JP2020064245A - Secret distribution device, secret distribution system, and secret distribution method - Google Patents

Abstract

To generate distributed data which is confirmable as being correct data with a small amount of calculation in secrete distribution.SOLUTION: A secret distribution device of the present invention holds secret data and a public parameter, generates a plurality of partial distributed data from divided secret data and the exclusive OR of random numbers of a first random number group, calculates a hash value with respect to the secret data, the first value obtained from the first random number group and each partial distributed data, generates, for each partial distributed data, distributed data from additional distributed data that includes a value obtained from the hash value of secret data, the hash value of first value and the partial distributed data and a value obtained from a second random number group and the partial distributed data, and includes, in data for verification of the distributed data, a value calculated on the basis of the public parameter, the hash value of secret data and the second random number group and a value calculated on the basis of the public parameter, the hash value of first value and the second random number group.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a secret sharing device, a secret sharing system, and a secret sharing method.

  A representative example of the secret sharing method is a (k, n) threshold secret sharing method devised by Shamir. Shamir's (k, n) threshold secret sharing method disperses secret information (original data) into n meaningless distributed data, and collects k or more distributed data out of n distributed data. And confidential information (original data) can be restored.

  However, Shamir's (k, n) threshold secret sharing method realizes the secret information sharing process and the restoring process by polynomial interpolation, which is a complicated process, and therefore, it is often used to secretly share a large amount of data. Requires a large amount of calculation.

  Therefore, there is JP-A-2007-124032 (Patent Document 1) as a background art of the (2, n) secret sharing scheme which is realized only by an exclusive OR operation which is a simple process. In this publication, "secret information S in the storage unit 11 is divided to generate n-1 pieces of first divided secret data K (1), ..., K (j), ..., K (n-1). , Divided zero secret data K (0) is generated, and n−1 random number data R (0), ..., R (i) ,. 2) is generated, and based on the divided secret data K (0), ..., K (n-1) and the random number data R (0), ..., R (n-2), n (n-1) Distributed partial data D (j, i) = K (j-i (mod n)) (+) R (i) is calculated ((+) is an exclusive OR), and the shared row numbers j are the same. N pieces of shared information D (0), ..., D (j), ..., D (n-1) having partial data D (j, 0) to D (j, n-2) are individually n pieces. The data is distributed to a storage device. Zui and have been described as able to recover the secret information S. "(See Abstract).

JP, 2007-124032, A

  However, the technique described in Patent Document 1 cannot determine whether the distributed data is correct when the distributed data is broken or when a third party intentionally falsifies the correct distributed data. . Therefore, an aspect of the present invention is to generate shared data that can be confirmed to be correct data with a small amount of calculation in secret sharing.

  In order to solve the above problems, one embodiment of the present invention employs the following configuration. The secret sharing device includes a processor and a storage device, the storage device holds secret data and public parameters, the processor divides the secret data, and divides the secret data, and a plurality of divided secret data. A plurality of partial distributed data is generated based on an exclusive OR of a first random number group consisting of random numbers, and is obtained from a hash value of the secret data by a predetermined hash function and a random number of the first random number group. A hash value of the first value by the predetermined hash function and a hash value of each of the plurality of partial distribution data by the predetermined hash function are calculated, and the secret data of each of the plurality of partial distribution data is calculated. A value obtained by substituting the partial variance data into a first function having a hash value and a hash value of the first value as a coefficient or a constant term; A value obtained by substituting the partial distributed data into a second function having a random number of a second random number group that is not included in 1 random number group as a coefficient or a constant term is added to the partial distributed data. Based on the public parameter, the hash value of the secret data, and the first random number included in the second random number group, the distributed data is generated by adding it to the distributed data, and the distributed data is output to different output destinations. The second value calculated by the above, the third value calculated based on the public parameter, the hash value of the first value, and the second random number included in the second random number group, and the variance. A secret sharing device that is included in the data for data verification.

  According to one aspect of the present invention, in secret sharing, it is possible to generate distributed data that can be confirmed to be correct data with a small amount of calculation.

  Problems, configurations, and effects other than those described above will be clarified by the following description of the embodiments.

1 is a block diagram showing an example of the overall configuration of a secret sharing system according to a first exemplary embodiment. FIG. 3 is a block diagram showing a configuration example of a computer according to the first embodiment. FIG. FIG. 7 is a sequence diagram showing an example of an entire process of secret data distribution according to the first embodiment. FIG. 8 is a sequence diagram showing an example of restoration processing by the entire secret sharing system according to the first embodiment. 6 is a flowchart illustrating an example of details of secret information decentralization processing according to the first embodiment. 6 is a flowchart showing an example of distributed data storage processing by each storage server in the first embodiment. 6 is a flowchart illustrating an example of details of restoration processing by the client device according to the first embodiment. 5 is a table showing the value of each block of distributed data distributed to the storage server device according to the first embodiment. 5 is a table showing the values of each block of partial distributed data obtained by deleting additional distributed data from the distributed data stored in the storage server device in the first embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In this embodiment, the same components are denoted by the same reference symbols in principle, and repeated description will be omitted. It should be noted that the present embodiment is merely an example for realizing the present invention and does not limit the technical scope of the present invention.

<System configuration>
FIG. 1 is a block diagram showing an example of the overall configuration of a secret sharing system. This figure shows an example of the overall configuration of the secret sharing system as well as an example of the functional configuration of each device included in the secret sharing system.

The secret sharing system 1 includes, for example, a client device 10, a verification data disclosure device 30, and a plurality (n in this embodiment) of storage server devices 20 _i (i = 1, 2, ..., N). -1), and these are connected to each other via a network 40 such as the Internet.

That is, the secret sharing system 1 is a computer network system configured by the client device 10, the storage server device 20 _i, and the verification data disclosure device 30 communicably connected via a network 40 such as the Internet. A part or all of the plurality of storage server devices 20 _i may be operated by the same organization, or all of them may be operated by different organizations.

In addition, hereinafter, when it is not necessary to distinguish between the respective units included in the storage server devices 20 _{1 to} 20 _n-1 and the storage server devices 20 _{1 to} 20 _n-1 , the storage server devices 20 are added as described. The letters are omitted or generalized as described as the storage server device 20 _i .

  The client device 10 includes, for example, a communication unit 101, a control unit 102, an input / output unit 103, a distributed data generation unit 104, a data restoration unit 105, and a random number generation unit 106. The communication unit 101 communicates with other devices. The control unit 102 controls the client device 10 as a whole. The input / output unit 103 inputs instructions and data to the client device 10 and outputs instructions and data from the client device 10.

The distributed data generation unit 104 generates secret data D (i) by decentralizing secret information, which will be described later, and distributes the distributed data D (i) to the storage server device 20 _i . That is, the client device 10 functions as a secret information distribution device that distributes secret information. Further, the verification data and the public parameter, which will be described later, are generated and distributed to the verification data publishing device 30. The data restoring unit 105 restores the original secret information by collecting a required number of (two normal, unaltered and unaltered in this embodiment) decentralized data from the storage server device 20.

  The random number generation unit 106 generates a random number according to an instruction from the distributed data generation unit 104 or the like. The client device 10 also holds the secret information 107. The secret information 107 is data to be concealed by decentralization, and is original data before being decentralized.

Each storage server device 20 _i includes a communication unit 201 _i , a storage unit 202 _i , and a verification unit 204 _i . The communication unit 201 _i communicates with other devices. The storage unit 202 _i holds the distributed data (D (i)) 203 _i received via the communication unit 201 _i . The verification unit 204 _i verifies whether the received distributed data has not been tampered with or damaged.

The verification data disclosure device 30 includes a communication unit 301 _i and a storage unit 302 _i . The communication unit 301 _i communicates with other devices. The storage unit 302 _i includes, for example, verification data ((G ₁ , G ₂ )) 303, which will be described later, received via the communication unit 301 _i , and public parameters ((p, g ₁ , g ₂ )) 304, which will be described later. Hold. The verification data 303 and the disclosure parameter 304 are disclosed in the secret sharing system 1, and are used for the alteration detection process of the distributed data by the client device 10 and the storage server device 20 _i, and the restoration process of the confidential information by the client device 10. .

  FIG. 2 is a block diagram showing a configuration example of the computer 50. The client device 10, the storage server device 20, and the verification data disclosure device 30 are each configured by, for example, the computer illustrated in FIG. The computer 50 includes, for example, a communication device 501, an input device 502, a memory 503, an auxiliary storage device 504, a CPU (Central Processing Unit) 505, and an output device 506, which are mutually connected via an internal communication line such as a bus 507. It is connected.

  The CPU 505 includes a processor and executes a program stored in the memory 503. The memory 503 includes a ROM that is a non-volatile storage element and a RAM that is a volatile storage element. The ROM stores an immutable program (for example, BIOS) and the like. The RAM is a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores a program executed by the processor and data used when the program is executed.

  The auxiliary storage device 504 is a large-capacity and non-volatile storage device such as a magnetic storage device (HDD) or a flash memory (SSD), and stores a program executed by the CPU 505 and data used when the program is executed. . That is, the program is read from the auxiliary storage device 504, loaded into the memory 503, and executed by the CPU 505.

  The computer 50 may have an input interface and an output interface. The input interface is an interface to which an input device 502 such as a keyboard or a mouse is connected and which receives an input from an operator. The output interface is an interface to which an output device 506 such as a liquid crystal display device, an organic EL (Electro Luminescence) display device, and a printer is connected, and outputs the execution result of the program in a format that can be visually recognized by the operator.

  The communication device 501 is a network interface device that controls communication with other devices according to a predetermined protocol. For example, the communication unit 101 of the client device 10, the communication unit 201 of the storage server device 20, and the communication unit 301 of the verification data disclosure device 30 are each configured by the communication device 501.

  The program executed by the CPU 505 is provided to the computer 50 via a removable medium (CD-ROM, flash memory, etc.) or the network 40, and is stored in the non-volatile auxiliary storage device 504 which is a non-temporary storage medium. For this reason, the computer 50 may have an interface for reading data from the removable medium.

  Each device included in the secret sharing system 1 is a computer system physically configured on one computer or on a plurality of logically or physically configured computers, and is separate on the same computer. Of threads, or a virtual computer constructed on a plurality of physical computer resources.

  For example, the control unit 102, the distributed data generation unit 104, the data restoration unit 105, and the random number generation unit 106 of the client device 10 are realized by a program executed by the CPU 505. Specifically, for example, the CPU 505 functions as the control unit 102 by operating according to the control program loaded in the memory 503, and operates according to the distributed data generation program loaded in the memory 503 to generate distributed data. It functions as the unit 104. The same applies to the verification unit 204 of the storage server device 20.

For example, the storage unit 202 _i of the storage server device 20 and the storage unit 302 of the verification data disclosure device 30 are each configured by a part of the storage area included in the memory 503 or the auxiliary storage device 504. Further, for example, the secret information 107 is stored in the memory 503 or the auxiliary storage device 504 of the client device 10.

  In this embodiment, the information used by each device included in the secret sharing system 1 may be represented by any data structure without depending on the data structure. For example, a properly selected data structure from a table, list, database or queue can store the information.

<Example of processing procedure>
Hereinafter, an example of processing in the present embodiment will be described. Various operations corresponding to the secret sharing processing described below are performed by loading the respective devices constituting the secret sharing system 1, that is, the client device 10, the storage server device 20 _i , and the verification data disclosure device 30 into the memory 503 or the like. It is realized by a program to be executed.

  First, the decentralization process will be described with reference to FIGS. 3, 5, 6, and 8. FIG. 3 is a sequence diagram showing an example of the entire secret data distribution process. The process of FIG. 3 is triggered by, for example, an instruction from the user of the client device 10 (including information indicating secret information to be decentralized).

First, the distributed data generation unit 104 of the client device 10 generates public parameters (p, g ₁ , g ₂ ) (S10), and the communication unit 101 transmits the public parameters to the verification data public device 30 ( S11). Note that the public parameter is used in a process of restoring secret information described below, so the distributed data generation unit 104 may store the generated public parameter in the auxiliary storage device 504 of the client device 10.

The verification data disclosing device 30 stores the received public parameters (p, g ₁ , g ₂ ) as the public parameters 304 in the storage unit 302, and at the same time, stores the public parameters 304 for the client device 10 and the storage server device 20. It is made public in the secret sharing system 1 (S12). That is, each of the client device 10 and the storage server device 20 can acquire the public parameter 304 from the verification data public device 30 by requesting the verification data public device 30 to acquire the public parameter 304. .

The value p is a sufficiently large prime number such that q = (p-1) / 2 is a prime number (for example, p is a prime number of 1024 bits or more). Further, the values g ₁ and g ₂ are elements of different orders q of a finite field modulo p, that is, g ₁ , g ₂ εGF (p), ord (g ₁ ) = ord (g ₂ ) = q Is. Note that different secret information, the same public parameters _{(p, g 1, g 2} ) is to be used, the public parameters for each secret information _{(p, g 1, g 2} ) may be a different.

  The distributed data generation unit 104 of the client device 10 decentralizes the secret information 107 (hereinafter, referred to as secret information S if necessary) (S20). Details of the decentralization processing in step S20 will be described with reference to FIG.

  FIG. 5 is a flowchart showing an example of details of the secret information decentralization process of step S20. In this case, the data length of the secret information S is d × (n−1) (d is a predetermined natural number of 1 or more). If the data length of the secret information S is not divisible by n-1, the distributed data generation unit 104 performs a padding process on the secret information S to obtain a value adjusted so that the data length is divisible by n-1. , The secret information S is decided again.

First, the distributed data generation unit 104 distributes the secret information Sε {0,1} ^{d (n−1)} (S201). Specifically, for example, the distributed data generation unit 104 simply divides the secret information S into n-1 blocks (S201). Note that here, the secret information S is S = S ₁ || ... || S _n−1 (the symbol “||” indicates data concatenation), and each divided block is S ₁ ,. ···, _Sn-1 . Also, the distributed data generation unit 104 newly generates S ₀ ε {0} ^d .

Next, the distributed data generation unit 104 calculates a secret value, a random number, and a hash value of the partial shared data (S202). Specifically, first, the random number generation unit 106 sets n−1 random numbers R ₀ , ..., R _n−2 having a data length of d, for example, independently of each other (that is, between selected random numbers). And choose randomly (i.e., R _i ε {0,1} ^d ) so that there is no predetermined regularity). Then, the distributed data generation unit 104 sets D (i, j) = S _{(i−j mod n)} xor R _j (0 ≦ i ≦ n−1, 0 ≦ j ≦ n−2) to each (i, j) is calculated.

The distributed data generation unit 104 calculates the hash value of the secret information S = S ₁ || ... || S _n-1 and the random number R = R ₀ || ... || R _n-2 . Further, the distributed data generation unit 104 concatenates each D (i, j) with respect to each i, and the partial distributed data D '(i) = D (i, 0) || ... || D (i, n- 2), (0 ≦ i ≦ n−1) is generated.

The distributed data generation unit 104 has a hash of each partial distributed data D ′ (i) = D (i, 0) || ... || D (i, n-2), (0 ≦ i ≦ n−1) Calculate the value. Here, the hash function of the output length d ′ (for example, d ′ is about 256 bits) is represented by H (), and H (S) = h _S , H (R) = h _R , and H (D ′ ( i)) = h _{D ′ (i)} , (0 ≦ i ≦ n−1).

This hash function may be stored in advance in the auxiliary storage device 504 of the client device 10 and the storage server device 20 _i , or may be disclosed in the secret sharing system 1 by the verification data disclosure device 30, for example. .

Next, the random number generation unit 106 further selects the random numbers a and bεGF (q), and the distributed data generation unit 104 uses two linear expressions, F (X) = h _S + h _R X mod q and F ′ (. X) = a + bX mod q is generated (S203).

Then, the distributed data generating unit 104, the additional distributed data D (i, n-1) = F (h D '(i)) = f i and D (i, n) = F ' (h D '(i ₎ ) = F ′ _i is calculated (S204).

Next, the distributed data generation unit 104 uses G ₁ = pow (g ₁ , h _S ) × pow (g ₂ , a) mod p, G ₂ = pow (g ₁ , h _R ) × pow as verification data. (g ₂ , b) mod p is generated (S30), and (G ₁ , G ₂ ) is transmitted to the verification data disclosure device 30 as verification data (S31). The function pow () represents an exponential function and means pow (a, b) = ^ab .

Then, the verification data disclosure device 30 stores the received (G ₁ , G ₂ ) as the verification data 303, and at the same time, stores the verification data (G ₁ ) for the client device 10 and the storage server device 20 _i . , G ₂ ) is disclosed in the secret sharing system 1 (S32). The distributed data generation unit 104 links the distributed data D (i) = D ′ (i) || D (i, n−1) || D (i, n), (0 ≦ i ≦ n−1) is distributed to each storage server device 20 _i (S40).

Returning to the description of FIG. Subsequently, each storage server device 20 _i acquires the verification data (G ₁ , G ₂ ) and the disclosure parameters (p, g ₁ , g ₂ ) from the verification data disclosure device 30 and stores the distributed data itself. The legitimacy of D (i) 203 _i is verified (S50), and the distributed data D (i) is managed (S60).

FIG. 6 is a flowchart showing an example of distributed data storage processing by each storage server device 20 _i in steps S50 and S60. Each storage server device 20 _i is distributed data D (i) = D ′ (i) || D (i, n−1) || that is data obtained by concatenating the partial distributed data and the additional distributed data from the client device 10. D (i, n), (0≤i≤n-1) is received (step S401).

  FIG. 8 is a table showing the value of each block of the distributed data distributed to the storage server device 20. FIG. 8 shows an example when n = 5. The value of the cell in the m-th row and the 1-th column of the table indicates the value of the l-th block when D (i) at i = m is divided into block lengths of length d.

First, the details of the verification process in step S50 will be described. The verification unit 204 acquires the verification data (G ₁ , G ₂ ) and the public parameters (p, g ₁ , g ₂ ) from the verification data disclosure device 30 (S501). Verification unit 204 _i is distributed data D (i) = D '( i) || D (i, n-1) = f i || D (i, n) = f' i additional dispersion and partial dispersion data from The data is taken out and the hash value H (D ′ (i)) = h _{D ′ (i)} of the partial distributed data _{D ′ (i)} is calculated (S502).

Subsequently, the management process in step S60 will be described. The verification unit 204 _i confirms whether pow (g ₁ , f _i ) × pow (g ₂ , f ′ _i ) ≡G ₁ × pow (G ₂ , h _{D ′ (i)} ) mod p holds (S 503). ). When the verification unit 203 _i determines that the mathematical expression in step S503 holds (S503: yes), the storage server device 20 _i stores the received distributed data as D (i) 203 _i as correct data (S601). ).

On the other hand, when the verification unit 204 _i determines that the mathematical expression in step S503 does not hold (S503: no), the verification unit 204 _i processes it as ERROR (S602). Specifically, for example, the verification unit 204 _i outputs ERROR to the output device 506 of the storage server device 20 _i . Further, for example, the verification unit 204 _i may notify the client device 10. In this case, for example, the client device 10 simply retransmits the distributed data D (i), or regenerates the distributed data D (i) and then retransmits it to the storage server device 20 _i , and the storage server device 20. _i re-verifies the re-received distributed data D (i).

Hereinafter, the reason why it is possible to determine whether or not the received distributed data has a correct value by determining the success or failure of the mathematical expression in step S503 will be described. From the above definition, G ₁ = pow (g ₁ , h _S ) × pow (g ₂ , a) mod p, G ₂ = pow (g ₁ , h _R ) × pow (g ₂ , b) mod p, F _{(X) = h S + h} R X mod q, F '(X) = a + bX mod q, F (h D' (i)) = f i, in _{F '(h D' (i} )) = f 'i Because there is
(Right side of the equation in step S503)
≡G ₁ × pow (G ₂ , h _{D ′ (i)} ) mod p
≡ {pow (g _1-, hs) × pow (g ₂ , a)} × {pow (pow (g ₁ , h _R ) × pow (g ₂ , b)), h _{D ′ (i)} )} mod p
≡ pow (g ₁ , hs + h _R h _{D ′ (i)} ) × pow (g ₂ , a + bh _{D ′ (i)} ) mod p
≡pow (g ₁ , F (h _{D ′ (i)} ) × pow (g ₂ , F ′ (h _{D ′ (i)} ) mod p
≡ pow (g ₁ , f _i ) × pow (g ₂ , f ′ _i ).
≡ (left side of equation in step S503)
Is.

Therefore, if the storage server device 20 _i has acquired the correct public parameters and verification data, it is possible to determine whether or not the received distributed data is a correct value by checking the success or failure of the mathematical expression in step S503. it can.

  Next, the restoration process will be described with reference to FIGS. 4, 7, and 9. FIG. 4 is a sequence diagram showing an example of restoration processing by the entire secret sharing system 1. The process of FIG. 4 is triggered by, for example, an instruction from the user of the client device 10 (including information indicating the confidential information to be restored). First, the client device 10 acquires the distributed data D (i) from each of the two storage server devices 20 (step S70).

  Specifically, for example, the data restoration unit 105 of the client device 10 issues a transmission instruction of the distributed data D (i) to, for example, two randomly selected storage server devices 20. Each of the two storage server devices 20 transmits the distributed data D (i) held by itself to the client device 10 (step S71).

Further, the client device 10 acquires the verification value data (G ₁ , G ₂ ) from the verification data disclosure device 30 (step S80). Specifically, for example, the data restoration unit 105 of the client device 10 issues an instruction to send the verification value data (G ₁ , G ₂ ) to the verification data disclosure device 30. The verification data disclosure device 30 transmits (G ₁ , G ₂ ) to the client device 10 (step S81).

  If the verification parameter is not stored in the client device 10 when the verification parameter is generated, the client device 10 further acquires the verification parameter from the verification data disclosure device 30 in steps S80 to S81. Then, the data restoration unit 105 of the client device 10 restores the secret information S while confirming the validity of the acquired distributed data D (i) (step S90).

  FIG. 7 is a flowchart showing an example of details of the restoration processing by the client device 10. FIG. 7 shows details of the distributed data acquisition processing in step S70 and the confidential information restoration processing in step S90.

  First, the details of step S70 will be described. The data restoration unit 105 of the client device 10 determines whether or not there is an unselected storage server device 20 (that is, not a determination target of step S903 and step S905 described later) among the n−1 storage server devices 20. It is determined (S701). When the data restoration unit 105 determines that there is no unselected storage server device 20 (S701: no), it returns ERROR (S906). Specifically, for example, the data restoration unit 105 outputs ERROR to the output device 506 of the client device 10.

  When the data restoration unit 105 determines that there is an unselected storage server device 20 (S701: yes), it selects one unselected storage server device 20 and distributes the distributed data to the selected storage server device 20. A transmission instruction of D (i) is issued, and distributed data D (i) is acquired from the storage server device 20 (S702).

Subsequently, as described above, the client device 10 acquires the verification value data (G ₁ , G ₂ ) from the verification data disclosure device 30 (step S80). If the client device 10 has already acquired the verification value data (G ₁ , G ₂ ), step S80 may be omitted.

Next, the details of step S90 will be described. Data recovery unit 105 of the client device 10 acquires the distributed data D (i) = D '( i) || D (i, n-1) = f i || D (i, n) = f' i , respectively On the other hand, the hash value H (D ′ (i)) = h _{D ′ (i)} of the partial variance data D _{′ (i)} is calculated (S901).

Then, the data restoring unit 105, the generated hash value H (D '(i)) = h D' with respect to _{(i), pow (g 1} , f i) × pow (g 2, f 'i) ≡ It is confirmed whether G ₁ × pow (G ₂ , h _{D ′ (i)} ) mod p is obtained (S902). When the data restoration unit 105 determines that the mathematical expression in step S902 does not hold (S902: no), the data restoration unit 105 returns to step S701 and selects new distributed data.

  The verification of the mathematical formula in step S902 is the same as that in step S503. That is, by performing the verification in step S902, tampering (and damage, etc.) of the distributed data at any timing between the storage process and the restoration is detected, and thus the restoration process using the tampered distributed data. Need not be executed. It should be noted that the tampering detection processing of the distributed data may be executed only at one of the timing of the storage processing (steps S501 to S503) or the restoration processing (steps S901 to S902).

  Then, the data restoration unit 105 determines whether or not two pieces of distributed data satisfying the mathematical formula of step S902 have been collected (S903). If two pieces of distributed data satisfying the mathematical expression of step S902 have not been collected yet (S903: no), the data restoration unit 105 returns to step S701 and selects new distributed data.

  When the data restoration unit 105 determines that the two pieces of shared data satisfying the mathematical formula of step S902 have been collected (S903: yes), the secret information S is restored using the two pieces of shared data (S904). .

The details of step S904 will be described below. Here, the two distributed data formulas step S902 is satisfied, respectively D (i) = D '( i) || D (i, n-1) = f i || D (i, n) = f' _{i, D (j) = D} '(j) || D (j, n-1) = f j || D (j, n) = f' and _j.

First, the data recovery unit 105, to the distributed data D (i) and D (j), respectively, behind 2d 'length of data, namely, an additional distributed data D (i, n-1) = f i || D (i, n) = f ′ _i and D (j, n−1) = f _j || D (j, n) = f ′ _j , which is the remaining data obtained by deleting partial distribution data D '(i) = D (i, 0) || ... || D (i, n-2) and D' (j) = D (j, 0) || ... || D (j , N−2) is divided into blocks of data length d.

That is, each block of the data length d for the partial distributed data D ′ (i) is D (i, 0), ..., D (i, n−2), and for the partial distributed data D ′ (j). Each block of the data length d is D (j, 0), ..., D (j, n-2).
Then, the data restoration unit 105 obtains S ₁ , ..., S _n−1 for r = j−i mod n in the following cases.

Case 1: When D (i, i) is included in D (i, l) (where 0 ≦ l ≦ n−2), the following is repeated until end condition 1 is satisfied. However, the termination condition 1 is i-kr = n-1 (1≤k≤n-1).
k = 1: S _r = D (i, i) xor D (j, i) xor S ₀ ,
k = 2: S _{r + r} = D (i, i-r) xor D (j, i-r) xor S _r ,
...
k = n-1: S _{(n-1) r} = D (i, i- (n-2) r) xor D (j, i- (n-2) r) xor S _{(n-2) r}

Case 2: When D (j, j) is included in D (j, l), the following process is repeated until end condition 2 is satisfied. However, the end condition 2 is as follows. j + kr = n-1 (1≤k≤n-1).
k = 1: S− _r = D (i, j) xor D (j, j) xor S ₀ ,
k = 2: S _-r-r = D (i, j + r) xorD (j, j + r) xorS- _r ,
...
k = n-1: S- _{(n-1) r} = D (i, j + (n-2) r) xor D (j, i + (n-2) r) xor S- _{(n-2) r}

The operator ± in Case 1 and Case 2 indicates the calculation of mod n. Hereinafter, a specific example of the calculation processing of S ₁ , ..., S _n−1 in Case 1 and Case 2 described above will be described.

  FIG. 9 is a table showing the value of each block of the partial distributed data obtained by deleting the additional distributed data from the distributed data stored in the storage server device 20. FIG. 9 shows an example when n = 5. Therefore, FIG. 9 is a table in which the columns of j = 4 and j = 5 are deleted from the table of FIG.

  Since the table of FIG. 9 is a table of 5 rows × 4 columns, D (4,4) is not included in the diagonal components. Whether Case 1 and Case 2 are applicable or not is different depending on whether the selected two pieces of distributed data include D (4) or not.

Here, for example, an example in which i = 4 and j = 0, that is, an example in which D (4) and D (0) are selected will be described. First, r = j-i mod 5 = 0-4 = -4. Since D (4,4) is not included in D (4, l) = {D (4,0), D (4,1), D (4,2), D (4,3)}, This example does not correspond to Case 1.
Since D (0,0) is included in D (0, l) = {D (0,0), D (0,1), D (0,2), D (0,3)} This example corresponds to Case 2.

  k = 1: S − (− 4) = D (4,0) xor D (0,0) xor S0 = S4, and for the end condition 2, 0 + 1 (−4) = − 4 = 1 ≠ 4. Because there is, it is not satisfied.

  k = 2: S − (− 4) − (− 4) = D (4,1)) xor D (0,1) xor S4 = S3, and 0 + 2 (−4) = − for the end condition 2. Since 8 = 2 ≠ 4, it is not satisfied.

  k = 3: S−3 (−4) = D (4,2) xor D (0,2) xor S3 = S2, and for the end condition 2, 0 + 3 (−4) = − 12 = 3 ≠ 4. Is not satisfied.

  k = 4: S-4 (-4) = D (4,3) xor D (0,3) xor S2 = S1, and for the end condition 2, 0 + 4 (-4) =-16 = 4 = 4. Since the above condition is satisfied, the calculation of Case2 ends. Thereby, all of S1, S2, S3, and S4 from Case2 were calculated.

  Next, an example in which i = 3 and j = 0, that is, an example in which D (3) and D (0) are selected will be described. First, r = j-i mod 5 = 0-3 = -3. Since D (3,3) is included in D (3,1) = {D (3,0), D (3,1), D (3,2), D (3,3)}, this example Corresponds to Case 1.

  k = 1: S (−3) = D (3,3) xor D (0,3) xor S0 = S2, and for the end condition 1, 3-1 (−3) = 6 = 1 ≠ 4. Yes, not satisfied.

k = 2: S (−3) + (− 3) = D (3,1) xor D (0,1) xor S2 = S4, and 3-2 (−3) = 9 for the end condition 1. = 4 = 4, which is satisfied, the calculation of Case1 ends.
Further, D (0,0) is also included in D (0, l) = {D (0,0), D (0,1), D (0,2), D (0,3)}. This example also applies to Case 2.

  k = 1: S − (− 3) = D (3,0) xor D (0,0) xor S0 = S3, and the termination condition 2 is 0 + 1 (−3) = − 3 = 2 ≠ 4. Because there is, it is not satisfied.

k = 2: S − (− 3) − (− 3) = D (3,2)) xor D (0,2) xor S3 = S1, and for the end condition 2, 0 + 2 (−3) = − Since 6 = 2 = 4, which is satisfied, the calculation of Case2 ends. As a result, all of S1, S2, S3, and S4 were calculated from Case1 and Case2.
That is, S1, S2, S3, S4 can be calculated regardless of which combination of distributed data is selected.

Subsequently, the data restoration unit 105 restores data S ′ = S ₁ || which is secret information restored by connecting S ₁ , ..., S _n−1 output by Case 1 and / or Case 2. ... || Sn _-1 is restored. Note that here, the secret information restored to distinguish the restored data from the original data is referred to as restored data S ′.

When the data restoration unit 105 restores the restored data S ′ = S ₁ || ... || S _n−1 in step S904, f _i −H (R ′) h _{D ′ (i)} = H (S ′ ) Is confirmed (S905). Note that R ′ is random number data restored by the following processing.

The data restoration unit 105 calculates R _j = D (i, j) xorS _{(i−j mod n)} (0 ≦ j ≦ n−2), and outputs R ₀ , ..., R _n−2. Are connected to restore random number data R ′ = R ₀ || ... || R _n-2 .

Then, the data restoring unit 105, D (i, n-1 ) and = _{f i,} and H (D '(i)) = h D' (i), restored S ', R' from as described above Then, it is determined whether or not the mathematical expression f _i −H (R ′) × h _{D ′ (i)} = H (S ′) in step S905 holds.

  When the data restoration unit 105 determines that the mathematical expression of step S905 holds (S905: yes), the restoration data S'is the same as the secret information S, and the restoration data S'is output and the restoration processing ends. When the data restoration unit 105 determines that the mathematical expression of step S905 does not hold (S905: no), the restoration data S ′ is not the same as the secret information S, and thus the process returns to step S701.

Hereinafter, the reason why the success or failure of the restoration can be determined by determining the success or failure of the mathematical expression in step S905 will be described. The definition described _{above, F (h D '(i} )) = f i, since it is _{F (X) = h S +} h R X mod q, ( left side in step _{S905) = f i -H (R} ') _{× h D '(i) =} F (h D' (i)) -H (R ') × h D' (i) - = h S + h R h D '(i) -H (R') × h _{D '(i)} . Therefore, if h _S = H (S ′) and h _R = H (R ′) are satisfied, that is, the hash value of S and the hash value of S ′ are equal, and the hash value of R and the hash value of R ′ are equal. If they are equal to each other, (left side of step S905) = (right side of step S905) is satisfied. That is, if (left side of step S905) = (right side of step S905) is satisfied, it can be said that S and S ′ are equal to each other with an extremely high probability.

  As described above, according to the secret information distribution system of the present exemplary embodiment, by performing the verification process of step S503 or step S902, it is possible to prevent falsification and damage of the distributed data D (i) at the time of storing the distributed data or restoring the confidential information. It can be detected with a small amount of calculation. Also, the amount of calculation for generating the distributed data is small.

The verification data (G ₁ , G ₂ ) is a value that can be generated only by a person who knows the values of H (S) = h _S , H (R) = h _R. Only the person who generated it can generate correct verification data (G ₁ , G ₂ ).

Further, since the verification data (G ₁ , G ₂ ) is the same for each distributed data D (i) (0 ≦ i ≦ n−1), the verification processing of step S503 or step S902 is passed. It can also be confirmed with a small amount of calculation that each distributed data D (i) (0 ≦ i ≦ n−1) is the same secret information S distributed. Moreover, the amount of calculation for restoring the secret information is small.

Furthermore, since the verification data (G ₁ , G ₂ ) is data that also has a function of detecting the alteration of the secret information S, the restoration data S ′ becomes the secret information S (original data) by performing the verification process in step S905. It can also be confirmed that it agrees with.

  It should be noted that the present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail for the purpose of explaining the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of a certain embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of a certain embodiment. Further, it is possible to add / delete / replace other configurations with respect to a part of the configurations of the respective embodiments.

  Further, the above-described respective configurations, functions, processing units, processing means, etc. may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Further, the above-described respective configurations, functions and the like may be realized by software by a processor interpreting and executing a program for realizing each function. Information such as a program, a table, and a file that realizes each function can be placed in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, and a DVD.

  Further, the control lines and information lines are shown as being considered necessary for explanation, and not all control lines and information lines are shown in the product. In reality, it may be considered that almost all the configurations are connected to each other.

1 secret sharing system, 10 client device, 20 storage server device, 30 verification data disclosure device, 50 computer, 104 distributed data generation unit, 105 data restoration unit, 106 random number generation unit, 107 secret information, 203 shared data, 303 verification Data, 304 public parameters, 501 communication device, 502 input device, 503 memory, 504 auxiliary storage device, 505 CPU, 506 output device

Claims (12)

A secret sharing device,
A processor and a memory device,
The storage device holds secret data and public parameters,
The processor is
Divide the secret data,
Generating a plurality of partial distributed data based on an exclusive OR of the divided secret data and a first random number group composed of a plurality of random numbers,
A hash value of the secret data by a predetermined hash function, a hash value of a first value obtained from a random number of the first random number group by the predetermined hash function, and the predetermined hash of each of the plurality of partial distributed data. Calculate the hash value by the function and
A value obtained by substituting the partial distributed data into a first function having a hash value of the secret data and a hash value of the first value as a coefficient or a constant term for each of the plurality of partial shared data. A value obtained by substituting the partial dispersion data into a second function having a random number of a second random number group consisting of random numbers not included in the first random number group as a coefficient or a constant term, Generates distributed data by adding to the partial distributed data,
Output each of the distributed data to different output destinations,
A second value calculated based on the public parameter, the hash value of the secret data, and the first random number included in the second random number group, the public parameter, the hash value of the first value, and the second value. A secret sharing apparatus, which includes a third value calculated based on a second random number included in a group of two random numbers and verification data of the shared data. The secret sharing device according to claim 1,
The public parameters are prime numbers p such that q = (p-1) / 2 is a prime number and g ₁ εGF (p) and g ₂ which are different elements of order q of a finite field modulo p. ∈ GF (p) and,
The first random number group includes random numbers R ₀ , ..., R _n−2 (R _j ε {0,1} ^d (0 ≦ j ≦ n−2)),
The second random number group includes a random number aεGF (q) and a random number bεGF (q),
The first value is R = R ₀ || ... || R _{n-2 obtained} by combining the random numbers,
The first function is F (X) = h _S + h _R X mod q (where h _s is a hash value of the secret data, and h _R is a hash value of the first value R). is there),
The second function is F ′ (X) = a + bX mod q,
The processor is
The secret data Sε {0,1} ^{d (n-1)} is divided into n-1 pieces of data S ₁ , ..., S _n-1 each having a length d,
D (i, j) = S _{(i−j mod n)} xor R _j (0 ≦ i ≦ n−1, 0 ≦ j ≦ n−2, where S ₀ ε {0} ^d ) for each (i, j),
D '(i) = D (i, 0) || ... || D (i, n-2), which is obtained by concatenating each D (i, j) for each i, is generated as the partial variance data,
For each of the partial variance data D ′ (i) (0 ≦ i ≦ n−1), the additional variance data D (i, n−1) = F (h _{D ′ (i)} ) and D (i, n) = F ′ (h _{D ′ (i)} ) is calculated and the additional dispersion data and the partial dispersion data are combined to obtain D (i) = D ′ (i) || D (i, n−1). || D (i, n) is generated as the distributed data,
G ₁ = pow (g ₁ , h _S ) × pow (g ₂ , a) mod p is calculated as the second value,
A secret sharing apparatus that calculates G ₂ = pow (g ₁ , h _R ) × pow (g ₂ , b) mod p as the third value. The secret sharing device according to claim 1,
The storage device is
Holding first distributed data generated from the first secret data to be restored and second distributed data,
The processor is
Executing restoration processing of the first secret data from the first distributed data and the second distributed data,
In the restoration process,
Deleting the additional distributed data from each of the first distributed data and the second distributed data to obtain partial distributed data,
Dividing each of the partial distributed data of the first distributed data and the partial distributed data of the second distributed data,
The restored divided data of the first secret data based on the exclusive OR of the divided data of the first distributed data after the division and the divided data of the second distributed data Produces
A secret sharing device that combines the restored divided data to restore the first secret data. The secret sharing device according to claim 3,
The processor is
For each of the first distributed data and the second distributed data, based on the additional distributed data corresponding to the distributed data and the second value and the third value included in the verification data. , Determine whether the distributed data is correct data,
A secret sharing apparatus that performs the restoration process when it is determined that both the first distributed data and the second distributed data are correct data. The secret sharing device according to claim 3,
The processor is
It was used to generate the distributed data of the first secret data based on the exclusive OR of the divided first distributed data, the divided second distributed data, and the restored divided data. Restore the random numbers of the first random number group,
The restored first first value is calculated based on the hash value of the first value calculated from the restored random number by the predetermined hash function and the hash value of the restored first secret data by the predetermined hash function. A secret sharing device that determines whether the secret data is correct data. A secret sharing system,
Including a secret sharing device, a plurality of storage devices, and a verification data disclosure device,
The secret sharing device is
Holds secret data and public parameters,
Divide the secret data,
Generating a plurality of partial distributed data based on an exclusive OR of the divided secret data and a first random number group composed of a plurality of random numbers,
A hash value of the secret data by a predetermined hash function, a hash value of a first value obtained from a random number of the first random number group by the predetermined hash function, and the predetermined hash of each of the plurality of partial distributed data. Calculate the hash value by the function and
A value obtained by substituting the partial distributed data into a first function having a hash value of the secret data and a hash value of the first value as a coefficient or a constant term for each of the plurality of partial shared data. A value obtained by substituting the partial dispersion data into a second function having a random number of a second random number group consisting of random numbers not included in the first random number group as a coefficient or a constant term, Generates distributed data by adding to the partial distributed data,
Sending each of the distributed data to a different storage device,
A second value calculated based on the public parameter, the hash value of the secret data, and the first random number included in the second random number group, the public parameter, the hash value of the first value, and the second value. A third value calculated based on the second random number included in the two random number group, and the verification data of the distributed data,
Sending the verification data and the public parameters to the verification data publishing device,
The verification data disclosure device discloses the verification data and the disclosure parameter in the secret sharing system. The secret sharing system according to claim 6,
The public parameters are prime numbers p such that q = (p-1) / 2 is a prime number and g ₁ εGF (p) and g ₂ which are different elements of order q of a finite field modulo p. ∈ GF (p) and,
The first random number group includes random numbers R ₀ , ..., R _n−2 (R _j ε {0,1} ^d (0 ≦ j ≦ n−2)),
The second random number group includes a random number aεGF (q) and a random number bεGF (q),
The first value is R = R ₀ || ... || R _{n-2 obtained} by combining the random numbers,
The first function is F (X) = h _S + h _R X mod q (where h _s is a hash value of the secret data, and h _R is a hash value of the first value R). is there),
The second function is F ′ (X) = a + bX mod q,
The secret sharing device is
The secret data Sε {0,1} ^{d (n-1)} is divided into n-1 pieces of data S ₁ , ..., S _n-1 each having a length d,
D (i, j) = S _{(i−j mod n)} xor R _j (0 ≦ i ≦ n−1, 0 ≦ j ≦ n−2, where S ₀ ε {0} ^d ) for each (i, j),
D '(i) = D (i, 0) || ... || D (i, n-2), which is obtained by concatenating each D (i, j) for each i, is generated as the partial variance data,
For each of the partial variance data D ′ (i) (0 ≦ i ≦ n−1), the additional variance data D (i, n−1) = F (h _{D ′ (i)} ) and D (i, n) = F ′ (h _{D ′ (i)} ) is calculated and the additional dispersion data and the partial dispersion data are combined to obtain D (i) = D ′ (i) || D (i, n−1). || D (i, n) is generated as the distributed data,
G ₁ = pow (g ₁ , h _S ) × pow (g ₂ , a) mod p is calculated as the second value,
A secret sharing system that calculates G ₂ = pow (g ₁ , h _R ) × pow (g ₂ , b) mod p as the third value. The secret sharing system according to claim 6,
The secret sharing device is
Receiving first distributed data generated from the first secret data to be restored and second distributed data from different storage devices,
Executing restoration processing of the first secret data from the first distributed data and the second distributed data,
In the restoration process,
Deleting the additional distributed data from each of the first distributed data and the second distributed data to obtain partial distributed data,
Dividing each of the partial distributed data of the first distributed data and the partial distributed data of the second distributed data,
The restored divided data of the first secret data based on the exclusive OR of the divided data of the first distributed data after the division and the divided data of the second distributed data Produces
A secret sharing system that combines the restored divided data to restore the first secret data. The secret sharing system according to claim 8, wherein
The secret sharing device is
For each of the first distributed data and the second distributed data, based on the additional distributed data corresponding to the distributed data and the second value and the third value included in the verification data. , Performs verification processing to determine whether the distributed data is correct data,
When it is determined that both the first distributed data and the second distributed data are correct data, the restoration process is executed,
When it is determined that at least one of the first shared data and the second shared data is not correct data, a storage holding the shared data of the first secret data other than the first shared data and the second shared data. A secret sharing system that acquires third shared data of the first secret data from a device and performs the verification process on the third shared data. The secret sharing system according to claim 8, wherein
The secret sharing device is
It was used to generate the distributed data of the first secret data based on the exclusive OR of the divided first distributed data, the divided second distributed data, and the restored divided data. Restore the random numbers of the first random number group,
The restored first first value is calculated based on the hash value of the first value calculated from the restored random number by the predetermined hash function and the hash value of the restored first secret data by the predetermined hash function. A secret sharing system that determines whether or not secret data is correct. The secret sharing system according to claim 6,
The storage device is
From the verification data disclosure device, obtain the verification data,
It is determined whether the distributed data is correct data based on the additional distributed data corresponding to the received distributed data and the second value and the third value included in the verification data. A secret sharing system that performs verification processing. A secret sharing method using a secret sharing device,
The secret sharing device includes a processor and a storage device,
The storage device holds secret data and public parameters,
The secret sharing method is
The processor divides the secret data,
The processor generates a plurality of partial distributed data based on an exclusive OR of the divided secret data and a first random number group composed of a plurality of random numbers,
The processor includes a hash value of the secret data according to a predetermined hash function, a hash value of a first value obtained from a random number of the first random number group according to the predetermined hash function, and the plurality of partial distributed data. Calculating a hash value by the predetermined hash function,
The processor obtains, for each of the plurality of partial distributed data, by assigning the partial distributed data to a first function having a hash value of the secret data and a hash value of the first value as a coefficient or a constant term. And a value obtained by substituting the partial variance data into a second function having a random number of a second random number group that is a random number not included in the first random number group as a coefficient or a constant term. Distributed data is added to the partial distributed data to generate distributed data,
The processor outputs each of the distributed data to different output destinations,
A second value calculated by the processor based on the public parameter, a hash value of the secret data, and a first random number included in the second random number group, and a hash of the public parameter and the first value. A secret sharing method, wherein a third value calculated based on a value and a second random number included in the second random number group is included in the verification data of the shared data.

Images