Secret key management system

Abstract

The purpose of the present invention is to, even if one of shares stored in a distributed manner leaks, protect secret information unless all of k shares leak since the shares are stored in a distributed manner in a plurality of server devices.　This secret key management system is characterized in that a data terminal (1) is provided with a first registration unit (11A) that registers, among distributed values obtained by distributing generated secret key information into n pieces, one distributed value in a storage unit for data terminal management, and a first server device (1001) and a second server device (1002) are each independently provided with a second registration unit (12A) that acquires, from the data terminal (1), a distributed value assigned for management of each server device other than the distributed value for data terminal management among the distributed values distributed from the secret key information, and different biometric authentication information acquirable from a user operating the data terminal (1), and registers, in a storage unit for server device management provided in each server device, both the acquired biometric authentication information and the distributed value for management of each server device.

Description

Private Key Management System

[0001] The present invention relates to a secret information recoverable value distribution system and method, and in particular to a private key management system that cooperates with a secret information recoverable value distribution system in which secret information recoverable values ​​(shares) for recovering secret information are distributed and stored on physical storage media.

[0002] Computer systems are used to conduct online transactions over public networks such as the Internet. Examples of such computer systems include a virtual currency management system called Bitcoin (registered trademark), which is a peer-to-peer (P2P) payment network. Bitcoin (registered trademark) uses public key cryptography, which encrypts and decrypts data using two pairs of keys.

[0003] Below is a brief explanation of the process for sending virtual currency using Bitcoin (registered trademark). First, the party paying the virtual currency (the sender) generates a pair of public and private keys (1). Next, the sender generates an address (account number) from the public key (2). A collection of these addresses forms a wallet.

[0004] The sender signs the remittance information (transaction history information such as the Bitcoin (registered trademark) to be sent and addresses) using their own private key (3). The sender broadcasts the remittance information to the P2P network (4). The recipient of the virtual currency (recipient) verifies the validity of the transaction by comparing the public key and the signed remittance information included in the transaction (5).

[0005] In Bitcoin (registered trademark), remittance information is signed using a private key that is known only to the sender, so the private key must be managed with a high level of secrecy. This presents a challenge in the Bitcoin (registered trademark) system as to how to manage the private key.

[0006] For security reasons, a 64-digit private key consisting of random alphanumeric characters is generally used, so if the private key is lost, the Bitcoin (registered trademark) in that address can never be used again. For this reason, some users manage their private keys using various devices and services.

[0007] For example, some users have multiple Bitcoin (registered trademark) accounts for different purposes, and manage each account in different ways, taking into account convenience, security, and other factors.

[0008] Hiroshi Doi, "Secret Sharing and Its Applications," Information Security Comprehensive Science, Vol. 4, [online], November 2012, Institute of Information Security, [Retrieved August 30, 2017], Internet <URL: https: / / www.iisec.ac.jp / proc / vol0004 / doi.pdf> G.R. Blakley, Safeguarding Cryptographic Keys, Proc. of the National Computer Conference, Vol. 48, pp. 313-317, 1979, <URL: https: / / www.computer.org / csdl / proceedings / afips / 1979 / 5087 / 00 / 50870313.pdf>

[0009] To use Bitcoin (registered trademark), users must use computer terminals (smartphones, tablet computers, personal computers, etc.) connected to a P2P network. As long as these terminals are connected to the network, it is impossible to completely eliminate the risk that a malicious third party will gain unauthorized access to the computer terminal and leak the private key to a third party.

[0010] Non-Patent Document 1 discloses Shamir's threshold method. In Shamir's threshold method, n unique shares are generated based on secret information, and these unique shares are given to n shareholders. Then, by using k (k<n) shares out of the n, the original secret information can be restored. In other words, even if n-k unique shares are lost, the secret information can be restored using the remaining k unique shares. This means that the information cannot be restored even if k-1 shares are used. By using this technique, the shares for restoring the secret information can be distributed.

[0011] However, even if shares are distributed, if those shares are stored in a storage device connected to a network, there is a risk that a third party may gain unauthorized access to the storage device and leak k shares. For this reason, even if the technology disclosed in Non-Patent Document 1 is used, it may not be possible to adequately protect confidential information.

[0012] In particular, it has been pointed out that if k shares are stored in a storage device located on the same LAN, there is a problem that all k shares could easily be leaked to a third party by passing through the gateway (firewall) that serves as the entrance to that LAN.

[0013] On the other hand, an ultimate method for appropriately protecting confidential information is to write down the values ​​of at least k shares on paper or other media and store the paper in a safe or similar. Because the shares are stored on paper, the share information cannot be accessed over a network, reducing the possibility of the k shares being leaked to a third party. However, this method has been pointed out as having the disadvantage of increasing the information management burden on users.

[0014] In addition, with the recent advancement of the network environment in virtual currency transactions, information on the network can easily be leaked. In light of this, there is a strong demand for a more advanced private key management system than the secret information recovery value distribution system, which uses different memory resources as hardware.

[0015] The present invention has been made to solve the above-mentioned problems, and aims to provide a private key management system that works in conjunction with a private information recoverable value distribution system that can appropriately protect private information while reducing the burden of managing user information, and that can manage security levels more highly by combining a process to authenticate the legitimacy of the user himself who generates the private key.

[0016] The private key management system of the present invention is a private key management system in which a data terminal that performs a process for generating private key information communicates with a plurality of server devices via a predetermined communication medium to manage the distributed values ​​of the private key information, wherein the data terminal is equipped with a first registration means that registers one of the n distributed values ​​obtained by distributing the generated private key information in a storage unit for data terminal management, and each server device is independently equipped with a second registration means that acquires from the data terminal, from each distributed value distributed from the private key information, a distributed value assigned for management of each server device excluding the distributed value for management of the data terminal, and different biometric authentication information that can be acquired from a user operating the data terminal, and registers the acquired biometric authentication information together with the distributed value for management of each server device in a storage unit for management of the server device that each server device is equipped with.

[0017] According to the present invention, users can appropriately protect confidential information without the need for information management that places a significant burden on them. In particular, because shares are stored in a distributed manner across multiple server devices, even if one of the distributed and stored shares is leaked, confidential information can be protected as long as all k shares are not leaked.

[0018] 1 is a diagram showing a graph passing through coordinates corresponding to private key values ​​calculated according to the Shamir (k, n) threshold method according to the prior art. 2 is a diagram showing a graph passing through coordinates corresponding to private key values ​​calculated according to the Shamir (k, n) threshold method according to the prior art. 3 is a diagram showing a graph passing through coordinates corresponding to private key values ​​calculated according to the Shamir (k, n) threshold method according to the prior art. 4 is a diagram showing an example of the overall configuration of a computer system constituting a secret-recoverable value distribution system according to the present embodiment. 5 is a block diagram showing an example of the detailed configuration of a data terminal constituting a secret-recoverable value distribution system according to the present embodiment. 6 is a block diagram showing an example of a share generation process executed by the secret-recoverable value distribution system according to the present embodiment. 7 is a block diagram showing an example of a secret recovery process executed by the secret-recoverable value distribution system according to the present embodiment. 8 is a diagram showing an example of a combination of multiple physical storage devices in which shares are stored in a distributed manner. 9 is a diagram showing an example of a combination of multiple physical storage devices in which shares are stored in a distributed manner. 10 is a diagram showing an example of a combination of multiple physical storage devices in which shares are stored in a distributed manner. 11 is a block diagram illustrating the configuration of a private key management system according to the present embodiment. A block diagram illustrating the configuration of a server device in the private key management system showing the present embodiment. A flowchart illustrating data processing in the private key management system showing the present embodiment. A flowchart illustrating data processing in the private key management system showing the present embodiment. A block diagram illustrating the configuration of the private key management system showing the present embodiment.

[0019] [Configuration of the secret-recoverable value distribution system] A secret-recoverable value distribution system according to an embodiment of the present invention will now be described in detail with reference to the accompanying drawings. Note that this system may be configured as a system that cooperates with a data processing system corresponding to an embodiment described later, or as a system that incorporates a data processing system described later into the secret-recoverable value distribution system.

[0020] The secret recovery value distribution system according to the present invention distributes secret recovery values ​​(shares) by utilizing the Shamir threshold method (secret sharing method) according to the prior art.

[0021] Here, Shamir's threshold method defines k (threshold), which is the number of shares from which the secret information can be recovered, and n (number of shares), which is the number by which the shares are distributed. In addition to the above, the secret information recoverable value distribution system according to the present invention may use any other secret sharing method that can arbitrarily define a set from which information can / cannot be recovered (see Non-Patent Document 2).

[0022] [Outline of Shamir's Threshold Method] First, an outline of the Shamir's threshold method according to the prior art will be described with reference to FIGS. 1 to 3. FIG.

[0023] Shamir's threshold method (hereinafter referred to as the "(k, n) threshold method") assumes that secret information S is shared among n people. Each of the n people is given n shares generated using a predetermined polynomial, and secret information S can be restored using k of the shares.

[0024] In other words, the generated n shares are shared among n people, and the secret information S can be restored by using k shares owned by k people. In this specification, this number n is referred to as the number of shares, and the number k is referred to as the threshold.

[0025] Here, when generating shares, an arbitrary k-1th degree polynomial with a constant term of S is used. For example, let the threshold k be "3" and n be "4" (i.e., four shares are generated, and the secret information S can be restored by using three of those shares), and let the secret information be "9". Therefore, a k-1th degree polynomial, that is, an arbitrary second-degree polynomial with a constant term of "9", is used. For example, let the coefficient of the first term be 2 and the coefficient of the second term be 7, and define the following equation (1): f(x) = 2x2 - 7x + 9 (1)

[0026] When generating n=4 shares, the share numbers are assigned {1, 2, 3, 4}, and when f(1), f(2), f(3), and f(4) are substituted into equation (1), the set of n share values, n={(1, 4), (2, 3), (3, 6), (4, 13)}, is calculated.

[0027] <Description of System Configuration> [First Embodiment] Fig. 1 shows a graph in which the share values ​​calculated as described above are used as coordinates, and a curve passing through each coordinate is drawn. The curve shown in Fig. 1 passes through four coordinates corresponding to four share values. This curve represents the quadratic polynomial of equation (1). In the (k, n) threshold method, secret information can be restored by using k = 3 shares out of n = 4. In other words, a similar curve can be drawn by passing through any three of the four coordinates shown in Fig. 1.

[0028] On the other hand, the secret cannot be recovered by using k-1 shares, i.e., a similar curve cannot be drawn by passing through any two of the four coordinates shown in Figure 1.

[0029] Figure 2 shows a graph in which the values ​​of k=3 shares are plotted as coordinates, and a curve passing through each coordinate is drawn. As can be seen from Figure 2, if the coordinates of the k=3 threshold points are known, it is possible to plot the same curve as the curve shown in Figure 1.

[0030] 3 shows a graph in which the values ​​of k-1=2 shares are used as coordinates, and a curve passing through each coordinate is drawn. As can be seen from FIG. 3, using only the coordinates of the point where the threshold value k-1=2 is used, it is possible to draw a curve such as the dashed line, and it is not necessarily possible to draw a curve identical to the curve shown in FIG. 1. In other words, by using k-1(2) shares, it is not possible to derive the quadratic polynomial shown in Equation (1), and therefore it is not possible to restore the secret information S.

[0031] The secret information can be restored from the values ​​of the k shares by using polynomial interpolation, and the specific calculation formula is shown below.

[0032] First, since the threshold k = 3, it can be seen that the polynomial generating the share is a quadratic polynomial, y = x² + x + constant term. Then, by substituting a, b, and c for the coefficients of each term, y = a² + b + c, and substituting k = {(1, 4), (2, 3), (3, 6)}, the set of three share values ​​can be obtained, and equations (2) to (4) can be derived as follows: c = -a - b + 4 (2) c = -4a - 2b + 3 (3) c = -9a - 3b + 6 (4)

[0033] Next, by substituting equation (2) into equation (3) and equation (4), respectively, a (i.e., the coefficient of the first term of the quadratic polynomial shown in equation (1)) can be derived via equations (5) and (6) as follows: 3a = -b - 1 (5) 8a = -2b + 2 (6) a = 2

[0034] Since the value of coefficient a can be derived from the above equation, by substituting the derived value of a into equations (2) and (3), b (i.e., the coefficient of the second term of the quadratic polynomial shown in equation (1)) can be derived via equations (7) and (8) as follows: c = -b + 2 (7) c = -2b - 5 (8) b = -7

[0035] Finally, by substituting the derived values ​​of coefficient a and coefficient b into equation (2), c=9 (i.e., the value of the constant term of the quadratic polynomial shown in equation (1)) can be derived.

[0036] It can be seen that substituting the coefficient values ​​derived as described above into the quadratic polynomial makes it possible to restore the quadratic polynomial shown in equation (1), i.e., the secret information S. A specific equation for restoring this secret information S is publicly known, as disclosed in, for example, Non-Patent Document 1, and therefore will not be described in detail in this specification.

[0037] The secret-recoverable value sharing system according to the present invention generates n shares using any secret sharing method including the (k, n) threshold method described above, and recovers the secret using k shares. In the (k, n) threshold method, n>k, but depending on the secret sharing method used, n=k may hold, and it should be noted that the secret-recoverable value sharing system according to the present invention can also be applied in such cases.

[0038] Hereinafter, in this specification, the calculation formula used to generate n shares using the secret sharing scheme will be referred to as the secret information recovery value (share) generation formula, and the calculation formula used to recover secret information using k shares out of the n generated shares will be referred to as the secret information recovery formula.

[0039] When the secret-recoverable value sharing system according to the present invention uses the (k, n) threshold scheme, the share generation formula and the secret recovery formula are calculated using the formulas shown in Non-Patent Document 1. When the secret-recoverable value sharing system according to the present invention uses another secret sharing scheme in addition to the (k, n) threshold scheme, the share generation formula and the secret recovery formula corresponding to that secret sharing scheme are used.

[0040] Next, referring to Fig. 4, an example of the overall configuration of a computer system constituting a secret-recoverable value distribution system according to an embodiment of the present invention is shown. The secret-recoverable value distribution system according to this embodiment is not used alone, but is premised on the existence of a service (computer system) that uses the secret-recoverable value distribution system. However, the secret-recoverable value distribution system according to this embodiment may also be implemented in the above-mentioned computer system.

[0041] In the following embodiment, an example will be described in which the secret information recoverable value distribution system of the present invention works in conjunction with a computer system (hereinafter referred to as a payment system) that provides payment services using virtual currencies such as Bitcoin (registered trademark).

[0042] In this example, when making a payment (remittance) using virtual currency, the user (sender) generates a private key and signs the transaction history information of the virtual currency using the generated private key. Therefore, based on the private key generated in the payment system, the secret information recoverable value distribution system according to the present invention generates n shares and recovers the private key based on the k shares.

[0043] As shown in Figure 4, the secret information recoverable value distribution system of this embodiment includes a data terminal 1 and a server computer 2, which are connected via a network 3 (a public network such as the Internet, in this embodiment a P2P network).

[0044] The data terminal 1 is a computer device that implements the secret-recoverable value distribution system according to the present invention, and is implemented, for example, in a smartphone, tablet computer, personal computer, etc. A user uses the data terminal 1 to input predetermined information to generate n shares, and then uses k shares of these to recover the secret.

[0045] The server computer 2 is a computer device that executes functions such as providing payment services using the secret-recoverable value distribution method according to the present invention. In this embodiment, the data terminal 1 independently generates n shares and executes the process of recovering the secret, but the data terminal 1 and the server computer 2 may work together to implement a secret-recoverable value distribution system. In this case, the server computer 2 generates n shares in response to a request from the data terminal 1.

[0046] Next, an example of a detailed configuration of the data terminal 1 constituting the secret-recoverable value distribution system according to an embodiment of the present invention will be described with reference to Figure 5. The data terminal 1 includes a control device 11, a memory 12, a storage device 13, an input driver 16, an input device 15, an output driver 18, and an output device 17.

[0047] The control device 11 is implemented by a processor or the like and may include a central processing unit (CPU), a graphics processing unit (GPU), and one or more control device cores. The control device 11 executes predetermined programs (an OS and application programs). The memory 12 may include volatile or non-volatile memory, such as random access memory (RAM), dynamic RAM, or cache memory. The memory 12 temporarily stores program data executed by the control device 11.

[0048] The storage device 13 is a storage device built into the data terminal 1 and may include, for example, a hard disk drive, a solid state drive, an optical disk, or a flash drive. The storage device 13 stores one of the n generated shares. The communication device 14 is implemented as a network interface card (for example, a LAN card) or the like, and transmits and receives data via the network 3.

[0049] The input device 15 may include a keyboard, keypad, touch screen, touchpad, microphone, accelerometer, gyroscope, biometric scanner, etc. The input device 15 receives user input and communicates it to the controller 11 via an input driver 16.

[0050] The output device 17 may include a display, a speaker, a printer, etc. The output device 17 receives output from the control device 11 via an output driver 18 and outputs it (visual output via a display, audio output via a speaker, etc.).

[0051] A removable storage device 19 is connected to the data terminal 1. When the removable storage device 19 is connected, information from the removable storage device 19 is communicated with the control device 11 via the input driver 16. In addition, output from the control device 11 is output (stored) in the removable storage device 19 via the output driver 18. The removable storage device 19 includes any removable and non-volatile storage device 13, such as a flash memory such as a USB memory and an SD card, an optical storage medium such as a CD-ROM and a DVD, a magnetic storage medium such as a floppy disk, or a USB memory that accommodates an SSD.

[0052] As described above, the secret-recoverable value distribution system according to this embodiment works in conjunction with a predetermined computer system. That is, an application program provided by the predetermined computer system is executed on the data terminal 1. It is desirable that the secret-recoverable value distribution system according to this embodiment be executed independently for each service corresponding to the application program executed on the data terminal 1.

[0053] For example, if the data terminal 1 runs the operating system iOS (registered trademark) manufactured by Apple (registered trademark) (such as an iPhone (registered trademark)), the storage device 13 will configure a logically independent storage area for each service. In this case, for example, if the data terminal 1 runs multiple application programs and each application program works in conjunction with a secret-recoverable value distribution system, a logically independent storage area can be used for each service corresponding to the application program. This means that when shares, which will be described later, are stored in the storage device 13, they can be stored in logically independent areas for each application program being executed, thereby further enhancing security.

[0054] If the data terminal 1 runs an operating system other than iOS (such as Windows (registered trademark) or Android (registered trademark)), it is possible to provide separate storage areas for each service or each user by using, for example, container-based virtualization technology. In this way, when multiple application programs are run and each application program works in conjunction with a secret-recoverable-value distribution system, implementing separate storage areas can ensure further security.

[0055] Next, with reference to FIG. 6, a secret-recoverable value (share) generation process executed by the secret-recoverable value distribution system according to the embodiment of the present invention will be described.

[0056] In this embodiment, an example will be described in which the private key used in the above-described payment service is used as the private information, shares are generated based on the private key, and the shares are distributed and stored.

[0057] In this case, the application program that provides the payment service works in conjunction with the secret information recoverable value distribution system, and hereinafter the application program that provides the payment service is referred to as the “payment application.” The payment service is performed by exchanging information between the data terminal 1 and the server computer 2.

[0058] 6, the control device 11 of the data terminal 1 executes a predetermined program on the memory 12 to execute a share generation process including steps 61 to 64. In step 61, the control device 11 executes a payment application to generate a private key. This process includes a process for generating a private key used when transferring virtual currency in a payment service, according to conventional technology, and the generated private key is stored in the memory 12 and / or the storage device 13 using, for example, three memory resources.

[0059] In step 62, the control device 11 generates the number of shares (n) using the share generation formula described above based on the private key generated in step 61. In this embodiment, n=3, and the shares are represented as shares 1 to 3 to identify them. Also, the threshold k(n-1)=2.

[0060] Here, the share generated in step 62 is, for example, a file with the extension ".txt", and a value calculated based on the secret sharing scheme is written into the file. The file name may also be, for example, "UUID_share number.txt". The UUID is generated uniquely for each application program according to an arbitrary version. In other words, in this embodiment, a unique UUID is generated for each application that works in conjunction with the secret information recoverable value distribution system. Since a UUID is a unique number each time it is generated, the file name of the share is unique for each application program and each time it is generated. By assigning file names in this manner, the independence of application programs is further enhanced.

[0061] Note that using a UUID in the file name is merely an example, and is not limited to this format. A unique number may be generated for each service that works in conjunction with the secret information recovery value distribution system according to this embodiment, and that number may be used in the file name. Furthermore, as will be described later, the generated share is deleted each time the secret information is recovered. A new unique number, such as a UUID, may be assigned to the file name each time the secret information is recovered, or a new number may be assigned only when the share is lost, for example.

[0062] In this embodiment, the processing of steps 61 and 62 is executed by the data terminal 1, but is not limited to this format. The processing of steps 61 and / or 62 may also be executed by the server computer 2. In this case, for example, in response to a request from the data terminal 1, the server computer 2 generates a private key and / or shares and transmits them to the data terminal 1. If the server computer 2 generates a private key and / or shares, they are deleted from the storage area 13 of the server computer 2 after being transmitted to the data terminal 1.

[0063] In step 63, the control device 11 stores the three shares generated in step 62 in the predetermined storage area 13. Here, the predetermined storage area 13 includes the predetermined area of ​​the storage device 13 of the data terminal 1 as well as the removable storage medium 19 described above. In other words, the n shares are stored separately in multiple independent physical storage devices (media). The removable storage medium 19 includes, for example, a USB memory and an SD card.

[0064] The combinations of the multiple physical storage devices in which the shares are distributed and stored are not limited to the above-mentioned combinations, and for example, the combinations shown in Figures 8 to 10 below are possible.

[0065] The combination shown in Figure 8 indicates that share 1 is stored in storage device 13, share 2 is stored in USB memory, and share 3 is stored in the SD card. Storage device 13 is a storage device 13 built into data terminal 1 connected to network 3, and is therefore connected to network 3 via data terminal 1. On the other hand, removing the USB memory and SD card will disconnect them from network 3. For this reason, storing shares in a removable storage device 19 such as a USB memory provides greater security.

[0066] As described above, in the secret-recoverable value distribution system according to this embodiment, secret information cannot be recovered even if k-1 shares are used. In other words, by preventing the leakage of n-(k-1) shares, leakage of secret information can be prevented. In the combination shown in FIG. 8, each of the n-(k-1) (i.e., 2) shares is stored in a removable storage device 19 that can be disconnected from the network 3, making this a preferable combination in terms of ensuring security.

[0067] In this embodiment, to ensure that the n shares are stored in multiple independent physical storage devices, the control device 11 may determine whether the removable storage device 19 is connected to the data terminal 1 before executing step 61 or step 62. This process can be performed by the control device 11 executing a device control API, such as UsbDevice, which is provided as standard in the Android operating system, to determine whether the removable storage device 19 is connected. If the control device 11 determines through this process that the removable storage device 19 is not connected to the data terminal 1, it may notify the user of an error message (via the output device 17). On the other hand, if the control device 11 determines that the removable storage device 19 is connected to the data terminal 1, it notifies the user of this message and proceeds to the process of the subsequent step 64.

[0068] Furthermore, by executing the device control API, it is possible to determine the type of device connected to the data terminal 1. Therefore, in order to ensure that n-(k-1) shares are stored in the removable storage devices 19, it may be determined whether n-(k-1) removable storage devices 19 are connected to the data terminal 1. In the combination shown in FIG. 8, it is determined whether an SD card and a USB memory are each connected.

[0069] In addition to the combinations shown in FIG. 8, the following combinations can also ensure similar security.

[0070] 9 shows that Share 2 and Share 3 are stored in two independent USB flash drives. In this way, when multiple independent physical storage devices are the same type of removable storage device 19, the user must store the share in the first physical storage device, then remove that physical storage device and newly connect the second physical storage device.

[0071] In this way, to ensure that shares are stored in separate, independent physical storage devices of the same type, when a second physical storage device is connected, it may be determined whether it is a different physical storage device from the first physical storage device. This process is performed by executing the device control API described above to identify each physical storage device (e.g., by the serial number of the connected device). If the control device 11 determines through this process that the second physical storage device is the same physical storage device as the first physical storage device, it may notify the user of an error message (via the output device 17). On the other hand, if the control device 11 determines that the second physical storage device is a different physical storage device from the first physical storage device, it notifies the user of this message and proceeds to the subsequent process of step 64.

[0072] Furthermore, the following combinations are also possible:

[0073] 10 shows that share 1 is stored in storage device 13, share 2 is stored in a network-connected external storage device such as a NAS or SAN, and share 3 is stored in a USB memory. This combination has lower security than the combinations shown in FIGS. 8 and 9, because k shares are normally stored in a storage device that is not blocked from network 3.

[0074] The combination of storage devices 13 in which the shares are distributed and stored may be predefined in the secret-recoverable value distribution system, or may be set by a user at any time. Similarly, the number of shares and the threshold number may be predefined in the secret-recoverable value distribution system, or may be set by a user at any time.

[0075] In step 64, the private key generated in step 61 and stored in memory 12 and / or storage device 13 is deleted. This process results in no private information remaining in data terminal 1, and n shares are stored in a distributed manner. If removable storage device 19 is not removed within a certain period of time since the shares were stored, a message to that effect may be sent to the user. This ensures that removable storage device 19 is removed from data terminal 1, i.e., the stored shares are disconnected from network 3.

[0076] Next, the secret information recovery process executed by the secret information recoverable value distribution system according to the present invention will be described with reference to Fig. 7. The secret information recovery process described in this embodiment is a process for recovering the secret information generated in the share generation process described in Fig. 6 in normal use. In other words, this is an example of recovering the private key used to sign the transaction history information of the virtual currency when transferring the virtual currency in the above-mentioned payment service, without leaking or losing any shares.

[0077] There are two types of secret information restoration processes: the first is the restoration process for normal use as described above, and the second is restoration process in the event of share leakage, loss or replacement of a computer terminal, etc. These two types of restoration processes can be selected on a menu screen (not shown) displayed on the output device 17 (such as a display) of the data terminal 1 (the former type is referred to as "normal restoration mode," and the latter type as "recovery mode"). The purpose of recovery mode is not to restore secret information, but to regenerate shares.

[0078] 7, the control device 11 of the data terminal 1 executes a predetermined program to perform a secret information restoration process including steps 71 to 73. In step 71, the control device 11 reads a threshold (k) number of shares from one of a plurality of physical storage devices. In this embodiment, k=2, and share 1 is read from the storage device 13, and share 2 is read from the USB memory.

[0079] In the process of step 71, it may be determined whether the shares are being read from the same physical storage device that was used to store the shares in step 63 of the share generation process described in FIG. 6. As described above, the physical storage device can be identified by executing the device control API, so this determination can be made by storing the identifiers of the respective physical storage devices when the control device 11 stores n shares. If this process determines that the shares are being obtained from a different physical storage device than the one used to store them, an error message may be displayed to the user (via the output device 17). This further reduces the possibility of a third party recovering confidential information even if the shares are leaked.

[0080] In step 72, the control device 11 restores the secret information using the secret information restoration formula described above, based on the k shares acquired in step 71. The restored secret information is used in cooperation with the application 1 to sign the transaction history information of the virtual currency in the payment service.

[0081] In step 73, the control device 11 deletes the shares stored in each physical storage device. If the recovery mode described above is selected, the corresponding shares are deleted from the k physical storage devices in which at least the k shares acquired in step 71 are stored. On the other hand, if the normal recovery mode is selected, the corresponding shares are deleted from the n physical storage devices in which n shares are stored. When performing this deletion process, it may be determined whether a predetermined number of shares have been deleted depending on the mode selected by the user.

[0082] In step 73, the control device 11 deletes the private key restored in step 72. This deletion process may be performed by setting a timer when the private key is restored, and deleting the private key in response to the timer having reached a predetermined time period. This process deletes the restored private key from the data terminal 1 when the predetermined time period has elapsed, further reducing the possibility of private information being leaked to a third party.

[0083] In this way, shares are deleted each time secret information is generated and restored, thereby further ensuring the security of the secret information. If the recovery mode described above is selected, the control device 11 controls the execution of the share generation process described in FIG. 6 after step 73, and generates shares based on the secret information restored in step 72. For example, different shares can be generated by changing the coefficients of the first and second terms in the quadratic polynomial shown in equation (1). This process allows new shares to be generated again, even if one of the shares is lost.

[0084] [Effects of the First Embodiment] According to this embodiment, the generated shares are stored in a physical storage device, which reduces the burden of managing private keys used in payment services, for example. Furthermore, if the secret information recoverable value distribution system according to the present invention is applied to an authentication system using an ID and a password, for example, and the password is used as secret information, the risk of the password being leaked can be avoided by reusing the same or similar password across all services.

[0085] Furthermore, by implementing the storage device 13 storing the shares in a removable storage device 19 and removing it from the computer terminal, the shares can be blocked from the network 3. In the secret information recoverable value distribution system according to the present invention, the secret information cannot be recovered unless k shares are collected, so by storing at least n-(k-1) shares in the removable storage device 19 and removing and storing them from the computer terminal, extremely high security can be ensured.

[0086] [Configuration of the Private Key Management System] [Second Embodiment] Fig. 11 is a block diagram illustrating the configuration of the private key management system according to this embodiment. In Fig. 11, reference numeral 1000 denotes a communication unit that transmits, using a predetermined protocol, private key information via a network 1003 to a first server device 1001 or a second server device 1002 that stores the generated shares. The first server device 1001 or the second server device 1002 includes hardware resources, which will be described later.

[0087] A biometric information reader 1100 reads a unique vein image from the user's wrist using, for example, a vein scanning function. The read vein image is linked to predetermined identification information and registered in the storage device 13 as personal authentication information.

[0088] The first server device 1001 receives the generated share S2 and the biometric authentication information from the data terminal 1 via the network 1003, and registers and manages them in the storage unit 2004 shown in FIG.

[0089] The second server device 1002 receives the generated share S3 and the biometric authentication information from the data terminal 1 via the network 1003, and registers and manages them in the storage unit 2004 shown in Fig. 12. Note that the biometric authentication is not limited to wrist vein information, but may also be retinal information, or a configuration may be adopted in which these are combined and managed as biometric authentication information.

[0090] The operators of the first server device 1001 and the second server device 1002 are to be the same or affiliated, and no subordinate relationship between them will be allowed. This will prevent a situation in which a person from the same operator obtains shares generated from private key information beyond the management limit, thereby enabling the private key information to be restored.

[0091] In addition, although this embodiment shows a case where two servers, a first server device 1001 and a second server device 1002, are connected to the network 1003, the number of servers connected to the network 1003 may be two or more. Fig. 12 is a block diagram for explaining the configuration of the first server device 1001 and the second server device 1002 shown in Fig. 11. Note that the same reference numerals are used to denote the same components as in Fig. 11.

[0092] In FIG. 12, a CPU 2001 controls the I / O 1101 with each device as hardware connected to the internal bus based on a BIOS stored in a ROM 2002 .

[0093] Reference numeral 2003 denotes a RAM, which functions as a work memory for applications executed by the CPU 2001, and is configured so that its storage capacity can be expanded. Reference numeral 2004 denotes a storage unit formed of a non-volatile memory medium, which reserves an area for storing a share generated from the private key information received from the data terminal 1 and biometric authentication information for identifying the user operating the data terminal 1.

[0094] In the private key management system configured in this manner, the RAM 2003 of the server devices 1001, 1002 stores a program that functions as a second registration unit 12A that acquires from the data terminal 1 the distributed values ​​(shares S2, S3) allocated for managing each server device, excluding the distributed value for data terminal management (share S1) out of the distributed values ​​(shares S2, S3) distributed from the private key information, as well as different biometric authentication information that can be acquired from the user operating the data terminal 1, and registers the acquired biometric authentication information together with the distributed values ​​for managing each server device in a storage unit for server device management (corresponding to the memory unit 2004 in this embodiment) provided in each server device 1001, 1002.

[0095] The data terminal 1 also has a first registration unit 11A that registers one of the n distributed values ​​obtained by distributing the generated private key information in a storage unit for data terminal management (secured on the memory device 13), and a first restoration unit 11B that extracts the distributed value for terminal management (share S1) registered in the memory device 13 and obtains the distributed values ​​for server device management (shares S1, S2) that are separately registered from either of the server devices 1001, 1002 authenticated by the registered biometric authentication information BIO, and restores the private key information.

[0096] Furthermore, the data terminal 1 is equipped with a first discarding unit 11C that discards the restored private key information and the distributed value (shares S2, S3) for managing the server device obtained from either of the server devices 1001, 1002 after the first restoration unit 11B restores the private key information.

[0097] Furthermore, the data terminal 1 is equipped with a judgment unit 11D that judges, for example by referring to an IP address or a MAC address, whether either of the selected server devices 1001, 1002 is a server device in which a distributed value for server device management identical to the distributed value for server device management distributed from the same private key information has already been registered, and an exclusion unit 11E that excludes the server device from the registration destinations for distributed values ​​for server device management when the judgment unit 11D determines that the distributed value for server device management (shares S2, S3) is identical to that of an already registered server device.

[0098] Figures 13 to 15 are flowcharts showing an example of a data processing procedure in the private key management system according to this embodiment, where the process shown in Figure 13 corresponds to the data processing procedure ((1) to (13)) of the data terminal 1, the process shown in Figure 14 corresponds to the data processing procedure ((21) to (25)) of the first server device 1001, and the process shown in Figure 15 corresponds to the data processing procedure ((31) to (35)) of the second server device 1002.

[0099] [Data processing on the data terminal 1 side] First, the control device 11 of the data terminal 1 generates a private key in accordance with the processing of the above-described embodiment (1). Then, the control device 11 similarly generates multiple shares, three shares S1 to S3 in this embodiment, on the storage device 13 (2). Then, the control device 11 instructs the user to place their wrist on the biometric information reading unit 1100 connected to the data terminal 1 and scans it. This unit then performs predetermined image processing to generate biometric authentication information (BID). Then, the share S1 managed by the data terminal 1 and the BID that authenticates the user of the data terminal 1 are both registered in the storage device 13 (3).

[0100] Next, the control device 11 reads the share S2 and BID registered in the storage device 13 and transmits them to the first server device 1001 via the network 1003 (4).Then, the control device 11 receives a registration completion notification from the first server device 1001 indicating that the share S1 and BID have been registered in the storage unit 2004 (5).

[0101] Next, the control device 11 reads the share S3 and the BID registered in the storage device 13 and transmits them to the second server device 1002 via the network 1003 (6). Then, the control device 11 receives a registration completion notification from the second server device 1002 indicating that the share S1 and the BID have been registered in the storage unit 2004 (7).

[0102] As a result, the control device 11 stores share S1 of the multiple shares S1 to S3 generated in the data terminal 1, registers share S2 and the BID, which is biometric authentication information, in the memory unit 2004 of the first server device 1001, and registers share S3 and the BID, which is biometric authentication information, in the memory unit 2004 of the second server device 1002.In other words, shares S2 and S3 can be distributed and registered and managed in the first server device 1001 and the second server device 1002.

[0103] In addition, in preparation for the time when the private key is to be restored, the shares S2 and S3 can be registered and managed in a distributed state on the first server device 1001 and the second server device 1002, respectively, in combination with biometric authentication information that cannot be used by anyone other than the user of the data terminal 1.

[0104] On the other hand, when restoring the private key on the data terminal 1, if the user operating the data terminal 1 is successfully authenticated on the first server device 1001 using the registered biometric authentication information (8), the share S2 registered in the memory unit 2004 is read from the first server device 1001 and sent to the data terminal 1, and the control device 11 obtains the share S2 from the first server device 1001 via the network 1003 (9).

[0105] Similarly, if a user operating data terminal 1 is successfully authenticated by second server device 1002 using the registered biometric authentication information (10), share S3 registered in memory unit 2004 is read from second server device 1002 and sent to data terminal 1, and control device 11 obtains share S3 from second server device 1002 via network 1003 (11).

[0106] Next, the control device 11 executes a process to restore the private key from the share S1 registered in the storage device 13, the share S2 obtained from the first server device 1001, and the share S3 from the second server device 1002 (12).

[0107] Next, the control device 11 discards the share S1 registered in the storage device 13, the share S2 acquired from the first server device 1001, and the share S3 acquired from the second server device 1002 (13), and ends the processing.

[0108] The data terminal 1 discards all registered shares S1 to S3 and does not reuse them each time a private key is restored using shares S1 to S3, thereby enabling management without reducing the reliability of shares S1 to S3.

[0109] [Data processing on the first server device 1001 side] In Figure 14, the CPU 2001 of the first server device 1001 receives (21) the BID and share S2 sent in step (4) shown in Figure 13, and after registering them in the memory unit 2004 (22), notifies the data terminal 1 via the network 1003 that share S2 has been registered (23).

[0110] Thereafter, when a request to restore the private key occurs on the data terminal 1 side, the CPU 2001 determines whether the user of the data terminal 1 is the user who registered the share S2 by checking whether the BID of the registered user matches the BID obtained from the data terminal 1, and determines whether the authentication is OK (24). If the CPU 2001 determines that the authentication is NG, it terminates the processing without responding to the request from the data terminal 1.

[0111] On the other hand, if the CPU 2001 determines in step (24) that the authentication is OK, it reads out the share S2 registered in the storage unit 2004 and transmits it to the data terminal 1 via the network 1003 (25), thereby terminating the process. Note that when transmitting and receiving the share S2, it is optional to incorporate a process for performing data transmission and reception processing as a file using a specified encryption technology.

[0112] [Data processing on the second server device 1002 side] In Figure 15, the CPU 2001 of the second server device 1002 receives (31) the BID and share S3 sent in step (6) shown in Figure 13, and after registering them in the memory unit 2004 (32), notifies the data terminal 1 via the network 1003 that share S3 has been registered (33).

[0113] Thereafter, when a request to restore the private key occurs on the data terminal 1 side, the CPU 2001 determines whether the user of the data terminal 1 is the user who registered the share S3 by checking whether the BID of the registered user matches the BID obtained from the data terminal 1, and determines whether the authentication is OK (34). If the CPU 2001 determines that the authentication is NG, it terminates the processing without responding to the request from the data terminal 1.

[0114] On the other hand, if the CPU 2001 determines in step (34) that the authentication is OK, it reads out the share S3 registered in the storage unit 2004 and transmits it to the data terminal 1 via the network 1003 (35), and then ends the process. Note that when transmitting and receiving the share S3, it is optional to incorporate a process for performing data transmission and reception processing as a file using a specified encryption technology.

[0115] [Effects of the second embodiment] According to this embodiment, multiple shares generated from the generated private key can be registered and managed in multiple server devices distributed across a network, thereby significantly improving reliability and convenience compared to systems that manage shares as memory media.

[0116] [Third Embodiment] Figure 16 is a block diagram illustrating the configuration of a private key management system according to this embodiment, with the same components as those in Figure 12 being assigned the same reference numerals. Note that the difference from the configuration shown in Figure 12 is that this embodiment includes a second restoration unit 11B-1 and a second destruction unit 11C-1. In this embodiment, the second restoration unit 11B-1 restores the private key in three restoration modes.

[0117] Specifically, the second restoration unit 11B-1 restores the private key from share S1 registered in the data terminal 1, share S2 registered in the first server device 1001, and share S3 registered in the second server device 1002 (first restoration mode).

[0118] On the other hand, the second restoration unit 11B-1 restores the private key from share S1 registered in the data terminal 1, share S2 registered in the first server device 1001, and share S3 registered in the second server device 1002 (second restoration mode).

[0119] In addition, the second restoration unit 11B-1 restores the private key from share S2 and share S3 of the share S1 registered in the data terminal 1, share S2 registered in the first server device 1001, and share S3 registered in the second server device 1002 (third restoration mode).

[0120] Furthermore, the second discarding unit 11C-1 discards all of the shares S1 to S3 used in the restoration process in accordance with the first to third restoration modes.

[0121] [Effects of the Third Embodiment] According to this embodiment, the private key can be effectively restored by simply combining at least two available shares from among the shares S1 to S2 distributed and registered by the first server device 1001 and the second server device 1002.

[0122] This allows the private key to be reliably restored even if any of the server devices on the network in which the share is registered becomes unavailable (system down, maintenance), making it possible to flexibly respond to the system situation.

[0123] [Fourth Embodiment] In the above embodiment, an example was described in which no restrictions were placed on the operator of the server device that distributes and registers the generated shares S2 and S3. However, if the server devices are managed by the same operator, it cannot be denied that a system engineer (SE) could maliciously obtain shares S2 and S3, which could lead to a situation in which a third party could easily restore the private key.

[0124] Therefore, an application that determines whether the server devices for shares S2 and S3, where data terminals 1 are distributed, are installed in the system and whether they are operated by the same operator or affiliated with another operator, and a process can be incorporated that evaluates the similarity of URL information and vulnerabilities, and controls the registration of shares only to server devices that have obtained an evaluation value that allows them to be recognized as server devices operated by different operators.

[0125] Specifically, the data terminal 1 is configured to incorporate a program that executes a function to determine whether the server device selected by the control device 11 is a server device in which the same distributed value for server device management as the distributed value for server device management distributed from the same private key information has already been registered, and a function to exclude the server device from the registration destinations for distributed values ​​for server device management if it is determined that the server device is a server device in which the same distributed value for server device management has already been registered.

[0126] [Effects of the Fourth Embodiment] According to this embodiment, it is possible to register each share generated on a server device operated by a plurality of different operators, and it is possible to construct a system in which a malicious SE or administrator within the operator cannot restore a private key from each registered share. The disclosure of the present invention described above can be summarized at least in the following points.

[0127] (1) A private key management system in which a data terminal that performs a process for generating private key information communicates with a plurality of server devices via a predetermined communication medium to manage the distributed values ​​of the private key information, wherein the data terminal is provided with a first registration means that registers one of the n distributed values ​​into which the generated private key information is distributed in a storage unit for data terminal management, and each server device is independently provided with a second registration means that acquires from the data terminal, from each distributed value distributed from the private key information, a distributed value assigned for management of each server device, excluding the distributed value for management of the data terminal, and different biometric authentication information that can be acquired from a user operating the data terminal, and registers the acquired biometric authentication information together with the distributed value for management of each server device in a storage unit for management of the server device that each server device is provided with.

[0128] (2) The data terminal is characterized in that it is equipped with a first restoration means for extracting a shared value for terminal management registered in the storage unit, and acquiring a shared value for server device management registered in any server device authenticated with different biometric authentication information to be notified to any server device, and restoring the private key information.

[0129] (3) The data terminal is characterized in that it is equipped with a second restoration means for extracting a shared value for terminal management registered in the storage unit, and for acquiring a shared value for server device management registered in any of the server devices authenticated with different biometric authentication information to be notified to any of the server devices, thereby restoring the private key information.

[0130] (4) The present invention is characterized in that it comprises a first discarding means for discarding the restored private key information and a distribution value for server device management acquired from any of the server devices after the first restoration means has restored the private key information.

[0131] (5) The system is characterized in that it includes a second discarding means for discarding the restored private key information and the shares for server device management acquired from all server devices after the second restoring means has restored the private key information. (6) The system is characterized in that each operator of each server device is an exclusive business entity.

[0132] (7) The data terminal is characterized by comprising a judgment means for judging whether the selected server device is a server device in which a shared value for server device management identical to the shared value for server device management distributed from the same private key information has already been registered, and an exclusion means for excluding the server device from the registration destinations for the shared value for server device management when the judgment means judges that the selected server device is a server device in which the shared value for server device management identical to the shared value for server device management has already been registered.

[0133] In this embodiment, we have described the application of the present invention to a system that uses virtual currency, but it is expected that this system can be incorporated into systems other than those mentioned above as long as it is capable of using private keys, thereby significantly improving the reliability of private key generation and restoration processes.

[0134] 1001 First server device 1002 Second server device 1003 Network 1100 Biometric information reading unit

Claims

1. A private key management system in which a data terminal which performs a process for generating private key information communicates with a plurality of server devices via a specified communications medium to manage the distributed values ​​of the private key information, wherein the data terminal is provided with a first registration means which registers one of the n distributed values ​​obtained by distributing the generated private key information in a storage unit for data terminal management, and each server device is independently provided with a second registration means which acquires from the data terminal distributed values ​​allocated for each server device management among the distributed values ​​distributed from the private key information, excluding the distributed value for data terminal management, and different biometric authentication information which can be acquired from a user operating the data terminal, and registers the acquired biometric authentication information together with the distributed value for each server device management in a storage unit for server device management provided in each server device.

2. The private key management system according to claim 1, characterized in that the data terminal is provided with a first restoration means for extracting a distributed value for terminal management registered in the storage unit, and acquiring a distributed value for server device management registered in any of the server devices authenticated with different biometric authentication information to be notified to any of the server devices, thereby restoring the private key information.

3. The private key management system according to claim 1, characterized in that the data terminal is provided with a second restoration means for extracting a distributed value for terminal management registered in the storage unit, and acquiring a distributed value for server device management registered in any of the server devices authenticated with different biometric authentication information to be notified to any of the server devices, thereby restoring the private key information.

4. A private key management system as described in claim 2, characterized in that it further comprises a first discarding means for discarding the restored private key information and a shared value for server device management obtained from any of the server devices after the first restoration means has restored the private key information.

5. A private key management system as described in claim 3, characterized in that it further comprises a second discarding means for discarding the restored private key information and the distributed values ​​for server device management obtained from all server devices after the second restoration means has restored the private key information.

6. The private key management system according to claim 1, characterized in that the operators of the respective server devices are each exclusive business entities.

7. The private key management system according to claim 1, characterized in that the data terminal is equipped with: a judgment means for judging whether the selected server device is a server device in which a distributed value for server device management identical to the distributed value for server device management distributed from the same private key information has already been registered; and an exclusion means for excluding the server device from the registration destinations for the distributed value for server device management when the judgment means judges that the server device is a server device in which the same distributed value for server device management has already been registered.

Images