JP2010219603A - Secret information management system, secret information management device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a secret information management system capable of further securely protecting secret information such as an encryption key. <P>SOLUTION: A PDA 10 includes: a distributed information generating section 110 for generating a plurality of items of distributed information from the encryption key by using a secret distribution method and storing the generated information in a distributed information storage section 111; and an encryption key decrypting section 112 for decrypting the encryption key from the distributed information using the secret distribution method. The distribution information generating section 110 obtains random numbers from a plurality of portable devices via a communication section 113, sets a weighting value for each of obtained random numbers, and generates distributed information by using each of the obtained random numbers and a weighting value corresponding to each of the random numbers. The encryption key decrypting section 112 obtains random numbers from each of the portable devices via the communication section 113 and executes processing for decrypting the encryption key by using each of the obtained random numbers. In this case, only when the sum of weighting values for each of the obtained random numbers reaches a threshold value, the encryption key can be decrypted. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technique for protecting secret information such as an encryption key using a secret sharing method.

  In recent years, with the development of science and technology, mobile devices such as PDAs (Personal Digital Assistants), mobile phones, digital cameras, and the like have become increasingly sophisticated and downsized. With this high functionality, it is possible to store a large amount of information in one mobile device and perform advanced information processing, and due to the miniaturization, the user carries the mobile device and uses it in various situations. Opportunities are increasing.

  On the other hand, there is a growing social interest in leaking personal information and private company information, and personal information and private information in the event that a mobile device is lost or stolen. There is an increasing need to take measures to prevent leakage.

  In order to prevent leakage of personal information and non-public information from a lost mobile device, in general, the mobile device is set or stored in the mobile device so that a password is required for use. Measures such as pre-encrypting information based on a password can be considered.

  As a result of the above measures, a password must be entered in order to use a mobile device or view information stored in the mobile device, so even if the mobile device is lost, it is stored in the mobile device. It can be said that there is a certain effect that can prevent leakage of information.

  However, prevention of information leakage by only entering a password cannot be said to be a sufficient measure for the following reasons. First, the first reason is that a password that humans can store is limited to about 10 characters at most. In other words, it is possible for a third party to reach a set password by mechanically trying all combinations of characters that can be used as passwords. Furthermore, the second reason is that passwords set by humans tend to be biased toward combinations of characters that are easy to use, unlike cryptographic random numbers. This makes it possible for a third party who tries to read information illegally to arrive at a password that has been set more easily by trying a combination of characters that are likely to be used in advance.

  For example, Patent Document 1 proposes a technique related to protection of personal information in place of information leakage prevention by setting a password. In this technology, the information stored in the mobile device is converted into encrypted ciphertext, a plurality of pieces of shared information are generated based on a secret sharing method from a decryption key for decrypting the ciphertext, and the generated distributed information Are distributed and stored in another device different from the portable device. In order to decrypt the ciphertext stored in the portable device, a predetermined number or more of the shared information stored in the portable device and the shared information stored in the other device are prepared, and based on the secret sharing method from these shared information It is necessary to generate a decryption key. Therefore, even if the mobile device is lost or stolen, if the distributed information stored in other devices is managed safely, the ciphertext stored in the mobile device is decrypted. It can be said that the situation is avoided.

International Publication No. 2005/104430

  In the technique disclosed in Patent Document 1, the importance of the stored shared information is equal in the portable device and other devices storing the shared information necessary for decrypting the ciphertext. Yes. In other words, Patent Document 1 does not take into consideration that the possibility of being lost or stolen varies depending on the device.

  For example, in Patent Document 1, if the portable device is a PDA, and the other three devices are an IC tag attached to glasses, an IC tag attached to a coat, and an IC tag attached to a wristwatch, A specific example is described in which the ciphertext stored in the PDA can be decrypted if the three included devices can communicate.

  Although depending on the user's usage environment, it is generally considered that PDAs, glasses, and coats are more likely to be lost or stolen than watches. However, in the above example of Patent Document 1, a malicious third party who has obtained a PDA, glasses, and coat can decrypt the ciphertext stored in the PDA and see the information. .

  The present invention has been made to solve the above problem, and an object of the present invention is to provide a secret information management system, a secret information management device, and a program for further securely protecting secret information such as an encryption key. .

The secret information management system according to the present invention includes:
A secret information management system comprising a secret information management device and a portable device,
The secret information management device
First communication means for performing data communication with the portable device via a predetermined network;
By performing arithmetic processing by the secret sharing method, a plurality of shared information is generated from the secret information and stored in the shared information storage unit;
Secret information restoring means for restoring the secret information from the shared information stored in the shared information storage means by performing a calculation process by a secret sharing method,
The portable device is
Second communication means for performing data communication with the secret information management apparatus via the network;
Second storage means for storing data for distributed processing,
The distributed information generating means acquires the distributed processing data of each portable device via the first communication means, sets a weighting value for each acquired distributed processing data, and acquires each distributed processing data And generating the distribution information using a weighting value corresponding to each distributed processing data,
The secret information restoring means acquires the distributed processing data from each portable device via the first communication means, and the sum of the weight values corresponding to the acquired distributed processing data reaches a predetermined value In addition, it is possible to restore the secret information by using each acquired distributed processing data.

  The secret sharing method used by the shared information generating unit and the secret information restoring unit preferably includes a (k, n) threshold secret sharing method and an (n, n) threshold secret sharing method.

  Preferably, the data for distributed processing is a random number, and in this case, the secret information management device uses a random number generation unit that generates a random number, and the random number generated by the random number generation unit to the first communication unit. Random number distribution means for distributing to each portable device via, wherein each of the portable devices receives a random number distributed from the secret information management device by the second communication means, and the received random number is: The distributed processing data may be stored in the second storage unit.

  Alternatively, each portable device further includes a random number generation unit that generates a random number, and the random number generated by the random number generation unit is stored in the second storage unit as the distributed processing data. Good.

  The secret information corresponds to, for example, an encryption key for performing encryption processing on data.

  The portable device may be an IC tag.

Moreover, the secret information management device according to the present invention is:
A communication means for performing data communication with a portable device via a predetermined network;
By performing arithmetic processing by the secret sharing method, a plurality of shared information is generated from the secret information and stored in the shared information storage unit;
Secret information restoring means for restoring the secret information from the shared information stored in the shared information storage means by performing a calculation process by a secret sharing method,
The distributed information generation means acquires distributed processing data from a plurality of portable devices via the communication means, sets a weighting value for each acquired distributed processing data, and acquires each distributed processing data and Generating the distribution information using a weighting value corresponding to each distributed processing data;
The secret information restoring means acquires the distributed processing data from each portable device via the communication means, and when the sum of the weight values corresponding to each acquired distributed processing data reaches a predetermined value, It is possible to restore the secret information using each of the acquired distributed processing data.

  In the secret information management apparatus configured as described above, the secret sharing methods used by the shared information generating unit and the secret information restoring unit include (k, n) threshold secret sharing method and (n, n) threshold secret sharing method. It is preferably included.

  Further, the distributed processing data is preferably a random number. In this case, the secret information management device uses a random number generation unit that generates a random number and a random number generated by the random number generation unit via the communication unit. You may make it further provide the random number delivery means to deliver to each said portable device.

  In the secret information management apparatus configured as described above, for example, an encryption key for performing encryption processing on data corresponds to the secret information.

The program according to the present invention is
Computer
A shared information generating means for generating a plurality of shared information from the secret information and storing it in the shared information storage means by performing an arithmetic processing by a secret sharing method;
By performing arithmetic processing by a secret sharing method, it functions as a secret information restoring unit that restores the secret information from the shared information stored in the shared information storage unit,
The distributed information generation means acquires distributed processing data from a plurality of portable devices via communication means that performs data communication via a predetermined network, and sets a weighting value for each acquired distributed processing data. , Generating the distribution information using each of the distributed processing data and the weighting value corresponding to each distributed processing data,
The secret information restoration unit acquires the distributed processing data from each portable device via the communication unit, and acquires the total weighted value of each acquired distributed processing data when a predetermined value is reached. It is possible to restore the secret information using each distributed processing data.

  As described above, according to the present invention, secret information such as an encryption key can be more securely protected.

It is a figure showing the whole secret information management system composition concerning Embodiment 1 of the present invention. 2 is a block diagram showing a functional configuration of a PDA according to Embodiment 1. FIG. 3 is a block diagram illustrating a functional configuration of the mobile device according to Embodiment 1. FIG. It is a figure which shows the relationship between the data memorize | stored in the distributed information storage part of PDA and the random number memory | storage part of each portable apparatus, and these memory | storage data. It is a flowchart which shows the procedure of random number delivery processing. It is a flowchart which shows the procedure of a shared information generation process. It is a flowchart which shows the procedure of an encryption key restoration process. It is a block diagram which shows the function structure of PDA which concerns on Embodiment 2. FIG. 6 is a block diagram illustrating a functional configuration of a mobile device according to Embodiment 2. FIG. It is a block diagram which shows the function structure of PDA which concerns on Embodiment 3. FIG.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(Embodiment 1)
FIG. 1 is a diagram showing an overall configuration of a secret information management system according to Embodiment 1 of the present invention. As shown in FIG. 1, the secret information management system of the present embodiment includes a PDA (personal digital assistant) 10 as a secret information management device and a plurality of portable devices (cellular phone 20, digital camera 30, watch 40). Each has a wireless communication function for connecting to a network 50 which is a predetermined data communication network.

  FIG. 2 is a block diagram showing a functional configuration of the PDA 10. The PDA 10 includes an input unit 101, a display unit 102, a device control unit 103, a buffer 104, an encrypted data storage unit 105, an encryption processing unit 106, a random number generation unit 107, a random number distribution unit 108, an encryption key A generation unit 109, a distributed information generation unit 110, a distributed information storage unit 111, an encryption key restoration unit 112, and a communication unit 113 are provided.

  The input unit 101 includes a keypad, a touch panel, and the like, and performs processing for receiving an input operation from a user. The display unit 102 includes a liquid crystal display (LCD), an LED display, and the like, and displays data such as characters and images supplied from the device control unit 103.

  The device control unit 103 executes a process based on an input operation received by the input unit 101, displays a processing result on the display unit 102, and implements functions or the like that the PDA 10 originally (conventionally) has. Various controls are performed.

  The buffer 104 is a memory for storing data necessary for calculations and various controls performed by the device control unit 103 in plain text. The encrypted data storage unit 105 is a memory that stores data (encrypted data) obtained by encrypting plain text data stored in the buffer 104. The encryption processing unit 106 encrypts the plaintext data stored in the buffer 104 and stores it in the encryption data storage unit 105, or decrypts the encryption data stored in the encryption data storage unit 105 into plaintext data, The process etc. which store in are performed.

  The random number generation unit 107 generates a random number that is cryptographically secured by a known method. The random number distribution unit 108 transmits the random number generated by the random number generation unit 107 to the network 50 via the communication unit 113 and distributes it to the mobile phone 20, the digital camera 30, and the wristwatch 40.

  The encryption key generation unit 109 generates an encryption key required when the encryption processing unit 106 performs encryption or decryption processing. The shared information generation unit 110 performs the arithmetic processing using the (k, n) threshold secret sharing method and the (n, n) threshold secret sharing method, thereby obtaining the shared information from the encryption key generated by the encryption key generation unit 109. Generate. Although the details will be described later, random numbers stored in the mobile phone 20, the digital camera 30, and the wristwatch 40 are required to generate the shared information. These random numbers are transmitted from each portable device in response to a request from the PDA 10, and the PDA 10 receives these random numbers via the network 50. The shared information storage unit 111 is a memory that stores the shared information generated by the shared information generation unit 110.

  The encryption key restoration unit 112 restores the encryption key based on the shared information stored in the shared information storage unit 111 and the received random number from each portable device, and supplies it to the encryption processing unit 106.

  The communication unit 113 includes a network card or the like, and monitors a communication connection state such as whether or not a communication connection with other portable devices (the mobile phone 20, the digital camera 30, and the wristwatch 40) is established via the network 50. Managing general communication with other portable devices via the network 50, such as transmission of random numbers from the random number distribution unit 108 and output of random numbers received from the network 50 to the distributed information generation unit 110 and encryption key restoration unit 112. .

  FIG. 3 is a block diagram showing a functional configuration of each portable device (mobile phone 20, digital camera 30, wristwatch 40). Here, only the functions specialized in the secret information management system of the present embodiment (hereinafter referred to as “system-specific functions”) are mainly illustrated and described, and other functions that each mobile device has conventionally provided are described. Description is omitted. In the present embodiment, the system-specific functions of the respective mobile devices are the same, and therefore the system-specific functions of the respective mobile devices will be described collectively using the block diagram of FIG.

  As shown in FIG. 3, each portable device includes an input unit 201, a display unit 202, a device control unit 203, a unique ID storage unit 204, a random number storage unit 205, and a communication unit 206.

  The input unit 201 includes a keypad, buttons, a touch panel, and the like, and performs processing for receiving an input operation from a user. The display unit 202 includes a liquid crystal display (LCD), an LED display, and the like, and displays data such as characters and images supplied from the device control unit 203.

  The device control unit 203 executes functions based on input operations received by the input unit 201, displays processing results on the display unit 202, and implements functions and the like that the mobile device originally has (conventionally). Various controls are performed.

  The unique ID storage unit 204 stores a unique ID for identifying the portable device from other portable devices. It is assumed that the unique ID is assigned to each portable device at the manufacturing stage and is written in advance in the unique ID storage unit 204. Generally, an address (IP address, MAC address, etc.) is assigned to a device having a network communication function. Therefore, the unique ID may be an address assigned to each mobile device in the network 50. However, in this embodiment, in order to represent the feature of the present invention, the address in the network 50 is separated.

  The random number storage unit 205 stores a random number distributed from the PDA 10 and received from the network 50 via the communication unit 206. When a random number request is received from the PDA 10, the random number stored in the random number storage unit 205 is read and transmitted to the network 50 via the communication unit 206.

  The communication unit 206 monitors a communication connection state such as whether or not a communication connection with the PDA 10 is established via the network 50, and a data network related to the device control unit 203, the unique ID storage unit 204, and the random number storage unit 205. General communication via the network 50 such as transmission / reception to / from the network 50 is managed.

  FIG. 4 is a diagram showing data stored in the distributed information storage unit 111 of the PDA 10 and the random number storage unit 205 of each portable device, and the relationship between these stored data. Here, “(+)” in the figure is an operator indicating exclusive OR.

  Formula 1 below is a calculation formula according to the (k, n) threshold secret sharing scheme used in the present embodiment. The encryption key is divided into four pieces of shared information, and if there are three pieces of shared information, the original Indicates that the encryption key can be restored.

[Formula 1]
F (X) = s + a ₁ * x + a ₂ * x ²
s: encryption key a ₁ : random number a ₂ : random number

  The following formulas 2 and 3 are calculation formulas related to the (n, n) threshold secret sharing method used in this embodiment, formula 2 is a calculation formula for generating shared information, and formula 3 is calculated from the shared information. It is a calculation formula for restoring the original information. The values handled in Equations 2 and 3 are the four pieces of distributed information divided by Equation 1. The four pieces of shared information are each divided into two pieces of shared information according to Formula 2, and when four sets of shared information are collected by two divided pieces, the original four pieces of shared information are restored according to Formula 3. . Note that “(+)” in Equations 2 and 3 is an operator indicating exclusive OR.

[Formula 2]
G (m ₁ ) = F (m ₁ ) (+) R ₁
G (m ₂ ) = F (m ₂ ) (+) R ₂
G (m ₃ ) = F (m ₃ ) (+) R ₃
G (m ₄ ) = F (m ₄ ) (+) R ₃
R ₁ : random number (mobile phone 20)
R ₂ : random number (digital camera 30)
R ₃ : random number (watch 40)

[Formula 3]
F (m ₁ ) = G (m ₁ ) (+) R ₁
F (m ₂ ) = G (m ₂ ) (+) R ₂
F (m ₃ ) = G (m ₃ ) (+) R ₃
F (m ₄ ) = G (m ₄ ) (+) R ₃
R ₁ : random number (mobile phone 20)
R ₂ : random number (digital camera 30)
R ₃ : random number (watch 40)

The encryption key generated by the encryption key generation unit 109 of the PDA 10 is divided into four pieces of shared information by the shared information generation unit 110 based on the above Equation 1. In Equation 1, s is an encryption key generated by the encryption key generation unit 109, a ₁ and a ₂ is a random number that can be guaranteed cryptographically secure. The four pieces of distributed information are calculated by substituting appropriate values m ₁ , m ₂ , m ₃ , and m ₄ for the variable x in Equation 1, and F (m ₁ ), F (m ₂ ), and F (m ₃ ). , F (m ₄ ).

The four pieces of shared information F (m ₁ ), F (m ₂ ), F (m ₃ ), and F (m ₄ ) divided by using Equation 1 are obtained by the shared information generation unit 110 based on Equation 2 The information is further divided into two pieces of shared information. In Equation 2, R ₁ is a random number stored in the random number storage unit 205 of the mobile phone 20, R ₂ is a random number stored in the random number storage unit 205 of the digital camera 30, and R ₃ is The random number is stored in the random number storage unit 205. The calculation results of Expression 2 are G (m ₁ ), G (m ₂ ), G (m ₃ ), and G (m ₄ ). That is, F (m ₁ ) is divided into two pieces of shared information of G (m ₁ ) and R ₁ , F (m ₂ ) is divided into two pieces of shared information of G (m ₂ ) and R ₂ , and F (m m ₃₎ is divided into two distributed information G _{(m 3)} and _{R 3,} F _{(m 4)} is divided into two distributed information _{R 3} and G _{(m 4).}

In FIG. 4, shared information G (m ₁ ) 504 divided from F (m ₁ ) using Formula 2 and shared information G (m ₂ ) 507 divided from random numbers R ₁ and F (m ₂ ) and random number R _2, F _{(m 3)} distributed information G _{(m 3)} divided from 510 and the random number _R 3, F shared information divided from _{(m 4) G (m 4} ) 513 and the random number _{R 3} are distributed information storage PDA10 A state of being stored in the unit 111 and the random number storage unit 205 of each portable device is shown.

  The encryption key s is restored by the encryption key restoration unit 112. Specifically, it is performed by calculation using Formula 3 and derivation of Formula 1 by solving simultaneous equations.

Formula 3 is a calculation formula for restoring the shared information F (m ₁ ), F (m ₂ ), F (m ₃ ), and F (m ₄ ) from the shared information divided using Formula 2. To restore the shared information F (m ₁ ), the shared information G (m ₁ ) and the random number R ₁ , and to restore the shared information F (m ₂ ), the shared information G (m ₂ ) and the random number R ₂ , To restore the shared information F (m ₃ ), the shared information G (m ₃ ) and the random number R ₃ are used, and to restore the shared information F (m ₄ ), the shared information G (m ₄ ) and the random number R ₃ are used. I need it.

As shown in FIG. 4, the PDA 10 stores the shared information G (m ₁ ) 504, G (m ₂ ) 507, G (m ₃ ) 510, and G (m ₄ ) 513 in the shared information storage unit 111. Random numbers R _{1 to} R ₃ are not stored. Therefore, in order to restore the shared information F (m ₁ ), it is necessary to communicate with the mobile phone 20 to obtain the random number R _1. To restore the shared information F (m ₂ ), the digital camera 30 It is necessary to communicate to obtain the random number R ₂ , and to restore the shared information F (m ₃ ) and F (m ₄ ), it is necessary to communicate with the wristwatch 40 to obtain the random number R ₃ .

Further, PDA 10 is a mobile phone 20 that stores a random number R _1, as storing the random number R ₂ is a digital camera 30, as storing the random number R ₃ is wristwatch 40 It needs to be able to be determined. Therefore, the distributed information storage unit 111 also stores a unique ID of each portable device.

In FIG. 4, unique IDN ₁ 502, unique IDN ₂ 505, and unique IDN ₃ 508, 511 are shared information G (m ₁ ) 504, G (m ₂ ) 507, G (m ₃ ) 510, G (m ₄ ). This is identification information (unique ID) for associating 513 with each portable device. The PDA 10 acquires a unique ID along with a random number from each portable device when generating the shared information. The acquired unique ID of each mobile device is stored in the shared information storage unit 111 at the same timing as the shared information G (m ₁ ) 504, G (m ₂ ) 507, G (m ₃ ) 510, and G (m ₄ ) 513. Is done.

The encryption key restoration unit 112 uses the restored shared information after restoring the shared information F (m ₁ ), F (m ₂ ), F (m ₃ ), and F (m ₄ ) using Equation 3. By solving the simultaneous equations, the function of Equation 1 is derived and the encryption key s is restored. In order to establish simultaneous equations, m ₁ , m ₂ , m ₃ and m ₄ corresponding to the distributed information F (m ₁ ), F (m ₂ ), F (m ₃ ), and F (m ₄ ) are required. However, these are stored in the shared information storage unit 111 by the shared information generation unit 110. In FIG. 4, these are represented as distributed information m ₁ 503, m ₂ 506, m ₃ 509, and m ₄ 512.

  In the (k, n) threshold secret sharing method, if F (x) is calculated by substituting an appropriate value for the variable x of the polynomial shown in Equation 1, the secret information is divided into an arbitrary number of shared information. Is possible. In addition, by appropriately selecting the dimension of the polynomial, it is possible to change the condition such as how many pieces of shared information can be collected to restore the secret information.

  In the present embodiment, the encryption key s is secret information, the number of divisions n of the encryption key s is 4, and the threshold value k for restoring the encryption key s is 3. However, this is only an example, and the network 50 is connected. Depending on the increase or decrease of the secret information management device and the mobile device to be used and the usage environment, it is possible to operate with the appropriately set number of divisions and threshold. The set division number and threshold are stored in the distributed information storage unit 111 of the PDA 10 as the division number n501 and the threshold k500, respectively, as shown in FIG.

As shown in FIG. 4, in the present embodiment, for restoration of the shared information F (m ₃ ) and the shared information F (m ₄ ), the random number R ₃ stored in the random number storage unit 205 of the wristwatch 40 is used. It is necessary. That is, in the derivation of the function of Equation 1 for restoring the encryption key s, the random number R ₃ has two weights. In this embodiment, the encryption key s is divided into four pieces of shared information, and three or more pieces of shared information are required to restore the encryption key s. Therefore, in order to decode the encrypted data stored in the encrypted data storage unit 105 of the PDA 10, the PDA 10 communicates with at least watch 40, it is necessary to obtain a random number R _3, further cellular telephone 20 or a digital It is necessary to communicate with the camera 30 to obtain the random number R ₁ or R ₂ .

  For example, in a situation where the PDA 10 can communicate with the mobile phone 20 or the digital camera 30 via the network 50 and cannot communicate with the wristwatch 40, the PDA 10 stores the distributed information for restoring the encryption key s. Only one can be restored. For this reason, the PDA 10 cannot decrypt the encrypted data stored in the encrypted data storage unit 105. If the watch 40 is managed safely, even if all of the PDA 10, the mobile phone 20 and the digital camera are illegally acquired by a third party, the information stored in the PDA 10 is protected and does not leak. Means that.

  In addition, for example, the PDA 10 can communicate with the wristwatch 40 via the network 50, but the PDA 10 can restore the encryption key s even in a situation where the mobile phone 20 and the digital camera 30 cannot communicate. Only up to two pieces of distributed information can be restored. This is because if the mobile phone 20 and the digital camera 30 are managed safely, even if both the PDA 10 and the watch 40 are illegally acquired by a third party, the information stored in the PDA 10 is protected and leaked. It means not.

In the present embodiment, the random number R ₃ stored in the random number storage unit 205 of the wristwatch 40 is assigned two weights by the (k, n) threshold secret sharing method. It is also possible to change the weights assigned to the random numbers R ₁ , R ₂ and R ₃ stored in the mobile phone 20, the digital camera 30 and the wristwatch 40, respectively. Further, if Formula 1 is changed, the number of shared information necessary for restoring the encryption key s can be changed, even if the number of secret information management devices and portable devices is different from the system configuration shown in FIG. It is possible to respond.

  Next, the procedure of each process (random number distribution process, distributed information generation process, encryption key restoration process) in the secret information management system of this embodiment will be described with reference to the flowcharts of FIGS.

  FIG. 5 is a flowchart showing a procedure of random number distribution processing. First, both the PDA 10 and the mobile device (the mobile phone 20, the digital camera 30, or the wristwatch 40) establish communication connections with the mobile device and the PDA 10, respectively (steps S101 and S102). To establish communication connection, the communication unit 113 of the PDA 10 issues a connection inquiry to the mobile device connected to the network 50, and the communication unit 206 of the mobile device responds that communication is possible in response to this inquiry. It is done by doing.

  When the communication connection with the mobile device is established, the random number generation unit 107 of the PDA 10 generates a random number that is cryptographically secure (step S103). The random number distribution unit 108 transmits the random number generated by the random number generation unit 107 to the network 50 via the communication unit 113 (step S104).

The communication unit 206 of the portable device receives the random number transmitted from the PDA 10 and stores the received random number in the random number storage unit 205 (step S105). Here, for example, the mobile device if the mobile phone 20, the random number R ₁ as shown in FIG. 4 are stored in the random number memory unit 205.

The communication unit 113 of the PDA 10 checks whether there are still other portable devices connected to the network 50 (step S106). If another portable device exists (YES in step S106), the process returns to step S101, and the PDA 10 generates a newly generated random number for the newly established portable device (for example, the digital camera 30). To deliver. The communication unit 206 of the mobile device receives the random number transmitted from the PDA 10 and stores the received random number (for example, the random number R ₂ ) in the random number storage unit 205.

When the communication unit 113 of the PDA 10 confirms the presence of another portable device (for example, the wristwatch 40) (YES in step S106), the PDA 10 delivers the newly generated random number to the portable device. , the mobile device stores the received random number (e.g. random number R ₃₎ in the random number memory unit 205.

  When the presence of another portable device connected to the network 50 cannot be confirmed (NO in step S106), this process (random number distribution process) ends.

  Next, the procedure of the shared information generation process will be described with reference to the flowchart of FIG. First, a communication connection is established between the PDA 10 and the mobile device (the mobile phone 20, the digital camera 30, or the wristwatch 40) (steps S201 and S202).

  When the communication connection with the mobile device is established, the distributed information generation unit 110 of the PDA 10 creates a random number request message and transmits it to the mobile device (step S203).

  The mobile device that has received the random number request message reads the unique ID stored in the unique ID storage unit 204 and the random number stored in the random number storage unit 205 (step S204). Then, a response message storing these is created and transmitted to the PDA 10 (step S205).

  In the PDA 10, the communication unit 113 receives the response message (step S206), and supplies the received response message to the distributed information generation unit 110. The shared information generation unit 110 extracts a unique ID and a random number from this response message.

  The communication unit 113 of the PDA 10 checks whether there are still other portable devices connected to the network 50 (step S207). If the presence of another portable device is confirmed (YES in step S207), the processing from step S201 is repeated, and the PDA 10 acquires a unique ID and a random number from the newly established portable device.

  On the other hand, when the presence of other mobile devices connected to the network 50 cannot be confirmed (NO in step S207), the shared information generation unit 110 assigns weights to the random numbers corresponding to the mobile devices (in other words, each mobile device). (Distributed information distribution) is determined (step S208). In this embodiment, the weighting value of the mobile phone 20 is 1, the weighting value of the digital camera 30 is 1, the weighting value of the wristwatch 40 is 2, the division number n of the (k, n) threshold secret sharing method is 4, The threshold value k of the distributed information necessary for restoring information is set to 3.

  The encryption key generation unit 109 generates an encryption key (step S209) and supplies it to the shared information information generation unit 110. The shared information generation unit 110 generates shared information from the encryption key using the random numbers acquired from the respective mobile devices and the mathematical formulas 1 and 2 (step S210). The shared information generation unit 110 stores the determined division number and threshold in the shared information storage unit 111, and stores the generated shared information in association with the unique ID acquired from each portable device.

  Next, the procedure of the encryption key restoration process will be described with reference to the flowchart of FIG. First, communication connection is established between the PDA 10 and the mobile device (the mobile phone 20, the digital camera 30, or the wristwatch 40) (steps S301 and S302).

  When the communication connection with the mobile device is established, the encryption key restoration unit 112 of the PDA 10 creates a random number request message and transmits it to the mobile device (step S303).

  The mobile device that has received the random number request message reads the unique ID stored in the unique ID storage unit 204 and the random number stored in the random number storage unit 205 (step S304). Then, a response message storing these is created and transmitted to the PDA 10 (step S305).

  In the PDA 10, the communication unit 113 receives the response message (step S306) and supplies the received response message to the encryption key restoration unit 112. The encryption key restoration unit 112 extracts the unique ID and the random number from this response message.

  The communication unit 113 of the PDA 10 checks whether there are still other portable devices connected to the network 50 (step S307). When the presence of another portable device is confirmed (YES in step S307), the processing from step S301 is repeated, and the PDA 10 acquires a unique ID and a random number from the newly established portable device.

  On the other hand, if the presence of another mobile device connected to the network 50 cannot be confirmed (NO in step S307), the encryption key restoration unit 112 displays the shared information corresponding to the unique ID acquired from the mobile device as the shared information storage unit 111. And is associated with the acquired random number. Then, the encryption key is restored using each shared information, the corresponding random number, and Equations 1 and 3 (step S308).

In the present embodiment, the encryption key restoration unit 112 needs to obtain the random number R ₃ and restore at least one of the random numbers R _{1 and} R ₂ in order to restore the encryption key. Therefore, for reasons such as the communication connection is not established, if the random number R ₃ from wristwatch 40 can not obtain the encryption key recovery unit 112 can not restore the encryption key. Further, retrieving the random number R _3, If you can not get the random number from one of the mobile telephone 20 and the digital camera 30, an encryption key restoring unit 112 can not restore the encryption key.

  When the encryption key is restored by the encryption key restoration unit 112, encryption processing by the encryption processing unit 106 is performed. For example, the encryption processing unit 106 creates encrypted data by encrypting plaintext data stored in the buffer 104 and stores the encrypted data in the encrypted data storage unit 105 or the encryption data stored in the encrypted data storage unit 105. Data is decrypted to generate plain text data and stored in the buffer 104.

  As described above, in the secret information management system of this embodiment, the encryption key necessary for decrypting the information (encrypted data) encrypted and stored by the PDA 10 is divided into four pieces of distributed information and stored. The And in order to restore | restore an encryption key, it is necessary to acquire a random number from each portable apparatus (the mobile telephone 20, the digital camera 30, and the wristwatch 40).

  A weighting value is set by the PDA 10 for the random number of each portable device. In the present embodiment, the weighting value of the random number of the mobile phone 20 is 1, the weighting value of the digital camera 30 is 1, and the weighting value of the wristwatch 40 is 2. Since the threshold value k is set to 3 so that three or more pieces of shared information are required to restore the encryption key, the random number obtained from each mobile device is weighted to restore the encryption key. The sum of the values needs to be 3 or more.

  For example, in a situation where the PDA 10 can communicate with the mobile phone 20 and the digital camera 30 via the network 50 and cannot communicate with the wristwatch 40, the PDA 10 can obtain random numbers that can be acquired from the mobile phone 20 and the digital camera 30. The total of the weight values is only 2, and the encryption key restoration unit 112 of the PDA 10 cannot restore the encryption key. That is, as a result, the encryption processing unit 106 of the PDA 10 cannot decrypt the encrypted data into plaintext data.

  Therefore, if the wristwatch 40 is managed safely, even if all of the PDA 10, the mobile phone 20, and the digital camera 30 are illegally passed to a third party due to theft or the like, the information stored in the PDA 10 is It is protected and leakage can be prevented.

  Although depending on the user's usage environment, since the wristwatch 40 is usually worn on the user's arm, the wristwatch 40 is generally lost or stolen compared to the PDA 10, the mobile phone 20, and the digital camera 30. The possibility is considered low. Therefore, as described above, by increasing the weight assigned to the random number stored in the wristwatch 40 as compared with other portable devices, it is possible to reduce the risk of information leakage due to loss of the PDA 10 or other portable devices as much as possible. Become.

  Although the possibility of the loss of the wristwatch 40 is considered low, of course, it is not zero. For example, there may be a case where the PDA 10 and the wristwatch 40 are illegally acquired by a third party. However, even in this case, the total of the weights of random numbers that can be acquired by the PDA 10 is only 2. Therefore, the encryption key recovery unit 112 of the PDA 10 cannot recover the encryption key. Therefore, if the mobile phone 20 and the digital camera 30 are managed safely, the information stored in the PDA 10 can be protected even if both the PDA 10 and the wristwatch 40 are in the hands of third parties.

(Embodiment 2)
Next, the secret information management system according to the second embodiment will be described. FIG. 8 is a block diagram showing a functional configuration of the PDA 10 of the present embodiment, and FIG. 9 is a block diagram showing a functional configuration of each mobile device (the mobile phone 20, the digital camera 30, and the wristwatch 40) in the present embodiment. is there.

  As shown in FIG. 8, the PDA 10 of the present embodiment does not include the random number generation unit 107 and the random number distribution unit 108 unlike the PDA 10 of the first embodiment (see FIG. 2). Other configurations are the same as those of the PDA 10 of the first embodiment. On the other hand, as shown in FIG. 9, the mobile device of this embodiment includes a random number generation unit 207, unlike the mobile device of Embodiment 1 (see FIG. 3). Other configurations are the same as those of the portable device of the first embodiment.

  In the present embodiment, each mobile device (the mobile phone 20, the digital camera 30, and the wristwatch 40) generates a random number with the random number generation unit 207 included in the mobile device, and stores the generated random number in the random number storage unit 205. Therefore, the PDA 10 does not need to generate a random number and distribute it to each portable device.

  As described above, even if each mobile device generates a random number, the effect intended by the present invention can be obtained as in the first embodiment.

  As a modification of the second embodiment, a cryptographically secure random number generated in advance by a predetermined method is used as a random number at the manufacturing stage (before shipment) of each portable device (mobile phone 20, digital camera 30, watch 40). The specification may be stored in the storage unit 205. In this case, each mobile device need not include the random number generation unit 207.

(Embodiment 3)
In the first and second embodiments, the PDA 10 communicates with each mobile device (the mobile phone 20, the digital camera 30, the wristwatch 40) via the network 50, and acquires a random number held in each mobile device. This was an example of restoring the encryption key. In the third embodiment, each mobile device has a function of enabling encryption processing of stored data, generating shared information from the encryption key, and restoring the encryption key from the distributed information.

  FIG. 10 is a block diagram showing a functional configuration of the PDA 10 of the present embodiment. As shown in FIG. 10, the PDA 10 of the present embodiment does not include the random number generation unit 107 and the random number distribution unit 108 as compared with the PDA 10 of the first embodiment (see FIG. 2), and the unique ID storage unit 114. And the random number storage unit 115 is added.

  In the present embodiment, the functional configuration of each mobile device (the mobile phone 20, the digital camera 30, and the wristwatch 40) is the same as that of the PDA 10.

  The PDA 10 and the random number storage unit 115 of each portable device store cryptographically safe random numbers generated in advance by a predetermined method.

  For example, in the mobile phone 20, the encryption key generation unit 109 generates an encryption key, the distributed information generation unit 110 generates shared information from the encryption key and stores it in the distributed information storage unit 111, and the encryption key restoration unit 112 distributes The cryptographic key is restored from the distributed information stored in the information storage unit 111, and the cryptographic processing unit 106 performs cryptographic processing using the restored cryptographic key. At that time, random numbers necessary for generating the shared information and restoring the encryption key are acquired from the PDA 10, the digital camera 30, and the wristwatch 40 through communication via the network 50.

  Similarly, in the digital camera 30, the encryption key generation unit 109 generates an encryption key, the shared information generation unit 110 generates shared information from the encryption key, stores it in the shared information storage unit 111, and the encryption key restoration unit 112. Restores the cryptographic key from the shared information stored in the shared information storage unit 111, and the cryptographic processing unit 106 performs cryptographic processing using the restored cryptographic key. At that time, random numbers necessary for generating the shared information and restoring the encryption key are acquired from the PDA 10, the mobile phone 20, and the wristwatch 40.

  As described above, in this embodiment, each mobile device has a function of performing encryption key generation, shared information generation, encryption key restoration, and encryption processing using the encryption key. Each portable device acquires a random number necessary for generating shared information and restoring the encryption key from the PDA 10 and other portable devices by communication. As a result, for example, when any of the PDA 10, the mobile phone 20, the digital camera 30, and the wristwatch 40 is lost and communication between the lost item and another portable device becomes impossible, the lost item is dispersed. The encryption key cannot be restored from the shared information stored in the information storage unit 111. Therefore, information leakage from lost items can be prevented.

  In addition, in the PDA 10 and each portable device, the shared information generation unit 110 appropriately sets a weighting value for the random number of each portable device, so that the remaining portable devices that have not been lost, etc. It is possible to restore the encryption key using a random number obtained from a portable device or the like, and it is possible to perform encryption processing.

  The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the present invention.

  For example, in each of the above embodiments, the mobile phone 10, the digital camera 20, and the wristwatch 30 are illustrated as the mobile devices. However, the mobile device according to the present invention stores the unique ID and the random number, and the PDA 10 ( It may be embodied by an IC tag capable of wireless communication with a secret information management device. In this case, the secret information management system according to the present invention can be operated by attaching an IC tag as a portable device according to the present invention to an existing mobile phone, digital camera, or wristwatch. By doing in this way, it can manufacture at low cost and a user's utilization becomes easy.

  Further, in each of the above embodiments, a protection method against wiretapping or tampering is not particularly specified for communication data flowing through the network 50. However, a well-known technique for protecting communication data from wiretapping or tampering is described in each of the above embodiments. Of course, it may be incorporated in the encryption processing in FIG.

  Also, by applying the program, it is possible to cause an existing PDA or the like to function as the secret information management apparatus according to the present invention. That is, a program executed by each functional unit of the PDA 10 described above (encryption processing unit 106, random number generation unit 107, random number distribution unit 108, encryption key generation unit 109, distributed information generation unit 110, encryption key restoration unit 112, etc.) Is applied to an existing PDA or the like, and a control device (CPU or the like) in the PDA or the like executes the program, thereby allowing the secret information management device according to the present invention to function.

  Such a program distribution method is arbitrary. For example, the program can be distributed by being stored in a recording medium such as a CD-ROM or a memory card, or can be distributed via a communication network such as the Internet.

  DESCRIPTION OF SYMBOLS 10 ... PDA, 20 ... Mobile phone, 30 ... Digital camera, 40 ... Wristwatch, 50 ... Network, 101, 201 ... Input part, 102, 202 ... Display part, 103, 203 ... Device control part, 104 ... Buffer, 105 ... Encryption data storage unit 106 ... Encryption processing unit 107, 207 ... Random number generation unit 108 108 Random number distribution unit 109 109 Encryption key generation unit 110 ... Distributed information generation unit 111 ... Distributed information storage unit 112 ... Encryption key Restoration unit, 113, 206 ... communication unit, 114, 204 ... unique ID storage unit, 115, 205 ... random number storage unit

Claims (13)

A secret information management system comprising a secret information management device and a portable device,
The secret information management device
First communication means for performing data communication with the portable device via a predetermined network;
By performing arithmetic processing by the secret sharing method, a plurality of shared information is generated from the secret information and stored in the shared information storage unit;
Secret information restoring means for restoring the secret information from the shared information stored in the shared information storage means by performing a calculation process by a secret sharing method,
The portable device is
Second communication means for performing data communication with the secret information management apparatus via the network;
Second storage means for storing data for distributed processing,
The distributed information generating means acquires the distributed processing data of each portable device via the first communication means, sets a weighting value for each acquired distributed processing data, and acquires each distributed processing data And generating the distribution information using a weighting value corresponding to each distributed processing data,
The secret information restoring means acquires the distributed processing data from each portable device via the first communication means, and the sum of the weight values corresponding to the acquired distributed processing data reaches a predetermined value In addition, it becomes possible to restore the secret information using each acquired data for distributed processing,
A secret information management system characterized by that. Secret sharing methods used in the shared information generating means and the secret information restoring means include (k, n) threshold secret sharing method and (n, n) threshold secret sharing method.
The secret information management system according to claim 1. The distributed processing data is a random number.
The secret information management system according to claim 1 or 2. The secret information management device
Random number generating means for generating a random number;
Random number distribution means for distributing the random number generated by the random number generation means to the portable devices via the first communication means,
In each mobile device,
The random number distributed from the secret information management device is received by the second communication means, and the received random number is stored in the second storage means as the distributed processing data.
The secret information management system according to claim 3. Each of the mobile devices further includes a random number generating means for generating a random number,
The random number generated by the random number generation means is stored in the second storage means as the distributed processing data.
The secret information management system according to claim 3. The secret information is an encryption key for performing encryption processing on data.
The secret information management system according to claim 1, wherein the secret information management system is a secret information management system. The portable device is an IC tag;
The secret information management system according to any one of claims 1 to 6. A communication means for performing data communication with a portable device via a predetermined network;
By performing arithmetic processing by the secret sharing method, a plurality of shared information is generated from the secret information and stored in the shared information storage unit;
Secret information restoring means for restoring the secret information from the shared information stored in the shared information storage means by performing a calculation process by a secret sharing method,
The distributed information generation means acquires distributed processing data from a plurality of portable devices via the communication means, sets a weighting value for each acquired distributed processing data, and acquires each distributed processing data and Generating the distribution information using a weighting value corresponding to each distributed processing data;
The secret information restoring means acquires the distributed processing data from each portable device via the communication means, and when the sum of the weight values corresponding to each acquired distributed processing data reaches a predetermined value, It becomes possible to restore the secret information using each acquired distributed processing data,
A secret information management device characterized by that. Secret sharing methods used in the shared information generating means and the secret information restoring means include (k, n) threshold secret sharing method and (n, n) threshold secret sharing method.
The secret information management apparatus according to claim 8. The distributed processing data is a random number.
The secret information management apparatus according to claim 8 or 9, characterized in that Random number generating means for generating a random number;
Random number distribution means for distributing random numbers generated by the random number generation means to the portable devices via the communication means,
The secret information management apparatus according to claim 10. The secret information is an encryption key for performing encryption processing on data.
The secret information management apparatus according to claim 8, wherein the secret information management apparatus is a secret information management apparatus. Computer
A shared information generating means for generating a plurality of shared information from the secret information and storing it in the shared information storage means by performing an arithmetic processing by a secret sharing method;
By performing arithmetic processing by a secret sharing method, it functions as a secret information restoring unit that restores the secret information from the shared information stored in the shared information storage unit,
The distributed information generation means acquires distributed processing data from a plurality of portable devices via communication means that performs data communication via a predetermined network, and sets a weighting value for each acquired distributed processing data. , Generating the distribution information using each of the distributed processing data and the weighting value corresponding to each distributed processing data,
The secret information restoration unit acquires the distributed processing data from each portable device via the communication unit, and acquires the total weighted value of each acquired distributed processing data when a predetermined value is reached. It becomes possible to restore the secret information using each distributed processing data.
A program characterized by that.

Images