CN117155551A - Secret information sharing method, system, equipment and storage medium - Google Patents

Abstract

The invention discloses a secret information sharing method, system, equipment and storage medium, which are applied in the field of information security technology and solve the problem of low reliability and poor flexibility of the classic secret sharing scheme, including: converting the secret information into a Galois domain An element in is used as a secret element and forms a vector to be encoded with k -1 elements in the Galois field; based on the encoding rules of the generalized Reed Solomon code, the vector to be encoded is encoded through the identity information of n participating nodes, The encoding result including n elements is obtained and divided into n shares and sent to n participating nodes, so that r participating nodes use r shares for secret reconstruction. Applying the solution of the present invention can effectively deal with the malicious fraud of participating nodes in the secret reconstruction stage. It is information-theoretic security rather than security in the computational sense. There is no need for distribution nodes to participate in secret reconstruction, and there is no data expansion in the secret distribution process. Conducive to further ensuring security.

Description

A method, system, equipment and storage medium for sharing secret information

Technical field

The present invention relates to the field of information security technology, and in particular to a secret information sharing method, system, equipment and storage medium.

Background technique

With the continuous development of informatization, digitization, and intelligence, data leakage has become an increasingly serious problem. Cryptography provides many practical technologies to ensure data security, such as encryption and digital signatures. In the cryptographic system, due to the security requirements of the cryptographic algorithm itself and the popularization of cryptographic algorithm applications, the implementation details of the cryptographic algorithm are always public. Therefore, the security of commercial cryptography systems depends on the confidentiality of keys, and key management is an important research direction in the field of cryptography.

As shown in Figure 1, it is a schematic diagram of a commonly used key management method. Figure 1 is a threshold secret sharing scheme, which divides the key or other sensitive information into several shares, that is, divided into several parts, and then handed over to different safekeeping of the participants. The threshold secret sharing scheme requires that the secret can be recovered only when no less than a certain number of participants (threshold value k ) cooperate, and the secret cannot be recovered by participants less than the threshold value. The set of participants who can reconstruct the secret is called the authorized set, otherwise it is called the non-authorized set. All authorized sets constitute the access structure of the secret sharing scheme.

Figure 1 The effectiveness of this classic secret sharing technique relies on certain assumptions, that is, all participants are honest. However, this assumption is unreasonable in reality, because some participants may produce false shares during the secret reconstruction stage, causing honest participants to be unable to recover the secret or obtain wrong results, while fraudsters can take advantage of honest participation The secret is reconstructed from the attacker's share, thereby posing a major threat to the reliability of the system. In addition, in the current scheme, some anti-fraud methods are to construct a verifiable secret sharing scheme, such as using digital signatures to verify the participants' shares, introducing so-called shadow shares in addition to the shares, and so on. However, the security of this type of scheme relies on the difficulty of the discrete logarithm problem or the prime factorization problem, so it is security at the computational level and cannot resist quantum computing attacks with extremely large computing power.

To sum up, how to effectively realize the sharing of secret information and improve reliability is an urgent technical problem that those skilled in the art need to solve.

Contents of the invention

The purpose of the present invention is to provide a secret information sharing method, system, equipment and storage medium, so as to effectively realize the sharing of secret information and improve reliability.

In order to solve the above technical problems, the present invention provides the following technical solutions:

A method of sharing secret information, including:

According to the set conversion rules, the secret information is converted into an element in the set Galois domain as a secret element;

Select n different elements from the set Galois field as the public identity information of n participating nodes;

Select k -1 elements from the Galois field, and together with the secret element form a vector to be encoded containing k elements;

Based on the encoding rules of the generalized Reed-Solomon code, the vector to be encoded is encoded through the identity information of n participating nodes to obtain an encoding result including n elements;

According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively, so that when r participating nodes use r shares for secret reconstruction, if r = k , then based on r The secret elements are reconstructed from the shares and the secret information corresponding to the secret elements is determined. If r > k and it is judged that there are false shares among the r shares, the false shares are corrected and then the secret information is reconstructed. a secret element and determining the secret information corresponding to said secret element;

Among them, n is a positive integer not less than 2, k is a positive integer indicating the minimum number of shares to achieve secret reconstruction, r is a positive integer, and when r < k , secret reconstruction cannot be achieved, and when r > k , false shares The number of corrections shall not exceed .

In one implementation, n different elements are selected from the set Galois field as the public identity information of n participating nodes, including:

n different elements are randomly selected from the set Galois field as the public identity information of n participating nodes.

In one implementation, n different elements are randomly selected from the set Galois field as the public identity information of n participating nodes, including:

N different elements are uniformly and randomly selected from the set Galois field as the public identity information of the n participating nodes.

In one implementation, k -1 elements are selected from the Galois field, and together with the secret element, a vector to be encoded containing k elements is formed, including

k -1 elements are uniformly and randomly selected from the Galois field, and together with the secret elements form a vector to be encoded containing k elements.

In one implementation, the encoding rule based on the generalized Reed-Solomon code encodes the vector to be encoded through the identity information of n participating nodes to obtain an encoding result including n elements, including:

Based on the encoding rules of the generalized Reed-Solomon code, a Vandermond matrix is established through the identity information of n participating nodes, and the vector to be encoded is encoded through the established Vandermond matrix to obtain an encoding result including n elements.

In one implementation, the encoding rule based on the generalized Reed-Solomon code establishes a Vandermond matrix through the identity information of n participating nodes, and encodes the vector to be encoded through the established Vandermond matrix to obtain: The encoding result of n elements includes:

Based on the coding rules of the generalized Reed-Solomon code, the identity information of n participating nodes is used to encode the vector to be encoded according to the calculation method of ( s ₁ ,..., s _n ) = a · G , and the result includes: Encoding result of n elements;

Where, a is the vector to be encoded containing k elements, G is a Vandermond matrix established through the identity information of n participating nodes, and , s ₁ to s _n are the obtained encoding results including n elements, /> to/> is the identity information of each of the n participating nodes.

In one embodiment, it also includes:

When a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules, so that the newly added participating node gets an additional share.

In one implementation, when a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules, so that the newly added participating node gets 1 new shares, including:

When a new participating node needs to be added, the r participating nodes among the current n participating nodes will calculate their respective intermediate values;

Among them, the intermediate value calculated by the i- th participating node among the r participating nodes Expressed as , s _i is the share of the i- th participating node, m _i is the i- th row vector of the first k -column submatrix of M ^-1 , matrix /> , M ^-1 is the inverse matrix of M , /> ,/> to is the identity information of each of the n participating nodes,/> is the identity information of the newly added participating nodes, T is the symbol of the transposed matrix, r ≥ k ;

Based on the preset secure information sending method, the newly added participating nodes determine to/> The total of , and the sum will be used as 1 new share obtained by the newly added participating nodes, and the newly added participating nodes cannot be determined/> to/> any intermediate value in .

In one implementation, based on the preset secure information sending method, newly added participating nodes determine to/> The total of , and the sum will be used as 1 new share obtained by the newly added participating nodes, and the newly added participating nodes cannot be determined/> to/> Any intermediate value in , including:

For each participating node among r participating nodes, the participating node divides the intermediate value calculated by itself into r data, so that the sum of the divided r data is equal to the intermediate value calculated by itself, and the participating node is in After retaining 1 piece of r data, the remaining r- 1 data are sent to the remaining r- 1 participating nodes;

For each participating node among r participating nodes, the participating node sums the retained 1 data with the received r- 1 data, and sends the summation result to the newly added participating node, so that The newly added participating node sums the sent data of r participating nodes and obtains to/> The sum will be regarded as one new share obtained by the newly added participating nodes.

In one embodiment, it also includes:

When a participating node needs to be removed, no less than k participating nodes among the current participating nodes will be operated according to the preset participating node removal rules, so that the remaining participating nodes except the removed participating node will be removed. Participating nodes each receive a new share to replace the original share.

In one embodiment, when one participating node needs to be removed, no less than k participating nodes among the current participating nodes operate according to the preset participating node removal rules, so that the removed participating nodes are removed. Each remaining participating node other than the node will receive a new share to replace the original share, including:

When one participating node needs to be removed, the r participating nodes among the current n participating nodes will calculate their respective sub-secret data based on their current shares;

Among them, the sub-secret data a _{i 0} calculated by the i- th participating node among the r participating nodes is expressed as , s _i is the share of the i- th participating node, M _{i 0} is/> Algebraic cofactors in M , matrices , det( M ) represents the determinant of M ,/> to/> is the identity information of each of the n participating nodes, r ≥ k ;

Based on r sub-secret data, r participating nodes operate according to the preset secure share generation method, so that each remaining participating node except the removed participating node gets a new share to replace the original share. , and makes it impossible for any participating node to obtain the sub-secret data of any other participating node.

In one implementation, based on r sub-secret data, r participating nodes operate according to a preset safe generation method of shares, so that each remaining participating node except the removed participating node gets 1 The new share replaces the original share and makes it impossible for any participating node to obtain the sub-secret data of any other participating node, including:

For each participating node among the r participating nodes, the participating node calculates n -1 sub-share values through the sub-secret data calculated by itself and the first polynomial constructed by itself, and calculates the calculated n -1 sub-share value is allocated to the n -1 remaining participating nodes, including itself, excluding the removed participating nodes;

For the remaining n -1 participating nodes except the removed participating nodes, after obtaining the r sub-share values, the participating node sums up the r sub-share values it obtained as its own new share to replace its own original share;

Wherein, the first polynomial constructed by the i- th participating node among the r participating nodes is expressed as , t is a positive integer and 1≤ t ≤ k -1, a _{i 1} to a _{i ( k -1)} are the k -1 elements selected by the i- th participating node from the Galois field; the i-th The participating nodes are calculated sequentially by taking the value of the independent variable x of the constructed first polynomial to the identity information of the remaining n -1 participating nodes excluding the removed participating nodes. Output n -1 sub-share values.

In one embodiment, it also includes:

When it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, no less than k participating nodes among the current participating nodes will operate according to the preset threshold adjustment rules, so that each current participating node gets 1 The new shares replace the original shares, and the minimum number of shares to achieve secret reconstruction is adjusted from k to ;

Indicates the minimum number of shares required to achieve secret reconstruction after adjustment.

In one implementation, when it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, no less than k participating nodes among the current participating nodes operate according to the preset threshold adjustment rules, so that the current Each participating node gets a new share to replace the original share, and the minimum number of shares to achieve secret reconstruction is adjusted from k to ,include:

When it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, the r participating nodes among the current n participating nodes will calculate their respective sub-secret data based on their current shares;

Among them, the sub-secret data a _{i 0} calculated by the i- th participating node among the r participating nodes is expressed as: , s _i is the share of the i- th participating node, M _{i 0} is/> Algebraic cofactors in M , matrices , det( M ) represents the determinant of M ,/> to/> is the identity information of each of the n participating nodes, r ≥ k ;

Based on r sub-secret data, r participating nodes operate according to the preset threshold adjustment method, so that each participating node gets a new share to replace the original share, and no participating node can obtain any other The child secret data of participating nodes, and the minimum number of shares to achieve secret reconstruction is adjusted from k to .

In one implementation, based on r sub-secret data, r participating nodes operate according to a preset threshold adjustment method, so that each participating node obtains a new share to replace the original share, and any participating node The node cannot obtain the sub-secret data of any other participating node, and the minimum number of shares to achieve secret reconstruction is adjusted from k to ,include:

For each participating node among the r participating nodes, the participating node calculates the n sub-share values through the sub-secret data calculated by itself and the second polynomial constructed by itself, and uses the calculated n sub-shares Values are assigned to n participating nodes including itself;

For each participating node among the n participating nodes, after obtaining the r sub-share values, the participating node sums up the r sub-share values it obtained as its own new share to replace its original share;

Wherein, the second polynomial constructed by the i- th participating node among the r participating nodes is expressed as , c is a positive integer and/> , a _{i 1} to/> Selected from the Galois field for the i- th participating node/> elements; the i -th participating node sequentially calculates n sub-share values by taking the values of the independent variable x of the constructed second polynomial as the identity information of the current n participating nodes.

In one implementation, the encoding result is divided into n shares according to different element positions and sent to n participating nodes respectively, so that when r participating nodes use r shares to perform secret reconstruction , if r = k , reconstruct the secret element based on r shares and determine the secret information corresponding to the secret element. If r > k and it is determined that there are false shares among the r shares, perform false shares After correction, the secret element is reconstructed, and the secret information corresponding to the secret element is determined, including:

According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively, so that when r participating nodes use r shares for secret reconstruction, if r = k , then based on r The secret elements are reconstructed from the shares and the secret information corresponding to the secret elements is determined. If r > k , it is judged whether s · H ^T =0 is established. If it is not established, it is judged that there is falsehood in r shares. When a share is obtained, the secret element is reconstructed after correcting the false share, and the secret information corresponding to the secret element is determined;

Among them, H is a ( r - k ) × r- order full-rank matrix that satisfies M _k H ^T =0, M _k is a submatrix composed of the first k rows of matrix M , T is the transpose matrix symbol, and the matrix ,/> to/> is the identity information of each of the n participating nodes,/> , s ₁ to s _r represent the respective shares of the r participating nodes that perform secret reconstruction.

In one embodiment, it also includes:

When r participating nodes use r shares for secret reconstruction, and when it is determined that there are false shares among the r shares, if the number of false shares does not exceed , r participating nodes all determine the identity information of the participating nodes corresponding to each false share.

In one implementation, if r = k , reconstruct the secret element based on r shares and determine the secret information corresponding to the secret element, including:

If r = k , then based on r shares, calculate The secret element is reconstructed and the secret information corresponding to the secret element is determined.

In one embodiment, it also includes:

When r participating nodes use r shares to perform secret reconstruction and r = k , after reconstructing the secret element based on r shares, all r participating nodes output the reconstructed secret element, which may cause security risks. prompt information.

A secret information sharing system, including: distribution node and n participating nodes;

The distribution node is used for:

According to the set conversion rules, the secret information is converted into an element in the set Galois domain as a secret element;

Select n different elements from the set Galois field as the public identity information of n participating nodes;

Select k -1 elements from the Galois field, and together with the secret element form a vector to be encoded containing k elements;

Based on the encoding rules of the generalized Reed-Solomon code, the vector to be encoded is encoded through the identity information of n participating nodes to obtain an encoding result including n elements;

According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively;

The participating nodes are used for:

When r participating nodes use r shares to reconstruct the secret, if r = k , the secret element is reconstructed based on r shares. If r > k and it is judged that there are false shares among the r shares, proceed Correction of false shares followed by reconstruction of said secret elements;

Based on the reconstructed secret elements, determine the corresponding secret information;

Among them, n is a positive integer not less than 2, k is a positive integer indicating the minimum number of shares to achieve secret reconstruction, r is a positive integer and when r < k , secret reconstruction cannot be achieved, and when r > k , false shares are corrected. The quantity does not exceed .

A device for sharing secret information, including:

Memory, used to store computer programs;

A processor, configured to execute the computer program to implement the steps of the secret information sharing method described above.

A computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the steps of the secret information sharing method as described above are implemented.

The beneficial effect of applying the technical solutions provided by the embodiments of the present invention is that the solution of the present invention is based on the generalized Reed-Solomon code to realize the sharing of secret information, and can effectively deal with the situation where fraudsters provide false shares. Moreover, the security of the solution of the present invention does not depend on any assumption of computational difficulty, that is, the solution of the present invention is information-theoretic security rather than security in the computational sense of the classical solution. Therefore, the solution of the present invention can resist quantum computing attacks. In addition, after secret distribution, the solution of the present invention does not require the participation of distribution nodes in subsequent stages including secret reconstruction, which is conducive to further improving flexibility and reliability. The shares saved by the participating nodes have the same length as the secret elements, so that there is no data expansion in the secret distribution process of the solution of the present invention, and it is also conducive to further ensuring security.

Specifically, in order to be able to implement subsequent coding based on the generalized Reed-Solomon code, in the solution of the present invention, the distribution node converts the secret information into an element in the set Galois field as the secret according to the conversion rules set as needed. element, the secret element can be combined with the k -1 elements selected from the Galois field to form a vector to be encoded containing k elements, that is, the vector to be encoded carries the secret element. For n participating nodes, n different elements need to be selected from the set Galois field as the public identity information of the n participating nodes. Based on the encoding rules of the generalized Reed-Solomon code, the to-be-encoded vector is encoded through the identity information of n participating nodes, and the encoding result including n elements is obtained. The encoding result includes n elements, each element is regarded as a share, so that the encoding result can be divided into n shares and handed over to n participating nodes for safekeeping. Based on the principle of generalized Reed-Solomon code, when r participating nodes use r shares to reconstruct the secret, if r = k , the secret element can be reconstructed based on the r shares and the secret information corresponding to the secret element can be determined , of course, the accuracy of the reconstruction cannot be guaranteed at this time, that is, when r = k , all r participating nodes are required to be honest participating nodes to reconstruct the correct secret element, so as to determine the secret corresponding to the secret element according to the conversion rules. information. When r > k , the solution of the present invention can determine whether there are false shares among the r shares. If there are false shares, the number can be corrected to not exceed After correcting the false shares, the secret elements can be reconstructed and the secret information corresponding to the secret elements can be determined;

It can be seen that the solution of the present invention can determine whether there are false shares among r shares, and can correct the number not exceeding false shares, that is, the solution of the present invention can effectively deal with the situation where fraudsters provide false shares. And when r is less than k , no matter how high the computing resources of the attacker are, the secret reconstruction cannot be achieved. That is, the security of the scheme of the present invention does not depend on the assumption of any computational difficulty, which is information theoretic security rather than the classical scheme calculation sense. The security makes the solution of the present invention resistant to quantum computing attacks. In addition, it can be seen that in the solution of the present invention, the distribution node only needs to complete the distribution of shares. When performing operations in subsequent stages including secret reconstruction, the solution of the present invention does not require the participation of the distribution node. Helps further improve reliability. The shares and secret elements saved by the participating nodes are elements in the Galois domain and have the same length, so that there is no data expansion in the secret distribution process of the solution of the present invention, and it is also conducive to further ensuring security.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 is a schematic diagram of a currently commonly used key management method;

Figure 2 is an implementation flow chart of a secret information sharing method in the present invention;

Figure 3 is a schematic structural diagram of a secret information sharing system in the present invention;

Figure 4 is a schematic structural diagram of a secret information sharing device in the present invention;

Figure 5 is a schematic structural diagram of a computer-readable storage medium in the present invention.

Detailed ways

The core of the present invention is to provide a secret information sharing method, system, equipment and storage medium, which can effectively deal with the situation where false shares exist. It is information-theoretic security rather than security in the computational sense. The implementation of subsequent stages of secret distribution does not require Distribution nodes participate, and there is no data expansion in the secret distribution process, which is conducive to further ensuring security.

In order to enable those skilled in the art to better understand the solution of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

Please refer to Figure 2. Figure 2 is an implementation flow chart of a secret information sharing method in the present invention. The secret information sharing method may include the following steps:

Step S101: Convert the secret information into an element in the set Galois field as a secret element according to the set conversion rules.

The distribution node can also be called the distribution center, which can realize the distribution of secrets, that is, it can generate each share of the secret and send it to each participating node. The participating nodes can also be called participants, can receive the corresponding shares, and can be sent by no less than k Participating nodes realize secret reconstruction.

The secret information represents the information to be encrypted, and it can be understood that the secret information can be in many specific forms, for example, it can be a piece of text, a string of numbers, or a key including letters and symbols. This document In the invented scheme, subsequent encoding is based on the encoding rules of the generalized Reed-Solomon code. Therefore, the secret information needs to be converted into an element in the Galois field so that subsequent steps can be based on the generalized Reed-Solomon code. The encoding rules of Reed-Solomon code implement encoding.

The specific content of the conversion rules can be set and adjusted according to actual needs. As long as the secret information can be converted into an element in the set Galois domain according to the set conversion rules, the converted element is called as a secret element. For example, in one situation, the secret information is a key including letters and symbols, and the conversion rules stipulate that different letters and symbols will be converted into corresponding fixed-bit binary values, and then based on the obtained each Binary value, mapped to an element in the set Galois field. In addition, it can be understood that the conversion rules need to be saved so that the conversion process is reversible, that is, when performing secret reconstruction, the participating nodes can reversely determine the secret information according to the conversion rules after obtaining the secret elements. , for example, in practical applications, the conversion rules can be publicly saved by the distribution node, or, for example, each participating node saves the conversion rules.

The Galois field can also be called a finite field. In the following, the Galois field is expressed as , the specific parameter settings of the Galois domain can be set and adjusted according to actual needs.

Step S102: Select n different elements from the set Galois field as the public identity information of n participating nodes.

In the secret distribution stage, the distribution node can perform the operations from step S101 to step S105, thereby dividing n shares and sending them to n participating nodes respectively. That is to say, when performing step S102, the distribution node can select n different elements from the set Galois field as the public identity information of the n participating nodes.

In a specific implementation of the present invention, step S102 may include: randomly selecting n different elements from the set Galois field as the public identity information of the n participating nodes.

This implementation mode takes into account that the present invention is not limited to the public identity information of n participating nodes, as long as it is n mutually different elements in the set Galois field. In this regard, this kind of In the implementation, n different elements are randomly selected from the Galois field. The random selection method is more convenient in implementation.

Further, in one implementation, step S102 may include: uniformly and randomly selecting n different elements from the set Galois field as the public identity information of the n participating nodes.

This implementation method takes into account that when each element in the Galois field is selected as identity information, ideally, the selection probability should be consistent, that is, when randomly selected, each element in the Galois field is equal to have the same probability of being selected as the identity information of the corresponding participating nodes. Therefore, in this implementation, n different elements are uniformly and randomly selected from the set Galois field as n participating nodes. publicly identifiable information.

The uniform randomness described in this implementation means that when randomly selected, each element in the Galois field has the same probability of being selected, which can be expressed as ,/> to/> That’s from the Galava Realm/> n different elements uniformly and randomly selected from , that is,/> to/> is the identity information of each of the n participating nodes, or the ID of each of the n participating nodes. The same symbols appearing in the following text also represent the uniform random selection method.

Step S103: Select k -1 elements from the Galois field, and together with the secret element form a vector to be encoded containing k elements.

In the same way as above, when selecting k -1 elements from the Galois field, random selection can be used to facilitate implementation. Moreover, when k -1 elements are selected from the Galois field, ideally, the selection probabilities of each element should also be consistent. Therefore, in a specific implementation of the present invention, step S103 may specifically include :

k -1 elements are uniformly and randomly selected from the Galois field, and together with the secret elements form a vector to be encoded containing k elements.

The uniform randomness described in this implementation means that when randomly selected, each element in the Galois field has the same probability of being selected. Therefore, when performing step S103 using this implementation, the distribution node will uniformly and randomly select from the Galois field. Select k -1 elements from the Luohua domain, which can be expressed as , that is, the selected k -1 elements are recorded as a ₁ to a _{k -1} in sequence.

After k -1 elements are selected from the Galois field, together with the secret elements obtained in step S101, a vector to be encoded containing k elements is formed. For example, if the secret element is expressed as a ₀ , the vector to be encoded containing k elements can be expressed as a = ( a ₀ , a ₁ ,..., a _{k -1} ).

Step S104: Based on the encoding rules of the generalized Reed-Solomon code, encode the vector to be encoded using the identity information of n participating nodes to obtain an encoding result including n elements.

The vector to be encoded carries a secret element. In the solution of the present invention, the encoding is implemented based on the encoding rules of GRS (Generalized Reed-Solomon code), so that security at the information theory level can be achieved.

When encoding is implemented based on the encoding rules of the generalized Reed-Solomon code, encoding can usually be implemented based on the Vandermond matrix. Therefore, in a specific implementation of the present invention, step S104 may specifically include:

Based on the coding rules of the generalized Reed-Solomon code, a Vandermond matrix is established through the identity information of n participating nodes, and the to-be-encoded vector is encoded through the established Vandermond matrix to obtain a coding result including n elements.

In this implementation, the coding of the generalized Reed-Solomon code can be implemented conveniently and effectively based on the Vandermond matrix.

For example, in a specific implementation of the present invention, step S104 may specifically include:

Based on the encoding rules of the generalized Reed-Solomon code, the identity information of n participating nodes is used to encode the vector to be encoded according to the calculation method of ( s ₁ ,..., s _n ) = a · G , and the result includes n elements. the coding results;

Among them, a is a vector to be encoded containing k elements, G is a Vandermond matrix established through the identity information of n participating nodes, and , s ₁ to s _n are the obtained encoding results including n elements, /> to/> is the identity information of each of the n participating nodes.

In this implementation, the Vandermond matrix G is established through the identity information of n participating nodes. By multiplying the vector a to be encoded by the Vandermond matrix G , the encoding result including n elements can be determined conveniently and effectively, and we get The encoding result including n elements is expressed as ( s ₁ ,..., s _n ).

Step S105: Divide the encoding result into n shares according to different element positions and send them to n participating nodes respectively, so that when r participating nodes use r shares to perform secret reconstruction, if r = k , then based on r shares reconstruct the secret elements and determine the secret information corresponding to the secret elements. If r > k and it is determined that there are false shares among the r shares, correct the false shares and then reconstruct the secret elements and determine to produce a secret message corresponding to the secret element;

Among them, n is a positive integer not less than 2, k is a positive integer indicating the minimum number of shares to achieve secret reconstruction, r is a positive integer, and when r < k , secret reconstruction cannot be achieved, and when r > k , false shares The number of corrections shall not exceed .

After the distribution center performs the above-mentioned operations from step S101 to step S104, it can obtain the encoding result ( s ₁ ,..., s _n ) including n elements. Then the shares can be distributed.

When distributing shares, the coding result is divided into n shares according to the different positions of the elements. That is to say, for the n elements in the coding result, each element is regarded as 1 share, so n can be divided into Shares, and each n shares need to be sent to the corresponding 1 participating node, for example, the first share s ₁ is sent to the first participating node, and the second share s ₂ is sent to the second participating node, so as to And so on. After distribution, each participating node among the n participating nodes must receive 1 share.

In addition, it can be understood that in practical applications, when the encoding result is divided into n shares and sent to n participating nodes respectively, in order to ensure communication security, the information transmission needs to be carried out in a secret manner, so that the first share s ₁ Send to the first participating node as an example. The distribution center can use encrypted communication to send the first share s ₁ to the first participating node, so that except for the first participating node, other participating nodes cannot get the first participating node. 1 share s ₁ . Similarly, in subsequent implementations, unless otherwise specified, information transmission between distribution nodes and participating nodes, as well as between different participating nodes, should be conducted in a confidential manner to ensure the security of information transmission.

In the solution of the present invention, after the distribution node divides the encoding result into n shares and sends them to n participating nodes respectively, the secret distribution work of the distribution node has been completed. For subsequent secret reconstruction, and in some embodiments Existing operations such as adding participating nodes, removing participating nodes, and adjusting threshold values do not require the participation of distribution nodes, which is conducive to further ensuring the security of the solution of the present invention. Therefore, in practical applications, the distribution node can delete all the stored relevant information after completing the secret distribution work.

It should also be noted that when the shares are distributed, the encoding result is divided into n shares according to the different positions of the elements. That is, the different shares and secret elements are all elements in the Galois field. In the computer, it can be The same size of space is used to realize the storage of elements in a single Galois field, that is, in the scheme of the present invention, the shares saved by the participating nodes have the same length as the secret elements, so that there is no data expansion in the secret distribution process of the scheme of the present invention. It is also helpful to further ensure security.

After encoding and dividing the shares as described above, if the secret reconstruction is to be realized, the number of participating nodes participating in the secret reconstruction cannot be less than k . k is a positive integer, which represents the minimum number of nodes to realize the secret reconstruction. The number of shares can also be called the threshold value.

That is to say, when r participating nodes use r shares to perform secret reconstruction, r ≥ k is required to achieve secret reconstruction. If r = k , there is no error correction capability at this time. That is to say, at this time, only r participating nodes are honest and no false shares are provided. The secret elements can be reconstructed based on r shares, and then follow the steps The conversion rules described in S101 determine the secret information corresponding to the secret element.

And if r > k , it can be determined whether there are false shares among r shares. At this time, no more than r - k false shares can be detected, and the false shares can be corrected first, and then the secret can be reconstructed after correction element, and then determine the secret information corresponding to the secret element according to the conversion rule described in step S101. When correcting false shares, the correction amount of false shares shall not exceed .

In the classic secret sharing technology, after the secret distribution phase is completed, the access structure that the system can achieve is also fixed. However, during the period from secret distribution to secret reconstruction, the set of participants or the threshold for secret reconstruction may change. For example, if a participant leaves or loses his shares, it will pose a major threat to the security of the entire system. The reason for this problem is that the classic secret sharing technology is designed for a fixed access structure and cannot adapt to changes in the access structure, that is, it does not have "dynamic" properties.

In the solution of the present invention, the addition of participating nodes, the removal of participating nodes and the dynamic adjustment of threshold values can be supported without the participation of distribution nodes.

In a specific implementation of the present invention, it may also include:

When a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules, so that the newly added participating node gets an additional share.

In this implementation, if a new participating node needs to be added, no less than k participating nodes can operate according to the preset share adding rules, so that a new shared share can be obtained as a newly added participating node. Node share, so this implementation effectively achieves an increase in share.

The preset new share rules can be set according to actual needs in combination with the encoding rules of the generalized Reed-Solomon code. For example, the Clem's rule for solving a system of equations can be used to perform distributed calculations and finally obtain a new increase share.

In a specific implementation of the present invention, when a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules, so that the newly added Participating nodes get 1 new share, which can specifically include:

Step 1: When a new participating node needs to be added, the r participating nodes among the current n participating nodes calculate their respective intermediate values;

Among them, the intermediate value calculated by the i- th participating node among the r participating nodes Expressed as , s _i is the share of the i- th participating node, m _i is the i- th row vector of the first k -column submatrix of M ^-1 , matrix /> , M ^-1 is the inverse matrix of M , /> ,/> to/> is the identity information of each of the n participating nodes,/> is the identity information of the newly added participating nodes, T is the symbol of the transposed matrix, r ≥ k ;

Step 2: Based on the preset information security sending method, the newly added participating nodes are determined to/> The sum of , and the sum will be used as 1 new share obtained by the newly added participating nodes, and the newly added participating nodes cannot be determined/> to/> any intermediate value in .

In this implementation mode, a specific implementation is provided to operate according to the preset share addition rules so that newly added participating nodes obtain one new share.

Before adding this 1 participating node, there were n participating nodes, that is, the newly added participating node is the n +1th participating node, and the identity information of the newly added participating node is expressed as . Understandably, with/> to/> In the same way, for the identity information of newly added participating nodes/> , which is also an element selected from the set Galois field, and with/> to/> All are different.

In this implementation, the r participating nodes that perform intermediate value calculations may be any r participating nodes among the current n participating nodes. For these r participating nodes, each participating node will calculate an intermediate value based on its own saved share and use Clem's rule to solve the system of equations, thereby achieving the purpose of distributed computing of the present invention.

Taking the i- th participating node among r participating nodes as an example, the intermediate value calculated by the i- th participating node Expressed as/> , s _i is the share of the i- th participating node, m _i is the i- th row vector of the first k- column submatrix of M ^-1 , /> , it can be seen that for the i -th participating node, s _i , m _i and/> All are known.

Each of the r participating nodes can calculate a corresponding intermediate value, so a total of r intermediate values will be obtained. The sum of these r intermediate values is the new share obtained by the newly added participating nodes.

And it should be noted that for the r participating nodes, it is based on the preset information security sending method, so that the newly added participating nodes can determine to/> The sum of , but it is impossible to determine/> to/> any value in . This is because if r participating nodes directly // to/> Sent to the newly added participating node, the participating node can then be based on/> to/> The corresponding s ₁ to s _r are determined, causing the newly added participating node to obtain multiple shares, causing great security risks.

The specific rules based on the preset information security transmission method can be set and adjusted according to actual needs, as long as the purpose of the present invention can be achieved, that is, the newly added participating nodes can determine to/> The total of , but it is impossible to determine/> to/> any intermediate value in .

In a specific implementation of the present invention, the above step two may specifically include:

For each participating node among r participating nodes, the participating node divides the intermediate value calculated by itself into r data, so that the sum of the divided r data is equal to the intermediate value calculated by itself, and the participating node is in After retaining 1 piece of r data, the remaining r- 1 data are sent to the remaining r- 1 participating nodes;

For each participating node among r participating nodes, the participating node sums the retained 1 data with the received r- 1 data, and sends the summation result to the newly added participating node, so that The newly added participating node sums the sent data of r participating nodes and obtains to/> The total of , and the total is used as 1 new share obtained by the newly added participating nodes.

In this implementation, for each participating node among the r participating nodes, the participating node divides the intermediate value calculated by itself into r pieces of data, so that the sum of the divided r pieces of data is equal to the intermediate value calculated by itself. , which can be easily implemented in the Galois domain.

Taking the i- th participating node among r participating nodes as an example, the intermediate value calculated by the i- th participating node is , then, the i -th participating node needs to select r pieces of data from the Galois field:/> , need to satisfy . For the selected/> to/> For this r data, the i -th participating node needs to retain 1 of the r data, and send the remaining r- 1 data to the remaining r- 1 participating nodes.

That is to say, counting the 1 data retained by itself and the r- 1 data sent by the remaining r- 1 participating nodes, each of the r participating nodes can get r data and will Send the summation result of these r data to the newly added participating nodes.

It can be seen that the newly added participating node can receive a total of r summation results sent by r participating nodes. These r summation results are summed to obtain the sum. to/> The total is regarded as one new share obtained by the newly added participating nodes. And it can be seen that since in this implementation mode/> to/> It was split and then summarized, making it impossible to determine the newly added participating nodes/> to/> any intermediate value in .

In addition, it should be pointed out that in the above, there are currently n participating nodes as an example, that is, the new participating node is the n+ 1th participating node. In actual applications, one or more participating nodes can be further added. Node, each time a participating node is added, the principle is the same as above. Similarly, in the following article, we will also take the current n participating nodes as an example to explain the removal of the nth participating node. In actual applications, one or more participating nodes can be further removed. The principle is the same. .

In a specific implementation of the present invention, it may also include:

When a participating node needs to be removed, no less than k participating nodes among the current participating nodes will be operated according to the preset participating node removal rules, so that the remaining participating nodes except the removed participating node will be removed. Participating nodes each receive a new share to replace the original share.

As described above, in the classic secret sharing technology, after the secret distribution phase is over, the access structure that the system can achieve is also fixed, and it cannot adapt to changes in the access structure, that is, it does not have "dynamic" properties. . In the solution of the present invention, the addition of participating nodes, the removal of participating nodes and the dynamic adjustment of threshold values can be supported, without the participation of distribution nodes.

In this implementation, if one participating node needs to be removed, no less than k participating nodes can operate according to the preset participating node removal rules, so that the remaining participating nodes except the removed participating nodes can Each participating node can obtain a new share to replace the old invalid share, so this implementation method effectively realizes the removal of participating nodes.

The preset participating node removal rules can be set according to actual needs in combination with the encoding rules of the generalized Reed-Solomon code. For example, the Clem's rule for solving a system of equations can be used to perform distributed calculations, and finally the current residual Each participating node is configured with a new share.

In a specific implementation of the present invention, when one participating node needs to be removed, no less than k participating nodes among the current participating nodes operate according to the preset participating node removal rules, so that the removed Each remaining participating node except the removed participating nodes will receive a new share to replace the original share, which can specifically include:

The first step: When one participating node needs to be removed, the r participating nodes among the current n participating nodes will calculate their respective sub-secret data based on their current shares;

Among them, the sub-secret data a _{i 0} calculated by the i- th participating node among the r participating nodes is expressed as , s _i is the share of the i- th participating node, M _{i 0} is/> Algebraic cofactors in M , matrices , det( M ) represents the determinant of M ,/> to/> is the identity information of each of the n participating nodes, r ≥ k ;

The second step: Based on r sub-secret data, r participating nodes operate according to the preset secure share generation method, so that all remaining participating nodes except the removed participating nodes receive a new share. to replace the original share and make it impossible for any participating node to obtain the sub-secret data of any other participating node.

In this implementation mode, a specific implementation is provided to operate according to the preset participating node removal rules and complete the removal of participating nodes.

In this implementation manner, before this one participating node is removed, there are n participating nodes. For example, the participating node that needs to be removed is the nth participating node.

In this implementation, the r participating nodes that perform calculation of sub-secret data can be any r participating nodes among the current n participating nodes. Of course, the r participating nodes will not include participating nodes to be removed. . For these r participating nodes, each participating node will calculate a sub-secret data based on its own saved share, thereby achieving the purpose of distributed computing of the present invention.

Taking the i- th participating node among r participating nodes as an example, the sub-secret data a _{i 0} calculated by the i -th participating node is expressed as , it can be seen that for the i -th participating node, s _i , Mi ₀ and det ( M ) are all known.

Each r participating node can calculate a corresponding sub-secret data based on its own share, so a total of r sub-secret data will be obtained. Based on these r sub-secret data, the r participating nodes will generate it safely according to the preset share method. Carry out operations so that all remaining participating nodes except the removed participating node can obtain a new share to replace the original share, and make it impossible for any participating node to obtain the sub-secret of any other participating node. data.

It should be noted that in this implementation, for the r participating nodes, the operation is performed according to the preset safe generation method of shares, which not only achieves the goal of all remaining participating nodes except the removed participating nodes. The purpose of creating a new share also makes it impossible for any participating node to obtain the sub-secret data of any other participating node. This is taken into account that if in the process of obtaining each new share, a participating node obtains the sub-secret data of other participating nodes, it can determine the share of the corresponding participating node or sum the r sub-secret data accordingly. Obtaining secret elements will cause great security risks.

The specific rules of the preset safe share generation method can be set and adjusted according to actual needs, as long as the purpose of the present invention can be achieved, that is, to ensure that all remaining participating nodes except the removed participating nodes are A new share is obtained to replace the original share, and at the same time, any participating node cannot obtain the sub-secret data of any other participating node.

In a specific implementation of the present invention, the above second step may specifically include:

For each participating node among the r participating nodes, the participating node calculates n -1 sub-share values through the sub-secret data calculated by itself and the first polynomial constructed by itself, and calculates the calculated n -1 sub-share value is allocated to the n -1 remaining participating nodes, including itself, excluding the removed participating nodes;

For the remaining n -1 participating nodes except the removed participating nodes, after obtaining the r sub-share values, the participating node sums up the r sub-share values it obtained as its own new share to replace its own original share;

Among them, the first polynomial constructed by the i- th participating node among the r participating nodes is expressed as , t is a positive integer and 1≤ t ≤ k -1, a _{i 1} to a _{i ( k -1)} are the k -1 elements selected from the Galois field by the i -th participating node; the i -th participating node The node calculates n -1 in sequence by taking the value of the independent variable x of the constructed first polynomial to the identity information of the remaining n -1 participating nodes excluding the removed participating nodes. sub-share value.

In this implementation, for each participating node among the r participating nodes, the participating node uses the first polynomial to represent the sub-secret data calculated by itself. This can be conveniently done in the Galois field. Implemented without exposing self-computed sub-secret data.

Taking the i- th participating node among r participating nodes as an example, the sub-secret data calculated by the i -th participating node is a _{i 0} , and k -1 elements need to be selected from the Galois field: , it can be seen that a _{i 1} to a _{i ( k -1)} here represent the k -1 elements uniformly and randomly selected by the i- th participating node from the Galois field, a _{i 1} to a The k -1 elements of _{i ( k -1)} are used as coefficients of the first polynomial constructed by the i- th participating node. That is, the first polynomial constructed by the i- th participating node is expressed as/> . In addition, it can be understood that for different participating nodes, the coefficients in the constructed first polynomial may be different.

After the i- th participating node constructs its own first polynomial, the value of the independent variable x of the first polynomial will be successively taken as the remaining n -1 values excluding the removed participating node. The identity information of the participating nodes is used to calculate n -1 sub-share values in sequence. For example to/> is the identity information of each of the n participating nodes, and the nth participating node is the removed participating node, then the value of x is/> to/> , the i -th participating node can calculate the n -1 sub-share values, and then distribute the calculated n -1 sub-share values to the n -1 remaining participating nodes including itself, that is, in this example The calculated n -1 sub-share values are allocated to the first participating node to the n -1 participating node respectively.

It can be seen that for the remaining n -1 participating nodes except the removed participating nodes, each participating node can obtain the r sub-share value. After obtaining it, the r sub-share value obtained by itself will be By summing the values, one's new share is determined. The one's original share is now invalid and can be deleted. And it can be seen that since the first polynomial is used in this implementation, the sub-secret data will not be directly exposed, so that no participating node can obtain the sub-secret data of any other participating node.

In a specific implementation of the present invention, it may also include:

When it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, no less than k participating nodes among the current participating nodes will operate according to the preset threshold adjustment rules, so that each current participating node gets 1 The new shares replace the original shares, and the minimum number of shares to achieve secret reconstruction is adjusted from k to . Understandably,/> Indicates the minimum number of shares required to achieve secret reconstruction after adjustment.

In the solution of the present invention, the addition of participating nodes, the removal of participating nodes and the dynamic adjustment of threshold values can be supported, without the participation of distribution nodes.

In this implementation, if it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, that is, if the threshold value needs to be adjusted, no less than k participating nodes can operate according to the preset threshold adjustment rules, so that Each current participating node gets a new share to replace the original share, and the minimum number of shares to achieve secret reconstruction is adjusted from k to , so this implementation effectively realizes the adjustment of the threshold value.

The preset threshold adjustment rules can be set according to actual needs in combination with the encoding rules of the generalized Reed-Solomon code. For example, the Clem's rule for solving a system of equations can be used to perform distributed calculations to adjust the threshold value. .

In a specific implementation of the present invention, when it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, no less than k participating nodes among the current participating nodes will operate according to the preset threshold adjustment rules. So that each current participating node gets a new share to replace the original share, and the minimum number of shares to achieve secret reconstruction is adjusted from k to , which can include:

When it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, the r participating nodes among the current n participating nodes will calculate their respective sub-secret data based on their current shares;

Among them, the sub-secret data a _{i 0} calculated by the i- th participating node among the r participating nodes is expressed as: , s _i is the share of the i- th participating node, M _{i 0} is/> Algebraic cofactors in M , matrices/> , det( M ) represents the determinant of M ,/> to/> is the identity information of each of the n participating nodes, r ≥ k ;

Based on r sub-secret data, r participating nodes operate according to the preset threshold adjustment method, so that each participating node gets a new share to replace the original share, and no participating node can obtain any other The child secret data of participating nodes, and the minimum number of shares to achieve secret reconstruction is adjusted from k to .

In this implementation manner, a specific implementation is provided to operate according to the preset threshold adjustment rules and complete the adjustment of the participation threshold value.

In this implementation, the r participating nodes that complete the threshold value adjustment can be any r participating nodes among the current n participating nodes. For these r participating nodes, each participating node will calculate a corresponding sub-secret data based on its own saved share, thus achieving the purpose of distributed computing of the present invention.

Taking the i- th participating node among r participating nodes as an example, the sub-secret data a _{i 0} calculated by the i -th participating node is expressed as , please refer to the above description and will not repeat the description here.

Each r participating node can calculate 1 sub-secret data based on its own share, so a total of r sub-secret data will be obtained. Based on this r sub-secret data, the r participating nodes operate according to the preset threshold adjustment method to This allows each participating node among the n participating nodes to obtain a new share to replace the original share, and makes it impossible for any participating node to obtain the sub-secret data of any other participating node, and makes it possible to achieve secret reconstruction. The minimum number of shares is adjusted from k to .

It should be noted that in this implementation, the r participating nodes are operated according to the preset threshold adjustment method, which not only achieves the purpose of threshold value adjustment, but also makes it impossible for any participating node to obtain any other The child secret data of a participating node. This is because during the threshold adjustment process, if a participating node obtains the sub-secret data of other participating nodes, it can determine the share of the corresponding participating nodes based on this, causing a huge security risk.

The specific rules of the preset threshold adjustment method can be set and adjusted according to actual needs, as long as the purpose of the present invention can be achieved, that is, not only the adjustment of the threshold value must be realized, but at the same time, any participating node cannot obtain the The child secret data of any other participating node.

In a specific implementation of the present invention, based on r sub-secret data, r participating nodes operate according to a preset threshold adjustment method, so that each participating node obtains a new share to replace the original share, and This makes it impossible for any participating node to obtain the sub-secret data of any other participating node, and the minimum number of shares to achieve secret reconstruction is adjusted from k to , which can specifically include:

For each participating node among the r participating nodes, the participating node calculates the n sub-share values through the sub-secret data calculated by itself and the second polynomial constructed by itself, and uses the calculated n sub-shares Values are assigned to n participating nodes including itself;

For each participating node among the n participating nodes, after obtaining the r sub-share values, the participating node sums up the r sub-share values it obtained as its own new share to replace its original share;

Among them, the second polynomial constructed by the i- th participating node among the r participating nodes is expressed as , c is a positive integer and/> , a _{i 1} to/> Selected from the Galois field for the i- th participating node/> elements; the i -th participating node successively calculates n sub-share values by taking the value of the independent variable x of the constructed second polynomial as the identity information of the current n participating nodes.

In the same manner as the above implementation, in this implementation, for each participating node among the r participating nodes, the participating node uses a second polynomial to represent the sub-secret data calculated by itself, which is It can be easily implemented in the Galois field without exposing the sub-secret data calculated by itself.

Taking the i- th participating node among r participating nodes as an example, the sub-secret data calculated by the i -th participating node is a _{i 0} . Since the threshold value has been adjusted, that is, the value of k is adjusted to , therefore, the i -th participating node needs to be selected from the Galois field/> elements:/> , it can be seen that a _{i 1} to/> It represents that the i- th participating node is uniformly and randomly selected from the Galois field/> elements, a _{i 1} to/> This/> elements are used as coefficients of the second polynomial constructed by the i- th participating node. That is, the second polynomial constructed by the i- th participating node is expressed as/> . In addition, it can be understood that for different participating nodes, the coefficients in the constructed second polynomial may be different.

After the i- th participating node constructs its own second polynomial, the value of the independent variable x of the second polynomial will be taken as the identity information of the current n participating nodes, thereby calculating n sub- Share value. For example to is the identity information of each of the n participating nodes, then the value of x is/> to/> , the i -th participating node can calculate the n sub-share values, and then distribute the calculated n sub-share values to n participating nodes including itself.

It can be seen that for each of the n participating nodes, r sub-share values can be obtained. After obtaining the r sub-share values, the r sub-share values obtained by it are summed to determine its own new share and its original share. The share has expired at this time and can be deleted. It can be seen that since polynomials are used for packaging in this implementation, no participating node can obtain the sub-secret data of any other participating node.

In a specific implementation of the present invention, step S105 may specifically include:

According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively, so that when r participating nodes use r shares for secret reconstruction, if r = k , then based on r shares Reconstruct the secret element and determine the secret information corresponding to the secret element. If r > k , then judge whether s · H ^T =0 is true. If not, then judge that there are false shares among r shares. When performing false After the share is corrected, the secret element is reconstructed, and the secret information corresponding to the secret element is determined;

Among them, H is a ( r - k ) × r- order full-rank matrix that satisfies M _k H ^T =0, M _k is a submatrix composed of the first k rows of matrix M , T is the transpose matrix symbol, and the matrix ,/> to/> is the identity information of each of the n participating nodes,/> , s ₁ to s _r represent the respective shares of the r participating nodes that perform secret reconstruction.

As described above, when r participating nodes use r shares to perform secret reconstruction, r ≥ k is required to achieve secret reconstruction. If r > k , it can be determined whether there are false shares among r shares. At this time, no more than r - k false shares can be detected.

In this implementation, when r > k ^, it can be judged whether s · HT =0 is established to determine whether all r participating nodes are honest.

If s · H ^T =0 holds, it can be determined that no participating node provides false shares, so the secret element can be reconstructed directly based on r shares and the secret information corresponding to the secret element can be determined. If s · H ^T =0 does not hold, Then it is necessary to reconstruct the secret element after correcting the false shares, and determine the secret information corresponding to the secret element.

In a specific implementation of the present invention, it may also include:

When r participating nodes use r shares for secret reconstruction, and when it is determined that there are false shares among the r shares, if the number of false shares does not exceed , r participating nodes all determine the identity information of the participating nodes corresponding to each false share.

Based on the principle of generalized Reed-Solomon code, if r > k , if the number of false shares does not exceed r - k , it can be determined that there are false shares. And if the number of false shares does not exceed , it can not only determine whether there are false shares among the r shares, but also further determine which one or several shares are false shares. That is, in this implementation, it is possible to determine whether there are false shares among the r shares. shares, if the number of false shares does not exceed/> , r participating nodes can all determine the identity information of the participating nodes corresponding to each false share, that is, find the ID of the participating node that has increased the false share, and determine its identity. Furthermore, it is understandable that if the number of false shares exceeds But if it does not exceed r - k , it can only be judged that there is a false share, but the positioning of the false share cannot be achieved.

In a specific implementation of the present invention, if r = k , reconstruct the secret element based on r shares and determine the secret information corresponding to the secret element, including:

If r = k , then based on r shares, calculate The method reconstructs the secret elements and determines the secret information corresponding to the secret elements.

In this implementation, when realizing secret reconstruction based on r shares, it is calculated by The secret element is reconstructed in this way, which is relatively simple and convenient in calculation. For example, in the above example, the secret element is represented as a ₀ , and the vector to be encoded containing k elements is a = ( a ₀ , a ₁ ,..., a _{k -1} ), that is, the secret element a ₀ is to be encoded At the position of the first element of the encoding vector, calculate/> After that, the first component obtained is the secret element a ₀ .

In addition, it can be understood that when r > k and after correcting the false shares, it can also be calculated by way to reconstruct the secret elements.

In a specific implementation of the present invention, it may also include:

When r participating nodes use r shares to perform secret reconstruction and r = k , after reconstructing the secret element based on r shares, all r participating nodes output prompt information indicating that the reconstructed secret element has security risks.

As described above, correct secret reconstruction can also be achieved when r = k , but only if no participating nodes provide false shares. And when r = k , even if the secret is reconstructed, it cannot be determined whether any participating node provides false shares. Therefore, in this implementation, a prompt message indicating that the secret element has security risks will be output in this case. In order to remind all participating nodes to pay attention to this situation.

The beneficial effect of applying the technical solutions provided by the embodiments of the present invention is that the solution of the present invention is based on the generalized Reed-Solomon code to realize the sharing of secret information, and can effectively deal with the situation where fraudsters provide false shares. Moreover, the security of the solution of the present invention does not depend on any assumption of computational difficulty, that is, the solution of the present invention is information-theoretic security rather than security in the computational sense of the classical solution. Therefore, the solution of the present invention can resist quantum computing attacks. In addition, after secret distribution, the solution of the present invention does not require the participation of distribution nodes in subsequent stages including secret reconstruction, which is conducive to further improving flexibility and reliability. The shares saved by the participating nodes have the same length as the secret elements, so that there is no data expansion in the secret distribution process of the solution of the present invention, and it is also conducive to further ensuring security.

Specifically, in order to be able to implement subsequent coding based on the generalized Reed-Solomon code, in the solution of the present invention, the distribution node converts the secret information into an element in the set Galois field as the secret according to the conversion rules set as needed. element, the secret element can be combined with the k -1 elements selected from the Galois field to form a vector to be encoded containing k elements, that is, the vector to be encoded carries the secret element. For n participating nodes, n different elements need to be selected from the set Galois field as the public identity information of the n participating nodes. Based on the encoding rules of the generalized Reed-Solomon code, the to-be-encoded vector is encoded through the identity information of n participating nodes, and the encoding result including n elements is obtained. The encoding result includes n elements, each element is regarded as a share, so that the encoding result can be divided into n shares and handed over to n participating nodes for safekeeping. Based on the principle of generalized Reed-Solomon code, when r participating nodes use r shares to reconstruct the secret, if r = k , the secret element can be reconstructed based on the r shares and the secret information corresponding to the secret element can be determined , of course, the accuracy of the reconstruction cannot be guaranteed at this time, that is, when r = k , all r participating nodes are required to be honest participating nodes to reconstruct the correct secret element, so as to determine the secret corresponding to the secret element according to the conversion rules. information. When r > k , the solution of the present invention can determine whether there are false shares among the r shares. If there are false shares, the number can be corrected to not exceed After correcting the false shares, the secret elements can be reconstructed and the secret information corresponding to the secret elements can be determined;

It can be seen that the solution of the present invention can determine whether there are false shares among r shares, and can correct the number not exceeding false shares, that is, the solution of the present invention can effectively deal with the situation where fraudsters provide false shares. And when r is less than k , no matter how high the computing resources of the attacker are, the secret reconstruction cannot be achieved. That is, the security of the scheme of the present invention does not depend on the assumption of any computational difficulty, which is information theoretic security rather than the classical scheme calculation sense. The security makes the solution of the present invention resistant to quantum computing attacks. In addition, it can be seen that in the solution of the present invention, the distribution node only needs to complete the distribution of shares. When performing operations in subsequent stages including secret reconstruction, the solution of the present invention does not require the participation of the distribution node. Helps further improve reliability. The shares and secret elements saved by the participating nodes are elements in the Galois domain and have the same length, so that there is no data expansion in the secret distribution process of the solution of the present invention, and it is also conducive to further ensuring security.

Corresponding to the above method embodiments, embodiments of the present invention also provide a secret information sharing system, which can be mutually referenced with the above.

Referring to Figure 3, the secret information sharing system includes: a distribution node 31 and n participating nodes 32. Three participating nodes 32 are shown in FIG. 3 , which are called the first to third participating nodes in sequence.

The distribution node 31 is used for:

According to the set conversion rules, the secret information is converted into an element in the set Galois domain as a secret element;

Select n different elements from the set Galois field as the public identity information of n participating nodes;

Select k -1 elements from the Galois field, and together with the secret element form a vector to be encoded containing k elements;

Based on the encoding rules of the generalized Reed-Solomon code, the vector to be encoded is encoded through the identity information of n participating nodes to obtain an encoding result including n elements;

According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively;

The participating node 32 is used for:

When r participating nodes use r shares to reconstruct the secret, if r = k , the secret element is reconstructed based on r shares. If r > k and it is judged that there are false shares among the r shares, proceed Correction of false shares followed by reconstruction of said secret elements;

Based on the reconstructed secret elements, determine the corresponding secret information;

Among them, n is a positive integer not less than 2, k is a positive integer indicating the minimum number of shares to achieve secret reconstruction, r is a positive integer and when r < k , secret reconstruction cannot be achieved, and when r > k , false shares are corrected. The quantity does not exceed .

Corresponding to the above method and system embodiments, embodiments of the present invention also provide a secret information sharing device and a computer-readable storage medium, which may be mutually referenced with the above.

Referring to Figure 4, the secret information sharing device may include:

Memory 401, used to store computer programs;

Processor 402, configured to execute the computer program to implement the steps of the secret information sharing method in any of the above embodiments.

Referring to FIG. 5 , a computer program 51 is stored on the computer-readable storage medium 50 . When the computer program 51 is executed by a processor, the steps of the secret information sharing method in any of the above embodiments are implemented. The computer-readable storage medium 50 mentioned here includes random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM , or any other form of storage medium known in the technical field.

It should also be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations There is no such actual relationship or sequence between them. Furthermore, the terms "comprises," "comprises," or any other variations thereof are intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus that includes a list of elements includes not only those elements, but also those not expressly listed other elements, or elements inherent to the process, method, article or equipment. Without further limitation, an element defined by the statement "comprises a..." does not exclude the presence of additional identical elements in a process, method, article, or apparatus that includes the stated element.

This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the technical solutions and core ideas of the present invention. It should be noted that for those of ordinary skill in the art, several improvements and modifications can be made to the present invention without departing from the principles of the present invention, and these improvements and modifications also fall within the protection scope of the present invention.

Claims (22)

1. A secret information sharing method, characterized by including: According to the set conversion rules, the secret information is converted into an element in the set Galois domain as a secret element; Select n different elements from the set Galois field as the public identity information of n participating nodes; Select k -1 elements from the Galois field, and together with the secret element form a vector to be encoded containing k elements; Based on the encoding rules of the generalized Reed-Solomon code, the vector to be encoded is encoded through the identity information of n participating nodes to obtain an encoding result including n elements; According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively, so that when r participating nodes use r shares for secret reconstruction, if r = k , then based on r The secret elements are reconstructed from the shares and the secret information corresponding to the secret elements is determined. If r > k and it is judged that there are false shares among the r shares, the false shares are corrected and then the secret information is reconstructed. a secret element and determining the secret information corresponding to said secret element; Among them, n is a positive integer not less than 2, k is a positive integer indicating the minimum number of shares to achieve secret reconstruction, r is a positive integer, and when r < k , secret reconstruction cannot be achieved, and when r > k , false shares The number of corrections shall not exceed . 2. The secret information sharing method according to claim 1, characterized in that, n mutually different elements are selected from the set Galois field as the public identity information of n participating nodes, include: n different elements are randomly selected from the set Galois field as the public identity information of n participating nodes. 3. The secret information sharing method according to claim 2, characterized in that n mutually different elements are randomly selected from the set Galois field as the public identities of n participating nodes. information, including: N different elements are uniformly and randomly selected from the set Galois field as the public identity information of the n participating nodes. 4. The secret information sharing method according to claim 1, characterized in that, k -1 elements are selected from the Galois field, and together with the secret elements, they form a block containing k elements. vectors to be encoded, including k -1 elements are uniformly and randomly selected from the Galois field, and together with the secret elements form a vector to be encoded containing k elements. 5. The secret information sharing method according to claim 1, characterized in that the encoding rule based on the generalized Reed-Solomon code encodes the vector to be encoded through the identity information of n participating nodes to obtain the following: The encoding result of n elements includes: Based on the encoding rules of the generalized Reed-Solomon code, a Vandermond matrix is established through the identity information of n participating nodes, and the vector to be encoded is encoded through the established Vandermond matrix to obtain an encoding result including n elements. 6. The secret information sharing method according to claim 5, characterized in that the coding rule based on the generalized Reed-Solomon code establishes a Vandermond matrix through the identity information of n participating nodes, and through the established Vandermond matrix The matrix encodes the vector to be encoded, and obtains an encoding result including n elements, including: Based on the coding rules of the generalized Reed-Solomon code, the identity information of n participating nodes is used to encode the vector to be encoded according to the calculation method of ( s ₁ ,..., s _n ) = a · G , and the result includes: Encoding result of n elements; Where, a is the vector to be encoded containing k elements, G is a Vandermond matrix established through the identity information of n participating nodes, and , s ₁ to s _n are the obtained encoding results including n elements, to/> is the identity information of each of the n participating nodes. 7. The secret information sharing method according to claim 1, further comprising: When a new participating node needs to be added, no less than k participating nodes among the current participating nodes will operate according to the preset share addition rules, so that the newly added participating node gets an additional share. 8. The secret information sharing method according to claim 7, characterized in that when a new participating node needs to be added, no less than k participating nodes among the current participating nodes will be added according to the preset share addition rules. Carry out operations so that newly added participating nodes get 1 new share, including: When a new participating node needs to be added, the r participating nodes among the current n participating nodes will calculate their respective intermediate values; Among them, the intermediate value calculated by the i- th participating node among the r participating nodes Expressed as , s _i is the share of the i- th participating node, m _i is the i- th row vector of the first k -column submatrix of M ^-1 , matrix /> , M ^-1 is the inverse matrix of M , /> ,/> to is the identity information of each of the n participating nodes,/> is the identity information of the newly added participating nodes, T is the symbol of the transposed matrix, r ≥ k ; Based on the preset secure information sending method, the newly added participating nodes determine to/> The total of , and the sum will be used as 1 new share obtained by the newly added participating nodes, and the newly added participating nodes cannot be determined/> to/> any intermediate value in . 9. The secret information sharing method according to claim 8, characterized in that, based on the preset information secure transmission method, the newly added participating nodes determine to/> The total of , and the sum will be used as 1 new share obtained by the newly added participating nodes, and the newly added participating nodes cannot be determined/> to/> Any intermediate value in , including: For each participating node among r participating nodes, the participating node divides the intermediate value calculated by itself into r data, so that the sum of the divided r data is equal to the intermediate value calculated by itself, and the participating node is in After retaining 1 piece of r data, the remaining r- 1 data are sent to the remaining r- 1 participating nodes; For each participating node among r participating nodes, the participating node sums the retained 1 data with the received r- 1 data, and sends the summation result to the newly added participating node, so that The newly added participating node sums the sent data of r participating nodes and obtains to/> The sum will be regarded as one new share obtained by the newly added participating nodes. 10. The secret information sharing method according to claim 1, further comprising: When a participating node needs to be removed, no less than k participating nodes among the current participating nodes will be operated according to the preset participating node removal rules, so that the remaining participating nodes except the removed participating node will be removed. Participating nodes each receive a new share to replace the original share. 11. The secret information sharing method according to claim 10, characterized in that when one participating node needs to be removed, no less than k participating nodes among the current participating nodes are removed according to the preset participating nodes. The rules operate so that each remaining participating node except the removed participating node gets a new share to replace the original share, including: When one participating node needs to be removed, the r participating nodes among the current n participating nodes will calculate their respective sub-secret data based on their current shares; Among them, the sub-secret data a _{i 0} calculated by the i- th participating node among the r participating nodes is expressed as , s _i is the share of the i- th participating node, M _{i 0} is/> Algebraic cofactors in M , matrices , det( M ) represents the determinant of M ,/> to/> is the identity information of each of the n participating nodes, r ≥ k ; Based on r sub-secret data, r participating nodes operate according to the preset secure share generation method, so that each remaining participating node except the removed participating node gets a new share to replace the original share. , and makes it impossible for any participating node to obtain the sub-secret data of any other participating node. 12. The secret information sharing method according to claim 11, characterized in that, based on r sub-secret data, r participating nodes operate according to a preset share security generation method, so that the removed participating nodes are removed Each remaining participating node will receive a new share to replace the original share, and any participating node will not be able to obtain the sub-secret data of any other participating node, including: For each participating node among the r participating nodes, the participating node calculates n -1 sub-share values through the sub-secret data calculated by itself and the first polynomial constructed by itself, and calculates the calculated n -1 sub-share value is allocated to the n -1 remaining participating nodes, including itself, excluding the removed participating nodes; For the remaining n -1 participating nodes except the removed participating nodes, after obtaining the r sub-share values, the participating node sums up the r sub-share values it obtained as its own new share to replace its own original share; Wherein, the first polynomial constructed by the i- th participating node among the r participating nodes is expressed as , t is a positive integer and 1≤ t ≤ k -1, a _{i 1} to a _{i ( k -1)} are the k -1 elements selected by the i- th participating node from the Galois field; the i-th The participating nodes are calculated sequentially by taking the value of the independent variable x of the constructed first polynomial to the identity information of the remaining n -1 participating nodes excluding the removed participating nodes. Output n -1 sub-share values. 13. The secret information sharing method according to claim 1, further comprising: When it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, no less than k participating nodes among the current participating nodes will operate according to the preset threshold adjustment rules, so that each current participating node gets 1 The new shares replace the original shares, and the minimum number of shares to achieve secret reconstruction is adjusted from k to ; Indicates the minimum number of shares required to achieve secret reconstruction after adjustment. 14. The method for sharing secret information according to claim 13, characterized in that when it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, no less than k participating nodes among the current participating nodes will adjust the secret information according to the preset value. The threshold adjustment rules are set so that each current participating node gets a new share to replace the original share, and the minimum number of shares to achieve secret reconstruction is adjusted from k to ,include: When it is necessary to adjust the value of the minimum number of shares k to achieve secret reconstruction, the r participating nodes among the current n participating nodes will calculate their respective sub-secret data based on their current shares; Among them, the sub-secret data a _{i 0} calculated by the i- th participating node among the r participating nodes is expressed as: , s _i is the share of the i- th participating node, M _{i 0} is/> Algebraic cofactors in M , matrices , det( M ) represents the determinant of M ,/> to/> is the identity information of each of the n participating nodes, r ≥ k ; Based on r sub-secret data, r participating nodes operate according to the preset threshold adjustment method, so that each participating node gets a new share to replace the original share, and no participating node can obtain any other The child secret data of participating nodes, and the minimum number of shares to achieve secret reconstruction is adjusted from k to . 15. The secret information sharing method according to claim 14, characterized in that, based on r sub-secret data, r participating nodes operate according to a preset threshold adjustment method, so that each participating node obtains a new share to replace the original share, and make it impossible for any participating node to obtain the sub-secret data of any other participating node, and make the minimum number of shares to achieve secret reconstruction adjusted from k to ,include: For each participating node among the r participating nodes, the participating node calculates the n sub-share values through the sub-secret data calculated by itself and the second polynomial constructed by itself, and uses the calculated n sub-shares Values are assigned to n participating nodes including itself; For each participating node among the n participating nodes, after obtaining the r sub-share values, the participating node sums up the r sub-share values it obtained as its own new share to replace its original share; Wherein, the second polynomial constructed by the i- th participating node among the r participating nodes is expressed as , c is a positive integer and/> , a _{i 1} to/> Selected from the Galois field for the i- th participating node/> elements; the i -th participating node sequentially calculates n sub-share values by taking the values of the independent variable x of the constructed second polynomial as the identity information of the current n participating nodes. 16. The secret information sharing method according to any one of claims 1 to 15, characterized in that the encoding result is divided into n shares according to the different positions of the elements and sent to n participating nodes respectively. , so that when r participating nodes use r shares to reconstruct the secret, if r = k , then the secret element is reconstructed based on the r shares and the secret information corresponding to the secret element is determined, if r > k and when it is determined that there are false shares among r shares, the false shares are corrected and then the secret element is reconstructed and the secret information corresponding to the secret element is determined, including: According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively, so that when r participating nodes use r shares for secret reconstruction, if r = k , then based on r The secret elements are reconstructed from the shares and the secret information corresponding to the secret elements is determined. If r > k , then it is judged whether s · H ^T =0 is established. If it is not established, it is judged that there is falsehood in the r shares. When a share is obtained, the secret element is reconstructed after correcting the false share, and the secret information corresponding to the secret element is determined; Among them, H is a ( r - k ) × r- order full-rank matrix that satisfies M _k H ^T =0, M _k is a submatrix composed of the first k rows of matrix M , T is the transpose matrix symbol, and the matrix ,/> to/> is the identity information of each of the n participating nodes,/> , s ₁ to s _r represent the respective shares of the r participating nodes that perform secret reconstruction. 17. The secret information sharing method according to claim 16, further comprising: When r participating nodes use r shares for secret reconstruction, and when it is determined that there are false shares among the r shares, if the number of false shares does not exceed , r participating nodes all determine the identity information of the participating nodes corresponding to each false share. 18. The secret information sharing method according to claim 16, characterized in that, if r = k , then reconstruct the secret element based on r shares and determine the secret information corresponding to the secret element, including : If r = k , then based on r shares, calculate The secret element is reconstructed and the secret information corresponding to the secret element is determined. 19. The secret information sharing method according to claim 16, further comprising: When r participating nodes use r shares to perform secret reconstruction and r = k , after reconstructing the secret element based on r shares, all r participating nodes output the reconstructed secret element, which may cause security risks. prompt information. 20. A secret information sharing system, characterized by including: a distribution node and n participating nodes; The distribution node is used for: According to the set conversion rules, the secret information is converted into an element in the set Galois domain as a secret element; Select n different elements from the set Galois field as the public identity information of n participating nodes; Select k -1 elements from the Galois field, and together with the secret element form a vector to be encoded containing k elements; Based on the encoding rules of the generalized Reed-Solomon code, the vector to be encoded is encoded through the identity information of n participating nodes to obtain an encoding result including n elements; According to the different positions of the elements, the encoding result is divided into n shares and sent to n participating nodes respectively; The participating nodes are used for: When r participating nodes use r shares to reconstruct the secret, if r = k , the secret element is reconstructed based on r shares. If r > k and it is judged that there are false shares among the r shares, proceed Correction of false shares followed by reconstruction of said secret elements; Based on the reconstructed secret elements, determine the corresponding secret information; Among them, n is a positive integer not less than 2, k is a positive integer indicating the minimum number of shares to achieve secret reconstruction, r is a positive integer and when r < k , secret reconstruction cannot be achieved, and when r > k , false shares are corrected. The quantity does not exceed . 21. A secret information sharing device, characterized by including: Memory, used to store computer programs; A processor configured to execute the computer program to implement the steps of the secret information sharing method according to any one of claims 1 to 19. 22. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the secret as claimed in any one of claims 1 to 19 is realized. Steps to share information.