JP4288966B2 - Secret sharing apparatus, secret reconfiguration apparatus, secret sharing reconfiguration system, secret sharing method, and secret reconfiguration method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a secret distribution device, a secret reconfiguration device, a secret distribution reconfiguration system, a secret distribution method, and a secret reconfiguration method for distributing and managing secret information, for example, a secret key in encryption and authentication It is about.
[0002]
[Prior art]
When storing important secret information such as a secret key used for encryption to conceal information or a secret for authentication, there is a risk of loss or destruction of the secret information and fear of theft of the secret information. . As a countermeasure against loss or destruction of confidential information, it is conceivable to make a copy of the confidential information and store it, but the risk of theft of confidential information due to an increase in the number of confidential information copies. Will increase. There is a secret sharing method as a method for solving this problem. In a system that implements the secret sharing method, a secret sharing device (arithmetic device) distributes (encodes) the original secret information into a plurality of pieces of shared information, and each member (calculation / storage device) that is a participant is involved. When it is necessary to distribute the multiple pieces of shared information and obtain the original secret information, the secret reconstruction device (arithmetic device) collects the shared information from the necessary members and Reconstruct (restore) information.
[0003]
One secret sharing method is a (k, n) threshold secret sharing method called the Shamir method (Shamir's method) (for example, see Non-Patent Documents 1 and 2 described later). In the (k, n) threshold secret sharing method described in Non-Patent Document 1, secret information is encoded into n (n is an integer of 2 or more) pieces of shared information, and k (k is an integer of n or less). ) If more than one piece of shared information is collected, the original secret information can be restored, but even if k-1 pieces or less of shared information are collected, the original secret information cannot be known at all. This is realized by using polynomial interpolation.
[0004]
Further, in the (k, n) threshold secret sharing method described in Non-Patent Document 2, the above properties are restricted to laws different from the Chinese remainder theorem, and those methods are determined in advance. It is realized by. The Chinese Remainder Theorem is a solution of simultaneous congruential equations that take modulo values.
"The following simultaneous linear congruence (where modulo m₁, M₂, ..., m_tAre disjoint. ),
x≡a₁(Mod.m₁)
x≡a₂(Mod.m₂)
...
x≡a_t(Mod.m_t)
Has a solution, and the solution x is the modulus m₁× m₂× ... × m_t(Mod.m₁× m₂× ... × m_t) Is uniquely determined. "
That is why. The solution x is a_iAnd m_i(I = 1, 2,..., T).
[0005]
[Non-Patent Document 1]
Okamoto Tatsuaki et al., “Contemporary Cryptography” (Industry Books), pages 214-216
[Non-Patent Document 2]
Charles Asmus et al., "A Modular Approach to Key Safe Guarding", I Triple E Transactions on Information Theory, IT-29, No. 2, March 1983 208-210 (CHARLES ASMUTH ET AL., "A MODULAR APPROACH TO KEY SAFEGUARDING", IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. IT-29, NO.2, MARCH 1983, pp.208-210)
[0006]
[Problems to be solved by the invention]
In the conventional (k, n) threshold value secret sharing method described above, it is assumed that the authority of each member who is a distribution information distribution destination is regarded as equivalent. In other words, the original secret information can be restored by collecting the shared information from the k members who received the distributed information.
[0007]
By the way, there is a case where it is desired to make a difference between the authority of each member, instead of making the authority of each member to which the distributed information is distributed the same. For example, in an organization where there are three levels of authority, level 3, level 5, and level 7 from the top, important confidential information of the organization is secretly distributed and stored. In this case, if three people have level 3 authority, it is possible to restore secret information (high authority of each member), and if they have level 5 authority, 5 people gather. The secret information can be restored (the authority of each member is medium level), and if the person has level 7 authority, the secret information can be restored when seven people gather (the authority of each member is low level) Shall. There are three (k, n) threshold secret sharing schemes with three authority levels: level 3, level 5, and level 7. The distributed secret is set to 105 or more, and if 105 pieces of distributed information are collected, the original secret is obtained. A (k, n) threshold secret sharing method that can reconstruct information, that is, “(105, 105 or more) threshold secret sharing method” can be considered. Here, 105 is the least common multiple of 3, 5, and 7. In this case, 35 shared information per person is distributed to level 3 persons, 21 distributed information per person is distributed to level 5 persons, and 15 per person is distributed to level 7 persons. Distributed information will be distributed.
[0008]
However, in this case, the amount of calculation executed by the secret sharing apparatus when the secret information is distributed (encoded), the amount of information that must be stored in the storage device of each member storing the distributed information, and the secret information There is a problem in that the amount of calculation executed by the secret reconstruction device increases when reconfiguration (restoration) is performed.
[0009]
Accordingly, the present invention has been made to solve the above-described problems of the prior art, and its purpose is to provide information amount of distributed information to be generated and information amount of distributed information to be stored. It is to provide a secret sharing apparatus, a secret sharing reconfiguration system, and a secret sharing method capable of performing secret sharing according to the authority level of each member while suppressing an increase in the number of members.
[0010]
Another object of the present invention is to provide a secret reconfiguration apparatus, a secret distribution reconfiguration system, and a secret reconfiguration method that can reconfigure original secret information from distributed information that is secret-distributed according to authority levels. Is to provide.
[0011]
[Means for Solving the Problems]
The secret sharing apparatus according to the present invention is an apparatus for generating shared information distributed to each of a plurality of members from the original secret information, wherein the original secret information and the authority level of each member are input. Used to calculate the original secret information from the member ID corresponding to each of the authority levels, the radix for generating shared information associated with the original secret information, and the radix. ID radix generation means for calculating a secret ID, and shared information generation means for calculating shared information distributed to each member from the radix calculated by the ID radix generation means and the member ID.
[0012]
The secret reconstruction device according to the present invention is a device for reconstructing information secret-distributed by the secret sharing device, wherein the original secret is collected from the member ID collected at the time of secret reconfiguration. A determination means for determining whether or not information can be reconfigured; and when the determination means determines that reconfiguration is possible, the original secret information is obtained from the collected member ID and shared information. And secret reconfiguration means for reconfiguration.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
(1) Secret sharing apparatus, secret sharing reconfiguration system and secret sharing method capable of performing secret sharing according to authority level of each member, and (2) secret according to authority level of each member A secret reconstruction device, a secret sharing reconstruction system, and a secret reconstruction method that can reconstruct the original secret from the distributed information will be described. Each member, the secret sharing device, and the secret reconstruction device are configured by an arithmetic storage device such as a computer. The secret sharing reconfiguration system includes each member, a secret sharing device, a secret reconfiguring device, and a network (communication means such as a dedicated line or the Internet) connecting them. Further, the secret sharing reconfiguration system may include a storage holding device that holds public information such as the number of digits of a radix described later. Furthermore, the secret sharing apparatus and the secret reconfiguration apparatus can be configured as a single apparatus that can implement both the secret sharing method and the secret reconfiguration method. In addition, a specific member (arithmetic storage device) may be configured to have the function of the secret sharing apparatus, the function of the secret reconstruction device, or both functions.
[0014]
<< 1. First Embodiment >>
The secret sharing apparatus (secret sharing method) and secret reconfiguring apparatus (secret reconfiguring method) according to the first embodiment of the present invention will be described below. In the first embodiment, in the (k, n) threshold secret sharing method using the properties of the Chinese remainder theorem, the member ID is not determined in advance, and further, there is no restriction between the member IDs. The distributed information corresponding to the desired authority level is generated by generating the member ID corresponding to the authority level of each member when the original secret information is distributed.
[0015]
The secret sharing method according to the first embodiment can be implemented by, for example, the secret sharing apparatus 100 (FIGS. 1 and 2), and the secret reconfiguration method according to the first embodiment is, for example, secret reconfiguration. It can be implemented by the apparatus 110 (FIG. 3). Also, (1) secret sharing device 100, (2) secret reconfiguration device 110, (3) a plurality of members (calculation storage devices), and (4) radix digit N in a state in which secret reconfiguration device 110 can be used. And the storage holding device for storing the secret ID_P, and (5) the line connecting these devices constitute a secret sharing reconfiguration system. In the present specification, the symbol “_” (underscore) means a space between “the name of the component” and “the symbol”.
[0016]
<< 1-1. Configuration of secret sharing apparatus 100 >>
FIG. 1 is a block diagram schematically showing the configuration of the secret sharing apparatus 100 according to the first embodiment. Here, a case where the original secret information S to be distributed is distributed to n members will be described. As shown in FIG. 1, the secret sharing apparatus 100 includes the original secret information S to be distributed and the authority level L of each member to which the distributed information is distributed.₁, L₂, ..., L_nN are input. Also, the secret sharing apparatus 100 can share information X distributed to each member.₁, X₂, ..., X_nN and member ID (member identification data) m distributed to each member₁, M₂, ..., m_nAnd the base digit number N and secret ID (secret identification data) P, which are auxiliary information necessary to reconstruct the original secret information S, are output.
[0017]
Here, the authority level is “minimum L_i"Let the people gather, the original secret information S can be reconstructed"_iTherefore, the lower the authority level, the higher the authority. For example, if two members with the authority level “2” gather (that is, if the distributed information held by the two members is collected) ), The original secret information S can be reconstructed, but the secret information S cannot be reconstructed unless six members with the authority level “6” are gathered, and the authority level is “2”. Since the member is considered to have shared information for three members with authority level “6”, one member with authority level “2” and three members with authority level “6” If the total of four people gather, the original secret information S can be reconstructed.
[0018]
As illustrated in FIG. 1, the secret sharing apparatus 100 according to the first embodiment includes an ID generation unit 101, a radix generation unit 102, and a shared information generation unit 103. The ID generation unit 101 and the radix generation unit 102 are portions that generate information necessary for generating shared information. These are collectively referred to as an ID radix generation unit 104.
[0019]
[Description of ID generation unit 101]
First, the minimum number of digits N of distributed information distributed to each member in advance_XminIs determined. As shown in FIG. 1, the original secret information S and authority level L of each member input to the secret sharing apparatus 100₁, L₂, ..., L_nIs input to the ID generation unit 101. The ID generation unit 101 uses the member ID_m used when generating the shared information according to the secret ID_P, the number of base digits N, and the authority level.₁, M₂, ..., m_nIs generated. The ID generation unit 101 outputs the generated secret ID_P and the base digit number N to the base generation unit 102, and generates the generated member ID_m₁, M₂, ..., m_nIs output to the distributed information generation unit 103. Since the generated base digit number N and secret ID_P are used when reconstructing the original secret information S, the ID generation unit 101 sets the generated base digit number N and secret ID_P to be described later. To the storage holding device that can be used by the secret reconfiguring device 110. Since the number of digits of the radix N and the secret ID_P are values that may be disclosed, they may be distributed to each member or stored in a storage holding device that functions as a bulletin board. At the time of secret reconstruction, the secret reconstruction device 110 must be in a usable state.
[0020]
FIG. 2 is a block diagram showing in detail the configuration of the ID generation unit 101 of FIG. As shown in FIG. 2, the ID generation unit 101 includes a range designation prime number selection unit 1011, a radix digit number generation unit 1012, a maximum value selection unit 1013, a member ID digit number generation unit 1014, and a digit number designation prime number. The selection unit 1015 is the main component.
[0021]
[Description of Range Specified Prime Number Selection Unit 1011]
As shown in FIG. 2, the secret information S input to the ID generation unit 101 is input to the range designation prime number selection unit 1011. The range designation prime number selection unit 1011 regards the original secret information S as a positive integer so that the remainder when the radix Y is divided by the secret ID_P becomes the original secret information S, and a prime number larger than the positive integer And the prime number is output as a secret ID_P. The output secret ID_P is one of the outputs of the ID generation unit 101.
[0022]
[Description of Maximum Value Selection Unit 1013]
As shown in FIG. 2, the authority level L of each member input to the ID generation unit 101₁, L₂, ..., L_nIs input to the maximum value selection unit 1013. The maximum value selection unit 1013 displays the input authority level L₁, L₂, ..., L_nThe one having the maximum value (that is, the authority level with the lowest authority) is selected and output to the radix digit number generation unit 1012.
[0023]
[Description of Radix Digit Number Generation Unit 1012]
As shown in FIG. 2, the radix digit number generation unit 1012 outputs the authority level L output from the maximum value selection unit 1013.₁, L₂, ..., L_nThe base number N is generated based on the received value and output. The radix Y shown in FIG. 1 is a value generated to distribute the secret information S. The radix Y is the member ID_m₁, M₂, ..., m_nEach of the remainder when divided by₁, X₂, ..., X_nAnd the value obtained by dividing the radix Y by the secret ID_P is the original secret information S to be distributed. The radix digit generation unit 1012 has a predetermined minimum number N of shared information._XminIs multiplied by the maximum value of the authority level inputted, and the multiplication result is output as the number of digits N of the radix. The output base digit number N is input to the member ID digit number generation unit 1014 and simultaneously becomes one of the outputs of the ID generation unit 101.
[0024]
[Description of Member ID Digit Number Generation Unit 1014]
As shown in FIG. 2, the authority level L of each member input to the ID generation unit 101₁, L₂, ..., L_nIs input to the maximum value selection unit 1013 and to the member ID digit number generation unit 1014. The member ID digit number generation unit 1014 includes a radix digit number N output from the radix digit number generation unit 1012 and an authority level L input to the ID generation unit 101.₁, L₂, ..., L_nIs generated, and the number of digits of the member ID for each authority level is generated and output to the digit number designation prime number selection unit 1015. The member ID digit number generation unit 1014 displays each authority level L₁, L₂, ..., L_nFor each authority level L₁, L₂, ..., L_nThe division means for calculating the quotient divided by ## EQU2 ## is output as the number of digits of each member ID.
[0025]
[Description of Digit Number Designating Prime Number Selection Unit 1015]
As shown in FIG. 2, the number-of-digits specifying prime number selection unit 1015 receives the number of member ID digits from the member ID digit number generation unit 1014 as many as the number of members, and becomes the number of digits of the received member ID. Select each prime number and select the selected prime number as member ID_m₁, M₂, ..., m_nOutput as. This member ID_m to be output₁, M₂, ..., m_nIs one of the outputs of the ID generation unit 101.
[0026]
[Description of Radix Generation Unit 102]
As shown in FIG. 1, the radix generation unit 102 receives the original secret information S input to the secret sharing apparatus 101, the secret ID_P output from the ID generation unit 101, and the number of digits N of the radix, Based on these, the radix Y is generated. The radix generation unit 102 outputs the generated radix Y to the distributed information generation unit 103. The radix generation unit 102 generates a radix Y from the secret ID_P, the original secret information S, and the number of digits N of the radix. The radix Y is a value of the number of digits N such that the remainder when divided by the secret ID_P becomes the original secret information S. Therefore, the radix Y can be calculated as follows, for example. Set the number of digits of secret ID_P to N_PThen, the number of digits NN_PThe result of adding the secret information S to the result of multiplying the random number R by the secret ID_P is defined as a radix Y. That is,
Y = S + RP (1)
Perform a calculation such that In this way, the remainder when the radix Y is divided by the secret ID_P becomes the secret information S, and the random number R (the number of digits is NN)._P) And secret ID_P (the number of digits is N_P) Of the multiplication result is (N−N_P) + N_PSince = N, the number of digits of the radix Y can also be N.
[0027]
[Description of Distributed Information Generation Unit 103]
As shown in FIG. 1, the radix Y from the radix generator 102 and the member ID_m from the ID generator 101 to the shared information generator 103.₁, M₂, ..., m_nIs distributed and distributed information X distributed to each member₁, X₂, ..., X_nAnd member ID_m₁, M₂, ..., m_nIs output. The shared information generation unit 103 sets the radix Y to each member ID_m₁, M₂, ..., m_nAnd a remainder calculation means for calculating the remainder when divided by, and each remainder calculation result is distributed information X₁, X₂, ..., X_nOutput as. Radix number N and secret ID_P output from the ID generation unit 101 and shared information X output from the shared information generation unit 103₁, X₂, ..., X_nAnd member ID_m₁, M₂, ..., m_nIs output from the secret sharing apparatus 100.
[0028]
<< 1-2. Configuration of Secret Reconfiguration Device 110 >>
FIG. 3 is a block diagram schematically showing the configuration of the secret reconstruction device 110 according to the first embodiment. Here, a case will be described in which the number of members gathered for reconfiguration is k (k ≦ n). That is, a case where shared information is collected from k members (arithmetic storage devices) will be described. As shown in FIG. 3, the secret reconstruction device 110 includes member ID_m of the k members gathered._i1, M_i2, ..., m_ikAnd shared information X held by k members_i1, X_i2, ..., X_ikAnd the base digit number N and the secret ID_P, which are auxiliary information necessary for reconstructing the original secret, are input, and the secret reconfiguration apparatus 110 receives the reconfigured secret information S or reconfiguration error information. Is output. The member IDs and shared information input to the secret reconstruction device 110 are the same as the number of k members (that is, k member ID_m)._i1, M_i2, ..., m_ikAnd k pieces of distributed information X_i1, X_i2, ..., X_ik) Is input. The order in which the member ID and the shared information are input to the secret reconfiguration apparatus 110 does not have to be the same as the order in which the secret distribution apparatus 100 outputs them. Further, as described above, the radix digit number N and the secret ID_P can be used by the secret reconstruction device 110 (for example, stored in a storage holding device accessible by the secret reconstruction device 110). , Members of the collective have it and can provide it as input).
[0029]
As illustrated in FIG. 3, the secret reconfiguration apparatus 110 includes a member ID determination unit 111, a radix reconfiguration unit 112, and a secret separation unit 113. The radix reconstructing unit 112 and the secret separating unit 113 are parts for reconstructing the secret, and hence are collectively referred to as the secret reconfiguring unit 114.
[0030]
[Description of Member ID Determination Unit 111]
As shown in FIG. 3, the member ID_m input to the secret reconfiguration device 110_i1, M_i2, ..., m_ik, Its distributed information X_i1, X_i2, ..., X_ik, And the number of digits N of the radix are input to the member ID determination unit 111. The member ID determination unit 111 inputs the number of base digits N and the member ID_m_i1, M_i2, ..., m_ikIn order to reconstruct the secret, it is determined whether or not a sufficient number of members having sufficient authority are gathered, and the determination result (referred to as member ID determination result) is sent to the radix reconstruction unit 112. Output. The member ID determination result is a determination result of “reconfigurable” if “a sufficient number of members having sufficient authority are gathered”, and a determination result of “non-reconfigurable” otherwise. . The member ID determination unit 111 includes multiplication means for multiplying all inputted member IDs, and multiplies all inputted member IDs (that is, member IDs of the collected members). The number of digits of the multiplication result is compared with the number of digits N of the input radix. If the number of digits of the multiplication result is equal to or larger than the number of digits N of the radix, the secret information S can be reconstructed. (This secret reconfigurability can be proved using the Chinese remainder theorem). Therefore, if the number of digits of the multiplication result is equal to or larger than the number of digits N of the radix, the determination result “reconfigurable” is output, and the process proceeds to the reconfiguration process of the secret information S. Otherwise, the determination result “unreconfigurable” is output.
[0031]
[Description of Radix Reconstruction Unit 112]
As shown in FIG. 3, the member ID_m input to the secret reconfiguration device 110_i1, M_i2, ..., m_ikAnd its distributed information X_i1, X_i2, ..., X_ikIs input to the radix reconstruction unit 112. The radix reconfiguration unit 112 receives the member ID determination result from the member ID determination unit 111, and outputs the reconfiguration error information to the secret separation unit 113 if the member ID determination result is a determination result that the reconfiguration is not possible. Otherwise, the radix reconstruction unit 112 receives the input member ID_m_i1, M_i2, ..., m_ikAnd its distributed information X_i1, X_i2, ..., X_ikThus, calculation is performed to obtain the radix Y, and the obtained radix Y is output to the secret separation unit 113. The radix Y can be obtained as follows, for example. Each distributed information X_i1, X_i2, ..., X_ikTwo types of coefficients M calculated from the member ID_i1, M_i2, ..., M_ikAnd I_i1, I_i2, ..., I_ikThe product of the member IDs of the gathered members
M = m_i1× m_i2× ... × m_ik
By taking the remainder (calculating mod.M). That is,
Y = M_i1I_i1X_i1+ M_i2I_i2X_i2+ ... + M_ikI_ikX_ik  (Mod.M) (2)
To obtain the radix Y. Each coefficient to be multiplied is calculated as follows. Input member ID_m_i1, M_i2, ..., m_ikOf these, all items other than the member ID for the distributed information to be multiplied are respectively M_i1, M_i2, ..., M_ikAnd M_i1, M_i2, ..., M_ik, The member ID method for the distributed information to be multiplied (remainder, mod.m_ijThe inverse element under the calculation_i1, I_i2, ..., I_ikAnd That is, X_ijCoefficient M_ijAnd I_ij(J = 1, 2,..., K) is
M_ij= M_i1× m_i2× ... × m_ik/ M_ij= M / m_ij    ... (3)
I_ij= (M_ij)^-1  (Mod.m_ij(4)
Can be obtained by calculating.
[0032]
The above formula (3) is calculated by multiplying all the member IDs gathered on the formula, and then calculating M_ijMember ID_m corresponding to_ijIn fact, it is divided by M_ijMember ID_m corresponding to_ijThere is also an implementation method in which member IDs other than those are simply multiplied (in this method, one multiplication and one division can be reduced). In addition, the calculation of the above formula (4) is performed by calculating the member ID_m_ijModulo (mod.m_ijThe calculation for obtaining the inverse element can be performed by using the Euclidean mutual division method. In particular, member ID_m_ijM is a prime number, m_ijSince a finite field can be generated by taking the remainder of_ijThe inverse calculation under the law of
(M_ij)^-1= (M_ij)^r  (Mod.m_ij(5)
r = m_ij-2 ... (6)
It can also be calculated with However, other methods may be used.
[0033]
[Description of Secret Separation Unit 113]
As shown in FIG. 3, the secret ID_P input to the secret reconstruction device 110 is input to the secret separation unit 113. The secret separation unit 113 receives the radix Y from the radix reconstruction unit 112, performs an operation to obtain the secret information S from the radix Y and the secret ID_P that is input, and the secret separation unit 113 Output from. The secret separation unit 113 includes a remainder calculation unit, and outputs the remainder when the radix Y is divided by the secret ID_P as secret information S. If the output from the radix reconstruction unit 112 is reconstruction error information, the secret separation unit 113 outputs the reconstruction error information as it is instead of reconstructing the secret information S. The output from the secret separation unit 113 becomes the output of the secret reconstruction device 110.
[0034]
<< 1-3. Operation of secret sharing apparatus 100 >>
Next, the operation of the secret sharing apparatus 100 in FIG. 1 will be described. When the secret sharing apparatus 100 distributes the original secret information S to be distributed to n members as shared information, the secret level L of each member₁, L₂, ..., L_nDepending on the member ID_m₁, M₂, ..., m_nAnd the distributed information X corresponding to the member ID₁, X₂, ..., X_nIs generated and output. FIG. 4 is a flowchart showing the operation of the secret sharing apparatus 100.
[0035]
As shown in FIG. 4, first, the input secret information S and the authority level L of each member₁, L₂, ..., L_nTo secret ID_P, radix Y, and member ID_m distributed to each member₁, M₂, ..., m_nAre calculated (step S11). This step S11 corresponds to the operation of the ID radix generation unit 104 in FIG. A more detailed flowchart of step S11 is shown in FIG.
[0036]
As shown in FIG. 5, in step S11, first, a secret ID_P is calculated from the secret information S (step S111).₁, L₂, ..., L_nThe number of radix digits N is calculated from (step S112). Step S111 and step S112 may be operated in parallel as shown in FIG. 5, or may be operated in series so as to be executed by program software. When operating in series, either step S111 or step S112 may be operated first. This step S111 corresponds to the operation of the range designation prime number selection unit 1011 in FIG. 2, and the secret ID_P is calculated by selecting a prime number larger than the secret information S. Step S112 corresponds to the operations of the maximum value selection unit 1013 and the radix digit generation unit 1012 in FIG. The number of digits of the radix N is the authority level L in the maximum value selection unit 1013.₁, L₂, ..., L_nThe one having the maximum value (that is, the authority level with the lowest authority) is selected and input to the radix digit number generation unit 1012, and the predetermined minimum number N of the distributed information is determined._XminIs multiplied by the maximum authority level input.
[0037]
Next, as shown in FIG.₁, L₂, ..., L_nAnd the member ID is calculated from the number of digits N of the radix (steps S1131 and S1132), and the radix Y is calculated from the secret information S, the secret ID_P, and the number of digits N of the radix (step S114). The combined step of step S1131 and step S1132 is collectively referred to as step S113. Step S113 and step S114 may be operated in parallel as shown in FIG. 5, or may be operated in series so as to be executed by program software. When operating in series, either step S113 or step S114 may be operated first. Step S1131 corresponds to the operation of the member ID digit number generation unit 1014 of FIG. 2, and the number of digits of each member ID is the number of digits N of the radix.₁, L₂, ..., L_nIt is calculated by dividing by (rounded up after the decimal point). Step S1132 corresponds to the operation of the digit number specifying prime number selection unit 1015 in FIG. 2, and each member ID is calculated by selecting a prime number that is the number of digits of each member ID. Step S114 corresponds to the operation of the radix generation unit 102 of FIG. 1, and the radix Y is the number of digits of the secret ID_P as N_PAs the number of digits N-N_PIs generated by adding the secret information S to the result of multiplying the random number R and the secret ID_P (see the above-described equation (1)).
[0038]
As shown in FIG. 4, after step S11, the radix Y and member ID_m₁, M₂, ..., m_nTo distributed information X₁, X₂, ..., X_nIs calculated (step S12). This step S12 corresponds to the operation of the shared information generating unit 103 in FIG.₁, X₂, ..., X_nUses the radix Y for each member ID_m₁, M₂, ..., m_nCalculated by finding the remainder when divided by. With the above operation, the secret sharing apparatus 100 has the authority level L of each member.₁, L₂, ..., L_nDepending on the member ID_m₁, M₂, ..., m_nAnd the distributed information X for the member ID₁, X₂, ..., X_nIs generated and output.
[0039]
<< 1-4. Operation of Secret Reconstruction Device 110 >>
Next, the operation of the secret reconstruction device 110 in FIG. 3 will be described. The secret reconstructing device 110 is a member ID_m collected from k members (calculation storage devices) gathered to reconstruct the secret information S._i1, M_i2, ..., m_ikAnd distributed information X_i1, X_i2, ..., X_ikFrom this, the secret information S is reconstructed. At that time, the secret information S can be reconstructed if a sufficient number of members having a sufficient authority level for reconstructing the secret are gathered. Otherwise, the secret information S is reconstructed. Can not do it. FIG. 6 is a flowchart showing the operation of the secret reconstruction device 110.
[0040]
As shown in FIG. 6, first, the member ID_m that is input_i1, M_i2, ..., m_ikAnd the member ID determination result is calculated from the number of digits N of the radix (step S21). The process of step S21 corresponds to the operation of the member ID determination unit 111 in FIG. 3, and the member ID determination result is a multiplication result obtained by multiplying all input member IDs (that is, the member IDs of the collected members). Compare the number of digits with the number of digits N in the radix. If the number of digits in the multiplication result is equal to or greater than the number of digits N in the radix, it is calculated as “reconfigurable”; It is calculated as “unconfigurable”.
[0041]
Next, as shown in FIG. 6, the operation is divided depending on whether or not the member ID determination result is reconfigurable (step S22). If the determination result in step S22 is Yes (ie, if reconfigurable), proceed to step S23 to reconstruct the secret information S, and if No (ie, reconfigure) If the configuration is not possible, the reconstruction error information is output (step S24) and the process is terminated.
[0042]
As shown in FIG. 6, if the determination result in step S22 is Yes, the input member ID_m_i1, M_i2, ..., m_ik, Distributed information X_i1, X_i2, ..., X_ikAnd secret information S is calculated from secret ID_P (step S23). Step S23 corresponds to the operation of the secret reconstruction unit 114 in FIG. A more detailed flowchart of step S23 is shown in FIG.
[0043]
  As shown in FIG. 7, in step S23, first, member ID_m_i1, M_i2, ..., m_ikAnd distributed information X_i1, X_i2, ..., X_ikThe radix Y is calculated from (step S231). Step S231 corresponds to the operation of the radix reconstruction unit 112 in FIG. The radix Y is calculated as follows, for example. Each distributed information X_i1, X_i2, ..., X_ikTwo coefficients M calculated from the member ID_i1, M_i2, ..., M_ikAnd I_i1, I_i2, ..., I_ikThe product of the member IDs of the gathered members
M = m_i1× m_i2× ... × m_ik
By taking the remainder at (calculate mod.M)TotalIs calculated (refer to the above-mentioned formulas (2), (3), (4)).
[0044]
Next, as shown in FIG. 7, the secret information S is calculated from the radix Y (step S232). Step S232 corresponds to the operation of the secret separation unit 113 in FIG. 3, and the secret information S is calculated by taking the remainder when the radix Y is divided by the secret ID_P. When the secret information S is obtained in step S23, the secret information S is output and the operation is terminated.
[0045]
<< 1-5. Effects of the first embodiment >>
As described above, in the conventional Shamir method, equal authority is given to each member, or a plurality of distributed information is given to a person with high authority (in this case, the authority level with a small value is There are restrictions on the values that can be taken by the authority level, such as a divisor of the authority level with a large value), and there is a case where the member must have extra large distributed information. It was. Also, in the case of the (k, n) threshold secret sharing method using the Chinese remainder theorem, there are restrictions between member IDs, and each member ID is determined in advance, so that it is the same as the Shamir method. There are some restrictions. On the other hand, according to the first embodiment, when the secret sharing apparatus 100 distributes the secret information, the authority level L of each member₁, L₂, ..., L_nMember ID_m according to₁, M₂, ..., m_nAnd member ID_m₁, M₂, ..., m_nIn the meantime, there is no restriction other than that each is a prime number (that is, each is relatively prime), and a secret sharing method using the property of the Chinese remainder theorem is adopted, so the desired authority level L₁, L₂, ..., L_nDistributed information X according to₁, X₂, ..., X_nCan be generated. For this reason, according to the secret sharing apparatus 100, secret sharing reconfiguration system, and secret sharing method of the first embodiment, the amount of shared information that must be generated and the amount of shared information that must be stored While suppressing the increase, secret sharing according to the authority level of each member can be performed. Further, according to the secret reconfiguration apparatus 110, the secret sharing reconfiguration system, and the secret reconfiguration method of the first embodiment, it is possible to reconfigure information that is secret-shared according to the authority level.
[0046]
≪2. Second Embodiment >>
The secret sharing apparatus (secret sharing method) and secret reconfiguring apparatus (secret reconfiguring method) according to the second embodiment of the present invention will be described below. In the second embodiment, as in the first embodiment, in the (k, n) threshold secret sharing method using the properties of the Chinese remainder theorem, the member ID is not determined in advance, By generating a member ID corresponding to the authority of the member at the time of distribution without providing a restriction between the member IDs, distributed information corresponding to the desired authority is generated. The second embodiment is different from the first embodiment in that the original secret, member ID, secret ID, radix, and distributed information are handled as a polynomial having elements on a finite field as coefficients. is there. Therefore, there is no need to perform calculations between numerical values with extremely different numbers of digits, or calculations with an unknown number of digits are eliminated, which makes it more efficient when implemented in hardware. .
[0047]
The secret sharing method according to the second embodiment can be implemented by, for example, the secret sharing apparatus 200 (FIGS. 8 and 9), and the secret reconfiguration method according to the second embodiment is, for example, secret reconfiguration. It can be implemented by the apparatus 210 (FIG. 10). In addition, (1) secret sharing apparatus 200, (2) secret reconstructing apparatus 210, (3) a plurality of members (arithmetic storage devices), and (4) base polynomial degree N in a state where secret reconfiguring apparatus 210 can be used. And the storage holding device for storing the secret ID polynomial P (x) and (5) the line connecting these devices constitute a secret sharing reconfiguration system.
[0048]
<< 2-1. Configuration of secret sharing apparatus 200 >>
FIG. 8 is a block diagram schematically showing the configuration of the secret sharing apparatus 200 according to the second embodiment. The secret sharing apparatus 200 has a configuration similar to the secret sharing apparatus 100 of the first embodiment. However, in the first embodiment, the distributed information distributed to each member, the member ID, and the like are configured to take integer values. In the second embodiment, however, a finite field is used instead of the integer values. It is configured to take the above polynomial.
[0049]
In the description of the second embodiment, a finite field to be used is determined in advance as GF (q) (q is a prime number or a power of a prime number), and a polynomial on this finite field has a coefficient finite field GF ( q) Let us deal with the ones with the above values. Similar to the first embodiment, a case where the original secret information S to be distributed is distributed to n members will be described. As shown in FIG. 8, the secret sharing apparatus 200 includes the original secret information S to be distributed and the authority level L of each member to be distributed.₁, L₂, ..., L_nIs entered. Also, the secret sharing apparatus 200 has a shared information polynomial X distributed to each member.₁(X), X₂(X), ..., X_n(X) and member ID polynomial m distributed to each member₁(X), m₂(X), ..., m_n(X) and the degree N of the base polynomial and the secret ID polynomial P (x), which are auxiliary information necessary for reconstructing the original secret, are output. The meaning of the authority level is the same as in the first embodiment.
[0050]
As illustrated in FIG. 8, the secret sharing apparatus 200 according to the second embodiment includes an ID generation unit 201, a base polynomial generation unit 202, and a distributed information polynomial generation unit 203. Since the ID generation unit 201 and the base polynomial generation unit 202 are portions that generate information necessary for generating shared information, they are collectively referred to as an ID base polynomial generation unit 204.
[0051]
[Description of ID generation unit 201]
First, the minimum order N of the distributed information polynomial distributed to each member in advance_XminIs determined. As shown in FIG. 8, the original secret information S and the authority level L of each member input to the secret sharing apparatus 200₁, L₂, ..., L_nIs input to the ID generation unit 201. The ID generation unit 201 includes a secret ID polynomial P (x), a degree N of the base polynomial, a secret polynomial S (x) obtained by converting the secret information S into a polynomial form, and a member ID polynomial m₁(X), m₂(X), ..., m_n(X) is generated. Further, the ID generation unit 201 outputs the secret ID polynomial P (x), the secret polynomial S (x), and the degree N of the base polynomial to the base polynomial generation unit 202, and the member ID polynomial m₁(X), m₂(X), ..., m_n(X) is output to the distributed information polynomial generator 203. Further, the generated degree N of the base polynomial and the secret ID polynomial P (x) are also output to a memory holding device that can be used by the secret reconstructing device 210 described later. As in the first embodiment, the degree N of the base polynomial and the secret ID polynomial P (x) are values that may be disclosed, so that the memory holding device that is distributed to each member or serves as a bulletin board is used. Although it may be stored, the secret reconstruction device 201 must be in a usable state at the time of secret reconstruction.
[0052]
FIG. 9 is a block diagram showing in detail the configuration of the ID generation unit 201 in FIG. As shown in FIG. 9, the ID generation unit 201 includes a polynomial conversion unit 2011, an order range designation irreducible polynomial selection unit 2012, a base polynomial degree generation unit 2013, a maximum value selection unit 1013, and a member ID polynomial order. The generation unit 2014 and the degree designation irreducible polynomial selection unit 2015 are the main components.
[0053]
[Description of Polynomial Conversion Unit 2011]
As shown in FIG. 9, the secret information S input to the ID generation unit 201 is input to the polynomial conversion unit 2011 and converted into the secret polynomial S (x), and the secret polynomial S (x) is converted into the ID generation unit. 201 is output. For example, when the value of q on the finite field GF (q) used for the coefficient is larger than S, the conversion from the secret information S to the secret polynomial S (x) is a constant term S (x) = x + S. Can be a first order polynomial of S. Further, it is also possible to simply set the polynomial S (x) = S with only a constant term (in this case, there is no need to perform any processing in the polynomial converter 2011). Also, the secret is divided into y pieces
(E.g. bit-expand the secret and divide it into L pieces from LSB (least significant bit) or MSB (most significant bit), or S = S₁+ S₂+ ... + S_yS to be_i),
S (x) = S₁+ S₂x + S₃x²+ ... + S_yx^y-1
It is also possible to use a y-1 order polynomial as follows.
[0054]
Further, the secret information S is an extension field GF (q of the finite field GF (q).^m) Can be used as the secret polynomial S (x) as a polynomial expressed by a polynomial described by the remainder when divided by the generator polynomial g (x). Any conversion method may be adopted as long as the secret information S that is a numerical value can be uniquely converted to a polynomial, and conversely, the secret information S can be uniquely converted from a polynomial. In the description of the second embodiment, since the secret information S takes a positive integer value, it is necessary to convert it into a polynomial. If the secret information S to be input is already a polynomial, For example, the secret information S is an extension field GF (q of the finite field GF (q).^m), And a polynomial expression described by the remainder when divided by the generator polynomial g (x), it is not necessary to convert it to a polynomial. Therefore, depending on the description method of the secret information S, the polynomial converter 2011 may not be necessary (the polynomial converter 2011 does not perform any processing).
[0055]
[Description of degree range irreducible polynomial selection unit 2012]
As shown in FIG. 9, the degree range designated irreducible polynomial selection unit 2012 calculates the order of the secret polynomial S (x) input from the polynomial conversion unit 2011, and the order range specified irreducible polynomial selection unit 2012 calculates the order of the secret polynomial S (x). An irreducible polynomial P (x) having a large degree is selected, and the irreducible polynomial is output as a secret ID polynomial P (x). An irreducible polynomial is a polynomial that cannot be divided by any polynomial of lower degree than that polynomial (polynomial of 1st order or higher). The output secret ID polynomial P (x) is one of the outputs of the ID generation unit 201.
[0056]
[Description of Maximum Value Selection Unit 1013]
As shown in FIG. 9, the authority level L of each member input to the ID generation unit 201₁, L₂, ..., L_nIs input to the maximum value selection unit 1013. Similar to the maximum value selection unit 1013 of the first embodiment, the maximum value selection unit 1013 of the second embodiment has an authority level L₁, L₂, ..., L_nIs selected, and the maximum value selection unit 1013 selects the authority level that takes the maximum value (that is, the authority level with the lowest authority) and outputs it to the base polynomial degree generation unit 2013.
[0057]
[Description of Base Polynomial Order Generation Unit 2013]
As shown in FIG. 9, the base polynomial order generation unit 2013 receives the output from the maximum value selection unit 1013, generates the base polynomial order N based on the received value, and outputs the base polynomial order N. The base polynomial Y (x) is a polynomial generated to distribute the secret information S (that is, the secret polynomial S (x)). The base polynomial Y (x) is obtained by replacing the base polynomial Y (x) with each member ID polynomial m₁(X), m₂(X), ..., m_nEach remainder when divided by (x) is the variance information polynomial X₁(X), X₂(X), ..., X_n(X), and the remainder when the base polynomial Y (x) is divided by the secret ID polynomial P (x) is the secret polynomial S (x) obtained by converting the original secret information S polynomial to be distributed. Is a polynomial. The base polynomial degree generation unit 2013 generates a minimum degree N of a predetermined distributed information polynomial._XminIs multiplied by the maximum value of the authority level inputted, and the multiplication result is output as the degree N of the base polynomial. The order N of the output base polynomial is input to the member ID polynomial order generation unit 2014 and at the same time is one of the outputs of the ID generation unit 201.
[0058]
[Description of Member ID Polynomial Order Generation Unit 2014]
As shown in FIG. 9, the authority level L of each member input to the ID generation unit 201₁, L₂, ..., L_nAre input to the maximum value selection unit 1013 and to the member ID polynomial degree generation unit 2014. The member ID polynomial degree generation unit 2014 includes a base polynomial degree N output from the base polynomial degree generation unit 2013, and an authority level L input to the ID generation unit 201.₁, L₂, ..., L_nIs generated, and the degree of the member ID polynomial for each authority level is generated and output to the degree-specified irreducible polynomial selection unit 2015. The member ID polynomial degree generation unit 2014 determines each authority level L₁, L₂, ..., L_nFor each power level L₁, L₂, ..., L_nDividing means for calculating the quotient divided by (2) is provided, and the result of the division (that is, the quotient (however, the decimal point is rounded up)) is output as the degree of each member ID polynomial.
[0059]
[Explanation of degree-specified irreducible polynomial selector 2015]
As shown in FIG. 9, the degree-specified irreducible polynomial selection unit 2015 receives the degree of the member ID polynomial from the member ID polynomial degree generation unit 2014 for the number of members, and becomes the degree of the received member ID polynomial. Each irreducible polynomial is selected, and the selected irreducible polynomial is selected as a member ID polynomial m.₁(X), m₂(X), ..., m_nOutput as (x). This member ID polynomial m to be output₁(X), m₂(X), ..., m_n(X) is one of the outputs of the ID generation unit 201.
[0060]
[Description of the base polynomial generator 202]
As shown in FIG. 8, the base polynomial generation unit 202 receives the secret ID polynomial P (x), the secret polynomial S (x), and the degree N of the base polynomial from the ID generation unit 201, and based on them. A base polynomial Y (x) is generated. The base polynomial generation unit 202 outputs the generated base polynomial Y (x) to the distributed information polynomial generation unit 203. The base polynomial generation unit 202 generates a base polynomial Y (x) from the secret ID polynomial P (x), the secret polynomial S (x), and the degree N of the base polynomial. The base polynomial Y (x) is a polynomial of degree N in which the remainder when divided by the secret ID polynomial P (x) becomes the original secret polynomial S (x). Accordingly, the base polynomial Y (x) can be calculated as follows, for example. The order of the secret ID polynomial P (x) is N_PThen the order NN_PA polynomial R (x) (called a random number polynomial) in which the coefficient of each order is a random number is generated, and the result obtained by multiplying the random number polynomial R (x) by the secret ID polynomial P (x) is the secret polynomial S The result of adding (x) is a base polynomial Y (x). That is,
Y (x) = S (x) + R (x) P (x) (7)
Perform a calculation such that In this way, the remainder when the base polynomial Y (x) is divided by the secret ID polynomial P (x) becomes the secret polynomial S (x), and the random number polynomial R (x) (the order is NN)._P) And secret ID polynomial P (x) (the order is N_P) Of the multiplication result is (N−N)_P) + N_P= N, so the degree of the base polynomial Y (x) can also be set to N (however, as described in the description section of the degree range designated irreducible polynomial generator 2012, the secret polynomial S (x) is The order is smaller than the secret ID polynomial P (x)).
[0061]
[Description of Distributed Information Polynomial Generator 203]
As shown in FIG. 8, the variance information polynomial generator 203 receives the base polynomial Y (x) from the base polynomial generator 202 and the member ID polynomial m from the ID generator 201.₁(X), m₂(X), ..., m_n(X) is input, and the distributed information polynomial generator 203 distributes the distributed information polynomial X distributed to each member.₁(X), X₂(X), ..., X_n(X) is generated, and the generated distributed information polynomial X₁(X), X₂(X), ..., X_n(X) and member ID polynomial m₁(X), m₂(X), ..., m_n(X) is output. The distributed information polynomial generator 203 converts the base polynomial into each member ID polynomial m₁(X), m₂(X), ..., m_n(X) is provided with a remainder calculation means for calculating a remainder when divided by (x), and each remainder calculation result is distributed information polynomial X₁(X), X₂(X), ..., X_nOutput as (x). The degree N and the secret ID polynomial P (x) of the base polynomial output from the ID generation unit 201 and the shared information polynomial X output from the shared information polynomial generation unit 203₁(X), X₂(X), ..., X_n(X) and member ID polynomial m₁(X), m₂(X), ..., m_n(X) is an output from the secret sharing apparatus 200.
[0062]
<< 2-2. Configuration of Secret Reconstruction Device 210 >>
FIG. 10 is a block diagram schematically showing the configuration of the secret reconfiguration apparatus 210 according to the second embodiment. Here, a case will be described in which the number of members gathered for reconfiguration is k (k ≦ n). As shown in FIG. 10, the secret reconstruction device 210 includes a member ID polynomial m of k members who have gathered._i1(X), m_i2(X), ..., m_ik(X) and the distributed information polynomial X held by the k members gathered_i1(X), X_i2(X), ..., X_ik(X) and the base polynomial degree N and the secret ID polynomial P (x), which are auxiliary information necessary for reconstructing the original secret, are input, and the reconstructed secret information S or the reconstruction error Output information. The member ID polynomials and distributed information polynomials input to the secret reconstruction device 210 are the same as k members (that is, k member ID polynomials m)._i1(X), m_i2(X), ..., m_ik(X) and k distributed information polynomials X_i1(X), X_i2(X), ..., X_ik(X)) is input. The order in which the member ID polynomial and the distributed information polynomial are input need not be the same as the order in which the secret sharing apparatus 200 outputs them. Further, the degree N of the base polynomial and the secret ID polynomial P (x) are in a state where the secret reconstructing device 210 can be used as described above (for example, a storage holding device accessible by the secret reconfiguring device 210) Can be stored in the network, or can be held by members who have gathered and provided as input).
[0063]
As illustrated in FIG. 10, the secret reconstruction device 210 includes a member ID polynomial determination unit 211, a base polynomial reconstruction unit 212, a secret polynomial separation unit 213, and a polynomial conversion unit 214. Since the base polynomial reconstruction unit 212 and the secret polynomial separation unit 213 are portions that reconstruct the secret polynomial, they are collectively referred to as a secret polynomial reconstruction unit 215.
[0064]
[Description of Member ID Polynomial Determination Unit 211]
As shown in FIG. 10, the member ID polynomial m input to the secret reconstruction device 210._i1(X), m_i2(X), ..., m_ik(X), the variance information polynomial X_i1(X), X_i2(X), ..., X_ik(X) and the degree N of the base polynomial are input to the member ID polynomial determination unit 211. The member ID polynomial determination unit 211 receives the degree N of the input base polynomial and the member ID polynomial m_i1(X), m_i2(X), ..., m_ikBased on (x), in order to reconstruct the original secret information, it is determined whether a sufficient number of members having sufficient authority are gathered, and the determination result (referred to as a member ID polynomial determination result). ) To the base polynomial reconstruction unit 212. The member ID polynomial determination result is a determination result of “reconfigurable” if “a sufficient number of members having sufficient authority are gathered”, and a determination result of “unreconfigurable” otherwise. is there. The member ID polynomial determination unit 211 includes multiplication means for multiplying all input member ID polynomials, and multiplies all the input member ID polynomials (that is, the member ID polynomials of the collected members). The degree of the polynomial of the multiplication result is compared with the degree N of the input base polynomial. If the degree of the polynomial of the multiplication result is equal to or greater than the degree N of the base polynomial, the secret information S (secret polynomial S (X)) can be reconfigured (this secret reconfiguration possibility can be proved by the Chinese remainder theorem, as in the first embodiment). Therefore, if the degree of the polynomial of the multiplication result is equal to or larger than the degree N of the polynomial as described above, the determination result of “reconfigurable” is output, and the secret information S (ie, the secret polynomial S (x)) ). Otherwise, the determination result “unreconfigurable” is output.
[0065]
[Description of the base polynomial reconstruction unit 212]
  As shown in FIG. 10, the member ID polynomial m input to the secret reconstruction device 210._i1(X), m_i2(X), ..., m_ik(X) and its variance information polynomial X_i1(X), X_i2(X), ..., X_ik(X) is input to the base polynomial reconstruction unit 212. The base polynomial reconstruction unit 212 receives the member ID polynomial determination result from the member ID polynomial determination unit 211, and when the member ID polynomial determination result is a determination result that the reconfiguration is impossible, the reconstruction error information is sent to the secret polynomial separation unit 213. Output. Otherwise, the input member ID polynomial m_i1(X), m_i2(X), ..., m_ik(X) and distributed information polynomial X_i1(X), X_i2(X), ..., X_ikFrom (x), an operation is performed to obtain the base polynomial Y (x), and the obtained base polynomial Y (x) is output to the secret polynomial separator 213. The base polynomial Y (x) can be obtained as follows, for example. Each variance information polynomial X_i1(X), X_i2(X), ..., X_ik(X) includes two coefficient polynomials M calculated from the member ID polynomial._i1(X), M_i2(X), ..., M_ik(X) and I_i1(X), I_i2(X), ..., I_ikThe product of the member ID polynomials of the gathered members is obtained by multiplying (x) and adding up
M (x) = m_i1(X) × m_i2(X) × ... × m_ik(X)
By taking the remainder at (mod.M (x) is calculated)TotalCalculate.
[0066]
That is,
Y (x)
= M_i1(X) I_i1(X) X_i1(X)
+ M_i2(X) I_i2(X) X_i2(X)
+ ...
+ M_ik(X) I_ik(X) X_ik(X) (mod.M (x)) (8)
To obtain the base polynomial Y (x). Each coefficient polynomial to be multiplied is calculated as follows. Input member ID polynomial m_i1(X), m_i2(X), ..., m_ik(X) is obtained by multiplying all except the member ID polynomial for the distributed information polynomial to be multiplied by M_i1(X), M_i2(X), ..., M_ik(X) and M_i1(X), M_i2(X), ..., M_ik(X) is the member ID polynomial method for the distributed information polynomial to be multiplied (remainder, mod.m_ijThe inverse polynomial under (x) is calculated as I_i1(X), I_i2(X), ..., I_ik(X). That is, X_ijCoefficient M of (x)_ij(X) and I_ij(X) is (j = 1, 2,..., K),
M_ij(X)
= M_i1(X) × m_i2(X) × ... × m_ik(X) / m_ij(X)
= M (x) / m_ij(X) ... (9)
I_ij(X) = (M_ij(X))^-1(Mod.m_ij(X)) (10)
Can be obtained by calculating.
[0067]
The above formula (9) is calculated by multiplying all the member ID polynomials gathered on the formula, and then calculating M_ijMember ID polynomial m corresponding to (x)_ijDivide by (x), but in reality, M_ijMember ID polynomial m corresponding to (x)_ijThere is also an implementation method in which only member ID polynomials other than (x) are multiplied (when this method is employed, one multiplication and one division can be reduced). Further, the calculation of the above equation (10) is performed by calculating the member ID polynomial m._ij(X) modulo (remainder, mod.m_ijThe calculation for obtaining the inverse element under (Calculate (x)) can be performed using the Euclidean algorithm. In particular, the member ID polynomial m_ijIf (x) is an irreducible polynomial, m_ijSince a finite field can be generated by taking the remainder of (x), m_ijThe inverse calculation under the method (x) is
(M_ij(X))^-1= (M_ij(X))^r(Mod.m_ij(X)) (11)
r = q^m-2 ... (12)
m = deg (m_ij(X)) (13)
It can also be calculated with In the above equation (12), q is the number of finite fields GF (q) used for the coefficients of the polynomial, and in the above equation (13), deg (m_ij(X)) is m_ijThis means that the order of (x) is calculated. In obtaining the inverse element, another method may be used.
[0068]
[Description of Secret Polynomial Separation Unit 213]
As shown in FIG. 10, the secret ID polynomial P (x) input to the secret reconstruction device 210 is input to the secret polynomial separator 213. The secret polynomial separating unit 213 receives the base polynomial Y (x) from the base polynomial reconstruction unit 212, and from the secret ID polynomial P (x) input as the base polynomial Y (x), the secret polynomial S (x) Calculate to find The obtained secret polynomial S (x) is output to the polynomial converter 214. The secret polynomial reconstruction unit 213 includes a remainder calculation unit, and calculates and outputs the remainder when the base polynomial Y (x) is divided by the secret ID polynomial P (x) as the secret polynomial S (x). If the output from the base polynomial reconstruction unit 212 is reconstruction error information, the secret polynomial separation unit 213 outputs the reconstruction error information to the polynomial conversion unit 214 as it is instead of reconstructing the secret polynomial S (x). To do.
[0069]
[Description of Polynomial Converter 214]
As shown in FIG. 10, the polynomial converter 214 performs an operation to return the secret polynomial S (x) input from the secret polynomial separator 213 to the original secret information S, and obtains and outputs the secret information S. . If the output from the secret polynomial separator 213 is reconstruction error information, the polynomial converter 214 outputs the reconstruction error information as it is instead of obtaining the secret information S. The conversion by the polynomial conversion unit 214 is the reverse conversion of the polynomial conversion unit 2011 in the secret sharing apparatus 200. Similar to the description of the polynomial converter 2011 described above, in the description of the second embodiment, since the secret information S is a positive integer value, it is necessary to convert it to a polynomial. However, if the input secret information S is already a polynomial, for example, the secret information S is an extension field GF (q of the finite field GF (q).^m), And the polynomial expression described by the remainder when divided by the generator polynomial g (x), there is no need to convert it to a polynomial in the secret sharing apparatus. No conversion is required. Therefore, depending on the description method of the secret information S, the polynomial converter 214 may not be necessary (that is, the polynomial converter 214 does not perform any processing).
[0070]
Further, based on the example given in the description of the secret sharing apparatus 200, for example, in the polynomial conversion unit 2011, S (x) = x + S is used for conversion from the secret information S to the secret polynomial S (x) equation. When the conversion is performed such that the constant term uses the first-order polynomial of S (when the value of q on the finite field GF (q) used for the coefficient is larger than S), the polynomial conversion unit 214 stores the secret polynomial S The constant term of (x) is output as secret information S. Further, when the secret polynomial S (x) is formed only by the constant term (that is, when S (x) = S), the polynomial conversion unit 214 outputs it as it is without performing any processing. In the polynomial transformation unit 2011, the secret is divided into y pieces,
S (x) = S₁+ S₂x + S₃x²+ ... + S_yx^y-1
When the conversion is performed so that the polynomial is y−1 order, the polynomial conversion unit 214 uses each coefficient S of the secret polynomial S (x).₁, S₂, ..., S_y(The reverse process of the division is performed. That is, when the secret is bit-expanded and divided into y pieces, they can be connected or S = S₁+ S₂+ ... + S_yS to be_iIf you divide into two, add them together)
Thus, it is converted into secret information S. Furthermore, the original secret is an extension field GF (q of finite field GF (q).^m) And the polynomial expressed by the remainder when divided by the generator polynomial g (x) is S (x), it is output as it is (as a polynomial expression), Convert to the original representation format and output. The output from the polynomial transformation unit 214 becomes the output of the secret reconstruction device 210.
[0071]
<< 2-3. Operation of secret sharing apparatus 200 >>
Next, the operation of the secret sharing apparatus 200 in FIG. 8 will be described. When the secret sharing apparatus 200 distributes the original secret information S to be distributed to n members as distributed information, the secret level L of each member₁, L₂, ..., L_nDepending on the member ID polynomial m₁(X), m₂(X), ..., m_n(X) is generated, and the distributed information X corresponding to the member ID polynomial is generated₁(X), X₂(X), ..., X_n(X) is generated and output. FIG. 11 is a flowchart showing the operation of the secret sharing apparatus 200.
[0072]
As shown in FIG. 11, first, the input secret information S and the authority level L of each member₁, L₂, ..., L_n, Secret ID polynomial P (x), base polynomial Y (x), and member ID polynomial m distributed to each member₁(X), m₂(X), ..., m_n(X) is calculated (step S31). This step S31 corresponds to the operation of the ID base polynomial generator 204 in FIG. A more detailed flowchart of step S31 is shown in FIG.
[0073]
As shown in FIG. 12, in step S31, first, a secret polynomial S (x) is calculated from the secret information S (step S311). This step S311 corresponds to the operation of the polynomial converter 2011 in FIG. As described in the configuration of the polynomial conversion unit 2011 described above, this conversion is performed into a polynomial that takes coefficients of a finite field GF (q) (a finite field is determined in advance). Any conversion method may be adopted as long as the secret information S that is a numerical value can be uniquely converted to a polynomial, and conversely, the secret information S can be uniquely converted from a polynomial.
[0074]
Next, as shown in FIG. 12, the secret ID polynomial P (x) is calculated from the secret polynomial S (x) (step S312), and the authority level L₁, L₂, ..., L_nThen, the degree N of the base polynomial is calculated (step S313). Step S312 and step S313 may be operated in parallel as shown in FIG. 12, or may be operated in series so as to be executed by program software. When operating in series, either step S312 or step S313 may be executed first. This step S312 corresponds to the operation of the degree range designated irreducible polynomial selection unit 2012 in FIG. 9, and the secret ID polynomial P (x) is an irreducible polynomial having an order larger than the order of the secret polynomial S (x). Calculated by selecting. Step S313 corresponds to the operations of the maximum value selection unit 1013 and the base polynomial degree generation unit 2013 in FIG. The degree N of the base polynomial is determined by the authority level L in the maximum value selection unit 1013.₁, L₂, ..., L_nIs selected and input to the base polynomial degree generation unit 2013, and the predetermined minimum number N of distributed information is selected._XminIs multiplied by the maximum authority level input.
[0075]
Next, as shown in FIG.₁, L₂, ..., L_nAnd the member ID polynomial from the degree N of the base polynomial (steps S3141, S3142), and from the degree N of the secret polynomial S (x), secret ID polynomial P (x), and base polynomial, the base polynomial Y (x) Is calculated (step S315). The combined step of step S3141 and step S3142 is collectively referred to as step S314. Step S314 and step S315 may be operated in parallel as shown in FIG. 12, or may be operated in series so as to be executed by program software. When operating in series, either step S314 or step S315 may be executed first. Step S3141 corresponds to the operation of the member ID polynomial degree generation unit 2014 shown in FIG. 9, and the order of each member ID polynomial is obtained by changing the degree N of the base polynomial to each authority level L.₁, L₂, ..., L_nIt is calculated by dividing by (rounded up after the decimal point).
[0076]
Step S3142 shown in FIG. 12 corresponds to the operation of the degree-specified irreducible polynomial selection unit 2015 in FIG. 9, and each member ID polynomial is calculated by selecting an irreducible polynomial that is the degree of each member ID polynomial. The Step S315 corresponds to the operation of the base polynomial generation unit 202 in FIG. 8, and the base polynomial Y (x) sets the order of the secret ID polynomial P (x) to N._PAs order NN_PIs generated by generating a polynomial R (x) (random number polynomial) of a random coefficient, and adding the secret polynomial S (x) to the result of multiplying the random number polynomial R (x) and the secret ID polynomial P (x). (Refer to the formula (7) described above).
[0077]
As shown in FIG. 11, after step S31, the base polynomial Y (x) and the member ID polynomial m₁(X), m₂(X), ..., m_nFrom (x), the distributed information polynomial X₁(X), X₂(X), ..., X_n(X) is calculated (step S32). This step S32 corresponds to the operation of the distributed information polynomial generator 203 in FIG.₁(X), X₂(X), ..., X_n(X) represents the base polynomial Y (x) with each member ID polynomial m₁(X), m₂(X), ..., m_nIt is calculated by calculating the remainder when dividing by (x). With the above operation, the secret sharing apparatus 200 has the authority level L of each member.₁, L₂, ..., L_nDepending on the member ID polynomial m₁(X), m₂(X), ..., m_n(X), and the variance information polynomial X for the member ID polynomial₁(X), X₂(X), ..., X_n(X) is generated and output.
[0078]
<< 2-4. Operation of Secret Reconstruction Device 210 >>
Next, the operation of the secret reconstruction device 210 in FIG. 10 will be described. The secret reconstruction device 210 has a member ID polynomial m collected from k members gathered to reconstruct the secret information S._i1(X), m_i2(X), ..., m_ik(X) and distributed information polynomial X_i1(X), X_i2(X), ..., X_ikThe secret information S is reconstructed from (x). At that time, the secret information S can be reconstructed if a sufficient number of members having a sufficient authority level for reconstructing the secret are gathered. Otherwise, the secret information S is reconstructed. Can not do it. FIG. 13 is a flowchart showing the operation of the secret reconstruction device 210.
[0079]
As shown in FIG. 13, first, an input member ID polynomial m_i1(X), m_i2(X), ..., m_ikA member ID polynomial determination result is calculated from (x) and the degree N of the base polynomial (step S31). The process of step S41 corresponds to the operation of the member ID polynomial determination unit 211 of FIG. 10, and the member ID polynomial determination result is multiplied by all the member ID polynomials that are input (that is, the member ID polynomials of the gathered members). The degree of the polynomial of the multiplication result is compared with the degree N of the base polynomial, and if the degree of the polynomial of the multiplication result is equal to or greater than the degree N of the base polynomial, “reconfigurable” is calculated. If not, it is calculated as “non-reconfigurable”.
[0080]
Next, the operation is divided depending on whether or not the member ID polynomial determination result is reconfigurable (step S42). If the result of step S42 is Yes (ie if reconfigurable), proceed to step S43 to reconstruct the secret information S; otherwise (ie if not reconfigurable) The configuration error information is output (step S44), and the process ends.
[0081]
As shown in FIG. 13, if the determination result in step S42 is Yes, the input member ID polynomial m_i1(X), m_i2(X), ..., m_ik(X), distributed information polynomial X_i1(X), X_i2(X), ..., X_ikSecret information S is calculated from (x) and secret ID polynomial P (x) (step S43). Step S43 corresponds to the operation of the secret reconstruction unit 215 in FIG. A more detailed flowchart of step S43 is shown in FIG.
[0082]
  As shown in FIG. 14, in step S43, first, the member ID polynomial m_i1(X), m_i2(X), ..., m_ik(X) and distributed information polynomial X_i1(X), X_i2(X), ..., X_ikA base polynomial Y (x) is calculated from (x) (step S431). Step S431 corresponds to the operation of the base polynomial reconstruction unit 212 in FIG. The base polynomial Y (x) is calculated as follows, for example. Each variance information polynomial X_i1(X), X_i2(X), ..., X_ik(X) Two coefficient polynomials Mi1 (x), Mi2 (x),..., M calculated from the member ID polynomial_ik(X) and I_i1(X), I_i2(X), ..., I_ikThe product of the member ID polynomials of the gathered members is obtained by multiplying (x) and adding up
M (x) = m_i1(X) × m_i2(X) × ... × m_ik(X)
By taking the remainder at (mod.M (x) is calculated)TotalIs calculated (see the above-mentioned formulas (8), (9) and (10)).
[0083]
Next, as shown in FIG. 14, a secret polynomial S (x) is calculated from the base polynomial Y (x) (step S432). Step S432 corresponds to the operation of the secret polynomial separator 213 in FIG. 10, and the secret polynomial S (x) is obtained by taking a remainder when the base polynomial Y (x) is divided by the secret ID polynomial P (x). Calculated.
[0084]
Next, as shown in FIG. 14, the secret information S is calculated from the secret polynomial S (x) (step S433). Step S433 corresponds to the operation of the polynomial converter 214 in FIG. In this conversion, as described in the configuration of the polynomial conversion unit 214, a polynomial that takes a coefficient of a finite field GF (q) (a finite field is determined in advance) is converted into a numerical value, and a polynomial conversion unit 2011 is converted. Reverse conversion is performed. When the secret information S is obtained in step S43, the secret information S is output and the operation is terminated.
[0085]
<< 2-5. Effect of Second Embodiment >>
According to the second embodiment, as in the first embodiment, when the secret sharing apparatus 200 distributes the secret information, the authority level L of each member₁, L₂, ..., L_nMember ID polynomial m according to₁(X), m₂(X), ..., m_n(X) is generated, and the member ID polynomial m₁(X), m₂(X), ..., m_nSince (x) is not restricted except that each is an irreducible polynomial, and since the secret sharing method using the property of the Chinese remainder theorem is adopted, the desired authority level L₁, L₂, ..., L_nDistributed information polynomial X according to₁(X), X₂(X), ..., X_n(X) can be generated. Therefore, according to the secret sharing apparatus 200, secret sharing reconfiguration system, and secret sharing method of the second embodiment, the amount of shared information that must be generated and the amount of shared information that must be stored While suppressing the increase, secret sharing according to the authority level of each member can be performed. Further, according to the secret reconfiguration apparatus 210, the secret sharing reconfiguration system, and the secret reconfiguration method of the second embodiment, it is possible to reconfigure the information that is secret-shared according to the authority level. Furthermore, according to the second embodiment, since polynomials having elements in a finite field as coefficients are handled as member IDs and distributed information, it is possible to calculate numerical values with extremely different numbers of digits in calculation. This eliminates the need to avoid or perform an operation with an unknown number of digits, which makes it more efficient when implemented in hardware.
[0086]
≪3. Other variations >>
In the secret reconstruction devices 110 and 210 of the first and second embodiments, the determination results (member ID determination result and member ID polynomial determination result) in the member ID determination unit 111 and member ID polynomial determination unit 211 are not reconfigurable. Even if the determination result is possible, subsequent processing blocks in the secret sharing apparatuses 110 and 210 (the radix reconstruction unit 112, the secret reconstruction unit 113, the base polynomial reconstruction unit 212, the secret polynomial reconstruction unit 213) , The polynomial conversion unit 214) is sequentially passed, but only in the case of a determination result that is not reconfigurable, this determination result is directly output from the secret sharing apparatus 110, 210, and the processing block (the radix reconfiguration unit 112). , The secret reconstruction unit 113, the base polynomial reconstruction unit 212, the secret polynomial reconstruction unit 213, and the polynomial conversion unit 214) can be terminated. It is also possible to configure the so that.
[0087]
In the ID generation unit 101 of the secret sharing apparatus 100 according to the first embodiment, prime numbers are selected as all member IDs and secret IDs (range designation prime number selection unit 1011, digit number designation prime number selection unit 1015). However, if any two of all member IDs are in a relatively prime relationship, the member IDs do not necessarily have to be prime numbers. The secret ID does not necessarily have to be a prime number, and can be freely selected.
[0088]
Similarly, in the ID generation unit 201 of the secret sharing apparatus 200 according to the second embodiment, irreducible polynomials are selected as all member ID polynomials and secret ID polynomials (degree range designation irreducible polynomial selection unit). However, if any two of all the member ID polynomials do not have polynomials that are common to each other, the member ID polynomial is not necessarily a member ID polynomial. It need not be a polynomial. Further, the secret ID polynomial does not necessarily need to be an irreducible polynomial, and can be freely selected.
[0089]
In the member ID determination unit 111 of the secret reconfiguration apparatus 110 according to the first exemplary embodiment, a value obtained by multiplying all the member IDs of the gathered members is generated, and then the number of digits of the generated value and the digit of the radix are generated. Although the number N is compared with the number N, the number of digits of the result of multiplication between the integers is almost equal to the result of addition of the number of digits to be multiplied. After the calculation, the result obtained by adding all the calculated numbers of digits may be compared with the number of digits N of the radix.
[0090]
Similarly, the member ID polynomial determination unit 211 of the secret reconstruction device 210 of the second exemplary embodiment generates a polynomial obtained by multiplying all the member ID polynomials of the gathered members, and then generates the generated polynomial. The degree of the basic polynomial and the degree N of the base polynomial are compared. However, since the degree of the multiplication result of the polynomials is the result of addition of the orders to be multiplied, the degree of the member ID polynomial of the gathered members May be calculated, and the result obtained by adding all the calculated orders may be compared with the degree N of the base polynomial. That is, the following value:
deg (m_i1(X))
+ Deg (m_i2(X))
+ ...
+ Deg (m_ik(X)) (14)
Are compared with the degree N of the base polynomial. In equation (14), deg (m_ij(X)) is m_ijThis means that the order of (x) is calculated.
[0091]
【The invention's effect】
As described above, according to the secret sharing apparatus, secret sharing reconfiguration system, and secret sharing method of the present invention, the amount of shared information that must be generated and the amount of shared information that must be stored are increased. It is possible to perform secret sharing according to the authority level of each member while suppressing the above.
[0092]
Further, according to the secret reconfiguration apparatus, secret sharing reconfiguration system, and secret reconfiguration method of the present invention, it is possible to reconfigure information that has been secret-shared according to the authority level.
[Brief description of the drawings]
FIG. 1 is a block diagram schematically showing a configuration of a secret sharing apparatus according to a first embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of an ID generation unit in FIG.
FIG. 3 is a block diagram schematically showing the configuration of a secret reconfiguration apparatus according to the first embodiment of the present invention.
FIG. 4 is a flowchart showing an operation of the secret sharing apparatus according to the first embodiment of the present invention.
FIG. 5 is a flowchart showing the operation in step S11 of FIG.
FIG. 6 is a flowchart showing an operation of the secret reconfiguration apparatus according to the first embodiment of the present invention.
FIG. 7 is a flowchart showing the operation in step S23 of FIG.
FIG. 8 is a block diagram schematically showing a configuration of a secret sharing apparatus according to a second embodiment of the present invention.
9 is a block diagram illustrating a configuration of an ID generation unit in FIG.
FIG. 10 is a block diagram schematically showing a configuration of a secret reconfiguration apparatus according to a second embodiment of the present invention.
FIG. 11 is a flowchart showing an operation of the secret sharing apparatus according to the second embodiment of the present invention.
FIG. 12 is a flowchart showing the operation in step S31 of FIG.
FIG. 13 is a flowchart showing an operation of the secret reconfiguration apparatus according to the second embodiment of the present invention.
FIG. 14 is a flowchart showing the operation in step S43 of FIG.
[Explanation of symbols]
100 secret sharing device,
101 ID generator,
1011 range designation prime number selection unit,
1012 Radix digit generation unit,
1013 Maximum value selection unit,
1014 member ID digit number generation part,
1015 digit number designation prime number selection part,
102 base generation unit,
103 shared information generator,
104 ID radix generator,
110 secret reconstruction device,
111 member ID determination unit,
112 Radix reconstruction part,
113 Secret separation part,
114 Secret reconstruction part,
200 secret sharing device,
201 ID generator,
2011 polynomial conversion unit,
2012 degree range designated irreducible polynomial selector,
2013 base polynomial order generation unit,
2014 member ID polynomial degree generation unit,
2015 degree-specified irreducible polynomial selector,
202 base polynomial generator,
203 distributed information polynomial generator,
204 ID base polynomial generator,
210 secret reconstruction device,
211 member ID polynomial determination unit,
212 base polynomial reconstruction unit,
213 secret polynomial separator,
214 polynomial conversion unit,
215 secret polynomial reconstruction unit,
S The original secret,
L₁, L₂, ..., L_n  The authority level entered in the secret sharing device,
N the number of digits in the radix or the degree of the base polynomial,
P secret ID,
Y radix,
m₁, M₂, ..., m_n  Member ID output from the secret sharing device,
X₁, X₂, ..., X_n  Shared information output from the secret sharing device,
m_i1, M_i2, ..., m_ik  Member ID input to the secret reconstruction device;
X_i1, X_i2, ..., X_ik  Distributed information input to the secret reconstruction device,
S (x) secret polynomial,
P (x) secret ID polynomial,
Y (x) base polynomial,
m (x)₁, M (x)₂, ..., m (x)_n  Member ID polynomial output from the secret sharing device,
X (x)₁, X (x)₂, ..., X (x)_n  Distributed information polynomial output from the secret sharing device,
m (x)_i1, M (x)_i2, ..., m (x)_ik  Member ID polynomial input to the secret reconstruction device;
X (x)_i1, X (x)_i2, ..., X (x)_ik  Distributed information polynomial input to the secret reconstruction device.

Claims (34)

In the secret sharing apparatus that generates shared information distributed to each of a plurality of members from the original secret information,
The original secret information and the authority level of each member are input, a member ID corresponding to each of the authority levels, a radix for generating shared information associated with the original secret information, and ID radix generation means for calculating a secret ID used when calculating the original secret information from the radix;
A secret sharing apparatus, comprising: shared information generating means for calculating shared information distributed to each member from the base and member ID calculated by the ID radix generating means. The original secret information takes a positive integer value,
The ID radix generation means includes:
Member ID generating means for calculating, as the member ID, a positive integer having a number of digits corresponding to the authority level, each of which is relatively prime with other member IDs;
A secret ID generating means for calculating a positive integer larger than the original secret information as the secret ID;
Radix generation means for calculating the radix by adding the original secret information to a value obtained by multiplying the secret ID and a positive integer random number, and
2. The secret sharing apparatus according to claim 1, wherein the shared information generating unit calculates a remainder obtained by dividing the radix by the member ID as the shared information distributed to the members. The original secret information takes a positive integer value,
The ID radix generation means includes:
A member ID generating means for calculating, as the member ID, a prime number having a number of digits corresponding to the authority level and different from other member IDs and secret IDs;
A secret ID generating means for calculating a value different from all member IDs as a prime number larger than the original secret information as the secret ID;
Radix generation means for calculating the radix by adding the original secret information to a value obtained by multiplying the secret ID and a positive integer random number, and
2. The secret sharing apparatus according to claim 1, wherein the shared information generating unit calculates a remainder obtained by dividing the radix by the member ID as the shared information distributed to the members. The ID radix generation means includes:
Maximum value selection means for obtaining the maximum value of the authority level;
A radix digit generation means for calculating the number of digits of the radix by multiplying the maximum value obtained by the maximum value selection means and a minimum value of a predetermined member ID;
Random number selection means for selecting the positive integer random number so as to be the number of digits of the radix calculated by the radix digit generation means;
Member ID digit number generating means for calculating the number of digits of each member ID by dividing the number of digits of the radix calculated by the radix digit number generating means by each authority level;
4. The secret sharing apparatus according to claim 3, further comprising: a digit number designating prime number selecting unit that selects each prime number having the number of digits of each member ID calculated by the member ID digit number generating unit. If the original secret information is not a polynomial, the original secret information further comprises a polynomial conversion means for converting the original secret information into a polynomial,
The ID radix generation means includes:
Member ID generation means for calculating a polynomial having a degree corresponding to the authority level, and a polynomial that is mutually prime with other member IDs, as member IDs;
A secret ID generating means for calculating, as a secret ID, a polynomial having a higher order than the polynomial obtained by converting the original secret information;
A base polynomial generating means for calculating the radix that is a polynomial obtained by adding a polynomial obtained by converting the original secret information to a polynomial obtained by multiplying the secret ID and a polynomial having a random coefficient. ,
The shared information generating means calculates a polynomial of a remainder when the radix is divided by the member ID as the distributed information distributed to the members;
The secret sharing apparatus according to claim 1. If the original secret information is not a polynomial, the original secret information further comprises a polynomial conversion means for converting the original secret information into a polynomial,
The ID radix generation means includes:
Member ID generation means for calculating, as a member ID, a polynomial that is an irreducible polynomial having a degree corresponding to the authority level and different from other member IDs and secret IDs;
A secret ID generating means for calculating, as a secret ID, a polynomial that is an irreducible polynomial having an order larger than the polynomial obtained by converting the original secret information, and different from all member IDs;
A radix generation means for calculating the radix that is a polynomial obtained by adding the polynomial obtained by converting the original secret information to a polynomial obtained by multiplying the secret ID and a polynomial having a random coefficient;
2. The secret sharing apparatus according to claim 1, wherein the shared information generating unit calculates a remainder polynomial obtained by dividing the radix by the member ID as the shared information distributed to the members. The ID radix generation means includes:
Maximum value selection means for obtaining the maximum value of the authority level;
A radix order generation means for calculating the order of the radix by multiplying the maximum value obtained by the maximum value selection means by a minimum value of the order of a predetermined member ID;
Random number polynomial selection means for selecting a polynomial having a coefficient of the random number so as to be the order of the radix calculated by the radix order generation means;
Member ID degree generation means for calculating the degree of each member ID by dividing the degree of the radix calculated by the radix degree generation means by each authority level;
7. The secret sharing apparatus according to claim 6, further comprising: degree-designated irreducible polynomial selection means for selecting each irreducible polynomial having the degree of each member ID calculated by the member ID order generation means. In the secret reconfiguration apparatus for reconfiguring information secret-shared by the secret distribution apparatus according to any one of claims 1 to 7,
A judging means for judging whether or not the original secret information can be reconstructed from the member ID collected at the time of secret reconfiguration;
And a secret reconstructing means for reconstructing the original secret information from the collected member ID and shared information when it is determined by the determining means that reconfiguration is possible. Secret reconstruction device. The secret reconstruction means is:
A radix reconstruction means for calculating a radix;
A secret separation means for calculating a remainder when the radix is divided by the secret ID, and
The radix reconstruction means is:
Coefficient calculation means for calculating the coefficient of each shared information from the member IDs of the gathered members;
First multiplication means for multiplying the coefficient calculated by the coefficient calculation means and the variance information;
Adding means for adding the multiplication results of the first multiplying means by the amount of members gathered;
9. The secret reconstruction device according to claim 8, further comprising: residue calculation means for calculating a remainder when the addition result obtained by the addition means is divided by a value obtained by multiplying all member IDs of the gathered members. . In the calculation, the coefficient calculation means of the radix reconstruction means takes the value obtained by multiplying each shared information by a member ID other than the member ID for each shared information, and the remainder of the member ID for each shared information. , Calculate the two coefficients of the inverse element of the value obtained by multiplying all the member IDs other than the member IDs for each of the shared information,
The secret reconstruction device according to claim 9, wherein the first multiplication unit of the radix reconstruction unit multiplies three values of the calculated two coefficients and shared information. The determination means is
A second multiplication means for multiplying all member IDs of the gathered members;
The number-of-digits judging means for judging whether or not the number of digits of the result of multiplication by the second multiplying means is larger than the number of digits of the radix. The secret reconstruction device described in 1. The determination means is
A digit number calculating means for calculating the number of digits of each member ID of the gathered members;
Adding means for adding up the number of digits of each member ID calculated by the number of digits calculating means;
11. The secret reconfiguration according to claim 8, further comprising: a digit number determining unit that determines whether or not a result obtained by adding by the adding unit is larger than a digit number of a radix. apparatus. The secret reconstruction means is:
A radix reconstruction means for calculating a radix;
Secret separation means for calculating the remainder when the radix is divided by the secret ID;
Conversion means, and
The radix reconstruction means is:
Coefficient polynomial calculating means for calculating a polynomial that is a coefficient of each distributed information from the member IDs of the gathered members;
First multiplication means for multiplying the coefficient polynomial calculated by the coefficient polynomial calculation means and the variance information;
Adding means for adding the result of multiplication by the first multiplying means by the number of members gathered;
Residue calculation means for calculating a remainder when the addition result by the addition means is divided by a polynomial obtained by multiplying all member IDs of the gathered members;
9. The secret reconstruction device according to claim 8, wherein, when the original secret information is not a polynomial, the conversion means converts the polynomial calculated by the secret separation means into the original secret information. . The coefficient calculating means of the radix reconfiguring means is an arithmetic operation that takes a polynomial obtained by multiplying each shared information by a member ID other than the member ID for each shared information, and a remainder of the member ID for each shared information. And a coefficient polynomial calculation means for calculating a polynomial that is two coefficients of an inverse element of a polynomial obtained by multiplying all member IDs other than the member ID for each of the distributed information,
The secret reconstruction device according to claim 13, wherein the first multiplication means of the radix reconstruction means multiplies three polynomials of the calculated two coefficient polynomials and variance information. The determination means is
A second multiplication means for multiplying all member IDs of the gathered members;
Determining means for determining whether the order of the result of multiplication by the second multiplying means is greater than the order of the radix;
15. The secret reconstruction device according to any one of claims 8, 13, and 14, characterized by comprising: The determination means is
Degree calculation means for calculating the degree of each member ID of the gathered members;
Adding means for adding the orders of the respective member IDs calculated by the order calculating means;
Determination means for determining whether the result of addition by the addition means is greater than the order of the radix;
15. The secret reconstruction device according to any one of claims 8, 13, and 14, characterized by comprising: The secret sharing apparatus according to any one of claims 1, 2, 3, and 4, which distributes original secret information;
From the information distributed by the secret reconstructor reconstructs the original secret information, a secret reconstruction device mounting serial to any one of the preceding claims 8,9,10,11,12 A secret sharing reconfiguration system characterized by comprising: The secret sharing apparatus according to any one of claims 1, 5, 6, and 7 that distributes original secret information;
The secret reconstruction device according to any one of claims 8, 13, 14, 15, and 16 that reconstructs the original secret information from information distributed by the secret reconstruction device. A secret sharing reconstruction system characterized by that. In secret sharing device comprising a an ID radix generator and distributed information generation means, from the original secret information, a secret sharing method to generate a shared information is distributed to each of the plurality of members,
The ID radix generation means receives the original secret information and the authority level of each member, and generates a member ID corresponding to each of the authority levels and distributed information associated with the original secret information. An ID radix generation step for calculating a secret ID used when calculating the original secret information from the radix and the radix;
The shared information generating means includes: a distributed information generating step of calculating distributed information distributed to each member from the radix calculated in the ID radix generating step and the member ID. . The original secret information takes a positive integer value,
The ID radix generation step by the ID radix generation means is:
A member ID generation step of calculating, as the member ID, a positive integer having a number of digits corresponding to the authority level, each of which is relatively prime with other member IDs;
A secret ID generating step of calculating a positive integer larger than the original secret information as the secret ID;
A radix generation step of calculating the radix by adding the original secret information to a value obtained by multiplying the secret ID and a positive integer random number,
20. The secret according to claim 19, wherein, in the shared information generating step by the shared information generating means, a remainder when the radix is divided by the member ID is calculated as the shared information distributed to the members. Distribution method. The original secret information takes a positive integer value,
The ID radix generation step by the ID radix generation means is:
A member ID generating step of calculating a number different from other member IDs and secret IDs as a prime number having the number of digits according to the authority level;
A secret ID generating step of calculating a value different from all member IDs as a prime number larger than the original secret information as the secret ID;
A radix generation step of calculating the radix by adding the original secret information to a value obtained by multiplying the secret ID and a positive integer random number,
20. The secret according to claim 19, wherein, in the shared information generating step by the shared information generating means, a remainder when the radix is divided by the member ID is calculated as the shared information distributed to the members. Distribution method. The ID radix generation step by the ID radix generation means is:
A maximum value selection step for obtaining the maximum value of the authority level;
A radix digit generation step of calculating the number of digits of the radix by multiplying the maximum value obtained by the maximum value selection step and a minimum value of a predetermined member ID;
A random number selection step of selecting the positive integer random number so as to be the number of digits of the radix calculated by the radix digit generation step;
A member ID digit generation step of calculating the number of digits of each member ID by dividing the number of digits of the radix calculated by the above radix digit number generation step by each authority level;
The secret sharing method according to claim 21, further comprising: a digit number designating prime number selecting step of selecting prime numbers each having a digit number of each member ID calculated by the member ID digit number generating step. The secret sharing apparatus polynomial transformation means provided in is if the original secret information is not a polynomial, converting the original secret information polynomial, further comprising a polynomial transformation process,
The ID radix generation step by the ID radix generation means is:
A member ID generation step of calculating, as a member ID, a polynomial having a degree corresponding to the authority level, and a polynomial that is relatively prime to each other member ID;
A secret ID generating step of calculating a polynomial having a higher order than the polynomial obtained by converting the original secret information as a secret ID;
A base polynomial generation step of calculating the radix, which is a polynomial obtained by adding the polynomial obtained by converting the original secret information to a polynomial obtained by multiplying the secret ID and a polynomial having a random coefficient. ,
The distributed information generating step by the shared information generating means calculates a polynomial of a remainder when the radix is divided by the member ID as the distributed information distributed to each member. The secret sharing method described. The secret sharing apparatus polynomial transformation means provided in is if the original secret information is not a polynomial, converting the original secret information polynomial, further comprising a polynomial transformation process,
The ID radix generation step by the ID radix generation means is:
A member ID generation step of calculating an irreducible polynomial having a degree corresponding to the authority level and a polynomial different from other member IDs and secret IDs as a member ID;
A secret ID generating step of calculating an irreducible polynomial having an order larger than the polynomial obtained by converting the original secret information and a polynomial different from all member IDs as a secret ID;
A radix generation step of calculating the radix, which is a polynomial obtained by adding a polynomial obtained by converting the original secret information to a polynomial obtained by multiplying the secret ID and a polynomial having a random coefficient,
In the distributed information generation step according to the dispersion information generating means, the polynomial remainder by the base above the member ID, to claim 19, characterized in that calculated as the dispersion information to be distributed to each member The secret sharing method described. The ID radix generation step by the ID radix generation means is:
A maximum value selection step for obtaining the maximum value of the authority level;
A radix order generation step of calculating the order of the radix by multiplying the maximum value obtained by the maximum value selection step by a minimum value of the order of a predetermined member ID;
A random number polynomial selection step of selecting a polynomial having a coefficient of the random number so as to be the order of the radix calculated by the radix degree generation step;
A member ID order generation step of calculating the order of each member ID by dividing the order of the base calculated by the above base order generation step by each authority level;
25. The secret sharing method according to claim 24, further comprising: an degree-designated irreducible polynomial selection step for selecting each irreducible polynomial having the degree of each member ID calculated by the member ID degree generation step. In secret reconstructor and a determination means and a secret re-construction unit, a secret reconstruction method for reconstructing the information secret sharing by secret sharing method according to any of the claims 19 to 25,
A determination step for determining whether or not the original secret information can be reconstructed from the member ID collected when the secret reconfiguration is performed;
A secret reconstructing step for reconstructing the original secret information from the collected member ID and shared information when the secret reconfiguring means determines that the reconfiguration is possible in the determining step; A secret reconstruction method characterized by comprising: The secret reconstruction step by the secret reconstruction unit is:
A radix reconstruction process for calculating a radix;
A secret separation step of calculating a remainder when the radix is divided by the secret ID, and
The radix reconstruction process is:
A coefficient calculation step of calculating a coefficient of each shared information from the member IDs of the gathered members;
A first multiplication step of multiplying the coefficient calculated by the coefficient calculation step and the variance information;
An addition step of adding the multiplication results of the first multiplication step by the number of members gathered;
27. A secret reconstruction method according to claim 26, further comprising: a residue calculation step of calculating a residue when the addition result of the addition step is divided by a value obtained by multiplying all member IDs of the gathered members. . In the calculation of the coefficient in the radix reconstruction process, each shared information is multiplied by all member IDs other than the member IDs for each shared information, and the remainder of the member ID for each shared information is calculated. 2 coefficients of the inverse element of the value obtained by multiplying all the member IDs other than the member ID with respect to the shared information,
28. The secret reconstruction method according to claim 27, wherein, in the first multiplication step of the radix reconstruction step, three values of the calculated two coefficients and shared information are multiplied. The determination step by the determination means includes
A second multiplication step of multiplying all the member IDs of the gathered members;
29. A digit number determination step for determining whether or not the number of digits of the result of multiplication in the second multiplication step is larger than the number of digits of the radix. The secret reconstruction method described in 1. The determination step by the determination means includes
A digit number calculating step for calculating the number of digits of each member ID of the gathered members;
An addition step of adding the number of digits of each member ID calculated by the above-mentioned digit number calculation step;
29. A secret reconstruction process according to any one of claims 26 to 28, further comprising: a digit number determining step for determining whether a result obtained by the addition step is larger than a digit number of a radix. Method. The secret reconstruction step by the secret reconstruction unit is:
A radix reconstruction process for calculating a radix;
A secret separation step of calculating a remainder when the radix is divided by the secret ID;
Conversion process and
The radix reconstruction process is:
A coefficient polynomial calculation step of calculating a polynomial that is a coefficient of each shared information from the member IDs of the gathered members;
A first multiplication step of multiplying the coefficient polynomial calculated by the coefficient polynomial calculation step and the variance information;
An addition step of adding the result of multiplication in the first multiplication step by the number of members gathered;
A residue calculation step of calculating a residue when the addition result in the addition step is divided by a polynomial obtained by multiplying all member IDs of the gathered members, and
In the conversion step, when the original secret information is not a polynomial, the polynomial calculated in the secret separation step is converted into the original secret information.
27. The secret reconstruction method according to claim 26. In the coefficient calculation step of the radix reconfiguration step, each shared information is multiplied by all member IDs other than the member IDs for each shared information, and an operation for calculating a remainder of the member ID for each shared information Calculating a polynomial that is two coefficients of an inverse element of a polynomial obtained by multiplying all the member IDs other than the member ID for each of the distributed information,
32. The secret reconstruction method according to claim 31, wherein, in the first multiplication step of the radix reconstruction step, the three polynomials of the calculated two coefficient polynomials and variance information are multiplied. The determination step by the determination means includes
A second multiplication step of multiplying all the member IDs of the gathered members;
The determination step of determining whether or not the order of the result obtained by the multiplication by the second multiplication step is larger than the order of the radix. Secret reconstruction method. The determination step by the determination means includes
An order calculation step of calculating the order of each member ID of the gathered members;
An adding step of adding the orders of the respective member IDs calculated by the order calculating step;
33. The secret reconstruction method according to claim 26, 31 or 32, further comprising: a determination step of determining whether a result obtained by the addition step is greater than a radix order.

Images