JP2006018850A - Data storing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To store original data by efficiently splitting through a relatively simple processing. <P>SOLUTION: Original data S, number of partitions n and processing unit bit length b are set. A plurality of original partial data S(j) are generated by dividing the original data S into every processing unit bit length b, and a plurality of partial data of random numbers R(j) are generated. Then each partial partition data (i, j) which composes each partition data D(i) is generated by a given definitional equation which is given from an exclusive OR of the original partial data and the partial data of random numbers. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a technique for dividing and storing data in order to ensure confidentiality and security of the data.

  When important confidential data (hereinafter referred to as original data) is stored, there is a threat of loss, destruction, theft and privacy infringement. Such threats cannot be solved by simply encrypting data that should be kept secret, and it is effective to make multiple copies in preparation for loss or destruction, but making multiple copies increases the risk of theft. End up.

  Conventionally, there is a threshold secret sharing method as means for solving such a problem (see Non-Patent Document 1). In this conventional method, the original data S can be restored by dividing the original data S into n pieces of data, and collecting any x pieces of divided data, but with any x-1 pieces of divided data, the original data S Cannot be restored. Therefore, even if up to x-1 pieces of divided data are stolen, the original data S does not leak, and even if up to nx pieces of divided data are lost or destroyed, the original data S can be restored.

As a typical implementation example of this method, there is a method composed of an n-1 degree polynomial and a remainder operation (see Non-Patent Document 2). This conventional method is used for, for example, split key management of public key cryptography, and the amount of data is not so large, so the current computer processing capacity, the cost of storage devices and storage media, etc. There is no particular problem.
A. Shamir, "How to Share a Secret", Comm. Assoc. Comput. Mach., Vol. 22, no. 11, pp. 612-613 (Nov. 1979) Bruce Schneier, "Applied Cryptography", John Wiley & Sons, Inc., pp. 383-384 (1994)

  When the above-mentioned conventional method is used when the amount of data to be stored safely is, for example, megabytes, gigabytes or larger, multiple-precision integer arithmetic processing including polynomial arithmetic and remainder arithmetic can be converted into a large amount of data. For example, when the number of divisions is n = 5, five pieces of 1-byte divided data are generated from 1-byte data in this conventional method. On the other hand, there is a problem that it is not realistic in concrete implementation using a computer, such as requiring a storage capacity that is simply a multiple proportional to the number of divisions.

  In the conventional method described above, a processing unit for the division operation is set in order to ensure the confidentiality of the data. However, a certain data length is required for the processing unit of the division operation, and an arbitrary processing unit is set. There is also a problem that the division operation cannot be performed.

  The present invention has been made in view of the above, and an object thereof is to provide a data storage system capable of efficiently dividing and storing original data by relatively simple processing.

  In order to achieve the above object, the data storage system of the present invention creates four or more encrypted data from the target data using the secret sharing method, and stores the four or more pieces of the created data. A combination of different m pieces of data (2 ≦ m) cannot be restored by one, and the target data can be restored by collecting k pieces (2 ≦ k ≦ n−1) and encrypted. Distributed data creation means for creating n (n is an integer of 4 or more) distributed data, and n storage units that are provided at different locations and store each of the distributed data one by one, Each of the distributed data is individually transported from a transport source via a network, and stored in each storage unit in a state of being individually stored in a predetermined recording medium.

  The present invention is further characterized by comprising restoration means for restoring the target data using at least k pieces of each of the distributed data stored in the storage unit.

  According to the present invention, original data can be efficiently divided and stored by a relatively simple process.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a system configuration diagram including a data dividing apparatus for executing a data dividing method according to an embodiment of the present invention. The data dividing apparatus according to the present embodiment is provided connected to the network 3 as the dividing apparatus 1 as indicated by reference numeral 1, and the original data S in response to the original data dividing request from the terminal 5 accessing the network 3. Are divided into a plurality of divided data, and the divided plurality of divided data are stored in a plurality of storage servers 7a, 7b, 7c via the network 3. In FIG. 1, the dividing device 1 divides the original data S from the terminal 5 into three divided data D (1), D (2), and D (3), which are respectively stored in a plurality of storage servers 7a and 7b. , 7c.

  Further, the dividing device 1 sends a plurality of divided data D (1), D (2), D (3) via the network 3 in response to the original data restoration request from the terminal 5 accessed via the network 3. So that the original data S is restored from the plurality of obtained divided data D (1), D (2), D (3) and transmitted to the terminal 5 via the network 3. It has become.

  Specifically, the dividing device 1 includes a divided data generating unit 11 that generates a plurality of divided data D from the original data S, an original data restoring unit 13 that restores the original data S from the plurality of divided data D, and a plurality of pieces from the original data S. Random number generating means 15 for generating a random number R used to generate the divided data D, and a plurality of divided data D generated by the divided data generating means 11 via the network 3 are stored in a plurality of storage servers 7a, 7b, 7c. And a data transmission / reception means 17 for receiving a plurality of divided data D from a plurality of storage servers 7a, 7b, 7c via the network 3.

  In the division and restoration of the original data in the present embodiment configured as described above, the original data is divided into divided data of a desired number of divisions based on a desired processing unit bit length. In this case, the processing unit bit length Can be set to any value, and the original data is divided into processing unit bit lengths, and the divided partial data is generated from this original partial data by a number one less than the number of divisions, so that the bit length of the original data is If it does not match an integer multiple of (divided number -1) times the processing unit bit length, the bit length of the original data is set to the processing unit bit length (dividing number -1 ) This embodiment can be applied by adjusting to an integral multiple of times.

  The random numbers described above are also generated from the random number generation means 15 as (partition number-1) random number partial data having a bit length of the processing unit bit length corresponding to each of the (partition number-1) original partial data. Is done. That is, the random numbers are divided into processing unit bit lengths, and are generated as (partition number-1) random number partial data having a bit length of the processing unit bit length. Further, the original data is divided into a desired number of divided data based on the processing unit bit length, and each of the divided data also corresponds to each of the (division number-1) original partial data. It is generated as (partition number -1) pieces of divided partial data having a bit length. That is, each piece of divided data is divided into processing unit bit lengths, and is generated as (partition number-1) pieces of divided partial data having a bit length of the processing unit bit length.

  In the following description, the above-described original data, random numbers, divided data, number of divisions, and processing unit bit length are represented by S, R, D, n, and b, respectively, and one of a plurality of data, random numbers, and the like. I (= 1 to n) and j (= 1 to n-1) are used as variables to represent one, (division number n-1) original partial data, (division number n-1) random number partial data , And one of each of the divided data D with the number of divisions is represented by S (j), R (j) and D (i), respectively, and a plurality of ( The divided partial data of (n-1) is represented by D (i, j). That is, S (j) represents the j-th original partial data when the original data S is numbered in order from the top by dividing into processing unit bit lengths.

  When this notation is used, the original data, random number data, and divided data, and the original partial data, random number partial data, and divided partial data that constitute these, respectively, are represented as follows.

Original data S = (n-1) original partial data S (j)
= S (1), S (2), ..., S (n-1)
Random number R = (n-1) random number partial data R (j)
= R (1), R (2), ..., R (n-1)
n divided data D (i) = D (1), D (2),..., D (n)
Each partial data D (i, j)
= D (1,1), D (1,2), ..., D (1, n-1)
D (2,1), D (2,2), ..., D (2, n-1)
………
D (n, 1), D (n, 2), ..., D (n, n-1)
(i = 1 ~ n), (j = 1 ~ n-1)
In the present embodiment, an exclusive OR operation (XOR) of original partial data and random number partial data is performed on a plurality of partial data divided for each processing unit bit length as described above. The original data is divided using a definition formula consisting of exclusive OR (XOR) of data and random number partial data. Conventionally, a polynomial or a remainder operation is used for the above data division processing. Compared with this method, exclusive OR (XOR) operation, which is a bit operation suitable for computer processing, is used, so high-speed and high-performance operation processing capability is not required, and even large-capacity data is easy. In addition, it is possible to generate divided data by repeating such an arithmetic process, and it is also possible to make the storage capacity required for storing the divided data smaller than a multiple that is proportional to the number of divisions. Further, the divided data is generated by stream processing in which calculation processing is performed in order from the top of the data for each predetermined fixed length.

  In the following description, the exclusive OR operation (XOR) used in the present embodiment is expressed by an operation symbol “*”. However, in the bitwise operation rule of this exclusive OR operation, Each calculation result is as follows.

The operation result of 0 * 0 is 0
The result of 0 * 1 is 1
The result of 1 * 0 is 1
The result of 1 * 1 is 0
In addition, the XOR operation has an exchange law and a joint law. That is,
a * b = b * a
(a * b) * c = a * (b * c)
Is proved mathematically.

  Also, a * a = 0, a * 0 = 0 * a = a holds.

Here, a, b, and c represent bit strings having the same length, and 0 represents a bit string having the same length and consisting of all “0”.

  Next, the operation of the above embodiment will be described with reference to drawings such as flowcharts. Prior to this description, definitions of symbols shown in the flowcharts of FIGS. 2, 5, 8, and 9 will be described.

(1)

Means A (1) * A (2) *... A (n).

  (2) c (j, i, k) is replaced by (n-1) × (n-1) matrix U [n-1, n-1] × (P [n-1, n-1]) It is defined as the value of i rows and k columns of ^ (j-1).

  At this time, Q (j, i, k) is defined as follows.

When c (j, i, k) = 1 Q (j, i, k) = R ((n-1) × m + k)
Q (j, i, k) = 0 when c (j, i, k) = 0
However, m represents an integer of m ≧ 0.

(3) U [n, n] is an n × n matrix, and the value of i rows and j columns is represented by u (i, j).
When i + j ≦ n + 1 u (i, j) = 1
When i + j> n + 1, u (i, j) = 0
It means that the matrix is “upper triangular matrix”. Specifically, the matrix is as follows.

(4) P [n, n] is an n × n matrix, and the value of i rows and j columns is represented by p (i, j).
When j = i + 1, p (i, j) = 1
p (i, j) = 1 when i = 1, j = n
For other cases p (i, j) = 0
It means that the matrix is “rotation matrix”. Specifically, the matrix is as follows, and when multiplied from the right side of another matrix, the first column of the other matrix is changed to the second column, the second column to the third column,. Is moved to the nth column, and the nth column is moved to the first column. That is, when the matrix P is applied to another matrix a plurality of times from the right side, each column can be moved so as to rotate rightward by that number of times.

(5) If A and B are n × n matrices, A × B means the product of the matrices A and B. The calculation rules for the matrix components are the same as those used in normal mathematics.

  (6) When A is an n × n matrix and i is an integer, A ^ i means i products of the matrix A. A ^ 0 means the unit matrix E.

(7) The unit matrix E [n, n] is an n × n matrix, and the value of i rows and j columns is represented by e (i, j).
e (i, j) = 1 when i = j
For other cases e (i, j) = 0
Let's mean a matrix that is Specifically, the matrix is as follows. Let A be any n × n matrix
A × E = E × A = A
There is a property to become.

  Next, with reference to the flowchart shown in FIG. 2 and the specific data shown in FIGS. 3 and 4, first, the dividing process of the original data S will be described as an operation of the above embodiment.

  A user of the dividing apparatus 1 according to the present embodiment accesses the dividing apparatus 1 from the terminal 5 via the network 3 and transmits the original data S to the dividing apparatus 1. The original data S is received and supplied to the dividing device 1 (step S201 in FIG. 2). In this example, the original data S is 16 bits “10110010 00110111”.

  Next, the user instructs the dividing apparatus 1 to 3 as the division number n from the terminal 5 (step S203). A predetermined value in the dividing device 1 may be used as the division number n. Note that the three pieces of divided data generated by the dividing device 1 according to the number of divisions n = 3 are D (1), D (2), and D (3). The divided data D (1), D (2), and D (3) are all 16-bit data that is the same as the bit length of the original data.

  Then, the processing unit bit length b used for dividing the original data S is determined to be 8 bits, and a 16-bit random number R having the same bit length as that of the original data is acquired from the random number generation means 15 and generated. (Step S205). The processing unit bit length b may be specified by the user from the terminal 5 to the dividing device 1, or a value predetermined in the dividing device 1 may be used. The processing unit bit length b may be an arbitrary number of bits, but here it is 8 bits that can divide the original data S. Accordingly, the original data S of the above 16-bit “10110010 00110111” is divided into “10110010” when the two original divided data S (1) and S (2) are divided by the 8-bit processing unit bit length. And “00110111”.

  In the next step S207, it is determined whether or not the bit length of the original data S is an integer multiple of 8 × 2, and if it is not an integer multiple, the end of the original data S is padded with zeros to obtain 8 × 2 Fit to an integer multiple. Note that the division processing when the processing unit bit length b is set to 8 bits and the division number n is set to 3 as in this example is not limited to 16 bits as the bit length of the original data S. This is effective for the original data S that is an integral multiple of the length b × (number of divisions n−1) = 8 × 2.

  Next, in step S209, the variable m, that is, the variable m meaning the integer multiple described above is set to zero. As in this example, when the original data S has a processing unit bit length b × (number of divisions n−1) = 8 × 2 = 16 bits, the variable m is 0, but is doubled to 32 bits. In this case, the variable m is 1, and in the case of 3 times 48 bits, the variable m is 2.

  Next, it is determined whether or not there is data for 8 × 2 bits from the 8 × 2 × m + 1 bit of the original data S (step S211). This is because the division processing shown after step S211 is performed on the processing unit bit length b × (number of divisions n−1) = 8 × 2 = 16 bits specified by the variable m of the original data S, It is determined whether or not there is the next 16 bits as data S. In the case where the original data S is 16 bits as in this example, when the dividing process after step S211 is performed once on the 16-bit original data S, the variable m is incremented by 1 in step S219 described later. However, in the original data S of this example, there is no data of 17 bits or more corresponding to the case where the variable m is m + 1, so the process proceeds from step S211 to step S221. In this case, however, the variable m is Since it is 0, the 8 × 2 × m + 1 bit of the original data S is 8 × 2 × 0 + 1 = 1, and the data is 8 × 2 bits from the first 16 bits of the original data S. Since it exists, it progresses to step S213.

  In step S213, the variable j is changed from 1 to 2 (= number of divisions n-1), and 8 bits (= processing unit bits) from the 8 × (2 × m + j-1) +1 bit of the original data S Data) is set to the original partial data S (2 × m + j), thereby dividing the original data S by the processing unit bit length 2 (number of divisions n-1) original partial data S (1) , S (2) is generated as follows.

Original data S = S (1), S (2)
First original partial data S (1) = “10110010”
Second original partial data S (2) = “00110111”
Next, the variable j is changed from 1 to 2 (= number of divisions n-1), and a random number having a length of 8 bits generated from the random number generation means 15 is set in the random number partial data R (2 × m + j). Thus, 2 (division number n-1) random number partial data R (1) and R (2) obtained by dividing the random number R by the processing unit bit length are generated as follows (step S215).

Random number R = R (1), R (2)
First random number partial data R (1) = “10110001”
Second random number partial data R (2) = “00110101”
Next, in step S217, the variable i is changed from 1 to 3 (= number of divisions n), and the variable j is further changed from 1 to 2 (= number of divisions n-1) in each variable i, as shown in step S217. Each divided partial data D (i, 2 × m + j) that constitutes each of the plurality of divided data D (i) by a definition formula consisting of exclusive OR of the original partial data and random number partial data for generating the divided data ) Is generated. As a result, the following divided data D is generated.

Split data D
= 3 pieces of divided data D (i) = D (1), D (2), D (3)
First divided data D (1)
= 2 pieces of partial data D (1, j) = D (1,1), D (1,2)
= "00110110", "10110011"
Second divided data D (2)
= 2 pieces of partial data D (2, j) = D (2,1), D (2,2)
= "00000011", "00000010"
Third divided data D (3)
= 2 pieces of partial data D (3, j) = D (3,1), D (3,2)
= "10110001", "00110101"
Note that the definition formula shown in step S217 for generating each divided partial data D (i, j) is specifically shown in the table shown in FIG. 4 when the division number n = 3 as in this example. It will be described. From the table shown in FIG. 4, the definition formula for generating the divided partial data D (1,1) is S (1) * R (1) * R (2), and the definition formula for D (1,2) Is S (2) * R (1) * R (2), the definition of D (2,1) is S (1) * R (1), and the definition of D (2,2) is S (2) * R (2), the defining formula for D (3,1) is R (1), and the defining formula for D (3,2) is R (2). The table shown in FIG. 4 also describes general definition formulas for arbitrary integers when m> 0.

  In this way, after the divided data D is generated for the variable m = 0 which means an integer multiple, the variable m is then incremented by 1 (step S219), the process returns to step S211 and the original data S corresponding to the variable m + 1 is returned. However, since the original data S in this example is 16 bits and there is no data after 17 bits, the process proceeds from step S211 to step S221 and is generated as described above. The divided data D (1), D (2), D (3) are transmitted from the data transmitting / receiving means 17 of the dividing apparatus 1 to the storage servers 7a, 7b, 7c via the network 3, and stored in each storage server 7. Then, the division process ends.

  Here, the divided data generation process based on the definition formula in step S217 in the flowchart of FIG. 2 described above, specifically, the divided data generation process when the number of divisions n = 3 will be described in detail.

  First, in the case of a variable m = 0 meaning an integer multiple, each divided partial data D constituting each of the divided data D (i) = D (1) to D (3) from the definition formula shown in step S217. (i, 2 × m + j) = D (i, j) (i = 1 to 3, j = 1 to 2) is as follows.

D (1,1) = S (1) * Q (1,1,1) * Q (1,1,2)
D (1,2) = S (2) * Q (2,1,1) * Q (2,1,2)
D (2,1) = S (1) * Q (1,2,1) * Q (1,2,2)
D (2,2) = S (2) * Q (2,2,1) * Q (2,2,2)
D (3,1) = R (1)
D (3,2) = R (2)
Specifically, Q (j, i, k) included in the above four formulas among the above six formulas is obtained.

When c (j, i, k) is a value of i rows and k columns of U [2,2] × (P [2,2]) ^ (j-1) which is a 2 × 2 matrix, Is defined as

When c (j, i, k) = 1 Q (j, i, k) = R (k)
Q (j, i, k) = 0 when c (j, i, k) = 0
here,
When j = 1

When j = 2

  If this is used, each division | segmentation partial data D (i, j) is produced | generated by the following definitional expressions.

D (1,1) = S (1) * Q (1,1,1) * Q (1,1,2) = S (1) * R (1) * R (2)
D (1,2) = S (2) * Q (2,1,1) * Q (2,1,2) = S (2) * R (1) * R (2)
D (2,1) = S (1) * Q (1,2,1) * Q (1,2,2) = S (1) * R (1) * 0 = S (1) * R (1 )
D (2,2) = S (2) * Q (2,2,1) * Q (2,2,2) = S (2) * 0 * R (2) = S (2) * R (2 )
The definition formula for generating each of the divided partial data D (i, j) described above is also illustrated in FIG.

FIG. 3 shows the original data from the respective data, definition formulas, and divided partial data when the 16-bit original data S is divided into three with the division number n = 3 based on the 8-bit processing unit bit length as described above. It is a table | surface which shows the calculation formula in the case of decompress | restoring.

  Here, the divided data D (1), D (2), D (3) and the respective divided partial data D (1,1), D (1,2), D (2,1), The process of generating D (2,2), D (3,1), and D (3,2) and the general form of the definition formula will be described.

  First, for the first divided data D (1), the first divided partial data D (1,1) is defined by the definition formula S (1) * R (1) * R (2) described above. Then, the second divided partial data D (1, 2) is defined by the definition formula S (2) * R (1) * R (2). The general form of this defining formula is S (j) * R (j) * R (j + 1) for D (1, j), and for D (1, j + 1) S (j + 1) * R (j) * R (j + 1) (j is an odd number). When calculated according to the definition formula, D (1,1) is 00110110 and D (1,2) is 10110011, so D (1) is 00100110 10110011. The general form of the defining formula is shown collectively in FIG.

  For the second divided data D (2), D (2,1) is defined by S (1) * R (1), and D (2,2) is S (2) * R ( Defined in 2). The general form of this definition is S (j) * R (j) for D (2, j) and S (j + 1) * R for D (2, j + 1) (j + 1) (j is an odd number). When calculated according to the definition formula, D (2,1) becomes 00000011 and D (2,2) becomes 00000010, so D (2) is 00000011 00000010.

  Further, for the third divided data D (3), D (3,1) is defined by R (1) and D (3,2) is defined by R (2). The general form of this definition is R (j) for D (3, j) and R (3, j + 1) for D (3, j + 1) (j is Odd number). When calculated according to the definition formula, D (3,1) is 10110001, D (3,2) is 00110101, and D (3) is 10110001 00110101.

In the above description, the length of S, R, D (1), D (2), D (3) is 16 bits. Even from the original data S, the divided data D (1), D (2), and D (3) can be generated. Processing unit bit length b
Can be taken arbitrarily, and by repeating the above dividing process for each b × 2 length in order from the beginning of the original data S, the original data of any length, specifically, the processing unit bit length b × 2 This can be applied to original data having an integral multiple length. If the length of the original data S is not an integral multiple of the processing unit bit length b × 2, for example, the length of the original data S is set to the processing unit bit length b × 2 by filling the end portion of the data with 0, for example. The division processing of this embodiment described above can be applied by adjusting to an integral multiple of.

  Next, processing for restoring original data from divided data will be described with reference to the table shown on the right side of FIG.

  First, the user accesses the dividing device 1 from the terminal 5 via the network 3 and requests the restoration of the original data S via the data transmission / reception means 17 of the dividing device 1. When receiving the restoration request for the original data S, the dividing device 1 stores the divided data D (1), D (2), D (3) corresponding to the original data S in the storage servers 7a, 7b, 7c. Therefore, the divided data D (1), D (2), D (3) are acquired from the storage servers 7a, 7b, 7c via the network 3, and the acquired divided data D ( The original data S is restored from 1), D (2), and D (3) as follows.

  First, the first original partial data S (1) can be generated from the divided partial data D (2,1) and D (3,1) as follows.

D (2,1) * D (3,1) = (S (1) * R (1)) * R (1)
= S (1) * (R (1) * R (1))
= S (1) * 0
= S (1)
Specifically, since D (2,1) is 00000011 and D (3,1) is 10110001, S (1) is 10110010.

  Further, the second original partial data S (2) can be generated from the other divided partial data as follows.

D (2,2) * D (3,2) = (S (2) * R (2)) * R (2)
= S (2) * (R (2) * R (2))
= S (2) * 0
= S (2)
Specifically, since D (2,2) is 00000010 and D (3,2) is 00110101, S (2) is 00110111.

In general, let j be an odd number
D (2, j) * D (3, j) = (S (j) * R (j)) * R (j)
= S (j) * (R (j) * R (j))
= S (j) * 0
= S (j)
Therefore, S (j) can be obtained by calculating D (2, j) * D (3, j).

In general, j is an odd number,
D (2, j + 1) * D (3, j + 1) = (S (j + 1) * R (j + 1)) * R (j + 1)
= S (j + 1) * (R (j + 1) * R (j + 1))
= S (j + 1) * 0
= S (j + 1)
Therefore, S (j + 1) can be obtained by calculating D (2, j + 1) * D (3, j + 1).

  Next, when acquiring D (1) and D (3) and restoring S, it is as follows.

D (1,1) * D (3,1) * D (3,2) = (S (1) * R (1) * R (2)) * R (1) * R (2)
= S (1) * (R (1) * R (1)) * (R (2) * R (2))
= S (1) * 0 * 0
= S (1)
Therefore, S (1) can be obtained by calculating D (1,1) * D (3,1) * D (3,2). Specifically, since D (1,1) is 00110110, D (3,1) is 1010001, and D (3,2) is 0110101, S (1) is 10110010.

Similarly,
D (1,2) * D (3,1) * D (3,2) = (S (2) * R (1) * R (2)) * R (1) * R (2)
= S (2) * (R (1) * R (1)) * (R (2) * R (2))
= S (2) * 0 * 0
= S (2)
Therefore, S (2) can be obtained by calculating D (1,2) * D (3,1) * D (3,2). Specifically, since D (1,2) is 10110011, D (3,1) is 10110001, and D (3,2) is 00110101, S (2) is 00110111.

In general, let j be an odd number
D (1, j) * D (3, j) * D (3, j + 1) = (S (j) * R (j) * R (j + 1)) * R (j) * R (j +1)
= S (j) * (R (j) * R (j)) * (R (j + 1) * R (j + 1))
= S (j) * 0 * 0
= S (j)
Therefore, S (j) can be obtained by calculating D (1, j) * D (3, j) * D (3, j + 1).

In general, j is an odd number,
D (1, j + 1) * D (3, j) * D (3, j + 1) = (S (j + 1) * R (j) * R (j + 1)) * R (j) * R (j + 1)
= S (j + 1) * (R (j) * R (j)) * (R (j + 1) * R (j + 1))
= S (j + 1) * 0 * 0
= S (j + 1)
Therefore, S (j + 1) can be obtained by calculating D (1, j + 1) * D (3, j) * D (3, j + 1).

  Next, when acquiring D (1) and D (2) and restoring S, it is as follows.

D (1,1) * D (2,1) = (S (1) * R (1) * R (2)) * (S (1) * R (1))
= (S (1) * S (1)) * (R (1) * R (1)) * R (2)
= 0 * 0 * R (2)
= R (2)
Therefore, R (2) is obtained by calculating D (1,1) * D (2,1). Specifically, since D (1,1) is 00110110 and D (2,1) is 00000011, R (2) is 00110101.

Similarly,
D (1,2) * D (2,2) = (S (2) * R (1) * R (2)) * (S (2) * R (2))
= (S (2) * S (2)) * R (1) * (R (2) * R (2))
= 0 * R (1) * 0
= R (1)
Therefore, R (1) is obtained by calculating D (1,2) * D (2,2). Specifically, since D (1,2) is 10110011 and D (2,2) is 00000010, R (1) is 10110001.

  Using these R (1) and R (2), S (1) and S (2) are obtained.

D (2,1) * R (1) = (S (1) * R (1)) * R (1)
= S (1) * (R (1) * R (1))
= S (1) * 0
= S (1)
Therefore, S (1) can be obtained by calculating D (2,1) * R (1). Specifically, since D (2,1) is 00000011 and R (1) is 10110001, S (1) is 10110010.

Similarly,
D (2,2) * R (2) = (S (2) * R (2)) * R (2)
= S (2) * (R (2) * R (2))
= S (2) * 0
= S (2)
Therefore, S (2) can be obtained by calculating D (2,2) * R (2). Specifically, since D (2,2) is 00000010 and R (2) is 00110101, S (2) is 00110111.

In general, let j be an odd number
D (1, j) * D (2, j) = (S (j) * R (j) * R (j + 1)) * (S (j) * R (j))
= (S (j) * S (j)) * (R (j) * R (j)) * R (j + 1)
= 0 * 0 * R (j + 1)
= R (j + 1)
Therefore, R (j + 1) can be obtained by calculating D (1, j) * D (2, j).

Similarly,
D (1, j + 1) * D (2, j + 1) = (S (j + 1) * R (j) * R (j + 1)) * (S (j + 1) * R (j +1))
= (S (j + 1) * S (j + 1)) * R (j) * (R (j + 1) * R (j + 1))
= 0 * R (j) * 0
= R (j)
Therefore, R (j) can be obtained by calculating D (1, j + 1) * D (2, j + 1).

  Using these R (j) and R (j + 1), S (j) and S (j + 1) are obtained.

D (2, j) * R (j) = (S (j) * R (j)) * R (j)
= S (j) * (R (j) * R (j))
= S (j) * 0
= S (j)
Therefore, S (j) can be obtained by calculating D (2, j) * R (j).

Similarly,
D (2, j + 1) * R (j + 1) = (S (j + 1) * R (j + 1)) * R (j + 1)
= S (j + 1) * (R (j + 1) * R (j + 1))
= S (j + 1) * 0
= S (j + 1)
Therefore, S (j + 1) is obtained by calculating D (2, j + 1) * R (j + 1).

  As described above, when the divided data is repeatedly generated from the beginning of the original data based on the processing unit bit length b to generate divided data, the three divided data D (1), D (2), D ( Even if not all of 3) is used, the original data can be restored as described above using two divided data of the three divided data.

  As another embodiment of the present invention, the original data can be divided by using a random number R having a bit length shorter than that of the original data S.

  That is, the random number R described above is data having the same bit length as S, D (1), D (2), D (3), but the random number R is shorter than the bit length of the original data S, and the divided data D This short bit length random number R is repeatedly used to generate (1), D (2), and D (3).

  Since the divided data D (3) is generated only from the random number R, the divided data D (3) need not be stored repeatedly with the random number R. For example, when the bit length of the original data S is 1600 bits (200 bytes), the random number R is a repetition of arbitrarily selected 160 bits (20 bytes) of data. That is, R (1) to R (20) are randomly generated, and R (21) to R (200) are R (21) = R (1), R (22) = R (2), ..., R (40) = R (20), R (41) = R (1), R (42) = R (2), ..., R (60) = R (20), R (61) = R (1) , R (62) = R (2), ..., R (80) = R (20), ... ……, R (181) = R (1), R (182) = R (2), ..., R (200) = R (20).

  In the above description, D (3) is generated by defining divided part data D (3, j) as random part data R (j), but it is sufficient to store up to D (3,20). . That is, the length of D (3) is 1/10 of D (1) and D (2). Therefore, the total amount of data to be stored is three times the original data S in the previous embodiment, but can be 2.1 times in this embodiment. If the length of the data of the repetitive part in the random number R is too short, it is possible that R is decoded only from D (1) or D (2). Therefore, it is desirable to select an appropriate length.

In this embodiment, for example, a pseudo-random number generation algorithm is used to generate the random number R. Random numbers include true random numbers that generate random numbers using physical phenomena in nature, and pseudo-random numbers that generate random numbers using computer algorithms. True random numbers are physical phenomena such as rolling dice and noise. However, since it takes a lot of time and equipment, it is instead a definitive algorithm from seeds of appropriate length (information used as seeds for random number generation). A pseudo-random number generated based on is used. For example, if a short random number is used as a seed, a long random number can be obtained. Seed lengths are, for example, 128 bits, 160 bits or more. Even if it is generated based on a definitive algorithm, it satisfies certain characteristics as random numbers such as statistical uniformity and uncorrelation at a certain level. Specific examples include those standardized as ANSI X9, 42, FIPS 186-2 (http://www.ipa.go.jp/security/enc/CRYPTREC/fy15/cryptrec20030425_spec01.html).

  By using these, it is possible to generate a long sequence of pseudo-random numbers using the seed of random number generation as an input. For example, a random number R having the same length as the bit length of the original data S is generated by giving a seed of 160 bits, and D (1) and D (2) are generated from S and R as described above, and D ( In 3), instead of storing R, a 160-bit seed is stored and stored, so that even if the bit length of the original data S increases, the number of bits to be stored and stored in D (3) is 160. Only a bit is required, and the total amount of data to be stored can be reduced. In the case of restoring the original data S, a random number R having the same length as the bit length of the original data S is generated again from the 160-bit seed stored in D (3), and as described above, The original data S can be restored using (1) or D (2).

  In each of the above-described embodiments, the original data is divided into three, and the original data can be restored from two of them. However, when the division number n is larger than 3, the number of divisions is less than n. Of course, the original data can be restored from the data.

  As one application example thereof, division processing in the case where the number of divisions n = 4 for dividing the original data into four pieces of divided data will be described with reference to the flowchart shown in FIG. 5 and the general form of the definition formula shown in FIG. .

  First, the user accesses the dividing device 1 from the terminal 5 and transmits the original data S. In the dividing device 1, the data transmission / reception means 17 receives the original data S from the terminal 5 and supplies it to the dividing device 1 (step). S301). Then, the user instructs the dividing device 1 to 4 as the division number n from the terminal 5 (step S303). A predetermined value in the dividing device 1 may be used as the division number n. Further, the processing unit bit length b is determined to be 8 bits as an example (step S305). Next, it is determined whether or not the bit length of the original data S is an integer multiple of 8 × 3. If the bit length is not an integer multiple, the end of the original data S is filled with 0 (step S307). Further, a variable m meaning an integer multiple is set to 0 (step S309).

  Next, it is determined whether or not there is data for 8 × 3 bits from the 8 × 3 × m + 1 bit of the original data S (step S311). In this example, the case where the original data S is 8 × 3 = 24 bits long data is described.

  As a result of the determination in step S311, the original data S of this example is 8 × 3 = 24 bits of data, and 25 corresponding to 8 × 3 × m (= 1) +1 bits corresponding to the variable m = 1. Since there is no data after the bit, the process proceeds from step S311 to step S321. In this case, since the variable m is 0, the 8 × 3 × m + 1 bit of the original data S is 8th. Since × 3 × 0 + 1 = 1 and data exists for 8 × 3 bits from the first 24 bits of the original data S, the process proceeds to step S313.

  In step S313, the variable j is changed from 1 to 3 (= number of divisions n-1), and 8 bits (= processing unit bits) from the 8 × (3 × m + j−1) +1 bit of the original data S Data) is set to the original partial data S (3 × m + j), thereby dividing the original data S into three original partial data S (1), S (2), S (3) is generated.

  Next, the variable j is changed from 1 to 3, and a random number having a length of 8 bits generated from the random number generating means 15 is set in the random number partial data R (3 × m + j), thereby the random number R is processed. Three random number partial data R (1), R (2), R (3) divided by the bit length are generated (step S315).

  Next, in step S317, the variable i is changed from 1 to 4 (= number of divisions n), and further the variable j is changed from 1 to 3 (= number of divisions n-1) in each variable i, as shown in step S317. Each divided partial data D (i, 3 × m + j) constituting each of the plurality of divided data D (i) is generated by a definition formula for generating divided data. As a result, the following divided data D is generated.

Split data D
= 4 pieces of divided data D (i) = D (1), D (2), D (3), D (4)
First divided data D (1)
= 3 pieces of partial data D (1, j) = D (1,1), D (1,2), D (1,3)
Second divided data D (2)
= 3 pieces of partial data D (2, j) = D (2,1), D (2,2), D (2,3)
Third divided data D (3)
= 3 pieces of divided data D (3, j) = D (3,1), D (3,2), D (3,3)
Fourth divided data D (4)
= 3 divided partial data D (4, j) = D (4,1), D (4,2), D (4,3)
Note that the definition formula shown in step S317 for generating each divided partial data D (i, j) is specifically shown in the table shown in FIG. 6 when the division number n = 4 as in this example. It will be described. From the table shown in FIG. 6, the definition formula for generating the divided partial data D (1,1) is S (1) * R (1) * R (2) * R (3), and D (1,1 The definition of 2) is S (2) * R (1) * R (2) * R (3), and the definition of D (1,3) is S (3) * R (1) * R ( 2) * R (3), the definition of D (2,1) is S (1) * R (1) * R (2), and the definition of D (2,2) is S (2 ) * R (2) * R (3), the definition of D (2,3) is S (3) * R (1) * R (3), the definition of D (3,1) Is S (1) * R (1), the definition of D (3,2) is S (2) * R (2), and the definition of D (3,3) is S (3) * R (3), the definition of D (4,1) is R (1), the definition of D (4,2) is R (2), and the definition of D (4,3) Is R (3). The table shown in FIG. 6 also describes general definition formulas for arbitrary integers when m> 0.

  In this way, after the divided data D is generated for the variable m = 0, the variable m is then incremented by 1 (step S319), the process returns to step S311 and the 25th and subsequent bits of the original data S corresponding to the variable m = 1. Although the same division processing is to be performed, the original data S in this example is 24 bits, and there is no data after 25 bits. Therefore, the process proceeds from step S311 to step S321, and the divided data D ( 1), D (2), D (3), D (4) are respectively transmitted from the data transmitting / receiving means 17 of the dividing apparatus 1 to the storage server 7 via the network 3, stored in each storage server 7, and divided. Exit. In FIG. 1, the number of storage servers is three, but it is desirable to increase the number of storage servers according to the number of divisions and store each piece of divided data in different storage servers.

  Here, the divided data generation processing based on the definition formula in step S317 in the flowchart of FIG. 5 described above, specifically, the divided data generation processing when the number of divisions n = 4 will be described in detail.

  First, the divided partial data D (i, 3 × m + j) constituting each of the divided data D (i) = D (1) to D (4) from the definition formula shown in step S317 is as follows. become.

D (1,3 × m + 1) = S (3 × m + 1) * Q (1,1,1) * Q (1,1,2) * Q (1,1,3)
D (1,3 × m + 2) = S (3 × m + 2) * Q (2,1,1) * Q (2,1,2) * Q (2,1,3)
D (1,3 × m + 3) = S (3 × m + 3) * Q (3,1,1) * Q (3,1,2) * Q (3,1,3)
D (2,3 × m + 1) = S (3 × m + 1) * Q (1,2,1) * Q (1,2,2) * Q (1,2,3)
D (2,3 × m + 2) = S (3 × m + 2) * Q (2,2,1) * Q (2,2,2) * Q (2,2,3)
D (2,3 × m + 3) = S (3 × m + 3) * Q (3,2,1) * Q (3,2,2) * Q (3,2,3)
D (3,3 × m + 1) = S (3 × m + 1) * Q (1,3,1) * Q (1,3,2) * Q (1,3,3)
D (3,3 × m + 2) = S (3 × m + 2) * Q (2,3,1) * Q (2,3,2) * Q (2,3,3)
D (3,3 × m + 3) = S (3 × m + 3) * Q (3,3,1) * Q (3,3,2) * Q (3,3,3)
D (4,3 × m + 1) = R (3 × m + 1)
D (4,3 × m + 2) = R (3 × m + 2)
D (4,3 × m + 3) = R (3 × m + 3)
Next, Q (j, i, k) is specifically obtained. This is the following when c (j, i, k) is the value of i rows and k columns of U [3,3] × (P [3,3]) ^ (j-1) which is a 3 × 3 matrix Is defined as

When c (j, i, k) = 1 Q (j, i, k) = R (3 × m + k)
Q (j, i, k) = 0 when c (j, i, k) = 0
When j = 1

When j = 2

When j = 3

If this is used, each division | segmentation partial data are produced | generated by the following definition formulas.

D (1,3 × m + 1) = S (3 × m + 1) * Q (1,1,1) * Q (1,1,2) * Q (1,1,3)
= S (3 × m + 1) * R (3 × m + 1) * R (3 × m + 2) * R (3 × m + 3)
D (1,3 × m + 2) = S (3 × m + 2) * Q (2,1,1) * Q (2,1,2) * Q (2,1,3)
= S (3 × m + 2) * R (3 × m + 1) * R (3 × m + 2) * R (3 × m + 3)
D (1,3 × m + 3) = S (3 × m + 3) * Q (3,1,1) * Q (3,1,2) * Q (3,1,3)
= S (3 × m + 3) * R (3 × m + 1) * R (3 × m + 2) * R (3 × m + 3)
D (2,3 × m + 1) = S (3 × m + 1) * Q (1,2,1) * Q (1,2,2) * Q (1,2,3)
= S (3 × m + 1) * R (3 × m + 1) * R (3 × m + 2)
D (2,3 × m + 2) = S (3 × m + 2) * Q (2,2,1) * Q (2,2,2) * Q (2,2,3)
= S (3 × m + 2) * R (3 × m + 2) * R (3 × m + 3)
D (2,3 × m + 3) = S (3 × m + 3) * Q (3,2,1) * Q (3,2,2) * Q (3,2,3)
= S (3 × m + 3) * R (3 × m + 1) * R (3 × m + 3)
D (3,3 × m + 1) = S (3 × m + 1) * Q (1,3,1) * Q (1,3,2) * Q (1,3,3)
= S (3 × m + 1) * R (3 × m + 1)
D (3,3 × m + 2) = S (3 × m + 2) * Q (2,3,1) * Q (2,3,2) * Q (2,3,3)
= S (3 × m + 2) * R (3 × m + 2)
D (3,3 × m + 3) = S (3 × m + 3) * Q (3,3,1) * Q (3,3,2) * Q (3,3,3)
= S (3 × m + 3) * R (3 × m + 3)
D (4,3 × m + 1) = R (3 × m + 1)
D (4,3 × m + 2) = R (3 × m + 2)
D (4,3 × m + 3) = R (3 × m + 3)
Here, as described above, the division rule for dividing the original data based on the definition formulas shown in step S217 of FIG. 2 or step S317 of FIG.

  First, original data, random numbers, divided data, the number of divisions, and the processing unit bit length are represented by S, R, D, n, and b, respectively, and i (= 1 to n as a variable representing one of a plurality of n pieces ) And j (= 1 to n-1), multiple (n-1) original partial data, multiple (n-1) random number partial data, multiple (n) divided data, and each divided data One of each of the plurality (n-1) divided partial data is represented by S (j), R (j), D (i), and D (i, j), respectively.

Then, the variable j is changed from 1 to n−1, and each original partial data S (j) is created as data of b bits from the b × (j−1) +1 bit of the original data S. Next, when U [n, n] is an upper triangular matrix that is an n × n matrix and P [n, n] is a rotation matrix that is an n × n matrix, c (j, i, k) is expressed as ( n-1) × (n-1) matrix defined as U [n-1, n-1] × P [n-1, n-1] ^ (j-1) i rows and k columns . And when c (j, i, k) = 1, Q (j, i, k) = R (k), when c (j, i, k) = 0, Q (j, i, k) When = 0 is defined, variable i is changed from 1 to n, and variable j is changed from 1 to n-1 for each variable i.
When i <n, each divided partial data D (i, j) is

And when i = n, each divided data D (i, j)
D (i, j) = R (j)
And set. By repeating the above process from the beginning to the end of the original data S, it is possible to generate divided data of the number n of divisions from the original data S.

  Next, a process for restoring the original data S from the divided data D (1), D (2), D (3), D (4) generated by dividing the original data S into four as described above will be described with reference to FIG. Will be described with reference to FIG. In the case of the four divisions shown in FIG. 6, the variable j is set to 3 × m + 1 (an arbitrary integer satisfying m ≧ 0), and the original data as shown below from the general definition formula shown in FIG. S can be generated.

  First, a case where the original data S is obtained from the divided data D (1) and D (2) will be described.

D (1, j) * D (2, j) = (S (j) * R (j) * R (j + 1) * R (j + 2)) * ((S (j) * R (j ) * R (j + 1))
= (S (j) * S (j)) * (R (j) * R (j)) * (R (j + 1) * R (j + 1)) * R (j + 2)
= 0 * 0 * 0 * R (j + 2)
= R (j + 2)
Therefore, if D (1, j) * D (2, j) is calculated, the random number R (j + 2) is obtained, and D (1, j + 1) * D (2, j + 1) is similarly calculated. If calculated, the random number R (j) is obtained. Similarly, if D (1, j + 2) * D (2, j + 2) is calculated, the random number R (j + 1) is obtained, and these are obtained. Random numbers R (j), R (j + 1), R (j + 2)
D (1, j) * R (j) * R (j + 1) * R (j + 2)
= (S (j) * R (j) * R (j + 1) * R (j + 2)) * (R (j) * R (j + 1) * R (j + 2))
= S (j) * (R (j) * R (j)) * (R (j + 1) * R (j + 1)) * (R (j + 2) * R (j + 2))
= S (j) * 0 * 0 * 0
= S (j)
Therefore, D (1, j) * R (j) * R (j + 1) * R (j + 2) may be calculated to obtain S (j), or D (2, j ) * R (j) * R (j + 1) to obtain S (j).

  Similarly, D (1, j + 1) * R (j) * R (j + 1) * R (j + 2) or D (2, j + 1) * R (j + 1) * R (j + (2) to calculate S (j + 1), and similarly D (1, j + 2) * R (j) * R (j + 1) * R (j + 2) or S (j + 2) can be obtained by calculating D (2, j + 2) * R (j) * R (j + 2).

  Further, as described above, S can be obtained from D (2) and D (3).

  Specifically, R (j), R (j + 1), R (j + 2) are obtained first, and then D (2, j), D (2, j + 1), D (2, j +2) or D (3, j), D (3, j + 1), D (3, j + 2) and R (j), R (j + 1), R (j + 2) Thus, S (j), S (j + 1), and S (j + 2) can be obtained.

  Furthermore, S can be obtained from D (1) and D (4) or D (2) and D (4) or D (3) and D (4).

  Since D (4) defines R from itself, R (j), R (j + 1), R (j + 2) can be obtained from D (4) without calculation. For example, D (1, j), D (1, j + 1), D (1, j + 2) and R (j), R (j + 1), R (j + 2) (j), S (j + 1), S (j + 2) can be obtained.

  As described above, any two pieces of divided data D (1) and D (2), or D (2) and D (3), or D (4) and any arbitrary difference in the number of operations is 1. S can be restored from one piece of divided data D (1), D (2) or D (3). In other words, if any three divided data are obtained from the four divided data, any of the cases described above is included in the data, so the original data is restored from any three of the four divided data. Is possible.

  FIG. 7 is a table showing divided data and definition formulas in the case of five divisions. In the case of 5 divisions, j is 4 × m + 1 (m is an arbitrary integer satisfying m ≧ 0), and the same processing as the above-described restoration processing in the case of 4 divisions can be said from the definition formula of divided data. . Therefore, any two divided data D (1) and D (2), or D (2) and D (3), or D (3) and D (4), whose difference in the number of operations is 1, Alternatively, the original data S can be restored from D (5) and any one piece of divided data D (1) or D (2) or D (3) or D (4). If any three pieces of divided data are acquired from the five pieces of divided data, any one of these cases is always included therein, so that it can be restored from any three of the five pieces.

  Further, when the number of divisions n is greater than 5, if the divided data is configured in the same manner, (n + 1) / 2 when n is an odd number, and (n / 2) when n is an even number. ) The original data can be restored from +1 piece of divided data. This number is obtained by adding 1 to the maximum number that does not select adjacent data and does not select the nth divided data when there are n divided data. In other words, if 1 is added to the maximum number, two divided data whose difference in the number of operations is 1, or the nth divided data and other data are necessarily included, and the number required for restoration is as described above. It can be said.

  Next, a general division process when the number of divisions is n and the processing unit bit length is b will be described with reference to the flowchart shown in FIG.

  First, the user accesses the dividing device 1 from the terminal 5 and transmits the original data S. In the dividing device 1, the data transmission / reception means 17 receives the original data S from the terminal 5 and supplies it to the dividing device 1 (step). S401). Further, the user instructs the dividing device 1 from the terminal 5 about the division number n (an arbitrary integer satisfying n ≧ 3) (step S403). A predetermined value in the dividing device 1 may be used as the division number n. The processing unit bit length b is determined (step S405). Note that b is an arbitrary integer greater than 0. Next, it is determined whether or not the bit length of the original data S is an integer multiple of b × (n−1). If it is not an integer multiple, the end of the original data S is filled with 0 (step S407). Further, a variable m meaning an integer multiple is set to 0 (step S409).

  Next, it is determined whether or not there is data of b × (n−1) bits from the b × (n−1) × m + 1 bit of the original data S (step S411). As a result of this determination, if there is no data, the process proceeds to step S421. However, in this case, since the variable m is set to 0 in step S409, the data exists, so step S413. Proceed to

  In step S413, the variable j is changed from 1 to n−1, and b bits ((n−1) × m + j−1) +1 bits of the original data S are converted to the original partial data S. ((n-1) × m + j) is repeated, whereby (n-1) pieces of original partial data S (1), S (2 ),... S (n-1) is generated.

  Next, the variable j is changed from 1 to n-1, and a random number of the processing unit bit length b generated from the random number generation means 15 is set in the random number partial data R ((n-1) × m + j). Thus, n-1 random number partial data R (1), R (2),... R (n-1) obtained by dividing the random number R by the processing unit bit length b are generated (step S415).

  Next, in step S417, while changing the variable i from 1 to n and further changing the variable j from 1 to n-1 in each variable i, a plurality of definition expressions for generating the divided data shown in step S417 are used. Each divided partial data D (i, (n−1) × m + j) constituting each of the divided data D (i) is generated. As a result, the following divided data D is generated.

Split data D
= n pieces of divided data D (i) = D (1), D (2), ... D (n)
First divided data D (1)
= n-1 divided partial data D (1, j) = D (1,1), D (1,2), ... D (1, n-1)
Second divided data D (2)
= n-1 divided partial data D (2, j) = D (2,1), D (2,2), ... D (2, n-1)
………
………
N-th divided data D (n)
= n-1 divided partial data D (n, j) = D (n, 1), D (n, 2), ... D (n, n-1)
In this way, after generating the divided data D for the variable m = 0, the variable m is then incremented by 1 (step S419), and the process returns to step S411 to return b × (n of the original data S corresponding to the variable m = 1. -1) Similar division processing is performed for the bits after the bit. Finally, if there is no data in the original data S as a result of the determination in step S411, the process proceeds from step S411 to step S421, and the divided data D generated as described above is transferred from the data transmitting / receiving unit 17 of the dividing apparatus 1 via the network 3. Are transmitted to the storage servers 7 and stored in the storage servers 7, and the division process is terminated. In FIG. 1, the number of storage servers is three, but it is desirable to increase the number of storage servers according to the number of divisions and store each piece of divided data in different storage servers.

  Next, with reference to the flowchart shown in FIG. 9, the division process when the division number n is 2 will be described. That is, since each embodiment described above is for the case where the division number n is 3 or more (n ≧ 3) as shown in step S403 of the flowchart of FIG. 8, the division number n is 2 using FIG. The case will be described.

First, the user accesses the dividing device 1 from the terminal 5 and supplies the original data S to the dividing device 1 (step S501). In addition, the user instructs the dividing apparatus 1 to 2 as the division number n from the terminal 5 (step S503). A predetermined value in the dividing device 1 may be used as the division number n. Then, 8 bits are determined as the processing unit bit length b (step S505). Next, it is determined whether or not the bit length of the original data S is an integer multiple of 8. If the bit length is not an integer multiple, the end of the original data S is filled with 0 (step S507). Further, a variable m meaning an integer multiple is set to 0 (step S509).

  Next, it is determined whether or not there is data for 8 bits from the 8 × m + 1 bit of the original data S (step S511). If there is no data as a result of this determination, the process proceeds to step S521. In this case, since the variable m is set to 0, the process proceeds to step S513 because the data exists.

  In step S513, data of 8 bits from the 8 × m + 1 bit of the original data S is set as the original partial data S (m + 1), thereby generating the original partial data S (1).

  Next, an 8-bit random number generated from the random number generation means 15 is set in the random number partial data R (m + 1), thereby generating random number partial data R (1) (step S515).

  Next, in step S517, the divided data D (1, m + 1) and D (2, m + 1) constituting each of the divided data D are generated by the definition formula shown in the step.

  As described above, after the divided data D is generated for the variable m = 0, the variable m is then incremented by 1 (step S519), the process returns to step S511, and the subsequent 8 bits of the original data S corresponding to the variable m = 1. A similar division process is performed. Finally, if there is no data in the original data S as a result of the determination in step S511, the process proceeds from step S511 to step S521, and the divided data D (1) to D (2) generated as described above are used as the data of the dividing device 1. The data is transmitted from the transmission / reception means 17 to the storage server 7 via the network 3, stored in each storage server 7, and the division process is terminated. In FIG. 1, there are three storage servers, but each of the divided data may be stored in two of the storage servers.

  Here, the divided data generation process based on the definition formula in step S517 in the flowchart of FIG. 9 described above, specifically, the divided data generation process when the number of divisions n = 2 will be described in detail.

  When the variable m = 0, the divided data D (1,1) and D (2,1) are as follows from the definition formula shown in step S517.

D (1,1) = S (1) * Q (1,1,1)
D (2,1) = R (1)
Next, Q (j, i, k) is specifically obtained. Here, if n = 2 is applied to the definition, j, i, and k take only 1 values.

  c (j, i, k) is the value of i rows and k columns of U [1,1] × (P [1,1]) ^ (j-1) which is a 1 × 1 matrix as follows: Defined.

When c (j, i, k) = 1 Q (j, i, k) = R (k)
Q (j, i, k) = 0 when c (j, i, k) = 0
U [1,1] × (P [1,1]) ^ (j-1) = U [1,1] × (P [1,1]) ^ 0
= (1) × E [1,1]
= (1) × (1)
= (1)
Therefore, since c (1,1,1) is 1, Q (1,1,1) is defined as R (1).

From the above, the definition formula is
D (1,1) = S (1) * R (1)
D (2,1) = R (1)
It becomes. In the format using the variable m,
D (1, m + 1) = S (m + 1) * R (m + 1)
D (2, m + 1) = R (m + 1)
It becomes.

  When the number of divisions n = 2, the original data S cannot be restored by acquiring only one of the two divided data, and all the two divided data are acquired. Thus, the original data S is restored.

  In the embodiment described above, the random number component may be lost by performing an operation between the partial data constituting only the divided data. That is, for example, in the case of three divisions, each divided partial data is defined as follows.

D (1,1) = S (1) * R (1) * R (2), D (1,2) = S (2) * R (1) * R (2),…
D (2,1) = S (1) * R (1), D (2,2) = S (2) * R (2),…
D (3,1) = R (1), D (3,2) = R (2),…
Looking at D (1), for example, if D (1,1) and D (1,2) can be acquired,
D (1,1) * D (1,2) = (S (1) * R (1) * R (2)) * (S (2) * R (1) * R (2))
= S (1) * S (2) * ((R (1) * R (1)) * ((R (2) * R (2))
= S (1) * S (2) * 0 * 0
= S (1) * S (2)
It becomes. In general, D (1, j) * D (1, j + 1) = S (j) * S (j + 1). Here, j is j = 2 × m + 1, and m is an arbitrary integer satisfying m ≧ 0.

From the above definition, D (1,1) and D (1,2) are generated by the calculation of the original data and random numbers, and D (1,1) and D (1,2) are D (1,1) * D (1,2) is not understood from the original data
S (1) * S (2) is calculated by performing the above calculation. This is not the original data itself, but does not include a random number component.

  If the random component is lost in this way, for each original partial data, for example, if part of S (2) is known, part of S (1) can be restored, so it is not safe. Conceivable. For example, the original data is data according to a standardized data format, and S (2) includes header information and padding (for example, a part of the data area padded with 0), etc. If it is a part, it includes keywords specific to these data formats, fixed character strings, and the like, so the contents can be predicted. Further, a part of S (1) can be restored from the known part of S (2) and the value of S (1) * S (2).

  In the case of four divisions, from FIG. 6, D (2, j) * D (2, j + 1) * D (2, j + 2) = S (j) * S (j + 1) * S (j +2). Here, j is j = 3 × m + 1, and m is an arbitrary integer satisfying m ≧ 0.

  In the case of 5 divisions, from FIG. 7, D (i, j) * D (i, j + 1) * D (i, j + 2) * D (i, j + 3) = S (j) * S (j + 1) * S (j + 2) * S (j + 3). Here, i is 1 or 3, j is j = 4 × m + 1, and m is an arbitrary integer satisfying m ≧ 0.

  When the number of divisions is greater than 5, the random number component is lost in the same manner. Such a problem does not occur when the number of divisions is 2.

  One way to solve this problem is as follows. This is a method applicable to the case of three divisions. D (1, j + 1) and D (2, j + 1) in FIG. 10 are obtained by replacing D (1, j + 1) and D (2, j + 1) in FIG. Here, j is j = 2 × m + 1, and m is an arbitrary integer satisfying m ≧ 0.

In this case, with only the individual divided data, the random number component is not lost even if the calculation is performed between the divided partial data constituting the divided data. This is from FIG.
D (1, j) * D (1, j + 1) = (S (j) * R (j) * R (j + 1)) * (S (j + 1) * R (j + 1))
= S (j) * S (j + 1) * R (j) * ((R (j + 1) * R (j + 1))
= S (j) * S (j + 1) * R (j) * 0
= S (j) * S (j + 1) * R (j)
D (2, j) * D (2, j + 1) = (S (j) * R (j)) * (S (j + 1) * R (j) * R (j + 1))
= S (j) * S (j + 1) * (R (j) * R (j)) * R (j + 1))
= S (j) * S (j + 1) * 0 * R (j + 1)
= S (j) * S (j + 1) * R (j + 1)
D (3, j) * D (3, j + 1) = R (j) * R (j + 1)
Because it becomes.

  In this case, the characteristic that the original data can be restored from two of the three divided data is not lost. This is because when D (1) and D (2) are obtained and S is restored, D (1) and D (2) in FIG. 10 are D (1) and D (2) in FIG. Is simply a replacement of the divided part data, so the original data can obviously be restored from these, and D (1) and D (3) or D (2) and D (3) When acquiring and restoring S, since D (3) is divided data consisting only of random numbers, it is exclusive with the required number of random numbers for each divided partial data of D (1) or D (2). This is because the original data can be restored by erasing the random number portion by performing a logical OR operation.

  Another way to solve the above problem is as follows. This is a method applicable when the number of divisions is 3 or more regardless of the number of divisions. 11, 12, and 13 are obtained by deleting R (j) from individual definition formulas that generate D (i, j) in FIGS. 4, 6, and 7. Here, i is n−1> i> 0, j is j = (n−1) × m + 1, m is an arbitrary integer of m ≧ 0, and n is the number of divisions. This is the same even when the number of divisions is larger than five.

  Also in this case, with only individual divided data, the random number component is not lost even if calculation is performed between the divided partial data constituting the divided data. 4, 6, and 7, the random number portion is erased when an operation is performed between the divided portion data of individual divided data, and in the case of three divisions, D (1, j) * D (1 , j + 1) = S (j) * S (j + 1) (j is an arbitrary integer satisfying j = 2 × m + 1, m is m ≧ 0), and in the case of four divisions, D (2, j) * D (2, j + 1) * D (2, j + 2) = S (j) * (S (j + 1) * S (j + 2) (j is j = 3 × m + 1, m is m ≥0, any integer), and in the case of 5 divisions, D (i, j) * D (i, j + 1) * D (i, j + 2) * D (i, j + 3) = S (j) * S (j + 1) * S (j + 2) * S (j + 3) (i is 1 or 3, j is j = 4 × m + 1, m is an arbitrary integer of m ≧ 0) and However, as described above, R (j) is deleted from each definition formula that generates D (i, j) (i is n-1> i> 0, j is j = (n-1) × This is because m + 1 and m are arbitrary integers of m ≧ 0, and n is the number of divisions), so that one R (j) remains without being erased.

  Also in this case, the characteristic that original data can be restored from a predetermined number of pieces of divided data among n pieces of divided data is not lost.

First, in the case of three divisions, when acquiring D (1) and D (2) and restoring S, as described above, R (j) (j is j = 2 × m + 1, m is m ≧ 0) Any integer) is obtained from D (1, j) * D (2, j + 1), and S (j) is
D (2, j) * R (j) = S (j) * R (j) * R (j)
= S (j) * 0
= S (j)
R (j + 1) is obtained from
D (1, j) * S (j) = S (j) * R (j + 1) * S (j)
= S (j) * S (j) * R (j + 1)
= 0 * R (j + 1)
= R (j + 1)
S (j + 1) is obtained from D (2, j + 1) * R (j + 1) as described above. Further, when S is restored by acquiring D (1) and D (3) or D (2) and D (3), since D (3) is divided data consisting only of random numbers, D (3) By performing an exclusive OR operation with a required number of random numbers for each divided partial data of 1) or D (2), it is possible to erase the random number part and restore the original data.

Next, in the case of 4 divisions, when D (1) and D (2) are acquired and S is restored, R (j + 2) is
D (1, j) * D (2, j) = (S (j) * R (j + 1) * R (j + 2)) * (S (j) * R (j + 1))
= (S (j) * S (j)) * (R (j + 1) * R (j + 1)) * R (j + 2)
= 0 * 0 * R (j + 2)
= R (j + 2)
As described above, S (j) is obtained from D (1, j) * R (j + 1) * R (j + 2) or D (2, j) * R (j + 1).

In addition, when acquiring D (2) and D (3) and restoring S, as described above, R (j + 2) becomes D (2, j + 1) * D (3, j + 1) R (j) is obtained from D (2, j + 2) * D (3, j + 2) and S (j) is obtained from
D (3, j) * R (j) = (S (j) * R (j)) * R (j)
= S (j) * (R (j) * R (j))
= S (j) * 0
= S (j)
R (j + 1) is obtained from
D (2, j) * S (j) = (S (j) * R (j + 1)) * S (j)
= (S (j) * S (j)) * R (j + 1)
= 0 * R (j + 1)
= R (j + 1)
As described above, S (j) is obtained from D (1, j) * R (j + 1) * R (j + 2) or D (2, j) * R (j + 1).

  When D (4) and any one piece of divided data D (1) or D (2) or D (3) are acquired and S is restored, D (4) is divided data consisting only of random numbers. Therefore, by performing an exclusive OR operation with the required number of random numbers for each divided partial data of D (1), D (2), or D (3), the random number part is deleted and the original data is deleted. Can be restored.

  Therefore, any two divided data D (1) and D (2), or D (2) and D (3), or D (4) and any one divided data whose difference in the number of operations is 1. S can be restored from data D (1) or D (2) or D (3). In other words, if any three divided data are obtained from the four divided data, any of the cases described above is included in the data, so the original data is restored from any three of the four divided data. Is possible.

  Next, in the case of five divisions, when restoring D by acquiring D (1) and D (2) or D (2) and D (3), D (3) and D (4) are acquired. When S is restored, 4 (D) and any one of the divided data D (1) or D (2) or D (3) or D (4) are acquired to restore S. The same as in the case of division.

  Therefore, any two divided data D (1) and D (2), or D (2) and D (3), or D (3) and D (4), whose difference in the number of operations is 1, Alternatively, the original data S can be restored from D (5) and any one piece of divided data D (1) or D (2) or D (3) or D (4). If any three pieces of divided data are acquired from the five pieces of divided data, any one of these cases is always included therein, so that it can be restored from any three of the five pieces.

  Further, when the number of divisions n is greater than 5, if the divided data is configured in the same manner, (n + 1) / 2 when n is an odd number, and (n / 2) when n is an even number. ) The original data can be restored from +1 piece of divided data. This number is obtained by adding 1 to the maximum number that does not select adjacent data and does not select the nth divided data when there are n divided data. In other words, if 1 is added to the maximum number, two divided data whose difference in the number of operations is 1, or the nth divided data and other data are necessarily included, and the number required for restoration is as described above. It can be said.

  The processing procedure of the data division method of the above embodiment is recorded on a recording medium such as a CD or FD as a program and the recording medium is incorporated into a computer system, or the program recorded on the recording medium is connected to a communication line. Of course, it is possible to function as a data dividing device that implements the data dividing method by downloading to a computer system or installing from a recording medium and operating the computer system with the program. By using a recording medium, the circulation property can be improved.

  As described above, according to the present embodiment, the predetermined defining expression is composed of an exclusive OR of the original partial data and the random partial data, so that a high-speed and high-performance calculation that performs a polynomial or remainder calculation as in the past. No processing capability is required, and it is possible to easily and quickly generate divided data by repeating simple arithmetic processing even for large volumes of data.

  In addition, since the original data is restored by applying the definition formula to the divided data that is smaller than the number of divided data among the plurality of generated divided data, the original data can be generated with any number of divided data smaller than the number of divided data. Data can be restored, and original data can be restored even if divided data up to the number obtained by subtracting x from the number of divisions is lost or destroyed.

  Further, the original data is received from the terminal via the network, and the original partial data, the random number partial data, and the divided partial data are generated on the original data, and a plurality of pieces of the divided partial data are generated via the network. Since the data is transmitted to the storage server and stored, a large number of users can access the terminal from the terminal via the network and request division processing, thereby achieving commonality and economy.

  In the above-described embodiment, the divided data is composed of one piece of divided data consisting only of random numbers, and divided partial data generated by exclusive OR operation of one original partial data and one or more random number partial data. In the case of including one or more pieces of divided data, the above-described embodiment is modified so that the divided data includes one or more pieces of divided data composed of only random numbers, one or more original partial data, and one or more random numbers. It may include one or more pieces of divided data composed of divided partial data generated by exclusive OR operation of partial data. Further, by modifying the above-described embodiment, the divided data is divided into two or more divided pieces of divided partial data generated by exclusive OR operation of one or more original partial data and one or more random number partial data. Data may be included.

1 is a system configuration diagram including a data dividing apparatus that performs a data dividing method according to an embodiment of the present invention. 7 is a flowchart showing a division process when the number of divisions n = 3 in the data division apparatus of the embodiment shown in FIG. 1. Each data and definition formula when 16-bit original data S is divided into three with a division number n = 3 based on the 8-bit processing unit bit length, and a calculation formula when restoring the original data from each divided partial data, etc. It is a table | surface which shows. It is a table | surface which shows the definition formula which produces | generates the division data, division | segmentation partial data, and each division | segmentation partial data in case division number n = 3. 7 is a flowchart showing a division process when the number of divisions n = 4 of the data division apparatus of the embodiment shown in FIG. 1. It is a table | surface which shows the definition formula which produces | generates the division data, division | segmentation partial data, and each division | segmentation partial data in case division number n = 4. It is a table | surface which shows the definition formula which produces | generates the division data, division | segmentation partial data, and each division | segmentation partial data in case the division number n = 5. 2 is a flowchart showing a general division process when the number of divisions of the data division apparatus of the embodiment shown in FIG. 1 is n and the processing unit bit length is b. It is a flowchart which shows a division | segmentation process in case the division | segmentation number of the data division | segmentation apparatus of embodiment shown in FIG. 12 is a table showing another example of definition data for generating divided data, divided partial data, and divided partial data when the number of divisions n = 3. 12 is a table showing still another example of definition data for generating divided data, divided partial data, and divided partial data when the number of divisions n = 3. 12 is a table showing another example of definition data for generating divided data, divided partial data, and divided partial data when the number of divisions n = 4. 10 is a table showing another example of definition data for generating divided data, divided partial data, and divided partial data when the number of divisions n = 5.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Dividing apparatus 3 Network 5 Terminal 7a, 7b, 7c Storage server 11 Divided data generation means 13 Original data restoration means 15 Random number generation means 17 Data transmission / reception means

Claims (2)

Create four or more encrypted data from the target data using the secret sharing method, and combine different m pieces (2 ≦ m) of the created four or more pieces of data. 1 data cannot be restored, the target data can be restored by collecting k data (2 ≦ k ≦ n−1), and n pieces of encrypted distributed data (n is an integer of 4 or more) Distributed data creation means to create;
N storage units that are provided at different locations and store each of the distributed data one by one,
Each of the distributed data is individually transported from a transport source via a network, and stored in each storage unit in a state of being individually stored in a predetermined recording medium. The data storage system according to claim 1, further comprising a restoring unit that restores the target data using at least k pieces of each of the distributed data stored in the storage unit.

Images