・・X （M-2） X （M-1） X （M） ) is generated.

[0108] In this way, (X （１） X （２） X （３） X （４） X （５） X （６） ・・・・・・・ X （M-2） X （M-1） X （M） ) in order from the beginning, the data string (Y （１） Y （２） Y （３） Y （４） Y （５） Y （６） ....Y （M-2） Y （M-1） X （M） ) to generate the

[0109] Then, as shown in equation (37-7), (Y （Ｍ-2） Y （Ｍ-1） X （Ｍ） ) by performing the above calculation （Ｍ－２） Y （Ｍ－１） Y （Ｍ） ), and the data string Y (Y （１） Y （２） Y （３） Y （４） Y （５） Y （６） ....Y （M-2） Y （M-1） Y （M） ) to generate a

[0110] S13: A new data string Z is generated by replacing the upper 32 bits with the lower 32 bits between adjacent data pieces of the data string Y generated in S12.

[0111] For example, as shown in FIG. （１） and data Y （２） The upper 32 bits of data Y are replaced. （２） and data Y （３）The upper 32 bits of data Y are replaced. （３） and data Y （４） The upper 32 bits of data Y are replaced in the same way. Finally, data Y （Ｍ） and data Y （１） The data string Z is generated by substituting the upper 32 bits of the above.

[0112] S14: For the data string Z created in S13, "modulo 2" is added in order from the end. ６４ " is multiplied by matrix A to generate a new data sequence S.

[0113] A processing example will be described based on equation (38). Each generation in this processing example is also performed using "modulo 2" ６４ " is used to perform operations on matrix A.

[0114] Equation (38-1) is the data string Z (Z （１） Z （２） Z （３） Z （４） Z （５） Z （６）・・・・・・・・ Z （M―４） Z （M―３） Z （M―２） Z （M―１） Z （M） First, as shown in equations (38-2) and (38-3), (Z （M―２） Z （M―１） Z （M） ) by performing the above calculation (S （Ｍ－２） S （Ｍ－１） S （Ｍ） ) is then generated, as shown in equations (38-4) and (38-5). （Ｍ－３） S （Ｍ－２） S （Ｍ－１） ) by performing the above calculation (S （Ｍ－３） S （Ｍ－２） S （Ｍ－１） ) to generate the

[0115] In this way, by performing the above calculation on three data in a row starting from the end of the data string Z, (Z （１） S （２） S （３） S （４） S （５） S （６）-------S （M―４） S （M―３） S （M―２） S （M―１） S （M） ) is generated.

[0116] Then, as shown in equation (38-7), (Z （１） S （２） S （３） ) by performing the above calculation (S （１） S （２） S （３） ) is generated. As a result, a new data sequence S (S （１） S （２） S （３） S （４） S （５） S （６）------- S （M―４） S （M―３） S （M―２） S （M―１） S （M） ) is generated.

[0117] (2) Reconstruction Function The reconstruction function will be explained based on Fig. 10. Here, the original data to be distributed is reconstructed and restored using a group of distributed fragment data (distributed fragments and spare distributed fragments) by basically executing the reverse process of the distributed data generation function.

[0118] The arrows C and D in Figure 7 indicate that the original data to be distributed is restored using the spare distributed piece (k+2) because the distributed piece (2) has been damaged or lost. The following information is set as an argument to the reconstruction function (function):

[0119] <Argument (input)> ・"N (unsigned char ＊ N)) The first address of the one-dimensional array that stores the number of reconstructed shares and the number of preliminary shares (set the same value as "Si" of the shared data generation function). "P (unsigned char ＊ P)) The first address of the one-dimensional array that stores the data length (8 bytes) of the data to be distributed (set the same value as "Si" of the distributed data generation function). "CS (unsigned char ＊CS)) The first address of the one-dimensional array that stores the hash value (32 bytes) of the data to be distributed (set the same value as the hash value returned by the "CS" of the distributed data generation function). ＊ Sni)" is the starting address of a two-dimensional array that stores the shared pieces used for reconstruction, and this two-dimensional array is set in the same way as "Sni" in the shared data generation function. For example, if the number of shared pieces to be reconstructed is three and the number of spare shared pieces is two, if the shared pieces with shared numbers "1" and "3" cannot be collected due to missing or damaged pieces, they will be reconstructed using two spare shared pieces. In this case, the two-dimensional array will look like this (shared numbers do not need to be sorted in order): Sni[0]: Shared number 2 + shared piece data (shared piece) for shared number 2 + hash value Sni[1]: Shared number 4 + shared piece data (spare shared piece) for shared number 4 + hash value Sni[2]: Shared number 5 + shared piece data (spare shared piece) for shared number 5 + hash value Note that the number of rows in the two-dimensional array is the number of shared pieces to be reconstructed, and the number of columns is "total number of blocks x 8 + 1 (bytes)." This total number of blocks is the same as "Sni" in the shared data generation function.

[0120] <Argument (output)> ・"Si (unsigned char ＊ Si)" This is the starting address of a one-dimensional array that stores the decrypted distribution target data, and the size of the array is the same as the data length set in the argument (input) "P". The processing contents (S21 to S23) by the reconstruction function will be explained below.

[0121] S21: When the process starts, the fragment data, i.e., the fragment "W １ , W ２ , . . . , W ｋ " and spare dispersion pieces (preliminary dispersion = 2 pieces, "W ｋ＋１ " " W ｋ＋２ " / spare dispersion piece = 1 piece "W ｋ＋１ The collected dispersed pieces "W １ , W ２ , . . . , W ｋ In this embodiment, the determination is made in two steps.

[0122] Due to a failure of the storage 3 or a network error, it may not be possible to collect the fragments within a predetermined time, resulting in a timeout and missing fragments. Therefore, as a first step, a check is made to see whether the number of fragments equals the number of fragments required for reconstruction based on the distribution number of each collected fragment. For example, if collection of fragments with distribution numbers "1" and "3" times out, the fragments with distribution numbers "1" and "3" will be missing. In this case, since there are no fragments with distribution numbers "1" and "3," it is determined that the number of fragments required for reconstruction is not met. On the other hand, if the number of collected fragments satisfies the number of fragments required for reconstruction, the process proceeds to the second step, an error check.

[0123] In the second step, each collected fragment “W １ , W ２ , . . . , W ｋ " is calculated and compared with the hash value set in "Sni" of the reconstruction function.

[0124] If the result of the comparison is that the two hash values ​​are the same, the shared fragments are recognized as normal. １ , W ２ , . . . , W ｋ If the dispersion piece "W" is recognized as normal, the number of normal pieces equal to the number of reconstructed dispersion pieces is obtained, and it is determined that the number of reconstructed dispersion pieces is satisfied. １ , W ２ , . . . , W ｋ " is used to decrypt the original data to be shared.

[0125] On the other hand, if the two hash values ​​are not the same, data corruption or the like has occurred, and the shared piece is deemed abnormal. For example, if the two hash values ​​for a shared piece with share number "3" are not the same, it is deemed abnormal. In this case, the shared piece with share number "3" is treated as non-existent due to a defect, and is determined to not meet the number of shares for reconstruction. It is also preferable to perform a similar error check on spare shared pieces to confirm whether they are normal or abnormal.

[0126] If it is determined that the number of reconstructed fragments is not met, the spare fragments "W ｋ＋１" " W ｋ＋２ (when there are two spare shares) is used. For example, S21 in Figure 10 shows a case where, as in Figure 7, the spare share number "2" is deemed to be non-existent, and instead the "k+2"th spare share is used to decrypt together with the existing spare shares. However, it is preferable to limit this to spare shares that have been determined to be normal by error checking.

[0127] In this way, in this embodiment, since the fragment data is made redundant by "AMSSS", the fragment "W １ , W ２ , . . . , W ｋ Even if one or two pieces are missing or missing in the "Sni" block, the data to be distributed can be restored. When restoring the data, the "GF(2 ６４ The content of the calculation is shown below (block number y is omitted):

[0128] ≪"W １ , W ２ , . . . , W ｋ " only>> If it is determined that the number of reconstruction shares is satisfied, the share piece "W １ , W ２ , . . . , W ｋ " is used to decrypt the data.

[0129]

[0130] W ｚ : Value of the shared piece of the shared number z of the block to be decrypted (8 bytes) S z : The zth value of the decrypted block (8 bytes) where "(α-1) -１ " to "α -１ " is calculated in advance and defined as an "unsigned long long" type constant in the program to speed up the decoding process. ａ , 1≦a≦k) does not exist> ａ : 1≦a≦k) does not exist (W ａ In the case where (k-1) pieces of the dispersion pieces W are missing or missing, firsti (1≦i≦k, i≠a) and the spare dispersion piece (1 piece) are used to separate the dispersion piece (W ａ ) is calculated using equations (41) to (43). Here, the upper equation of equation (41) is equivalent to equation (23), and the lower equation is equivalent to equation (24).

[0131]

[0132]

[0133] In this case, in order to reduce the calculation time, the "W ｉ , W ｋ＋１ , W ｋ＋２ It is preferable to calculate the coefficients for " and set them in an array. For example, "W ｋ＋１ , W ｋ＋２ Since the coefficients for " are determined by k and a, they are initially set as a two-dimensional array with k and a as the elements of the array. ｉ The coefficients for " are determined by k, a, and i, so they are initialized to a three-dimensional array with these as elements. Next, the dispersion pieces (W ａ ) and dispersion piece W i (1≦i≦k, i≠a) is used to decrypt the data to be shared using equation (40).

[0134] <(W ａ ,W b : 1≦a≦b≦k) does not exist > Dispersion piece (W ａ ,W b If 1≦a≦b≦k) does not exist (missing or missing), first (k-2) dispersed pieces W i (1≦i≦k, i≠a, i≠b) and spare dispersion pieces (2 pieces) are used to create dispersion pieces (W ａ ,W b ) is found. Here, equations (44) to (46) are used. Here, equation (44) is equivalent to equation (27-1), and equation (45) is equivalent to equation (27-2).

[0135]

[0136]

[0137] In this case, too, in order to reduce the calculation time, the "W ｉ , W ｋ＋１ , W ｋ＋２ It is preferable to calculate the coefficients for " and set them in an array. For example, "W ｋ＋１ , W ｋ＋２ The coefficients for " are determined by k, a, and b, so they are initialized to a three-dimensional array with these as elements. ｉ The coefficients for " are determined by k, a, b, and i, so they are initialized to a four-dimensional array with these as elements. Next, the dispersion pieces (W ａ ,W b ) and dispersion piece W i (1≦i≦k, i≠a, i≠b) is used to decrypt the data to be shared using equation (40).

[0138] S22: The data string decoded in S21 is subjected to the inverse operation of the independent uniform distribution in S04.

[0139] (a) Using the inverse matrix B of matrix A, the data string is sequentially divided into "modulo 2" ６４ ” is used to perform the operation of matrix B (the inverse operation of S14).

[0140] (b) In the data string after the calculation of the inverse matrix B, the upper 32 bits and the lower 32 bits of adjacent data are inversely permuted (the inverse operation of S13).

[0141] (c) Using the inverse matrix B on the data string after the inverse substitution, ６４ " is multiplied by the inverse matrix B (the inverse operation of S12).

[0142] S23: The data to be distributed is extracted from the data string generated after the processing of S22, and a hash value (OpenSSL SHA-256) is calculated. The calculated hash value is compared with the hash value set in "CS" of the reconstruction function, and the authenticity of the reconstructed data to be distributed is confirmed.

[0143] That is, if the two hash values ​​are the same, the decrypted data to be shared is set in the one-dimensional array "Si" and a return value of "0" is returned. On the other hand, if the two hash values ​​are different, the data could not be correctly reconstructed, so a value other than "0" is returned (although the return value "6" is shown in FIG. 6, any other value is also acceptable). In this case, it is preferable to set the data to be reconstructed again.

[0144] In this way, according to this embodiment, by adopting "AMSSS", it is possible to create one or two spare distributed pieces while taking advantage of the high speed of "MSSS", and to reconstruct the data to be distributed using the spare distributed pieces. This makes it possible to achieve both availability and confidentiality in a large-capacity backup system such as a data center.

[0145] In the first embodiment, whether or not the dispersed piece group satisfies the reconstructed dispersed number is determined in two steps, but in this embodiment, the second step is omitted and the determination is made only in the first step.

[0146] Therefore, it is not necessary to obtain a hash value for each piece of distributed data in S06 of this embodiment, nor is it necessary to set a hash value for each piece of distributed data in the distributed data generation function and the reconstruction function.

[0147] Specifically, (1) the dispersed pieces "W １ , W ２ , . . . , W ｋ If all of the fragments "W" can be collected without timing out, it is determined that the number of fragments to be reconstructed is satisfied. In this case, the fragment data "W" is calculated using equations (39) and (40) in the same manner as in the first embodiment. １ , W ２ , . . . , W ｋ " is the only way to decrypt it.

[0148] However, the fragments used for decoding are １ , W ２ , . . . , W ｋ If there is a loss due to data corruption or the like in any of the fragments, a return value other than "0" is returned when checking the success or failure of S23, and another restoration attempt is made. At this time, if "Distribution variable = 1", the fragment data is transferred to the spare fragment "W" in the order of the fragment number. ｋ＋１" and decrypted using equations (39) and (40). If "distribution variable = 2", two pieces of shared piece data are decrypted in the order of the shared piece numbers into spare shared pieces "W ｋ＋１ " " W ｋ＋２ " and decoded using equations (39) and (40).

[0149] (2) On the other hand, the distributed piece “W １ , W ２ , . . . , W ｋ If any of the collections of "<(W ａ , 1≦a≦k) does not exist> <(W ａ , 1≦a≦k) does not exist> The same process as in the above is performed to restore the data to be distributed.

[0150] The present invention is not limited to the above-described embodiment, and can be modified and implemented within the scope of the claims. For example, it can be configured as a secret sharing program that causes a computer to execute the processing steps (S01 to S06, S11 to S14, S21 to S23) of the secret sharing method of the embodiment.

[0151] This program allows the secret sharing system 1 to be constructed on a computer, and the program may be distributed by being stored on a recording medium, or by being downloaded from the Internet.

[0152] REFERENCE SIGNS LIST 1... Confidential information system 2... Storage server device 3-1 to 3-n... Storage storage device 4... Network 14... Distributed data generation unit 15... Data restoration unit 16... Random number generation unit 21... Communication unit 22... Storage unit

Claims

1. A method for executing a secret sharing system comprising: a shared data generation unit that generates a set of shared pieces by code-distributing data to be shared; a plurality of storage units that respectively store each of the shared pieces; and a data recovery unit that collects the shared pieces stored in each of the storage units and decrypts and reconstructs the shared data based on a predetermined number of shares to be reconstructed, the method comprising: a shared data generation step in which the shared data generation unit generates from the shared data a plurality of shared piece sets according to the number of shares to be reconstructed and spare shared pieces that have been made redundant by distributing the generated shared pieces and the spare shared pieces in each of the storage units; and a reconstruction step in which the data recovery unit collects the shared pieces and the spare shared pieces from the storage units, and if the collected shared piece set satisfies the number of shares to be reconstructed, reconstructs the shared data using the shared piece set, while if the collected shared pieces do not satisfy the number of shares to be reconstructed, uses the existing shared pieces and the spare shared pieces to find the non-existent shared pieces and reconstructs the shared data.

2. The secret sharing method according to claim 1, characterized in that the shared data generation step includes a step of determining the value of an error detection code for each of the generated shared pieces and setting it in a data recovery unit, while the reconstruction step includes a step of determining whether each shared piece exists by determining the value of an error detection code for each of the collected shared pieces and comparing it with the set value.

3. The secret sharing method according to claim 1, characterized in that the reconstruction step includes the steps of: if the number of the collected shared pieces satisfies the reconstructed share number, reconsidering the data to be shared using the collected shared piece set; and if the reconstruction using the collected shared piece set fails, replacing the shared pieces with the spare shared pieces in the order of the numbers assigned to the shared pieces and performing reconstruction.

4. A method for executing a secret sharing system comprising: a shared data generation unit that generates a set of shared pieces by code-distributing shared data; a plurality of storage units that respectively store each of the shared pieces; and a data recovery unit that collects the shared pieces stored in each of the storage units and decrypts and reconstructs the shared data based on a predetermined number of shares to be reconstructed, the method comprising: a shared data generation step in which the shared data generation unit generates from the shared data a plurality of shared piece sets according to the number of shares to be reconstructed and spare shared pieces (one or two) that have been made redundant from the shared piece sets, and distributes and stores the generated shared pieces and the spare shared pieces in the storage units; and a reconstruction step in which the data recovery unit collects the shared pieces and the spare shared pieces from the storage units, and reconstructs the shared data using the shared piece set if the collected shared piece set satisfies the number of shares to be reconstructed, and reconstructs the shared data using the spare shared pieces if the collected shared pieces do not satisfy the number of shares to be reconstructed, The shared data generation step includes a first step of reading each piece of information from a shared data function that stores information on the reconstruction shared number (k), the number of spare shared pieces (r), the data length (L) of the data to be distributed, and the data to be distributed; a second step of generating a random number and creating a data string S (number of bytes=a multiple of “k×8”) of the generated random number, the data length (L), and the data to be distributed; and a third step of dividing the data string S into “k×8” blocks, performing an operation on each divided block, and obtaining a shared piece “W”, wherein the third step uses equations (28) and (29) when “the number of spare shared pieces (r)=1”, while S ｘｙ : Block number y x (x = 1.2 .

3. . . k)th value (8 bytes) W ｚｙ : Block number y, distribution number z (z = 1.2 .

3. . . k) the value of the dispersion piece (8 bytes) W （ｋ＋１）ｙ : The spare dispersion piece A secret sharing method, characterized in that when "the number of spare sharing pieces (r)=2", equations (30) and (31) are used. S ｘｙ : Block number y x (x = 1.2 .

3. . . k)th value (8 bytes) W ｚｙ : Block number y, distribution number z (z = 1.2 .

3. . . k) the value of the dispersion piece (8 bytes) W （ｋ＋１）ｙ , W （ｋ＋２）ｙ : The spare dispersion piece 5. A secret sharing system comprising: a shared data generation unit that generates a set of shared pieces by coding and distributing data to be shared; a plurality of storage units that respectively store each of the shared pieces; and a data recovery unit that collects the shared pieces stored in each of the storage units and decrypts and reconstructs the shared data based on a predetermined number of shares to be reconstructed, wherein the shared data generation unit generates from the shared data a plurality of shared piece sets corresponding to the number of shares to be reconstructed and spare shared pieces by making the shared piece sets redundant, and distributes and stores the generated shared pieces and the spare shared pieces in each of the storage units; the data recovery unit collects the shared pieces and the spare shared pieces from the storage units, and if the collected set of shared pieces satisfies the number of shares to be reconstructed, it uses the set of shared pieces to reconstruct the shared data, while if the collected shared pieces do not satisfy the number of shares to be reconstructed, it uses the existing shared pieces and the spare shared pieces to find a non-existent shared piece and reconstruct the shared data to be reconstructed.

6. A secret sharing program that causes a computer to execute the secret sharing method according to any one of claims 1 to 4.

Images