JP2003348065A - Distributed data storage system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simplify management of a decryption key in a distributed data storage system that protects data from disk destruction and data outflow, etc. <P>SOLUTION: An original data file is encrypted, encoded by correcting errors and defined as five redundant files by a user personal computer 1. The encryption key is encoded to five share keys by a threshold distribution method. The redundant files and the share keys are defined as five distributively stored pairs and transmitted to distributed storage servers SV1 to SV5 via the Internet. When the data is taken out, the distributively stored pairs are returned by accessing the distributed storage server from the user personal computer 1 via the Internet. When two share keys exist, the encryption key is restored and when three redundant files exist, an encrypted file is obtained by error correction decryption. The original data file is obtained by decrypting the encrypted file by the encryption key. <P>COPYRIGHT: (C)2004,JPO

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data distributed storage system, and more particularly, to a data distributed storage system for encrypting and distributing data for distributed storage.

[Prior art]

[0002] One of the conventional data storage systems is a mirror server. The mirror server is a system that stores the same data in a plurality of servers. Assume that data for three disks is stored on six disks. Let P be the probability that one disk goes down due to a disk crash or the like during a certain period. In a mirror server, two disks store data for one device, so a total of six disks are required. The probability that at least one of the two units in the set will survive is (1−P ² ). The probability that a system consisting of three units of one set consisting of two units will survive is
A (1-P ^{2) 3.} Therefore, the probability of system failure is a ^{1- (1-P 2) 3} . The probability of system down when P = 0.02 is 1.2 × 10 ⁻³ .

There is a RAID (Raid) disk system as a system for storing data in a distributed manner. By using a plurality of storage devices such as hard disks and distributing accesses, a high-speed, large-capacity, highly reliable disk device is realized. By using error correction technology, data can be safely protected against accidents such as disk crashes. The following is an example of a conventional RAID disk system.

[0004] Japanese Patent Application Laid-Open No. 2000-259359 discloses "RAI
The "D device" is a RAID device having data restoration means for adding a redundant code (parity) to data and restoring data in the event of a disk failure. Data is distributed and stored on multiple data disks. A parity disk is added to these data disks. The data and parity storage areas are divided into arbitrary integer blocks in bit units. Using the expanded Galois field GF (2 ⁿ ), the parity of the parity disk added to the data disk is calculated for each group of all disks. At the time of an arbitrary data disk failure, a simultaneous congruence formula is created according to the rules defined by the extended Galois field GF (2 ⁿ ), using the data of the failed disk as unknown data. The unknown data is restored from this simultaneous equation.

[0005] Japanese Patent Application Laid-Open No. 2000-276308 discloses a "disk subsystem and a method for restoring data in a disk subsystem". This is a disk subsystem that prevents the disk subsystem from becoming unusable due to being unable to read from the disk device. In the disk subsystem configured with RAID, the data of the failed magnetic disk device is
Restore to a spare magnetic disk drive. Data that can be read from the failed magnetic disk device is stored in a spare magnetic disk device. Data that cannot be read from a failed magnetic disk device is restored by computation from data stored in a magnetic disk device in which no failure has occurred among a plurality of magnetic disk devices constituting a RAID. The restored data is stored in a spare magnetic disk device to restore the data.

[0006] The "data recording / reproducing apparatus and data recording / reproducing method" disclosed in Japanese Patent Application Laid-Open No. 2001-166887 discloses a method in which recording or reproduction is not performed at all in any RAID in an AV server using a network. Also during playback
It is intended to output AV data without loss, and to prevent an increase in the size of an AV server and an increase in network load. For the RAID, an input / output processing unit for inputting / outputting AV data with the outside is connected via a network. Each input / output processing unit receives an externally input AV
Divide the data into two or more RAIDs and transfer them. Generates an error correction code for the AV data and generates at least one RAID
Transfer to The AV data transferred from the RAID is corrected using an error correction code and output to the outside.

[0007] A threshold secret sharing method is a method that can be used for distributing and storing secret information. An outline of the (k, n) threshold secret sharing scheme will be described. For details, see Reference 1 [Tatsuaki Okamoto and Hirosuke Yamamoto, “Contemporary Cryptography”, Sangyo Tosho pp.209-21
0]. In the (k, n) threshold secret sharing scheme, the secret information S is encoded into n pieces of shared information w _j (j = 1, 2,..., n). How to play. Secret information S cannot be reproduced from less than k pieces of shared information.

[0008] From secret information S, shared information is created by linear operation.
You. (K-1) random numbers are represented by U₁, U _Two,…, U_k-1And
And the horizontal vector that combines the secret information S U≡ (S, U₁, U_Two,…, U_k-1) And This U is multiplied by a matrix G of k rows and (n + 1) columns.
By making the distributed information horizontal vector W≡ (S, w₁, w_Two,…, W_n) make. That is, W = UG To calculate the shared information.

In the (k, n) threshold secret sharing scheme, any k column vectors of the matrix G need to be linearly independent.
If the primitive element of the finite field GF (q ^m ) is α, then

(Equation 1) Is an arbitrary k × k minor determinant is Van
Since the determinant is a dermonde determinant, the k column vectors of the matrix G ′ are linearly independent. Therefore, the matrix G ′ is (k,
n) It can be used for threshold secret sharing.

[0010] Except for the second column of the matrix G ', k rows (n +
1) Create a matrix G of columns. The matrix G is

(Equation 2) It becomes.

[0011] Distributed information w_j(J = 1,2, ..., n) is W = UG Since it is represented by w_j= S + U₁・ (Α^j) + U_Two・ (Α^j)^Two+ ... + U_k-1・ (Α^j)
^(k-1) Becomes Therefore, the shared information w_j(J = 1,2, ...,
n) is a polynomial of degree (k-1) f (x) = S + U₁・ X + U_Two・ X^Two+ ... + U_k-1・ X^(k-1) Using, w_j= F (α^j) The secret sharing scheme using Shamir's polynomial
It becomes a stem. k pieces of shared information w_j= F (α^j) (J = 1,
2, ..., k), k coordinate points (α^j, f (α ^j))
From the polynomial of degree (k-1) y = f (x) Is uniquely obtained, and the secret information S is also the value of the y-intercept of the polynomial.
Is determined. However, from (k-1) or less coordinate points,
Possibility of polynomial not being uniquely determined and passing through all y-intercepts
, Secret information S is not required.

(K, n) One kind of the threshold secret sharing scheme, (k, n)
n) Verifiable Secret Shar (VSS)
ing) is used when each shared information holder needs to confirm that the sent shared information is correctly created. For example, in key escrow, a private key is distributed and deposited to a plurality of third parties. At this time, it is necessary to prove to the depository that the key is correctly distributed.

An example of the (k, n) verifiable secret sharing scheme will be described. The distributor having the secret information S selects a random (k-1) -order polynomial f (x) having its secret information S as a constant term, and f (x) = S + a ₁ x + a ₂ x ² +... + A _k-1 x ^k-1 modr. r is a prime number. a _{1 to} a _k-1 are random numbers. The distributor distributes the shared information w _j = f (j) = S + a ₁ j + a ₂ j ² +... + A _k−1 j ^k−1 modr to ^each shared information holder j (j = 1,..., N). . The matrix G in this case is

(Equation 3) It becomes.

[0014] The distributor of the secret information is r | p-1.
Generates una prime p and multiplies Zp^*(That is, 1-p-
Group of operations in which the remainder of p is a product in an integer multiplication of 1
An element g whose order is r (that is, g^r= 1 modp)
Determine. next, C₀= G^S modp C₁= G^a1 modp … C_k-1= G ^ (a_k-1) modp Is calculated. The distributor assigns (p, g,
C₀, C₁,…, C_k-1) To distribute. Threshold secret sharing
When using for trust or key recovery, for example,
If you need to decrypt important documents at the time of your
When the staff gather and recover the key, the key to keep is correct
You need to confirm it because it must be a key. That
(P, g, C₀, C₁,…, C_k-1) To distribute. At this time
Is the shared information w _jAnd (p, g, C
₀, C₁,…, C_k-1).

Each shared information holder j (j = 1, 2,..., N)
Is g ^wj = C ₀ · C ₁ ^ (j) · C ₂ ^ (j ² )... C _k-1 ^ (j ^k-1 )
Verify whether modp holds. The left-hand side of this ^{equation, g wj = g ^ (S} + a 1 j + a 2 j 2 + ... + a k-1 j k-1 modr)
modp. The right side of the previous equation is C ₀ · C ₁ ^ (j) · C ₂ ^ (j ² )... C _k-1 ^ (j ^k-1 ) modp = g ^S · (g ^a1 ) ^ (j ). (G ^a2 ) ^ (j ² ) ... (g ^ (a _k-1 )) ^ (j ^k-1 ) modp = g ^ (S + a ₁ j + a ₂ j ² + ... + a _k-1 j ^{k -1) modp = g ^ (S} + a 1 j + a 2 j 2 + ... + a k-1 j k-1 modr) an integral multiple of modp × g ^ (r) modp = g ^ (S + a 1 j + a 2 j 2 + ... + a _k-1 j ^k-1 modr) modp (∵g ^r = 1 modp), so that if the shared information w _j is correct, the values on both sides match. If this expression is verified to be correct, the shared information w _j
Is made correctly. Secret information S satisfying C ₀ = g ^S modp is obtained from the k pieces of shared information w _j that pass this verification.

[0016]

However, in the above-mentioned conventional system, a memory having a capacity several times as large as that of the secret information is required to store the secret information in a distributed manner. Therefore, it is not suitable for keeping a large amount of information secret. In VSS, the encryption key is often distributed and stored, and the data to be stored must be encrypted and deposited in another storage location. That is, since the key and the data need to be stored separately, management is complicated.

The conventional RAID disk system guarantees the reliability of the entire disk drive, and is suitable for storing a large amount of data. However, large amounts of data on the order of tera or giga are not always generated. In addition, in order to withstand high-speed operation, it is necessary to use an LSI for the error correction part, and it is necessary to perform the operation in parallel, which is costly. However, there is a need to store confidential data more easily in small peer groups.

The present invention solves the above-mentioned conventional problems and provides an easy-to-use distributed data storage system that can easily manage an encryption key against loss of a key, data leakage, or data destruction due to a disk crash. The purpose is to realize.

[0019]

In order to solve the above-mentioned problems, according to the present invention, a plurality of distributed storage servers for storing data in a distributed manner and a user personal computer connected to the distributed storage server via a network are provided. Means for encrypting data with an encryption key to create encrypted data, means for encrypting the data to be error-correction-encoded into redundant data, Means for encoding into a plurality of share keys, means for performing error correction decoding of redundant data to obtain encrypted data, means for restoring an encryption key from a share key, and decryption of encrypted data with an encryption key. Means and a means for storing the redundant data and the shared key as a set in the distributed storage server.

With this configuration, it is possible to realize a user-friendly distributed data storage system in which encryption keys can be easily managed in the event of loss of a key, data leakage, or data destruction due to a disk crash.

[0021]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below in detail with reference to FIGS.

(First Embodiment) In a first embodiment of the present invention, original data is divided into three files and encrypted, and if there are three files, five redundant files can be restored. This is a data distributed storage system in which an encryption key is distributed to five shared keys by a secret sharing scheme with a threshold of 2, and five sets of a redundant file and a shared key are stored in five distributed storage servers.

FIG. 1 is a conceptual diagram of a distributed data storage system according to the first embodiment of the present invention. In FIG. 1, distributed storage server SV1, SV2, SV3, SV4, SV5 is, distributed storage pair _{(c1, w 1), ...} , is a file server to store the (c5, w _5). The user personal computer 1 is a personal computer of a user who requests data storage.

FIG. 2 shows a first embodiment of the present invention.
FIG. 1 is a data configuration diagram of a data distributed storage system according to an embodiment. FIG.
Source data files a1, a2, and a3
Data. The encryption key S is composed of the original data files a1, a2, a3
Is the key that encrypts The encrypted files b1, b2, b3 are
Data obtained by encrypting the data files a1, a2, and a3 with the encryption key S
It is. Redundant files c1, c2, c3, c4, and c5 are encrypted files.
Error correction coding of files b1, b2, b3 using Reed-Solomon code
Data. Share key w₁, w_Two, w_Three, w_Four, w_FiveIs
This is data obtained by distributing the encryption key S by the threshold secret sharing method. Minute
Storage pair (c1, w₁),…, (C5, w_Five) Is the redundant file c
1, c2, c3, c4, c5 and share key w₁, w_Two, w_Three, w _Four, w_FiveIn the set
You. Distributed storage servers SV1, SV2, SV3, SV4, SV5
Tube pair (c1, w₁),…, (C5, w_Five) Server
You. FIG. 3 shows a file storage system of the data distributed storage system.
It is a figure showing an image. VSS of threshold secret sharing method
In the case of using, (p, g, C₀, C₁)
To the distributed storage server
Share key w received from₁~ W_FiveUse for checking.

FIG. 4 is a functional block diagram of a user personal computer of the distributed data storage system according to the first embodiment of the present invention. In FIG. 4, the data storage means 11
This is a storage device such as a hard disk in which data requested to be stored is stored. The data dividing means 12 is means for dividing the data requested to be stored into three original data files. The encryption key generation means 13 is a means for generating a MISTY or DES encryption key. The encryption means 14 is means for encrypting the original data file with an encryption key. The Reed-Solomon encoding unit 15 is a unit that performs error correction encoding on the encrypted file using the Reed-Solomon code. The secret sharing means 16 is means for sharing the encryption key into five share keys by the threshold secret sharing method. The transmission means 17 is a means for transmitting a pair of the redundant file and the shared key to the distributed storage server via the Internet. The receiving means 18 is a means for receiving a pair of a redundant file and a shared key from a distributed storage server via the Internet. The error correction unit 19 is a unit that performs error correction decoding of the redundant file using a Reed-Solomon code. The encryption key restoring means 20 is a means for restoring the encryption key from the share key. The decryption means 21 is means for decrypting the encrypted file with the encryption key. The data combining unit 22 combines the three restored original data files into one.

FIG. 5 is a functional block diagram of the distributed storage server of the data distributed storage system according to the first embodiment of the present invention. In FIG. 5, the data receiving means 31
This is a means for receiving a distributed storage pair from a user personal computer via the Internet. The data storage unit 32 is a disk device that stores a distributed storage pair. The data transmission means 33 is means for transmitting the distributed storage pair to the user personal computer. The user authentication unit 34 is a unit for confirming that the accessing user is a legitimate user.

FIG. 6 is a flowchart showing a processing procedure of the user personal computer of the data distributed storage system according to the first embodiment of the present invention. FIG. 6A is a flowchart showing a processing procedure when a data storage request is made. FIG. 6 (b)
9 is a flowchart showing a processing procedure when data is reproduced. FIG. 7 is a flowchart showing a processing procedure of the distributed storage server. FIG. 7A is a flowchart showing a processing procedure when data is stored. FIG. 7B is a flowchart showing a processing procedure when data is taken out.

The operation of the data distributed storage system according to the first embodiment of the present invention configured as described above will be described. First, the operation principle of the data distributed storage system will be briefly described. The data distribution and storage function realizing means for restoring the data and the security maintaining function realizing means are separated. Utilizing the redundancy of error correction codes to deal with disk failures and data errors. The data redundancy of an error correction code such as a Reed-Solomon code is used. The secrecy is achieved by encryption. Use encryption such as MISTY or DES.
The (k, n) threshold secret sharing scheme is used to store the encryption key used for encryption. The distributed storage server stores a shared key in which the encryption key is distributed by the threshold distribution method and distributed data in which the data is distributed as one set in association with each other. Both encryption key management and data storage can be performed easily and safely.

Next, the outline of the operation of the data distributed storage system will be described with reference to FIG. In a user personal computer 1, which is a terminal device of a user who requests data storage, data to be stored in secret is divided into three original data files a1, a2, and a3. The user personal computer 1 generates a MISTY or DES encryption key, encrypts the three original data files a1, a2, and a3, and creates an encrypted file b
1, b2, b3. The encrypted files b1, b2, and b3 are error-correction-coded using Reed-Solomon codes to obtain five redundant files c1, c2,..., C5. The encryption key is encoded into _five share keys w ₁ , w ₂ ,..., W ₅ by the threshold distribution method. Distributed storage server from user PC 1 via the Internet
In SV1, SV2, SV3, SV4, SV5, distributed storage pairs (c1, w ₁ ),…, (c
5, w ₅ ) is transmitted. Distributed storage servers SV1, SV2, SV3, SV4,
In SV5, distributed storage pair _{(c1, w 1), ...} , store receives a (c5, w _5).

The user who deposits the data retrieves the data
If you want to send it out,
To the distributed storage servers SV1, SV2, SV3, SV4, SV5
Access to the distributed storage pair (c1, w₁),…, (C5, w_Five)
I will have it. 5 share keys w ₁, w_Two,…, W_FiveThe encryption key from
Restore. The five redundant files c1, c2, ..., c5 are
Error-correction decoding with Dosolomon code, and encrypted file b
Get 1, b2, b3. Restore encrypted files b1, b2, b3 with encryption key
To obtain three original data files a1, a2 and a3.

The five distributed storage servers SV1, SV2, SV3, SV4,
Even if two of the SV5s did not return due to an accident, the original three encryptions were used with the erasure error correction capability of Reed-Solomon codes (the ability to correct using information on which server went down). Files b1, b2, b3 can be restored. If two share keys can be extracted from the _five share keys w ₁ , w ₂ ,..., W ₅ , the original encryption key S can be restored.

Third, referring to FIGS. 2 and 3, the data structure of the data distributed storage system will be described. As shown in FIG. 2, the data to be kept secret is divided equally into three original data files a1, a2, a3. this,
By encrypting with a block cipher such as MISTY or DES, three encrypted files b1, b2, b3 are obtained. The encryption key at this time is S
And The encrypted files b1, b2, and b3 are error-correction-coded using Reed-Solomon codes, and five redundant files c1, c2,
c3, c4, and c5.

On the other hand, the encryption key S is encoded by the threshold distribution method.
The share key w₁, w_Two, w_Three, w_Four, w _FiveBecomes Data and
Five shared storage servers SV1 and S with a set of shared keys
Send to V2, SV3, SV4, SV5 for storage. Each distribution
(C1, w₁) 、 (C2, w_Two) 、 (C3, w_Three), (C4,
w_Four) 、 (C5, w_Five), Redundant file and share
The key pair is stored. Figure 3 shows the distributed storage server
Stored as shown.

The user who has deposited the data accesses the distributed storage server via the Internet or the like, and has the redundant file and the shared key returned. Even if two of the five distributed storage servers did not return data due to an accident, the Reed-Solomon code's erasure error correction capability (the ability to correct using information on which server went down) Encrypted files b1, b2,
b3 can be restored. As for the share key, if the share key can be correctly extracted from the two distributed storage servers, the original encryption key S can be restored.

It is assumed that both the data distribution number n and the encryption key distribution number m are 5. The number (nk) of the check symbols of the Reed-Solomon code is 2. That is, the number of original information symbols is three. The threshold a of the threshold dispersion method is selected as 2.
In other words, when the share keys are correctly collected from the two storage locations, the original encryption key S is reproduced. The parameters are n = m = 5, k = 3, a = 2.

In the case of the threshold dispersion method in which m = 5 and a = 2, (S, U ₁ ) G = (S, w ₁ , w ₂ , w ₃ , w ₄ , w ₅ ). The matrix G is

(Equation 4) It becomes. The share key w _j (j = 1, 2,..., 5) becomes w _j = S + U ₁ · j (j = 1, 2,..., 5).

When two of the five share keys w ₁ and w ₄ survive, an encryption key S is obtained from them. That is, the simultaneous equation is solved from w ₁ = S + U ₁ w ₄ = S + 4U ₁ to obtain the encryption key S.

The probability that _three of the _five disks will go down is ₅ C ₃ × P ³ × (1−P) ² . _n C _i
Represents a combination that takes three out of n. The probability that four disks are down, a ^{_{5 C 4 × P 4 × (}} 1-P). The probability that _five disks will go down is ₅ C ₅ × P ⁵
It becomes. When P = 0.02, the probability of system down is 7.
It becomes 8 × 10 ^-5 . The reliability is improved by nearly two orders of magnitude compared to a mirror server having a duplex configuration. In addition, while the mirror server having the duplex configuration requires six disks, the present system requires only five disks.

Fourth, an outline of the operation of the user personal computer 1 will be described with reference to FIG. The data storage unit 11 stores data for requesting storage. The data dividing unit 12 divides the data requested to be stored into three original data files. MISTY or D
An ES encryption key S is generated. The encryption means 14 encrypts the original data file with the encryption key S. The Reed-Solomon encoding means 15 performs error correction encoding on the encrypted file using Reed-Solomon code. The secret sharing means 16 splits the encryption key S into five share keys by a threshold secret sharing method. Transmission means 17
Then, the pair of the redundant file and the shared key is transmitted to the distributed storage server via the Internet.

The receiving means 18 receives the pair of the redundant file and the shared key from the distributed storage server via the Internet. The error correction means 19 performs error correction decoding of the redundant file using Reed-Solomon code. Encryption key recovery means
At 20, the encryption key is restored from the shared key. In the decoding means 21,
The encrypted file is decrypted with the encryption key S. Data combining means
At 22, the three restored original data files are combined into one and stored in the data storage unit 11.

Fifth, an outline of the operation of the distributed storage server will be described with reference to FIG. In the case of a data storage request, the data receiving means 31 sends the request via the Internet.
Accepts access from user computers. The user authentication means 34 confirms that the accessed user is an authorized user. The data receiving means 31 receives the distributed storage pair from the user's personal computer via the Internet. The distributed storage pair is stored in the data storage unit 32.

In the case of taking out stored data, the data receiving means 31 receives access from the user's personal computer via the Internet. In the user authentication means 34,
Verify that the user who accessed is a legitimate user. The distributed storage pair stored in the data storage unit 32 is taken out, and the data transmission unit 33 transmits the distributed storage pair to the user personal computer via the Internet.

Sixth, the processing procedure of the user personal computer will be described with reference to FIG. The data requested to be stored is stored in the user personal computer 1, which is a terminal device of the user requesting the data storage. (Step 1) Data to be kept secret is equally divided into three original data files a1, a2, a3. (Step 2) MISTY or DES on user PC 1
Generate an encryption key for (Step 3) The three original data files a1, a2, a3 are encrypted to be encrypted files b1, b2, b3. (Step 4) The encrypted files b1, b2, and b3 are error-correction-coded by Reed-Solomon code to obtain five redundant files.
c1, c2, ..., c5. (Step 5) The encryption key is encoded into _five share keys w ₁ , w ₂ ,..., W ₅ by the threshold distribution method. (Step 6) From the user personal computer 1 via the Internet, the distributed storage servers SV1, SV2, SV3, SV4, SV5
, The distributed storage pair (c1, w ₁ ),..., (C5, w ₅ ) is transmitted.

When reproducing data, a distributed storage server is provided from the user's personal computer 1 via the Internet.
Access to SV1, SV2, SV3, SV4, SV5 to create a distributed storage pair (c
1, w ₁ ),…, (c5, w ₅ ) are returned. (Step 11) Receive a pair of a redundant file and a shared key from the distributed storage server via the Internet. (Step 12) Restore the encryption key from the share key. (Step 13) The redundant file is error-corrected and decoded by Reed-Solomon code. (Step 14) The encrypted file is decrypted with the encryption key S. (Step 15) The three restored original data files are combined into one and stored on the disk.

Seventh, the processing procedure of the distributed storage server will be described with reference to FIG. The distributed storage server:
The user is registered in advance. (Step 21) Perform user authentication to determine whether the accessed user is an authorized user. (Step 22) If the user authentication is not OK, the process ends. (Step 23) Receive the distributed storage pair from the user personal computer via the Internet. (Step 24) The received distributed storage pair is stored on the disk.

In the case of extracting stored data, access from a user personal computer is accepted via the Internet. (Step 31) User authentication is performed to determine whether the accessed user is an authorized user. (Step 32) If the user authentication is not OK, the process ends. (Step 33) Remove the stored distributed storage pair from the disk. (Step 34) Send the distributed storage pair to the user PC.

The case where the number of divisions between data and an encryption key is generalized will be described. One piece of data is divided into k (k> 3), and the encryption key is divided into j pieces by a threshold distribution method with a threshold value m.
The threshold distribution method may be an SSS other than the VSS. In a general secret sharing scheme SSS (Secret Sharing Scheme), if a certain number of pieces of shared information are collected, the original secret information can be restored. VS
S is a method of SSS that guarantees the validity of shared information. With VSS, it is possible to check for an error in the extracted shared key. The k data are made redundant by using an (n, k) error correction code. The case where j = n is the most efficient, but j ≠ n. In that case, some pairs cannot be made, but a dummy is made to make a pair. (N,
k) Even if the error correction code is not a Reed-Solomon code,
Any code that can be used may be a BCH code or another code.

Since the share key is not subjected to error correction coding, if any one has an error, the encryption key cannot be restored from any two. 6 out of 10
It can be correctly restored on the street, and the error can be found on the four ways, so that the correct one can be found by majority decision. If two or more of the five shared keys have an error, the secret key cannot be recovered. In the case of VSS, as described in the prior art (p,
g, C ₀ , C ₁ ), the presence or absence of an error in the shared key can be verified. When the data recovery side wants to check whether an error has occurred in the shared key, (p, g, C ₀ ,
C ₁ ) is left in the user's personal computer and used to check whether the share keys w _{1 to} w ₅ sent from the distributed storage server are correct.

As described above, in the first embodiment of the present invention, the data distributed storage system encrypts the data divided into a plurality of pieces, performs error correction encoding on the divided data, and sets the encryption key as the threshold secret shared It is configured to store the set of shared data and shared key in a storage server by encoding to multiple shared keys by the method, so it is safe against loss of key, data leakage and data destruction due to disk crash. ,
Usability also improves.

(Second Embodiment) In a second embodiment of the present invention, original data is divided into three files and encrypted, and if there are three files, five redundant files can be restored. The encryption key is distributed to five shared keys using a secret sharing scheme with a threshold of 2, and the five sets of the redundant file and the shared key are separately sent from five personal computers to five distributed storage servers. It is a data distributed storage system that stores data.

FIG. 8 is a conceptual diagram of a distributed data storage system according to the second embodiment of the present invention. In FIG. 8, distributed storage server SV1, SV2, SV3, SV4, SV5 is, distributed storage pair _{(c1, w 1), ...} , is a file server to store the (c5, w _5). The user personal computer 1 is a personal computer that divides and encrypts data. The distributed personal computer 2 is a personal computer of a user who requests data storage. The other basic configuration of the distributed data storage system according to the second embodiment of the present invention is the same as that of the first embodiment.

The operation of the data distributed storage system according to the second embodiment of the present invention configured as described above will be described. The operation of the distributed data storage system will be described with reference to FIG. In a user personal computer 1, which is a terminal device of a user who requests data storage, data to be stored secretly is divided into three original data files a1, a2, and a3. The user personal computer 1 generates a MISTY or DES encryption key S, and generates three original data files a1,
a2 and a3 are encrypted to be encrypted files b1, b2 and b3.
The encrypted files b1, b2, and b3 are error-correction-coded using Reed-Solomon codes to obtain five redundant files c1, c2,..., C5. The encryption key S is divided into five share keys w ₁ and w by the threshold distribution method.
_2, ..., it is encoded into w _5. From user PC 1, LAN
3 to the five distributed personal computers 2 in a distributed storage pair (c1,
w ₁ ),..., (c5, w ₅ ) are transmitted one by one.

Each distributed personal computer 2 uses a unique authentication code to connect to the distributed storage server SV via the Internet.
1, SV2, SV3, SV4, SV5 have distributed storage pairs (c1, w ₁ ), ..., (c5,
w ₅ ). Distributed storage server SV1, SV2, SV3, SV4, SV
In 5, distributed storage pair _{(c1, w 1), ...} , store receives a (c5, w _5).

When the user who has deposited the data wants to retrieve the data, the distributed personal computer 2 accesses the distributed storage servers SV1, SV2, SV3, SV4, and SV5 via the Internet using the unique authentication code. Distributed storage pair (c1,
w ₁ ), ..., (c5, w ₅ ). The distributed personal computer 2
Distributed storage pair _{(c1, w 1), ...} , to send a (c5, w ₅₎ to the user PC 1.

The user personal computer 1 has five share keys w
_The encryption key S is restored from ₁ , w ₂ ,..., W ₅ . The five redundant files c1, c2,..., C5 are error-corrected and decoded by Reed-Solomon code to obtain encrypted files b1, b2, b3. The encrypted files b1, b2, b3 are decrypted with the encryption key S to obtain three original data files a1, a2, a3.

The five distributed storage servers SV1, SV2, SV3, SV4,
Even if two of the SV5s did not return due to an accident, the original three encryptions were used with the erasure error correction capability of Reed-Solomon codes (the ability to correct using information on which server went down). Files b1, b2, b3 can be restored. If two share keys can be extracted from the _five share keys w ₁ , w ₂ ,..., W ₅ , the original encryption key S can be restored.

Since each of the five distributed personal computers 2 has its own authentication code, only the distributed storage pair transmitted by itself can be taken out. Since each distributed storage pair is stored on the distributed storage server independently of each other, no one can know the related pair. Therefore, there is no possibility that two or more share keys are stolen and the encryption key S is restored.

In this example, the configuration in which the user personal computer 1 and the distributed personal computer 2 are connected via the LAN 3 has been described. However, the user personal computer 1 may also serve as the distributed personal computer 2. Further, the number of pairs in which the data and the encryption key are distributed is 5, but may be any number of 3 or more.

As described above, in the second embodiment of the present invention, the data distributed storage system divides the original data into three files, encrypts the data, encrypts the original data into three files, and restores the data if there are three files. Reed-Solomon encoding is performed on the redundant file, and the encryption key is divided into five share keys using a secret sharing scheme with a threshold of 2, and the five sets of the redundant file and the share key are
Since the configuration is such that the data is sent separately from the five personal computers to the five distributed storage servers and stored, even if the encrypted data and the shared key are stored together, there is no danger that the secret of the data will be leaked.

[0060]

As is apparent from the above description, according to the present invention, a distributed storage system comprising a plurality of distributed storage servers for distributing and storing data, and a user personal computer connected to the distributed storage server via a network. Means for encrypting data with an encryption key to generate encrypted data, means for encrypting the data to be error-correction-coded to provide redundant data, Means for encoding into a share key, means for error-correcting and decoding redundant data to obtain encrypted data, means for restoring the encryption key from the share key, and means for decrypting the encrypted data with the encryption key. , The distributed storage server is equipped with a means to store redundant data and a shared key as a set, so if a key is lost, data is leaked, or a disk crash occurs For the destruction of over data, management of the encryption key is simple, the effect is obtained that the easy-to-use distributed data storage system can be realized.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram of a data distributed storage system according to a first embodiment of the present invention;

FIG. 2 is a data configuration diagram of a data distributed storage system according to the first embodiment of the present invention;

FIG. 3 is a diagram showing a file storage image of the data distributed storage system according to the first embodiment of the present invention;

FIG. 4 is a functional block diagram of a user personal computer of the distributed data storage system according to the first embodiment of the present invention;

FIG. 5 is a functional block diagram of a distributed storage server of the data distributed storage system according to the first embodiment of the present invention;

FIG. 6 is a flowchart showing a processing procedure of a user personal computer of the distributed data storage system according to the first embodiment of the present invention;

FIG. 7 is a flowchart showing a processing procedure of the distributed storage server of the data distributed storage system according to the first embodiment of the present invention;

FIG. 8 is a conceptual diagram of a data distributed storage system according to a second embodiment of the present invention.

[Explanation of symbols]

1 User personal computer 2 Distributed personal computer 3 LAN a1, a2, a3 Original data file S Encryption key b1, b2, b3 Encrypted file c1, c2, ..., c5 Redundant file SV1, SV2, ..., SV5 Distributed storage server (c1, w ₁ ),..., (c5, w ₅ ) distributed storage pair w ₁ , w ₂ ,..., w ₅ share key 11 data storage means 12 data division means 13 encryption key generation means 14 encryption means 15 Reed-Solomon encoding means 16 Secret sharing means 17 Transmitting means 18 Receiving means 19 Error correcting means 20 Encryption key recovery means 21 Decoding means 22 Data combining means 31 Data receiving means 32 Data storage means 33 Data transmitting means 34 User authentication means

Claims (4)

[Claims] 1. A distributed data storage system comprising a plurality of distributed storage servers for storing data in a distributed manner, and a user personal computer connected to the distributed storage server via a network. Means for encrypting the encrypted data into encrypted data, means for error-correction encoding the encrypted data to make redundant data, and means for encoding the encryption key into a plurality of share keys by a threshold secret sharing method. Means for obtaining the encrypted data by error correcting and decoding the redundant data, means for restoring the encryption key from the share key, and means for decrypting the encrypted data with the encryption key, A distributed storage system comprising: a distributed storage server that stores the redundant data and the share key as a set. 2. In a data distributed storage system comprising a plurality of distributed storage servers for storing data in a distributed manner and a user personal computer connected to the distributed storage server via a network, one data is stored in the user personal computer. means for dividing the data into k (k is an integer of 2 or more) data, means for encrypting each of the k data with one encryption key to obtain k encrypted data,
Error-encoding the encrypted data to n (n is k + 1)
Means for making the above (integer) pieces of redundant data, means for encoding the encryption key into n number of share keys by a threshold secret sharing method, and error-correction decoding of the redundant data to obtain the encrypted data. Obtaining means, means for restoring the encryption key from the share key, and means for decrypting the encrypted data with the encryption key, wherein the distributed storage server stores one of each of the redundant data and the share key. Data distribution means comprising: means for converting one pair into n pairs; means for forming a correspondence relationship between each pair; a memory for storing the correspondence table; and means for storing the pair. Storage system. 3. A user personal computer encrypts data using an encryption key to generate encrypted data, error-correction-encodes the encrypted data into redundant data, and uses the encryption key as a plurality of shares by a threshold secret sharing method. Encoding into a key, transmitting the redundant data and the share key to a distributed storage server via a network, and storing and storing the redundant data and the share key as a set at the distributed storage server. When the user restores, the user PC accesses the distributed storage server to have the redundant data and the share key sent back, and performs error correction decoding of the redundant data to obtain the encrypted data. Recovering the encryption key from the share key, decrypting the encrypted data with the encryption key, and reproducing the original data. Distributed storage method. 4. A data storage system comprising: a plurality of distributed storage servers for distributing and storing data; a plurality of distributed personal computers connected to the distributed storage server via a network; and a user personal computer connected to the distributed personal computers. In the distributed storage system, means for encrypting data with the encryption key to the user personal computer to obtain encrypted data;
Means for error-correction encoding the encrypted data into redundant data, means for encoding the encryption key into a plurality of share keys by a threshold secret sharing method, and error-correction decoding of the redundant data to Means for obtaining encrypted data, means for restoring the encryption key from the share key, and means for decrypting the encrypted data with the encryption key, wherein the distributed personal computer has the redundant data and the share key. Means for transmitting to the distributed storage server using a unique authentication code as a set, means for receiving the set of the redundant data and the shared key from the distributed storage server using a unique authentication code, A distributed storage system comprising: a distributed storage server that stores the redundant data and the share key as a set.