Asymmetric secret sharing device, secret information recovery device, asymmetric secret sharing program, and secret information recovery program

Abstract

An asymmetric secret sharing device in a system in which one set of secret information is converted into n distributed values, and the secret information can be recovered by collecting k of the n distributed values, but cannot be recovered by collecting k-1 or fewer of the n distributed values, where n is an integer at least equal to 2 and k is an integer having a minimum value of 2 and a maximum value of n, said asymmetric secret sharing device being characterized by comprising: a generation unit that acquires one or more true random numbers as first secret information and generates t (< k) distributed values for each true random number from a first key; and a calculation unit that calculates n-t distributed values from the t distributed values and the first secret information.

Description

Asymmetric secret sharing device, secret information recovery device, asymmetric secret sharing program, and secret information recovery program

[0001] The technology disclosed herein relates to an asymmetric secret sharing apparatus, a secret information recovery apparatus, an asymmetric secret sharing program, and a secret information recovery program.

[0002] In recent years, cloud computing has been attracting attention as a new network technology. Cloud computing is a technology that distributes and stores user data in large-capacity virtual storage on multiple servers on a network called the cloud, allowing users to access that data as needed from anywhere via the network. However, for security reasons, it is desirable to encrypt information stored in the cloud. Furthermore, in addition to encrypting and storing data, it is also expected that secure computations can be performed using data distributed and stored on the cloud to perform various processes while keeping the data confidential. Furthermore, with the recent spread of IoT (Internet of Things) devices, there is a demand for security technologies that can safely and confidentially communicate information from IoT devices.

[0003] To achieve such secret storage and secure computation, the use of secret sharing schemes has attracted attention. Secret sharing schemes are characterized by converting one piece of secret information into n (i.e., a natural number) values ​​(hereinafter referred to as shares), and by collecting k (i.e., a natural number) shares (k≦n) of the secret information, the original secret information can be restored. Furthermore, Shamir's (k,n) threshold secret sharing scheme (hereinafter referred to as the Shamir scheme) and additive secret sharing schemes are well-known as such secret sharing schemes. Conventional secret sharing systems, including the Shamir scheme, consist of n data servers that store shares, a dealer (i.e., a communication terminal) that distributes the secret information, and a restorer (i.e., a communication terminal) that restores the secret information. That is, during sharing, the owner of the secret information acts as the dealer and distributes the secret information, or requests a dealer, who exists only during secret sharing, to distribute the secret information. The dealer performs secret sharing processing to calculate n shares, and distributes and stores the values ​​in n data servers. On the other hand, in the restoration, a restorer collects and restores k distributed values ​​out of the n distributed distributed values.

[0004] The Shamir algorithm is performed as follows: [Shamir algorithm] [Distribution] 1. The dealer selects an arbitrary prime number p such that s (i.e., secret information)<p and n<p. 2. The dealer selects n distinct x's from Z / pZ (i.e., coset ring). ｉ (i = 1, 2, ..., n) and publish it as a server ID (i.e., send it to the restorer). 3 The dealer selects k-1 random numbers a from Z / pZ. ｌ (l=1, 2, ..., k-1) is selected and the following equation (hereafter called the dispersion equation) is generated: W ｉ = s + a １ x ｉ +a ２ x ｉ ２ +...+a ｋ－１ x ｉ ｋ－１ (modp) (1) 4 The dealer is x in the above formula (1). ｉ Substitute each server ID into and calculate the variance value W ｉ Calculate and send (x ｉ , Wｉ ) is distributed. [Decoding] 1. The distribution value used for decoding is W ｉ (i = 1, 2, ..., k). The server ID corresponding to the variance value is x ｉ (i = 1, 2, ..., k). 2. The restorer selects k (x ｉ , W ｉ ) and add x to the dispersion formula. ｉ and W ｉ Substituting and solving k simultaneous equations to obtain s. When restoring s, it is convenient to use the Lagrange interpolation formula.

[0005] The additive secret sharing scheme is as follows. The case where n=k is explained below. [Additive Secret Sharing Scheme] [Sharing] 1. The dealer distributes k-1 random numbers S １ ~S ｋ－１ 2. The dealer calculates the following for the secret information s:

[0006] Sk = s - S １ -...-S ｋ－１ 3. The dealer assigns identifier x to k servers. ｉ (i=1, 2, ..., k) and select server x ｉ to S ｉ [Decoding] 1. The decoder distributes k S ｉ , and calculate s=S1+ . . . +Sk to restore the secret information s.

[0007] If n = k + 1, the dealer is the server x ｉ to S ｉ , S ｉ＋１ However, for convenience, Sk+1 is considered to be S1.

[0008] However, a problem with secret sharing schemes is that one piece of secret information becomes n shares, which increases the memory capacity (in other words, the server capacity). To address this issue, a ramp secret sharing scheme is known, as shown in Non-Patent Document 1, in which the secret information is divided into 1 / L and used as the coefficients of the sharing formula. This allows the size of the shares to be reduced, thereby reducing the memory capacity. A technique called asymmetric secret sharing has also been proposed, as shown in Patent No. 6893708. Asymmetric secret sharing schemes reduce memory capacity (the number of servers) by reducing the number of shares stored, rather than the size of the shares. The asymmetric secret sharing scheme for the Shamir scheme is shown below (asymmetric secret sharing schemes can also be applied to additive secret sharing schemes). (Non-Patent Document 1) Yamamoto, Hirosuke. "(k, L, n) Threshold Secret Sharing System", Transactions of the Institute of Electronics and Communication Engineers, Vol. J68-A, No. 9, pp. 945-952 (1985) [Asymmetric Secret Sharing Scheme] From the n servers that make up the cloud system, t (i.e., a natural number) servers (t<k) are selected and designated as key servers. These key servers do not store shares, but only have keys for generating pseudorandom numbers. Servers other than the key servers are called data servers, and these store shares sent from users (i.e., communication terminals) who are dealers. Furthermore, for r (i.e., a natural number) users who share secret information, each user y is assigned an ID [y] (y = 1, ..., r) for user identification, and m pieces of secret information s held by user y are stored in the data servers. １ , ..., s ｍ For data identification, ｉ ] (i = 1, ..., m) are assigned to each user. Also, Enc(a, b) represents the process of encrypting a using key b. Below, we will explain the case where user y is the dealer and performs asymmetric secret sharing.

[0009] [Distribution] 1. User y sends his / her ID [y] to key server x. １ , ..., x ｔ 2. The key server that receives ID[y] sends it to the cryptographic device and key ｊ(j = 1, ..., t) is used to generate Eid(y, j) using equation (2) and send it to user y. Eid(y, j) = Enc(ID[y], key ｊ ) (j=1,...,t) (2) 3 User y receives this and assigns the data identifier dID[s ｉ ] (i = 1, ..., m) and use equation (3) to obtain the pseudorandom number q ｉｊ Generate q ｉｊ =Enc(dID[s ｉ ], Eid(y, j)) (3) 4. First, the user y calculates the coefficient vector A(i) = [s ｉ , a ｉ１ , ..., a ｉｋ－１ ] Ｔ k-1-t order partial vector A(i) in ｋ－１－ｔ = [a ｉｔ＋１ , ..., a ｉｋ－１ ] Ｔ is determined for each i using true random numbers. Then, the t-th order pseudo-random number sequence Q = [q ｉ１ , ..., q ｉｔ ] Ｔ and the following calculated from the key server ID series:

[0010]

[0011] Using the above, the remaining partial vector A(i) is calculated from the following equation (4). ｔ = [a ｉ１ , ..., a ｉｔ ] Ｔ is calculated for each i.

[0012]

[0013] Here, in the above formula, S = [s ｉ , ..., s ｉ ] Ｔ Then, A(i) ｋ－１ =X' －１ (Q-S) (5) As a result, the user can calculate the coefficient vector A(i) = [s ｉ , a ｉ１ , ..., a ｉｋ－１ ] Ｔ5. The user can also determine all of the data servers x ｔ＋１ , ..., x ｎ The variance value W ｉｔ＋１ , ..., W ｉｎ 6. User y calculates the shared value W generated in each data server by the same procedure as the (k, n) threshold secret sharing scheme (see Shamir method [share] 4 above) using the coefficient matrix generated in procedure (4). １ｊ , ..., W ｍｊ (j = t + 1, ..., n) is sent. [Recovery] 1. Secret information s ｉ The user who restores the １ , ..., x ｎ Select k arbitrary servers from the list, and send the ID [y] of user y and secret information s ｉ Data identifier dID[s ｉ 2. In the key server, (ID[y], dID[s ｉ ]) the key server receives its own key ｊ Using the encryption device, Eid(y, j) is generated from equation (2), and a pseudorandom number q is generated from equation (3). ｉｊ 3. In the data server, (ID[y], dID[s ｉ The data server receives the shared information W corresponding to the ID information. ｉｊ 4. The user who receives the shares and pseudorandom numbers generated by the server uses them to generate secret information s ｉ Restore.

[0014] In the asymmetric secret sharing scheme, for example, when t=k−1, t key servers generate t=k−1 q ｉｊ (j=1,...,t) is the distribution value, and a satisfying equation (1) is obtained from the distribution value and the secret information. ｉｊ (j=1,...,k-1) coefficients are calculated. If t<k-1, first k-1-t a ｉｊ (j=1,...,k-1-t) is determined from true random numbers, and the remaining coefficients that satisfy equation (1) are calculated to obtain all a ｉｊ The key server calculates the keyｊ If the owner manages the key, a physical server called a key server is not required, so the number of physical servers can be n-t instead of n, reducing the memory capacity (number of servers). In this case, the secret information cannot be restored without the shares generated from the key managed by the owner.

[0015] In recent years, research into quantum computers has progressed, and it is said that once quantum computers are realized, cryptography that currently only has computational security will be easily analyzed. Incidentally, computational security means security that can be solved if the attacker has more computational power than expected, while security that cannot be solved even if the attacker has infinite computational power because there is not enough information is called information-theoretic security.

[0016] For example, in the asymmetric secret sharing scheme, a key server generates a pseudorandom number q for one piece of secret information s1 using a cryptographic device. １ｊ Then the data server stores the variance value W １，ｔ＋１ , ..., W １，ｎ It is known that the Shamir scheme and ramp secret sharing schemes have information-theoretic security (however, the security of ramp secret sharing schemes gradually deteriorates depending on the number of shares collected), but the asymmetric secret sharing scheme is not information-theoretic secure, and q ｉｊ Therefore, asymmetric secret sharing schemes have the risk of being analyzed by a quantum computer. For example, when n = k = 2, the secret information s １ q generated by the key server and expressed by equation (6) １ Based on this, the W sent to the data server １ is calculated as in equation (8) via equation (7). For simplicity, notations such as j and (modp) are omitted. The following equation (6) is obtained from equation (4). When n = k = 2, equation (4) is ｉ１ =s １ +x １ a １ So, let's write this as a １ =, it becomes formula (7). Also, formula (8) is ２ Therefore, as shown in 5 of the asymmetric secret sharing method, the obtained a１ It is calculated using a １ =, we obtain another equation of equation (7). １ =s １ +a １ x １ (6) a １ = (q １ -s １ ) / x １ = (W １ -s １ ) / x ２ (7) W １ =s １ +a １ x ２ (8) q in equations (6) and (7) １ , a １ The value of W in equation (8) sent to the data server is known only to the dealer. １ Here, secret information s corresponding to a known plaintext attack is known. １ In this case, the attacker can obtain a from equation (7). １ Determine (W １ , x ２ is known), and from equation (6), q １ For example, the value of dID[s １ ] is public information, then q １ is dID[s １ ] is an encrypted value of multiple secret information s ２ , ..., s ｍ If this is made public, the key used for encryption can be analyzed using a quantum computer, etc. ｊ If the key is identified, the secret information s ｍ＋１ q for ｍ＋１ Since leaks, s ｍ＋１ Even if the W ｍ＋１ q identified as ｍ＋１ Confidential information from ｍ＋１ is leaked.

[0017] In contrast, in conventional secret sharing schemes, １ is determined as a truly random number, so the secret information s １ Even if the next s ２Since a different true random number is used for , the key etc. cannot be analyzed, and s ２ , ..., s ｍ Even if it is released ｍ＋１ The safety of the

[0018] Therefore, it is necessary to make it difficult to analyze secret information by improving the security of the asymmetric secret sharing scheme.

[0019] The technology disclosed herein aims to provide an asymmetric secret sharing device, a secret information recovery device, an asymmetric secret sharing program, and a secret information recovery program that can make analysis of secret information more difficult than with conventional technology.

[0020] A first aspect of the technology disclosed herein is an asymmetric secret sharing device in a system in which n is an integer greater than or equal to 2, k is an integer with a minimum value of 2 and a maximum value of n, one piece of secret information is shared among n shared values, and the secret information can be restored by collecting k of the shared values, but cannot be restored by collecting k-1 or fewer shared values, characterized in having: a generation unit that obtains one or more true random numbers as first secret information, and generates t (<k) shared values ​​for each true random number from a first key; and a calculation unit that calculates n-t shared values ​​from the t shared values ​​and the first secret information.

[0021] The second aspect is an asymmetric secret sharing device in a system in which n is an integer greater than or equal to 2, k is an integer with a minimum value of 2 and a maximum value of n, one piece of secret information is distributed into n distributed values, and the secret information can be restored by collecting k of the distributed values, but the secret information cannot be restored by collecting k-1 or fewer distributed values, and is characterized by having a first concealment unit that conceals a true random number as first secret information, and a second concealment unit that uses the first secret information to conceal second secret information in a form different from the first secret information.

[0022] The third aspect is a secret information restoration device in the system of the first aspect, characterized in that it has a first restoration unit that restores first secret information and a second restoration unit that uses the restored first secret information to restore second secret information of the second aspect.

[0023] A fourth aspect is a secret information recovery device for a system in which n is an integer equal to or greater than 2, k is an integer having a minimum value of 2 and a maximum value of n, one piece of secret information is distributed into n distributed values, and the secret information can be recovered by collecting k of the distributed values, but cannot be recovered by collecting k-1 or fewer distributed values, and is characterized by comprising a recovery unit that recovers the secret information by sequentially changing the combinations of t distributed values ​​and n-t distributed values ​​generated from the key of the first aspect.

[0024] A fifth aspect is an asymmetric secret sharing apparatus for a system in which n is an integer greater than or equal to 2, k is an integer with a minimum value of 2 and a maximum value of n, one piece of secret information is distributed into n shared values, and the secret information can be restored by collecting k of the shared values, but cannot be restored by collecting k-1 or fewer shared values, the asymmetric secret sharing apparatus having a first calculation unit that calculates t (<k) shared values ​​from a key, and a second calculation unit that calculates n-t shared values ​​from the calculated t shared values ​​and the secret information, and the secret sharing apparatus further comprises a true random number generation unit that generates true random numbers using a natural phenomenon that cannot be controlled by humans, and at least one of the t shared values ​​and the n-t shared values ​​is calculated further using the true random numbers.

[0025] In a sixth aspect of the asymmetric secret sharing program, n is an integer greater than or equal to 2, k is an integer having a minimum value of 2 and a maximum value of n, one piece of secret information is distributed into n distributed values, and the secret information can be restored by collecting k of the distributed values, but the secret information cannot be restored by collecting k-1 or fewer of the distributed values.The asymmetric secret sharing program functions as a computer of an asymmetric secret sharing device in a system in which n is an integer greater than or equal to 2, k is an integer having a minimum value of 2 and a maximum value of n, and the computer of the asymmetric secret sharing device functions as a generation unit that obtains one or more true random numbers as first secret information and generates t (<k) distributed values ​​for each true random number from a first key, and a calculation unit that calculates n-t distributed values ​​from the t distributed values ​​and the first secret information.

[0026] In the seventh aspect of the asymmetric secret sharing program, n is an integer greater than or equal to 2, k is an integer having a minimum value of 2 and a maximum value of n, one piece of secret information is distributed into n distribution values, and the secret information can be restored by collecting k of the distribution values, but the secret information cannot be restored by collecting k-1 or fewer of the distribution values.The asymmetric secret sharing program causes the computer of the asymmetric secret sharing device in the system to function as a first concealment unit that conceals a true random number as first secret information, and a second concealment unit that conceals second secret information in a form different from the first secret information using the first secret information.

[0027] The secret information restoration program of the eighth aspect causes a computer of a secret information restoration device in the system of the first aspect to function as a first restoration unit that restores first secret information and a second restoration unit that restores second secret information of the second aspect using the restored first secret information.

[0028] A secret information recovery program of the ninth aspect, where n is an integer greater than or equal to 2 and k is an integer having a minimum value of 2 and a maximum value of n, distributes one piece of secret information into n distributed values, and allows the secret information to be recovered by collecting k of the distributed values, but not by collecting k-1 or fewer of the distributed values, causes a computer of a secret information recovery device in a system to function as a recovery unit that recovers the t distributed values ​​and n-t distributed values ​​generated from the key of the first aspect by sequentially changing the combinations.

[0029] In a tenth aspect of the asymmetric secret sharing program, n is an integer equal to or greater than 2, k is an integer having a minimum value of 2 and a maximum value of n, one piece of secret information is shared into n shares, and the secret information can be restored by collecting k of the shares, but not by collecting k-1 or fewer of the shares. The asymmetric secret sharing program causes a computer of the asymmetric secret sharing apparatus in the system to function as a generation unit that generates t (<k) shares from a key, and a calculation unit that calculates n-t shares from the calculated t shares and the secret information. The asymmetric secret sharing apparatus further includes a true random number generation unit that generates true random numbers using a natural phenomenon that cannot be controlled by humans, and at least one of the t shares and the n-t shares is calculated further using the true random numbers.

[0030] The technology of the present disclosure can make it difficult to analyze secret information by improving the security of the asymmetric secret sharing scheme.

[0031] 1 is a block diagram of a distribution and decryption system 10 according to a first embodiment; FIG. 2 is a block diagram of an owner 12R1; FIG. 3 is a flowchart of a distribution program 26P1 according to a first embodiment; FIG. 4 is a diagram showing processing of a distribution unit 22A according to a first embodiment; FIG. 5 is a flowchart of a restoration program 26P2 according to a first embodiment; FIG. 6 is a diagram showing processing of a restoration unit 22B according to a first embodiment; FIG. 7 is a flowchart of a distribution program 26P1 according to a second embodiment; FIG. 8 is a flowchart of a restoration program 26P2 according to a second embodiment;

[0032] An example of an embodiment of the present invention will be described in detail below with reference to the drawings. <First embodiment> A method for converting shares calculated by a computationally secure cryptography into shares with information-theoretic security will be described below. First, for simplicity, an outline of this embodiment will be described assuming n=k=2. [Shares] 1. The owner generates a non-zero true random number (true random number) r as first secret information. １ Generate a truly random number r １ Asymmetric secret sharing. 2. The owner of the key ２ｊ The pseudorandom number q generated from １ Nir １ q added １ +r １ The second secret information s １ [Recovery] 1. The restorer receives the first secret information r １ 2. The restorer restores the key ２ｊ The pseudorandom number q generated from １ Nir １ q added １ +r １ The second secret information s １ Restore.

[0033] In the above, the true random number r １ is the first secret information, and the owner's secret information s １ is the second secret information, and distribution and recovery are performed by r １ and １ This is done in two stages. First, r １In [Sharing] 1, a １ oar １ and q １ QR １ , W １ Wr １ Then, equation (7) can be written as follows: １ = (qr １ -r １ ) / x １ = (Wr １ -r １ ) / x ２ (9) Here, the first secret information r １ is a truly random number, so ar １ is a pseudorandom number qr １ is a truly random number r １ It was kept secret, like the Vernam cipher, １ itself can be considered as a truly random number, and qr １ It does not provide information about Wr １ , x １ , x ２ The attacker knows, but １ For all values ​​of , the attacker １ Since it can be assumed that １ It is not possible to narrow down the value of qr １ The value of cannot be narrowed down. In other words, it has information-theoretic security.

[0034] Therefore, that ar １ and １ Wr of equation (8) calculated using １ Since it can be considered a true random number, the attacker can １ to the first secret information r １ or qr １ From another perspective, the true random number r １ If we use qr as the coefficient of the first-order term instead of the constant term, we get the following: １ = a ０ +r １ x １ (10) a ０ =qr １ -r １ x １(11) Wr １ = a ０ +r １ x ２ (12) Equations (10) and (12) are the secret information a ０ This is the traditional secret sharing format that keeps secret information a ０ is the pseudorandom number qr from equation (11). １ and a truly random number r １ x １ The value is hidden by the formula (11) and (12). ０ is regarded as a distributed value, this is the secret information qr １ is directly concealed in equations (11) and (13) (x ２ x １ -x ２ (Considered). Wr １ =qr １ -r １ (x １ -x ２ ) (13) Therefore, in [Sharing] 1, information-theoretic security is established as in conventional secret sharing, and qr １ (The first secret information may be used as a coefficient of a first or higher order term instead of a constant term.) １ Since is irrelevant, [variance] 1 and Wr １ and １ is known, the following holds: H(x) represents the amount of information or entropy about x,

[0035]

[0036] represents the conditional amount of information about x on the assumption that information y is known. Therefore, equation (14) is １ and １ Even if you know １ This means that the amount of information about Wr that the attacker can obtain from [Distribution] 1 remains the same. １ Even if I know １ This means that it has information-theoretic security.

[0037]

[0038] Next, s １ In [Distribution] 2, the key ２ｊ q calculated from １ is the first secret information r which is a truly random number １ This is also kept secret by q １ In other words, the variance value in [variance]2 becomes as shown in equations (15) and (17) via equation (16). q １ +r １ =s １ +a １ x １ (15) a １ = {(q １ +r １ ) -s １} / x １ (16) W １ =s １ +a １ x ２ (17) Here, the first secret information r １ is a truly random number, so a １ is a pseudorandom number q １ is a truly random number r １ It is kept secret and can be considered as a true random number like the Vernam cipher. １ It can be said that the formulas (15) and (17) calculated using the formula (16) have information-theoretic security similar to the conventional secret sharing. １ to the second secret information s １ or q １ cannot be inferred, and all s １ or q １ It can be assumed that:

[0039] Here, the second secret information s １ , ..., s ｍ If it is made public, then from equation (17) a １ , ..., a ｍ is leaked, but the first secret information r １ , ..., r ｍ Since there is no leakage, q １ , ..., q ｍ is unknown. Also, from equation (15), q１ +r １ I understand, but q １ Therefore, equation (18) holds, and it can be said that [variance]2 also has information-theoretic security.

[0040]

[0041] From the above, the proposed method is １ , ..., W ｍ is known to an attacker, it is information-theoretically secure, and furthermore, the secret information s １ , ..., s ｍ Even if the secret information s is made public, the pseudorandom number cannot be analyzed and the next secret information s ｍ＋１ is as secure as conventional secret sharing.

[0042] Next, a specific case where an owner manages keys of a fictitious key server will be described.

[0043] 1 is a block diagram of a distribution and decryption system 10 according to a first embodiment. In the distribution and decryption system 10, n is an integer equal to or greater than 2, k is an integer having a minimum value of 2 and a maximum value of n, one piece of secret information is distributed into n distribution values, and the secret information can be restored by collecting k of the distribution values, but the secret information cannot be restored by collecting k-1 or fewer distribution values.

[0044] The distribution and decryption system 10 includes r (i.e., a natural number) owners 12R1 to 12Rr and n-t data servers 14Kt+1 to 14Kn. The owners 12R1 to 12Rr and the data servers 14Kt+1 to 14Kn are connected to each other via a network 16 (e.g., the Internet) so that they can communicate with each other.

[0045] User y is called the owner.

[0046] The data servers 14Kt+1 to 14Kn each have a storage device 14M that stores its own ID. For example, the storage device 14M of the data server 14Kt+1 stores the ID xt+1, and has a storage device that stores the distribution values ​​sent from the owner.

[0047] The owners 12R1 to 12Rr are examples of the "asymmetric secret sharing device" and "secret information recovery device" of the technology of the present disclosure. Note that in the technology of the present disclosure, the owners 12R1 to 12Rr have the functions of the "asymmetric secret sharing device" of the technology of the present disclosure, and the sharing and decryption system 10 may include a recovery device (an example of a "secret information recovery device") separate from the owners 12R1 to 12Rr.

[0048] 2 is a block diagram of the owner 12R1. Note that the configurations of the other owners 12R2 to 12Rr are similar to that of the owner 12R1, and therefore a description thereof will be omitted.

[0049] The owner 12R1 is configured as a computer. The owner 12R1 is a communication terminal. Specifically, the owner 12R1 includes a CPU (Central Processing Unit) 22, a RAM (Random Access Memory) 24, a storage device 26, a true random number generation device 28, and a communication device 30. The CPU 22, the RAM 24, the storage device 26, the true random number generation device 28, and the communication device 30 are connected to each other via a bus 32 so as to be able to communicate with each other.

[0050] The CPU 22 includes a distribution unit 22A and a restoration unit 22B.

[0051] The storage device 26 stores the secret information S ｉ The data identifier dID[S ｉ The storage device 26 has a secret information storage area 26M1 for storing the keys managed by the fictitious key servers 14K1 to 14Kt. １ｊ , key ２ｊ The storage device 26 has key storage areas 26M2 and 26M3 for storing the IDs (x) of the key servers 14K1 to 14Kt and the data servers 14Kt+1 to 14Kn. １ ,...x ｔ , x ｔ＋１ , x ｔ＋２, ...xn). However, it is possible to store only the IDs necessary for calculating the shares, including the data server, and it is not necessary to store all IDs. Furthermore, every time secret information is generated, the shares are stored in the data server according to this proposal, and the shares are called up as needed to restore the secret information. Furthermore, the data identifier storage area 26M1 does not need to be stored if the method for constructing the data identifier is fixed. For example, if secret information is generated periodically, the data identifier can be generated from a fixed date and time. Furthermore, the key １ｊ , key ２ｊ When the key storage areas 26M2 and 26M3 for storing the above are generated from one key, the owner only needs to store the key, and this storage unit is not essential.

[0052] The sharing program 26P1 is an example of an "asymmetric secret sharing program" of the technology of the present disclosure. The restoration program 26P2 is an example of a "secret information restoration program" of the technology of the present disclosure.

[0053] The CPU 22 functions as a distribution unit 22A and a restoration unit 22B by reading the distribution program 26P1 and the restoration program 26P2 from the program storage area 26MP to the RAM 24 and executing them.

[0054] The communication device 30 transmits and receives data via the network 16 .

[0055] The owner 12R1 uses the keys managed by the key servers 14K1 to 14Kt. １ｊ , key ２ｊ (j=1,...,t) and keep it secret. ｉ ] is used as the encryption key Eid(y, j). １ｊ , key ２ｊ is one key ｊ The variance value Wr obtained in [Variance] 1 and 2 may be generated from １ , W １Although they may be sent separately, they are sent simultaneously to reduce the number of communications. Furthermore, when t>1, it is desirable to conceal the t pseudo-random numbers generated by the key server with t true random numbers, but as will be described later, there is no problem if only one true random number is generated and the pseudo-random numbers are concealed with the same true random number. Therefore, for the sake of simplicity, the number of true random numbers that conceal the pseudo-random numbers generated by the key server is assumed to be one.

[0056] If the pseudo-random numbers generated by the key server are to be kept secret by using different true random numbers, this can be done as shown in the second embodiment. The rest is the same as the asymmetric secret sharing scheme.

[0057] <Distribution> Next, the distribution program 26P1 will be described with reference to Figures 3A and 3B. Figure 3A is a flowchart of the distribution program 26P1 according to the first embodiment, and Figure 3B is a diagram showing the processing of the distribution unit 22A according to the first embodiment. The CPU 22 executes the distribution program 26P1 to perform distributed processing.

[0058] [Distribution 1] In step 42, the sharing unit 22A receives its own secret information s from the true random number generator 28. ｉ , a true random number r is used as the first secret information. ｉ Get.

[0059] In step 44, the sharing unit 22A shares its secret information s ｉ Data identifier dID[s ｉ ] (i = 1, ..., m) to generate pseudo-random numbers qr ｉｊ (j=1,...,t) is generated as follows. ｉｊ are used as t variance values. ｉｊ =Enc(dID[s ｉ ], key １ｊ ) (19) The key key1,j is an example of the "first key" of the technology of the present disclosure. The process of step 44 is an example of the process of the "generation unit" of the technology of the present disclosure.

[0060] In step 46, the sharing unit 22A shares the secret information s ｉ is a truly random number r ｉ and the pseudorandom numbers (t distributed values) qr ｉｊ qｉｊ Then, the processes 4 and 5 of the asymmetric secret sharing scheme [sharing] are performed to obtain t shared values ​​qr ｉｊ and the first secret information r ｉ From n−t variance values ​​Wr ｉ，ｔ＋１ , ..., Wr ｉ，ｎ Calculate.

[0061] The processing of step 46 is an example of processing by the "calculation unit" of the technology of the present disclosure.

[0062] In this way, in distribution 1, the distribution unit 22A generates the pseudo-random number qr ｉｊ is directly used to conceal the true random number (first secret information).

[0063] The processing of share 1 is an example of the processing of the "first concealment unit" of the technology of the present disclosure. The share 1 share unit 22A is an example of the "generation unit" and "calculation unit" of the technology of the present disclosure.

[0064] [Distribution 2] In step 48, the distribution unit 22A distributes the data identifier dID[s ｉ ] (i=1, . . . , m), and from the following equation (20), the key ２，ｊ t pseudorandom numbers q ｉｊ Hereafter, q ｉｊ are also used as t variance values. ｉ The secret was ｉｊ +r ｉ The t variance values ​​are in the form of q ｉｊ =Enc(dID[s ｉ ], key ２ｊ ) (20) key2,j is an example of the "second key" of the technique of the present disclosure.

[0065] In step 50, the sharing unit 22A shares its secret information (i.e., second secret information) with s ｉ The key server's share value is q ｉｊ +r ｉ Then, the processes 4 and 5 of the asymmetric secret sharing scheme [sharing] are performed to obtain t shared values ​​q ｉｊ and the second secret information s ｉ n-t variance values ​​W ｉ，ｔ＋１ , ..., W ｉ，ｎ Calculate.

[0066] In this way, in distribution 2, the distribution unit 22A generates the pseudo-random number q ｉｊ Instead of directly using the shared values, the secret information is concealed by using true random numbers. This is a different point from Share 1.

[0067] In step 52, the distribution unit 22A ｉ ] and the calculated variance value W ｉ，ｔ＋１ , ..., W ｉ，ｎ and the variance value Wr ｉ，ｔ＋１ , ..., Wr ｉ，ｎ Data Server x ｔ＋１ , ..., x ｎ This completes the execution of the distributed program 26P1.

[0068] The data server is dID[s ｉ ], Wr ｉ，ｔ＋１ , ..., Wr ｉ，ｎ and W ｉ，ｔ＋１ , ..., W ｉ，ｎ Associate and save.

[0069] The processing of distribution 2 is an example of the processing of the "second concealment unit" of the technology of the present disclosure. The distribution unit 22A of distribution 2 is an example of the "second concealment unit" of the technology of the present disclosure.

[0070] As described above, the distribution unit 22A is an example of the "first concealment unit" (specifically, the "generation unit" and the "calculation unit") and the "second concealment unit" of the technology of the present disclosure.

[0071] <Restoration> Next, the restoration program 26P2 will be described with reference to Figures 4A and 4B. Figure 4A is a flowchart of the restoration program 26P2 according to the first embodiment, and Figure 4B is a diagram showing the processing of the restoration unit 22B according to the first embodiment. The restoration processing is performed by the CPU 22 executing the restoration program 26P2.

[0072] [Restoration 1] In step 62, the restoration unit 22B restores the secret information s ｉ The owner who wants to restore the data is n-t data servers x ｔ＋１ , ..., xn to dID[s ｉ ] and in step 64, the associated and saved variance value Wr ｉ，ｔ＋１ , ..., Wr ｉ，ｎ and Wｉ，ｔ＋１ , ..., W ｉ，ｎ Receive.

[0073] In step 66, the restoration unit 22B restores the key １ｊ Using equation (19), qr ｉｊ Calculate Wr ｉ．ｔ＋１ , ..., Wr ｉ，ｎ Together with this, the first secret information r ｉ Restore.

[0074] [Restoration 2] In step 68, the restoration unit 22B restores the key ２ｊ Using equation (20), q ｉｊ and the key server generates a share value q ｉｊ +r ｉ As, W ｉ，ｔ＋１ , ..., W ｉ，ｎ In addition, confidential information ｉ Restore.

[0075] A more specific explanation will be given below.

[0076] When n=k=2, the number of key servers is one, so information-theoretic security can be achieved with one true random number, as described above.

[0077] When n = k = 3, the number of key servers is t < k, so one or two can be selected. [Distribution] If t = 1 in 1, one pseudo-random number qr ｉ１ is generated by the key server, and A(i) of asymmetric secret sharing [share] 4 ｋ－１－ｔ An additional truly random number r corresponding to ２ Using the asymmetric secret sharing process in step 4, Wr ｉ２ , Wr ｉ３ is calculated and sent to the data servers x2 and x3. ｉ１ , Wr ｉ２ , Wr ｉ３ The relationship between the two is as follows, and as mentioned above, １ and ２ If we reverse the above, it becomes the same as conventional secret sharing, and we can say that information-theoretic security is achieved.

[0078]

[0079] If t=2, two pseudo-random numbers qr ｉ１ , qr ｉ２ is generated by the key server, and the following ar is obtained by the process of 4. of asymmetric secret sharing １ , ar ２ Wr of equation (26) ｉ３ is calculated and sent to data server x3 (no additional truly random number r2 is used).

[0080]

[0081] In this case, the true random number is r １ However, since one true random number remains, information-theoretic security is maintained. Also, since there is only one data server, no further processing to delete true random numbers can be performed, and information-theoretic security is maintained in the same way as when t = 1.

[0082] Next, when t=2 in [Distribution 2], the pseudorandom number q １ , q ２ q １ +r １ , q ２ +r １ As a result, the following relationship is obtained.

[0083]

[0084] All the attacker knows is Wr ｉ３ (, W ｉ３ ), it can be said that there is no problem even if there is only one true random number (a in equations (27) to (29) １ , a ２ is qr in equations (24) and (25). １ , qr ２ q １ +r １ , q ２ +r １ Next, in [Distribution 2], even if t=1, an additional random number is added, and qr ｉ１ Gaq １ +r １ However, it can be said that there is no problem.

[0085] Also, in [Distribution 2], key ２ｊ t pseudorandom numbers q generated using ｉｊThe first secret information r ｉ I kept it secret, but ｉｊ Without adding with ｉ Alternatively, t may be generated as t shared values ​​and used directly. In this case, the same number of true random numbers as the number of key servers are required to change the shared values. For example, in equations (27) to (29), q １ +r １ r １ , q ２ +r １ r ２ Even if the secret is shared, it will be the same as the conventional secret sharing, and no problems will occur. １ , r ２ A １ , a ２ In this case, the secret sharing is not asymmetric but normal. Note that the confidentiality of the secret information is ensured by the secret sharing itself.

[0086] From the above, it can be said that the method proposed by the technology of the present disclosure allows n, k, and t to be set arbitrarily, and can achieve security equivalent to information-theoretic security, as in the case of n=k=2.

[0087] Second Embodiment Next, a second embodiment will be described. The configuration of the second embodiment is the same as that of the first embodiment, so the description thereof will be omitted. The operation of the second embodiment will be described below.

[0088] In addition to the processing in the first embodiment, there is the following method for making the asymmetric secret sharing scheme information-theoretically secure.

[0089] When calculating the variance value using the formula (1) in the Shamir method, the known x, which is the server ID, is added to the formula (1). ｉ Substituting the above, the corresponding variance value W ｉ Generally, the known x ｉ If n is not known, even if k shares are collected, the secret cannot be recovered. Therefore, by doing the following, the asymmetric secret sharing scheme can be made information-theoretically secure even if the second secret information s1 is known. For simplicity, the following outline will be given assuming n=k=2.

[0090] [Distributed] Owners are 0 and x１ , x ２ A truly random number r that is not １ and obtain a true random number r １ is asymmetrically shared.

[0091] The owner is １ x ２ Confidential information as １ Asymmetric secret sharing is performed. １ = x2'. [Restoration] The restorer restores x2'.

[0092] The restorer converts the restored x2' into x ２ Confidential information as １ Restore.

[0093] In the above, the true random number r １ is the first secret information, and the owner's secret information s １ is the second secret information, and distribution and recovery are performed by r １ and １ As in the first embodiment, the first secret information r １ It is clear that information-theoretic security can be achieved for r １ If x2' is not known, equation (1) cannot be solved, and the second secret information s １ Since there exists a solution for the above, it can be said that information-theoretic security is established. In addition, even if the second secret information s1 is guessed or made public, a １ We know x2' but not x2'. １ Because I don't know １ is unknown, and equation (17) holds, so information-theoretic security is guaranteed.

[0094] Also, in the above, x ２ Only the first secret information x2' is used, but x １ the first secret information x １ ', and x １ ', x ２ The detailed algorithm is shown below. In the first embodiment, although multiple pieces of first secret information can be selected, the second secret information s ｉ For r ｉIn this embodiment, the first secret information is all the server IDs x １ ', ..., x ｎ However, since the secret information will not be known even if only one server ID is unknown, the first secret information may be one server ID, as in the first embodiment. However, in order to differentiate from the first embodiment, the number of first secret information in [Sharing] 1 is set to n-t, which is the same number as the data servers. Therefore, asymmetric secret sharing is repeated using n-t true random numbers as the first secret information. However, when t=k-1, the number of data servers is 1, so the number of first secret information is 1, which is the same as in the first embodiment. Other settings are the same as in the first embodiment.

[0095] Next, the distribution program 26P1 will be described with reference to Fig. 5 (also see Fig. 3B). Fig. 5 is a flowchart of the distribution program 26P1 according to the second embodiment.

[0096] [Distribution 1] In step 72, the sharing unit 22A receives its own secret information s from the true random number generator 28. ｉ 0 and a true random number r that does not match the server ID ｉ，ｈ (h=t+1,...,n).

[0097] In step 74, the distribution unit 22A ｉ，ｈ Data identifier dID[r ｉ，ｈ ] to generate a pseudorandom number qr ｉｈｊ (j=1,...,t) is generated as follows: As mentioned above, the pseudo-random number qr ｉｈｊ are used as t distributed values ​​for each of the first secret information ri,h. ｉｈｊ =Enc(dID[r ｉ，ｈ ], key １ｊ ) (30) In step 76, the sharing unit 22A shares the first secret information with r ｉ，ｈ (h=t+1,...,n), and qr ｉｈｊ q ｉｊ , and repeat the process from step 4 onward of the asymmetric secret sharing method. ｔ＋１ , ..., x ｎ Dispersion value Wr sent to ｉ，ｈ，ｔ＋１ , ..., Wrｉ，ｈ，ｎ Calculate (h=t+1, . . . , n).

[0098] [Distribution 2] In step 78, the distribution unit 22A distributes the second secret information s ｉ Data identifier dID[s ｉ ] (i = 1, ..., m) to generate pseudo-random numbers qij. ｉｊ =Enc(dID[s ｉ ], key ２ｊ ) (31) Key ２ｉ is an example of the "second key" of the technique of the present disclosure.

[0099] In step 80, the distribution unit 22A ｈ (h=t+1,...,n) is a true random number r ｉ，ｈ As a truly random number r ｉ，ｈ is used as a variable in the sharing formula (1), and t shares q ｉｊ and the second secret information s ｉ From this, n-t variance values ​​W ｉ，ｔ＋１ , ..., W ｉ，ｎ Calculate.

[0100] True random number r ｉ，ｈ This differs from Distribution 1 in that it uses as the server ID.

[0101] In step 82, the distribution unit 22A ｔ＋１ , ..., x ｎ , dID[s ｉ ] and Wr ｉ，ｈ，ｔ＋１ , ..., Wr ｉ，ｈ，ｎ and W ｉ，ｔ＋１ , ..., W ｉ，ｎ and send.

[0102] The data server associates and stores them.

[0103] Next, the restoration program 26P2 will be described with reference to Fig. 6 (also see Fig. 4B). Fig. 6 is a flowchart of the restoration program 26P2 according to the second embodiment.

[0104] [Restore 1] Secret information s ｉIn step 92, the restoration unit 22B of the owner who wants to restore the data ｔ＋１ , ..., x ｎ dID[s ｉ ] and in step 94, the associated and saved variance value Wr ｉ，ｈ，ｔ＋１ , ..., Wr ｉ，ｈ，ｎ and W ｉ，ｔ＋１ , ..., W ｉ，ｎ Receive.

[0105] In step 96, the restoration unit 22B restores the key managed by itself. １ｊ Using equation (30), qr ｉｈｊ Obtaining Wr ｉ，ｈ，ｔ＋１ , ..., Wr ｉ，ｈ，ｎ Together with this, the first secret information r ｉ，ｈ (h=t+1, . . . , n). [Restoration 2] In step 98, the restoration unit 22B restores the key ２ｊ Using equation (31), q ｉｊ and data server x ｈ (h=t+1,...,n) is the ID of ｉ，ｈ As, W ｉ，ｔ＋１ , ..., W ｉ，ｎ In combination with this, the second secret information s ｉ Restore.

[0106] In the above, only the data server ID is kept secret, but the key server ID may also be kept secret.

[0107] Furthermore, when all server IDs are determined by true random numbers, the true random numbers need not be 0 or the same value.

[0108] <Third Embodiment> Next, a third embodiment will be described. The configuration of the third embodiment is the same as that of the first embodiment, so the description thereof will be omitted. The operation of the third embodiment will be described below.

[0109] This embodiment shows a method that is secure even if secret information is made public in a form different from that of the second embodiment. For simplicity, the following description will be given assuming n=k=2.

[0110] In asymmetric secret sharing, the owner has a fixed key. １ｊ , key ２ｊ(j=1,...,t) and encrypt it using qr ｉｊ , q ｉｊ Here we calculated some qr ｉｊ , q ｉｊ If this can be inferred, the key １ｊ , key ２ｊ Therefore, the key in [share] 2 ２ｊ A method for improving security by changing n every time will be described below. As in the first embodiment, an overview will be given assuming n=k=2.

[0111] [Distribution] 1. The distribution unit 22A distributes the owner a true random number r １ and generate the first secret information r １ 2. The sharing unit 22A shares the key ２ｊ +r １ A new key ２ｊ As q ｉｊ and calculates the second secret information s １ is asymmetrically shared.

[0112] In this way, the distribution unit 22A generates the true random number r １ The key for generating pseudorandom numbers is ２ｊ is used to generate t shared values, and n−t shared values ​​are calculated from the t shared values ​​and the secret information.

[0113] In the third embodiment, a true random number r １ The key for generating pseudorandom numbers is ２ｊ This differs from variance 1 in that it is used as

[0114] [Restoration] 1 The restoration unit 22B restores the first secret information r １ 2. The restoration unit 22B restores r １ +key ２ｊ A new key ２ｊ As q ｉｊ and calculates the second secret information s １ Restore.

[0115] In the above, q ｉｊ The key to generate ２ｊ is a truly random number r ｊ It changes every time depending on the past transmission data etc.ｉｊ can be analyzed, and q ｉｊ Generate a key ２ｊ Even if it can be analyzed, it will be meaningless. ｉ First secret information r ｊ Generate a key ２ｊ When changing the key, the detailed algorithm is ２ｊ r １ +key ２ｊ The rest of the configuration is the same as the first embodiment. ２ｊ If you change it every time, a set of dID[s ｉ ] and q ｉｊ Even if the key is discovered from the dID[s], it will not be used next time, so it can be said that security equivalent to information-theoretic security is achieved. ｉ ] and q ｉｊ If multiple s within the range are required, ｊ Every key ２ｊ In this case, the process of [distribution] [restore] is key ２ｊ Therefore, in this case, the number of times asymmetric secret sharing is performed and the number of shares stored in the data server are less than those in the first embodiment. However, even in the first and second embodiments, the first secret information does not need to be asymmetrically shared every time, and multiple s ｊ It is also possible to perform this every time. In this embodiment, if the first secret information is asymmetrically shared every time, the result will be almost the same as the first embodiment. In addition, if the first secret information is updated once every several times, [Share 1] and [Restore 1] can be performed at that time. Therefore, a detailed algorithm will be omitted.

[0116] Also, two truly random numbers r １ｊ , r ２ｊ is the first secret information, and key １ｊ Key １ｊ +r １ｊ Toshi, key ２ｊ Key ２ｊ +r １ｊ If so, key １ｊ Even analyzing it would be pointless.

[0117] Furthermore, the first secret information is １ｊ , key２ｊ It is also possible to use the key as it is as an update key without adding the value.

[0118] <Fourth embodiment> Next, a fourth embodiment will be described. The configuration of the fourth embodiment is the same as that of the first embodiment except that the owner is provided with a display device (not shown), so a description thereof will be omitted. The operation of the fourth embodiment will be described below.

[0119] In the first embodiment, it was shown that even if the shares stored in the data server are leaked, the secret information is protected with the same security as information-theoretic security. In this embodiment, a method is shown that can verify if the data server is tampered with by an attacker in asymmetric secret sharing. First, an overview will be given assuming n=4, k=3, t=2, and the number of data servers is u=n-t=2. Also, x １ , x ２ Let x be the ID of the key server, ３ , x ４ is the ID of the data server. If k=3, the data can be restored if all three shares are collected. Therefore, the shares generated from the two key server keys held by the owner are restored by changing the data server's shares one by one, and if the results match, the data server has not been tampered with.

[0120] [Distribution] 1. The distribution unit 22A distributes a true random number r １ The secret key is asymmetrically shared with n=4, k=3, t=2, and u=2. ２ｊ The pseudorandom number q generated from １ Nir １ q added １ +r １ The second secret information s １ is asymmetrically shared.

[0121] [Restoration] 1-1. The restoration unit 22B １ , x ２ , x ３ The secret information recovered using the server's shared value is １ 1-2. The restoration unit 22B is １ , x ２ , x ４ The secret information recovered using the server's shared value is１ 1-3. The restoration unit 22B is １ '=r １ "If it is, there is no tampering, and １ If '≠r1'', it is determined that there has been tampering and the process is stopped. 2-1. The restoration unit 22B １ , x ２ , x ３ The secret information restored using the server's shared value is denoted as s1'. 2-2. The restoration unit 22B restores the secret information by １ , x ２ , x ４ The secret information recovered using the server's shared value is １ 2-3. The restoration unit 22B is １ '=s １ If it is ", it is accepted as no falsification, and １ '≠s １ "If so, it is considered to have been tampered with.

[0122] In the above [Distribution] 1, key server x １ , x ２ is the pseudorandom number q １ , q ２ and data server x ３ , x ４ Is W ３ , W ４ is calculated and stored.

[0123]

[0124] a １ , a ２ is the q generated by t = 2 key servers. １ , q ２ It is calculated as in equations (24) and (25) from １ Since the value contains this, it can be considered a true random number.

[0125] Therefore, r １ , a １ , a ２ W calculated from １ , W ２ can also be considered as a truly random number, and q １ , q ２ Since k = 3, the attacker can know W ３ , W ４Solving this, r １ It is not possible to obtain W ３ From W ４ By subtracting the constant term r １ can be deleted, but a １ , a ２ As mentioned above, １ Since it contains, it satisfies information-theoretic security.

[0126] In contrast, in [Restore] 1, r １ The restoration of the data is performed twice by changing the combination of data servers, and if the results match, it is determined that there is no tampering, and if they do not match, it is determined that there is tampering. Generally, the variance value is calculated by the coordinate x ｉ In the above asymmetric secret sharing, k=3, so the owner is １ , q １ , q ２ Find the curve that passes through the three points (r １ is the y coordinate when the x coordinate is 0), and the x coordinate on that curve ３ , x ４ The y coordinate in W ３ , W ４ However, the attacker can ３ , W ４ Since the attacker can only know the two points, the curve cannot be known. ３ W ３ Even if the attacker tampered with q １ , q ２ , W ３ Since we do not know the curve that passes through ', we can create a W on the altered curve. ４ ' cannot be determined correctly. ３ , W ４ In order, １ , q ２ and restore it, and if the restoration results match, １ , q ２ , W ３ and q １ , q ２ , W ４ If the above calculation is performed on modp, there is a probability of 1 / p that W ４It is possible that ' coincides with a false curve by chance. However, if p is set to a sufficiently large value, 1 / p becomes a negligible probability, and security is maintained.

[0127] It is clear from the first embodiment that the process performed in [Distribution] [Recovery] 2 has the same security as that in [Recovery] 1. Furthermore, if the recovery results match, the recovered second secret information s １ It can be said that [Distribution] [Restore] has not been tampered with, just like [Distribution] [Restore] 1.

[0128] Next, the restoration program 26P2 will be described with reference to FIG. 7 (see also FIG. 4B). The distribution program is a value that allows the settings of n, k, and t to be tamper-detectable, and the same processing as in the first embodiment can be performed on these settings. A setting that allows tamper detection requires the number of data servers u to be 2 or more, and is a setting that cannot be restored from the data server, so 1 < u = n - t < k (where t < k). Therefore, since there are no n or t that satisfy this equation when k = 2, the minimum settings are k = 3, n - t = 2, and t = 2, so n = 4. FIG. 7 is a flowchart of the restoration program 26P2 of the fourth embodiment.

[0129] For simplicity, let t=k-1. If t<k-1, the variance values ​​of the data servers are verified while changing the combination. Other assumptions are the same as those in the first embodiment, so they will be omitted.

[0130] [Restoration 1] In step 102, the restoration unit 22B restores u data servers x ｎ－ｕ＋１ , ..., x ｎ dID[s ｉ ] to send.

[0131] In step 104, the restoration unit 22B restores the u data servers x ｎ－ｕ＋１ , ..., x ｎ From the associated and saved variance value Wr ｉ，ｎ－ｕ＋１ , ..., Wr ｉ，ｎ and W ｉ，ｎ－ｕ＋１ , ..., Wi ，ｎ Receive.

[0132] In step 106, the restoration unit 22B restores the key managed by itself. １ｊUsing Equation 19, k-1 qrij (j=1,...,k-1) are obtained, and Wr ｉ．ｎ－ｕ＋１ , ..., Wr ｉ，ｎ By combining them one by one, the secret information r ｉ，ｎ－ｕ＋１ , ..., r ｉ，ｎ Restore.

[0133] In step 108, the restoration unit 22B ｉ，ｎ－ｕ＋１ , ..., r ｉ，ｎ It is determined whether there is a match among them.

[0134] r ｉ，ｎ－ｕ＋１ , ..., r ｉ，ｎ If there is a match among r ｉ，ｎ－ｕ＋１ , ..., r ｉ，ｎ Match among them with r ｉ [Restoration 2] In step 112, the restoration unit 22B restores the key ２ｊ Using Equation 20, q ｉｊ (j=1,...,k-1) and W ｉ，ｎ－ｕ＋１ , ..., W ｉ，ｎ and combine them one by one to get secret information s ｉ，ｎ－ｕ＋１ , ..., s ｉ，ｎ Restore.

[0135] In step 114, the restoration unit 22B ｉ，ｎ－ｕ＋１ , ..., s ｉ，ｎ It is determined whether there is a match among them.

[0136] s ｉ，ｎ－ｕ＋１ , ..., s ｉ，ｎ If there is a match among s ｉ，ｎ－ｕ＋１ , ..., s ｉ，ｎ The one that matches is taken as the correct answer.

[0137] If the determination in step 108 or step 114 is negative, the display device displays a message indicating that tampering has occurred.

[0138] In the above, the tampering check in [Restoration 1] can be omitted. This is because if the results of [Restoration 1] do not match, it is assumed that the results of [Restoration 2] will also not match, so it is sufficient to check only [Restoration 2]. Accordingly, [Distribution 1] and [Restoration 1] may be the same as in the first embodiment.

[0139] If the same verification is performed for the second and third embodiments, it is possible to verify whether the restored results have been tampered with. In addition, security can be improved by increasing n and k. For example, if n = 6, k = 4, and t = 3, the number of data servers is 3. Here, the probability that three shared values ​​from the data servers are tampered with and made to coincide by chance is 1 / p ２ This improves safety.

[0140] <Other Embodiments> It is clear that the above four embodiments can be implemented in combination. For example, the first to third embodiments can simultaneously conceal the shares for the second secret information, the server ID, and the pseudorandom number generation key by using different first secret information, and one of them can be used as the fourth embodiment to detect tampering. In addition, in the above embodiments, the second secret information can be ｉ However, various other values ​​may be used as the second secret information.

[0141] (Non-Patent Document 2) Keiichi Iwamura and Ahmad Akmal Aminuddin Mohd Kamal, "Communication-Efficient Secure Computation of Encrypted Inputs Using (k, n) Threshold Secret Sharing", IEEE Access, May 2023. For example, １ (s １ +1) can be used as secret information, the restored value can be used directly for secure computation. １ Vernam cipher １ +s １ Furthermore, the transmitting side may generate a pseudo-random number qr using the first secret information r1.１ｊ like the Vernam cipher １ +qr １ｊ The receiver sends the shared key １ｊ From QR １ｊ The first secret information r １ Take out r １ The second secret information s １ However, the second secret information s １ If you send the first secret information in the Vernam cipher format, １ +s １ Then, the true random number is lost by the following calculation. (r １ +qr １ ) + (r １ +s １ ) = qr １ +s １ Therefore, the first secret information and the second secret information need to be concealed in different ways. In the first embodiment, the first secret information is used to conceal the shares, in the second embodiment it is used as a server ID, and in the third embodiment it is used for key update. Since they are concealed in different ways, no problems arise. That is, the essence of the present invention is to communicate a true random number as the first secret information while concealing it, and to conceal the second secret information in a different way from the first secret information using the first secret information. However, asymmetric secret sharing is used for one or both of them.

[0142] Also, the owner's key １ｊ , key ２ｊ However, the same key ｊ In this case, in order to change the encryption result, the data may be changed by adding or concatenating a predetermined value to the data identifier to be encrypted. Also, in the first embodiment, when the shares for the second secret information are directly used as the first secret information, the key ２ｊ is no longer necessary, so key １ｊ Nikey ｊ may be used directly.

[0143] Furthermore, in the first embodiment, when n = k = 2, the number of shares stored in the data server is two, and no reduction in memory capacity is achieved compared to conventional secret sharing schemes. However, for example, when n = k = 3 and t = k-1, the number of data servers is one and the number of shares stored is two. In conventional secret sharing schemes, three shares are stored, so the total memory capacity is 2 / 3. Therefore, in the first to third embodiments, if n and k are increased, the total memory capacity becomes 2 / n compared to conventional secret sharing schemes, and the memory reduction rate can be increased.

[0144] On the other hand, an advantage of asymmetric secret sharing, in addition to reducing memory requirements, is that it simplifies the owner's management of shares. In other words, conventional secret sharing schemes require n data servers, but if k of these servers are attacked by an attacker without the owner's knowledge and shares are leaked, there is a risk that the attacker will learn secret information. In contrast, asymmetric secret sharing schemes allow the owner to generate up to k-1 shares from a key, the number of data servers can be k-1 (minimum 1). Therefore, even if an attacker attacks up to k-1 data servers without the owner's knowledge, secret information will not be leaked unless the owner generates shares. Therefore, secret information will not be leaked without the owner's knowledge. From the above, if t = k-1, only one cloud data server is required, and if the owner performs distribution and restoration using a smartphone or PC (i.e., a personal computer (PC)) with the ability to generate true random numbers, data management with the above characteristics can be achieved with just one smartphone or PC, even if the number of secrets is enormous. Furthermore, in conventional asymmetric secret sharing schemes, if an attacker can infer the shares generated from the key from the transmitted information, the secret information will be leaked using a quantum computer or the like. In contrast, in the present invention, the security of the transmitted information can be made information-theoretically secure, so that an attacker cannot know the shares generated by the owner even with a quantum computer or the like, and it can be said that security is greatly improved. Furthermore, in conventional secret sharing schemes, even with the minimum k=2, a separate encryption mechanism such as the Vernam cipher is required to securely transmit two shares, making them unsuitable for use in communications. In contrast, in the asymmetric secret sharing scheme, if t=k-1, only one share needs to be exchanged, so it can be used for communications. That is, when n=k=2, the key １ｊ , key ２ｊ If the sender and receiver share the secrets, and the sender generates true random numbers and simultaneously transmits one share each for the first secret and the second secret, cryptographic communication that achieves information-theoretic security in a single communication can be achieved. Also, as shown in the fourth embodiment, if two different shares are transmitted for the same secret with n=4, k=3, and t=2, it is possible to verify whether tampering has occurred on the communication channel using secret sharing with verification.

[0145] Furthermore, n = k = 2 and the IoT device performs distributed processing. ｉ，２ , W ｉ，２ to the receiving terminal, and the key １ｊ , key ２ｊ If the receiving terminal performs the restoration process using the shared information, IoT devices can perform information-theoretically secure communication with very light processing. Therefore, the proposed method can also be used for communication.

[0146] Also, if the secret information is a password (i.e., PW) shared by the sender and receiver, the sender can authenticate the recipient by sending the PW as secret information. However, since this alone sends the same information every time, if a new true random number is sent as additional first secret information and the value obtained by applying this true random number to the PW is sent as second secret information, it becomes possible to authenticate the recipient using different information each time. The additional true random number can also be sent by the receiver, and the sender can restore it, apply it to the PW, and send back the value as second secret information.

[0147] In addition, the owner and the restorer may be the same person, but if the owner allows another restorer to restore the secret information, the owner may tell the restorer the combination of pseudo-random numbers or true random numbers generated for the second secret information. In this case, it is necessary to update the shares stored in the data server by changing the first secret information, for example, to prevent a second restoration from being performed.

[0148] The CPU 22 is an example of a "processor" in the technology of the present disclosure. In addition to the CPU 22, other examples of processors include dedicated electrical circuits that are processors having a circuit configuration designed specifically for executing specific processing, such as a field-programmable gate array (FPGA), a programmable logic device (PLD), or an application-specific integrated circuit (ASIC).

[0149] The hardware resource that executes the distributed processing and the restoration processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the distributed processing and the restoration processing may be a single processor.

[0150] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes the distributed processing and restoration processing. Second, there is a system that uses a processor that realizes the functions of the entire system, including multiple hardware resources that execute the distributed processing and restoration processing, on a single IC chip, as typified by SoC (System-on-a-chip). In this way, the distributed processing and restoration processing are realized using one or more of the various processors described above as hardware resources.

[0151] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The above-described distributed processing and restoration processing are merely examples. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[0152] The storage device 26 is a non-transitory storage medium. An example of the storage device 26 is a hard disk drive (HDD). Note that the HDD is merely an example, and other types of storage devices such as a solid state drive (SSD) may also be used.

[0153] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[0154] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[0155] <Addendum> The following addendum is proposed based on the above disclosure: (Addendum 1) A system including a secret sharing apparatus and a secret information recovery apparatus, where n is an integer greater than or equal to 2 and k is an integer having a minimum value of 2 and a maximum value of n, distributes one piece of secret information into n shares, and the secret information can be recovered by collecting k of the shares, but cannot be recovered by collecting k-1 or fewer shares, comprises a processor that obtains one or more true random numbers as first secret information, generates t (<k) shares for each true random number from a first key, and executes a process of calculating n-t shares from the t shares and the first secret information. (Supplementary Note 2) A system comprising a secret sharing device and a secret information recovery device, where n is an integer greater than or equal to 2 and k is an integer having a minimum value of 2 and a maximum value of n, where one piece of secret information is distributed into n distribution values, and the secret information can be recovered by collecting k of the distribution values, but cannot be recovered by collecting k-1 or fewer of the distribution values, the secret sharing device in this system comprises a processor, which conceals a true random number as first secret information, and uses the first secret information to conceal second secret information in a form different from the first secret information. (Supplementary Note 3) The secret information recovery device in the system according to claim 1 comprises a processor, which recovers the first secret information, and uses the recovered first secret information to recover the second secret information according to Supplementary Note 2. (Supplementary Note 4) A secret information recovery device in a system in which one piece of secret information is distributed into n distributed values, where n is an integer equal to or greater than 2, k is an integer having a minimum value of 2 and a maximum value of n, and the secret information can be recovered by collecting k of the distributed values ​​but cannot be recovered by collecting k-1 or fewer distributed values, includes a processor, and the processor executes a process of recovering the secret information by sequentially changing the combinations of the t distributed values ​​and the n-t distributed values ​​generated from the key according to Supplementary Note 1.(Supplementary Note 5) A secret sharing apparatus for a system in which one piece of secret information is distributed into n shares, where n is an integer greater than or equal to 2 and k is an integer with a minimum value of 2 and a maximum value of n, and the secret information can be restored by collecting k of the shares but not by collecting k-1 or fewer shares, comprises a processor, which calculates t (<k) shares from a key and executes a process of calculating n-t shares from the calculated t shares and the secret information, the secret sharing apparatus further comprising a true random number generation unit which generates true random numbers using a natural phenomenon that is not controllable by humans, and the processor calculates at least one of the t shares and the n-t shares using the true random numbers.

Claims

1. An asymmetric secret sharing device for a system in which one piece of secret information is shared into n shared values, where n is an integer greater than or equal to 2 and k is an integer with a minimum value of 2 and a maximum value of n, and the secret information can be restored by collecting k of the shared values, but cannot be restored by collecting k-1 or fewer of the shared values, the asymmetric secret sharing device comprising: a generation unit that obtains one or more true random numbers as first secret information, and generates t (<k) shared values for each true random number from a first key; and a calculation unit that calculates n-t shared values from the t shared values and the first secret information.

2. An asymmetric secret sharing device in a system in which n is an integer greater than or equal to 2, k is an integer having a minimum value of 2 and a maximum value of n, one piece of secret information is distributed into n distributed values, and the secret information can be restored by collecting k of the distributed values, but the secret information cannot be restored by collecting k-1 or fewer of the distributed values, characterized in having: a first concealment unit that conceals a true random number as first secret information; and a second concealment unit that uses the first secret information to conceal second secret information in a form different from the first secret information.

3. The asymmetric secret sharing device according to claim 2, wherein the first concealment unit comprises the generation unit and calculation unit according to claim 1, generates the t shares, and calculates n-t shares from the t shares and the first secret information, thereby concealing the true random numbers as the first secret information, and the second concealment unit conceals all or some of the t pseudo-random numbers generated from a second key using the true random numbers, and generates them as t shares, or generates the t true random numbers directly as t shares, and calculates n-t shares from the t shares and the second secret information.

4. The asymmetric secret sharing device according to claim 2, wherein the first concealment unit comprises the generation unit and calculation unit according to claim 1, and generates the t shares and calculates n-t shares from the t shares and the first secret information, thereby concealing the true random number as the first secret information; and the second concealment unit generates the t shares using a second key and calculates n-t shares from the t shares and the second secret information using the first secret information according to claim 1 as a variable of a sharing formula.

5. The asymmetric secret sharing device according to claim 2, wherein the first concealment unit comprises the generation unit and calculation unit according to claim 1, generates the t shared values, and calculates n-t shared values from the t shared values and the first secret information, thereby concealing the true random number as the first secret information, and the second concealment unit uses the true random number as a second key for generating pseudo-random numbers, generates t shared values, and calculates n-t shared values from the t shared values and secret information.

6. The asymmetric secret sharing device according to claim 2, wherein the first or second concealing unit obtains one or more true random numbers and conceals pseudo-random numbers generated from a key.

7. A secret information restoration device in the system described in claim 1, characterized in having: a first restoration unit that restores first secret information; and a second restoration unit that uses the restored first secret information to restore second secret information described in any one of claims 3 to 6.

8. A secret information recovery device for a system in which one piece of secret information is distributed into n shares, where n is an integer greater than or equal to 2, k is an integer with a minimum value of 2 and a maximum value of n, and the secret information can be recovered by collecting k of the shares but cannot be recovered with k-1 or fewer shares, the secret information recovery device comprising a recovery unit that recovers the secret information by sequentially changing the combinations of t shares and n-t shares generated from the key according to any one of claims 1 and 3 to 5.

9. An asymmetric secret sharing apparatus for a system in which one piece of secret information is shared into n shared values, where n is an integer greater than or equal to 2 and k is an integer with a minimum value of 2 and a maximum value of n, and the secret information can be restored by collecting k of the shared values but not by collecting k-1 or fewer of the shared values, the asymmetric secret sharing apparatus comprising: a first calculation unit that calculates t (<k) shared values from a key; and a second calculation unit that calculates n-t shared values from the calculated t shared values and the secret information, wherein the secret sharing apparatus further comprises a true random number generation unit that generates true random numbers using a natural phenomenon that is not controllable by humans, and at least one of the t shared values and the n-t shared values is calculated further using the true random numbers.

10. An asymmetric secret sharing program that causes a computer of an asymmetric secret sharing device in a system in which one piece of secret information is distributed into n shares, where n is an integer greater than or equal to 2 and k is an integer with a minimum value of 2 and a maximum value of n, and the secret information can be restored by collecting k of the shares but not by collecting k-1 or fewer shares, to function as: a generation unit that obtains one or more true random numbers as first secret information and generates t (<k) shares for each true random number from a first key; and a calculation unit that calculates n-t shares from the t shares and the first secret information.

11. An asymmetric secret sharing program that causes a computer of an asymmetric secret sharing device in a system in which one secret is distributed into n shared values, where n is an integer greater than or equal to 2 and k is an integer with a minimum value of 2 and a maximum value of n, and the secret can be restored by collecting k of the shared values but cannot be restored by collecting k-1 or fewer shared values, to function as a first concealment unit that conceals a true random number as first secret information, and a second concealment unit that uses the first secret information to conceal second secret information in a form different from the first secret information.

12. The asymmetric secret sharing program according to claim 11, wherein the first concealment unit comprises the generation unit and calculation unit according to claim 1, and generates the t shares and calculates n-t shares from the t shares and the first secret information, thereby concealing the true random numbers as the first secret information; and the second concealment unit conceals all or some of the t pseudo-random numbers generated from a second key using the true random numbers, and generates them as t shares, or generates the t true random numbers directly as t shares, and calculates n-t shares from the t shares and the second secret information.

13. The asymmetric secret sharing program according to claim 11, wherein the first concealment unit comprises the generation unit and calculation unit according to claim 1, and generates the t shares and calculates n-t shares from the t shares and the first secret information, thereby concealing the true random number as the first secret information; and the second concealment unit generates the t shares using a second key and calculates n-t shares from the t shares and the second secret information using the first secret information according to claim 1 as a variable of a sharing formula.

14. The asymmetric secret sharing program according to claim 11, wherein the first concealment unit comprises the generation unit and calculation unit according to claim 1, and generates the t shares and calculates n-t shares from the t shares and the first secret information, thereby concealing the true random number as the first secret information; and the second concealment unit uses the true random number as a second key for generating pseudo-random numbers, generates t shares, and calculates n-t shares from the t shares and secret information.

15. The asymmetric secret sharing program according to claim 11, wherein the first or second concealment unit obtains one or more true random numbers and conceals pseudo-random numbers generated from a key.

16. A secret information restoration program for causing a computer of the secret information restoration device in the system described in claim 1 to function as: a first restoration unit that restores first secret information; and a second restoration unit that uses the restored first secret information to restore the second secret information described in any one of claims 3 to 6.

17. A secret information recovery program for causing a computer of a secret information recovery device in a system in which one piece of secret information is distributed into n shares, where n is an integer greater than or equal to 2, k is an integer with a minimum value of 2 and a maximum value of n, and the secret information can be recovered by collecting k of the shares but cannot be recovered with k-1 or fewer shares, to function as a recovery unit that recovers the secret information by sequentially changing the combinations of t shares and n-t shares generated from the key defined in any one of claims 1, 3 to 5.

18. An asymmetric secret sharing program that causes a computer of an asymmetric secret sharing device in a system in which one secret is distributed into n shares, where n is an integer greater than or equal to 2 and k is an integer with a minimum value of 2 and a maximum value of n, and the secret can be restored by collecting k of the shares but not by collecting k-1 or fewer shares, to function as: a generation unit that generates t (<k) shares from a key; and a calculation unit that calculates n-t shares from the calculated t shares and the secret, wherein the asymmetric secret sharing device further comprises a true random number generation unit that generates true random numbers using a natural phenomenon that is not controllable by humans, and at least one of the t shares and the n-t shares is further calculated using the true random numbers.

Images