JP2008145917A - Threshold secret sharing apparatus, threshold secret sharing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a threshold secret sharing apparatus, a threshold secret sharing method and a program, capable of performing high-speed calculation by use of XOR, and to provide a general (3, n) threshold secret sharing method. <P>SOLUTION: Secret information K is divided into (n<SB>p</SB>-1) pieces (n<SB>p</SB>is a prime number satisfying n<SB>p</SB>≥ n, based on the sharing number n) of partial secret information K<SB>q</SB>; dummy secret information K<SB>0</SB>is produced; a random number R<SB>m</SB>and a random number T<SB>1</SB>, independent of each other, are generated; and with the dummy secret information K<SB>0</SB>, the partial secret information K<SB>q</SB>, the random number R<SB>m</SB>and the random number T<SB>1</SB>, partial sharing information is produced by an exclusive-OR (XOR) operation so that sharing information S<SB>i</SB>is generated by linking the partial sharing information for constituting a (3, n) threshold secret sharing method. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a threshold secret sharing apparatus, a threshold secret sharing method, and a program for protecting confidential information.

  In recent years, with the increasing importance of information security, measures against theft and loss of information have become important issues. For this reason, the (k, n) threshold secret sharing method as shown in Non-Patent Document 1 is attracting attention as a method for simultaneously realizing confidentiality of information and avoidance of risk due to loss. Here, (k, n) threshold secret sharing means that secret information is distributed into n pieces of shared information, and if any k pieces of shared information are gathered, it can be restored.

  However, the (k, n) threshold secret sharing method shown in Non-Patent Document 1 needs to process a (k−1) -order polynomial when distributing and restoring information, and the amount of calculation is enormous. Become. Therefore, as shown in Non-Patent Document 2, a (2, n) threshold secret sharing method that can be distributed and restored at high speed using exclusive OR (XOR) has been proposed.

On the other hand, (3, 5) threshold secret sharing method and (3, 7) threshold secret sharing method are proposed in Non-Patent Document 3 as threshold secret sharing methods using XOR other than threshold 2. The (3, n) threshold secret sharing method has not yet been proposed. Also, Non-Patent Document 4 proposes a (k, n) threshold secret sharing method that can be distributed and restored at high speed using XOR or additive operation. Compared to the data length of the secret information, the data of the distributed information The length is several times larger and the efficiency is poor. Further, Patent Document 1 proposes a (k, n) threshold secret sharing method, but secret information may be restored even when a smaller number of pieces of shared information are available. It does not satisfy generality as a secret sharing method.
A. Shamir, “How to Share a Secret,” Commun. ACM, vol. 22 no. 11 pp. 612-613, 1979. Yoshihiro Fujii, Minako Tada, Norikazu Hosaka, Takaya Tochikubo, Takehisa Kato, “Structure Method of Fast (2, n) Threshold Method and Application to System,” CSS 2005 Proceedings, 2005. Minako Tada, Yoshihiro Fujii, Norikazu Hosaka, Takaya Tochikubo, Takehisa Kato, “Structure of secret sharing method with threshold 3” CSS 2005 Proceedings, 2005. Nobuyuki Shiina, Ken Okamoto, Eiji Okamoto, “How to raise from 1-out-of-n proof to k-out-of-n proof” SCIS 2004 Proceedings, 2004. JP 2006-18850 A

  As described above, the (k, n) threshold secret sharing method disclosed in Non-Patent Document 1 has a problem that the amount of calculation becomes enormous. Further, the method shown in Non-Patent Document 4 has a problem that the data length of the distributed information is several times larger than that of the secret information. Thus, there is a demand for an efficient threshold secret sharing method that enables high-speed computation using XOR and that the data length of the shared information is equal to the data length of the secret information. The current (3, n) threshold secret sharing scheme has not yet been proposed.

  Therefore, the present invention has been made in view of the above-described problems, and high-speed calculation is possible by using XOR. The data lengths of secret information and shared information are equal, and general (3, n It is an object of the present invention to provide a threshold secret sharing apparatus, a threshold secret sharing method, and a program that can constitute a threshold secret sharing method.

In order to solve the above-described problems, the present invention proposes the following matters.
(1) The present invention divides the secret information K into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n for the distributed number n) (for example, FIG. and corresponding to one of the divider 11), dummy information generator for generating dummy portions secret information K ₀ (e.g., equivalent to the dummy information generator 12 of FIG. 1), first generate mutually independent random numbers R _m 1 A random number generator (for example, corresponding to the random number generator 14 in FIG. 1), a second random number generator (for example, corresponding to the random number generator 15 in FIG. 1) for generating random numbers T ₁ independent from each other, and a dummy A partial shared information generator (for example, a partial shared information generator that generates partial shared information by an exclusive OR (XOR) operation) using the partial secret information K ₀ and the partial secret information K _q , the random number R _m, and the random number T _l . Corresponding to the partial shared information generator 13 in FIG. 1) and the partial shared information. Thus, a threshold secret sharing apparatus is proposed that includes a coupler (for example, equivalent to the coupler 16 in FIG. 1) that generates the shared information S _i .

According to the present invention, the divider divides the secret information K into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n for the distributed number n) to generate dummy information The generator generates dummy partial secret information K ₀ , the first random number generator generates a random number R _m independent of each other, and the second random number generator generates a random number T ₁ independent of each other. Then, the partial shared information generator uses the dummy partial secret information K ₀ and the partial secret information K _q , the random number R _m, and the random number T _l to generate partial shared information by an exclusive OR (XOR) operation. At the same time, the coupler generates the shared information S _i by connecting the partial shared information. Therefore, a general (3, n) threshold secret sharing apparatus can be configured using exclusive OR (XOR).

(2) The present invention includes a first step of dividing the secret information K into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n with respect to the distributed number n); A second step for generating dummy partial secret information K ₀ , a third step for generating mutually independent random numbers R _m and mutually independent random numbers T ₁ , dummy partial secret information K ₀ and partial secret information K _q , , A fourth step of generating partial shared information by an exclusive OR (XOR) operation using the random number R _m and the random number T _l, and generating the shared information S _i by connecting the partial shared information. And a threshold secret sharing method characterized by comprising a fifth step.

According to the present invention, the secret information K is divided into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n with respect to the distributed number n), and dummy partial secret information K _{0 is obtained.} To generate a random number R _m independent from each other and a random number T _l independent from each other, and using the dummy partial secret information K ₀ and the partial secret information K _q , the random number R _m and the random number T _l Partial disperse information is generated by a logical sum (XOR) operation, and the disperse information S _i is generated by concatenating the partial disperse information. Therefore, a general (3, n) threshold secret sharing scheme can be constructed using an exclusive OR (XOR) operation.

(3) In the present invention, the computer divides the secret information K into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n with respect to the distributed number n). A second step for generating dummy partial secret information K ₀ , a third step for generating mutually independent random numbers R _m and mutually independent random numbers T ₁ , dummy partial secret information K ₀ and partial secret information A fourth step of generating partial shared information by exclusive OR (XOR) operation using K _q , random number R _m and random number T _l, and connecting the partial shared information to share information S _i And a program for executing the fifth step.

According to the present invention, the secret information K is divided into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n with respect to the distributed number n), and dummy partial secret information K _{0 is obtained.} To generate a random number R _m independent from each other and a random number T _l independent from each other, and using the dummy partial secret information K ₀ and the partial secret information K _q , the random number R _m and the random number T _l Partial disperse information is generated by a logical sum (XOR) operation, and the disperse information S _i is generated by concatenating the partial disperse information. Therefore, it is possible to provide a program capable of realizing a general (3, n) threshold secret sharing method using an exclusive OR (XOR) operation.

  According to the present invention, a general (3, n) threshold secret sharing scheme can be constructed using exclusive OR (XOR). For this reason, since dispersion and restoration can be performed by XOR operation, there is an effect that high-speed processing becomes possible.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
In this embodiment, secret information is distributed and restored by the (3, n) threshold method. FIG. 1 is a functional block diagram showing an overview of a distributed information generation and distribution apparatus according to this embodiment.

In FIG. 1, secret information K is sent to a divider 11 and divided into (n _p −1) pieces of partial secret information K _q . Further, dummy partial secret information K ₀ is generated by the dummy information generator 12. The dummy partial secret information K ₀ and the partial secret information K _q are sent to the partial shared information generator 13.

The random number generator 14 generates random numbers Rm that are independent of each other. The random number generator 15 generates random numbers T ₁ that are independent of each other. The random number Rm from the random number generator 14 and the random number T ₁ from the random number generator 15 are sent to the partial shared information generator 13.

The partial shared information generator 13 includes dummy partial secret information K ₀ and (n _p −1) pieces of partial secret information K _q , a random number R _m from the random number generator 14, and a random number T _l from the random number generator 15. Is used to generate partial dispersion information by an exclusive OR (XOR) operation. This partial shared information is linked by the coupler 16 to generate shared information S _i . The shared information S _i is securely transmitted to the administrator P _i by the transmission device 17.

In the present embodiment, the secret information K can be distributed to the distributed information S _i of the distribution number n by a general (3, n) threshold secret sharing method of the distribution number n. In addition, since the operation necessary for distribution is exclusive OR (XOR), high-speed operation can be performed.

In the present invention, it is necessary to equally divide the secret information into (n _p −1) pieces. However, n _p is a prime number satisfying n _p ≧ n for the dispersion number n. Therefore, when the desired variance number n is a composite number, by using n pieces of variance information of the (3, n _p ) threshold method using prime numbers n _p satisfying n _p > n, (3, n) Realize the threshold method.

  The threshold secret sharing method of this embodiment will be described in detail. First, prior to describing the threshold secret sharing method of the present embodiment, operators and symbols used in this specification are defined as follows.

  First, the distributed processing method will be described. In the threshold secret sharing method of this embodiment, the (3, n) threshold secret sharing method is realized by performing distributed processing according to the following procedure.

As described above, in the present invention, it is necessary to equally divide the secret information K into (n _p −1) pieces, and n _p is a prime number that satisfies n _p ≧ n with respect to the number of distributions n. Therefore, when the desired distribution number n is a composite number, by using n pieces of distribution information of (3, n _p ) threshold secret sharing method using prime number n _p satisfying n _p > n, ( 3, n) Realize the threshold method.

(Step 1)
The secret information K is divided into (n _p −1) partial secret information K _q .

(Step 2)
It generates partial secret information K ₀ of the dummy.

(Step 3)
(N _p −1) random numbers R _m and n _p random numbers T ₁ are generated.

(Step 4)
The partial distribution information S _{(i, m)} is generated by the XOR operation as follows.

(Step 5)
As shown below, (n _p −1) pieces of partial shared information S _{(i, m)} (0 ≦ m ≦ n _p −2) are concatenated to generate shared information S _i , and secure to the administrator P _i Distribute.

  The configuration table of the partial shared information configured by the above steps is as shown in Table 1. The number of bits distributed to one manager is equal to the number of bits of K.

  As a specific example, the configuration table of partial shared information in the (3, 5) threshold secret sharing method is as shown in Table 2.

  Next, the restoration method will be described. Restoration is performed using the decompressor 21 shown in FIG. This is a three-input one-output device. When four or more managers gather, the distributed information is obtained from any three of these managers and input to the device.

Hereinafter, the procedure of the restoration process will be described. As a premise, it is assumed that three managers P _i , P _j , P _k (0 ≦ i <j <k ≦ n _p −2) are gathered, and the three pieces of shared information S _i , S _j , S _k are secret. The information is input to the information restorer 21.

  Also, x and y are defined as follows.

(Step 1) Each of the three pieces of shared information S _i , S _j , S _k is divided into partial shared information. That is, the following 3 (n _p −1) pieces of partial dispersion information are obtained.

(Step 2)
U _{(i, k, m)} and U _{(j, k, m)} defined below are obtained for all m (0 ≦ m ≦ n _p −2).

(Step 3)
The minimum natural number r that satisfies the following equation is obtained.

(Step 4)
The following sub-steps are performed for all m (0 ≦ m ≦ n _p −2).

(Substep 4-i)
It is verified whether or not s satisfying the following expression exists in the range of the variable s (0 ≦ s ≦ r−1).

  If s satisfying the above equation does not exist, the process of substep (4-ii-a) is performed. If it exists, the sub-step (4-ii-b) is processed.

(Substep 4-ii-a)
Next, A _{(i, k, m)} to be defined is _obtained .

(Substep 4-ii-b)
Next, A _{(i, k, m)} to be defined is _obtained .

(Step 5)
The minimum natural number v satisfying the following formula is obtained.

(Step 6)
The following sub-steps are performed for all m (0 ≦ m ≦ n _p −2).

(Substep 6-i)
It is verified whether or not t satisfying the following expression exists within the range of variable t (0 ≦ t ≦ v−1).

  When t satisfying the above equation does not exist, the process of sub-step 6-ii-a is performed. If it exists, the process of sub-step 6-ii-b is performed.

(Substep 6-ii-a)
Next, A _{(j, k, m)} to be defined is _obtained .

(Substep 6-ii-b)
Next, A _{(j, k, m)} to be defined is _obtained .

(Step 7)
Next, W _{(i, j, k, m)} defined next is obtained for all m (0 ≦ m ≦ n _p −2).

(Step 7)
Dividing into the following sub-steps, all partial secret information K _q (1 ≦ q ≦ n _p −1) is restored.

(Substep 8-i)
When there exists m (0 ≦ m ≦ n _p −2) for which the following equation holds,

  The m satisfying the above equation is set as m ′, and the following sequential processing is performed while increasing w of the initial value 0 below by 1 until the end condition is satisfied.

（ｍ’−２ｗｘ＝ｎ_ｐ−１）を終了条件とし、（ｍ’−２ｗｘ＝ｎ_ｐ−１）になったら処理を打ち切って、サブステップ８−ｉｉに行く。

And _{(m'-2wx = n p -1} ) termination conditions, _{(m'-2wx = n p -1} ) since Once it aborted the process goes to sub-step 8-ii.

(Substep 8-ii)
When there exists m (0 ≦ m ≦ n _p −2) for which the following equation holds,

  The m satisfying the above equation is set as m ″, and sequential processing is performed while increasing w of the initial value 0 below by 1 until the end condition is satisfied.

_{(M '' + 2wx = n} p -1) and the termination condition, (m 'and ends discontinued processing Once _{turned' + 2wx = n p -1)} .

(Step 9)
All partial secret information is concatenated and restored to the original secret information.

  It can be seen that the original secret information can be restored from the three pieces of shared information by the above processing steps.

  As a specific example, a restoration example when the (3, 5) threshold secret sharing method is configured will be described. The configuration of the partial shared information in the (3, 5) threshold secret sharing method is as shown in Table 2 above.

In this restoration example, it is assumed that three pieces of shared information S ₁ , S ₂ , S ₄ are collected from the managers P ₁ , P ₂ , P ₄ to restore the secret information. The steps in each stage correspond to the steps of the restoration procedure described above.

(Step 1)
Three pieces of shared information are divided into 3 × 4 pieces of partial shared information.

(Step 2)
U shown in Table 3 is generated from each partial distribution information.

(Step 3)
When the minimum natural number r satisfying the equation (10) is obtained, (r = 2) is obtained.

(Step 4)
The following is obtained.

(Step 5)
When the minimum natural number v satisfying the equation (14) is obtained, (v = 2) is obtained.

(Step 6)
The following is obtained.

(Step 7)
The following is obtained.

(Step 8)
The following is obtained.

(Step 9)
When all the partial secret information is connected, the secret information is obtained as follows.

  From the above, it can be seen that the secret information can be restored from the three pieces of shared information S1, S2, and S4.

  As described above, in this embodiment, a secret sharing system based on the (3, n) threshold secret sharing method using XOR that can generate shared information and restore secret information at high speed can be realized.

  The secret sharing and restoration process described above can be recorded on a computer-readable recording medium, and the program recorded on the recording medium can be read by a recording device and executed to implement the control of the present invention. . The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes a design and the like within a scope not departing from the gist of the present invention.

  The present invention can be used to securely process confidential data handled in a company or the like.

It is a functional block diagram used for description of the production | generation of the shared information of embodiment of this invention, and a distribution apparatus. It is a functional block diagram used for description of restoration of distributed information according to an embodiment of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 ... Divider 12 ... Dummy secret information generator 13 ... Partial distribution information generator 14, 15 ... Random number generator 16 ... Concatenator 17 ... Transmission apparatus

Claims (3)

A divider that divides the secret information K into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n for the distribution number n);
A dummy information generator for generating the dummy partial secret information K ₀ ;
A first random number generator for generating random numbers R _m independent of each other;
A second random number generator for generating random numbers T _l independent of each other;
A partial shared information generator that generates partial shared information by an exclusive OR (XOR) operation using the dummy partial secret information K ₀ and the partial secret information K _q , the random number R _m and the random number T ₁ ;
A coupler for concatenating the partial shared information to generate shared information S _i ;
A threshold secret sharing apparatus comprising: A first step of dividing the secret information K into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n for the distribution number n);
A second step of generating a dummy portion secret information K _0,
A third step of generating a random number R _m independent of each other and a random number T _l independent of each other;
A fourth step of generating partial shared information by an exclusive OR (XOR) operation using the dummy partial secret information K ₀ and the partial secret information K _q , the random number R _m and the random number T ₁ ;
A fifth step of generating the shared information S _i by concatenating the partial shared information;
A threshold secret sharing method comprising: On the computer,
A first step of dividing the secret information K into (n _p −1) pieces of partial secret information K _q (n _p is a prime number satisfying n _p ≧ n for the distribution number n);
A second step of generating a dummy portion secret information K _0,
A third step of generating a random number R _m independent of each other and a random number T _l independent of each other;
A fourth step of generating partial shared information by an exclusive OR (XOR) operation using the dummy partial secret information K ₀ and the partial secret information K _q , the random number R _m and the random number T ₁ ;
A fifth step of generating the shared information S _i by concatenating the partial shared information;
A program for running

Images