JP5640624B2 - Distributed information generation apparatus, restoration apparatus, secret sharing system, information processing method, and program - Google Patents

Description

  The present invention relates to a distributed information generating device for distributing and securely storing secret information, a restoring device for restoring stored secret information, a secret sharing system, an information processing method, and a computer About the program.

  A secret sharing method is known as an encryption technique in which secret information is distributed into a plurality of distributed secret information and the secret information is restored only when predetermined distributed secret information is gathered.

  The most famous technique among secret sharing schemes is a technique called (k, n) threshold secret sharing scheme. In this secret sharing method, this technology (1) distributes secret information to n distributed secret information, and (2) if any k of them are collected, the secret information can be restored, (3 ) It has a feature that no secret information can be obtained from less than k pieces of distributed information (see Non-Patent Document 1).

  The (k, n) threshold secret sharing method shown in Non-Patent Document 1 is a method that does not take into account the fraud of the person managing the distributed secret information and the failure of the device managing the distributed secret information. . Therefore, when collecting the k distributed secret information and restoring the secret, if at least one distributed secret information different from the original information is issued, the secret cannot be correctly restored, and the restored The fact that the secret is different from the original secret information could not be detected.

  In order to solve this problem, each of Non-Patent Document 2, Non-Patent Document 3, and Patent Document 1 includes a restored secret even when k-1 altered distributed secret information is collected at the time of secret restoration. A method that can detect the fact that is different from the original secret information is disclosed. However, with these technologies, it has been possible to detect at the time of secret restoration that the distributed secret information has been tampered with, but it has not been possible to identify which distributed secret information has been tampered with.

  Non-Patent Documents 4 to 7 are known as techniques for identifying which distributed secret information has been tampered when it becomes clear at the time of secret restoration that tampered distributed secret information is included. In Non-Patent Document 5 and Non-Patent Document 7, when the number t of the distributed secret information that has been tampered is k ≧ 3t + 1, it is possible to identify all t tampered distributed secret information with high probability. The scheme is shown. In Non-Patent Document 4 and Non-Patent Document 6, if the number t of tampered distributed secret information is k ≧ 2t + 1, it is possible to identify all t tampered distributed secret information with high probability. The scheme is shown.

International publication WO 2008/001628

Adi Shamir, "How to share a secret", Comm. ACM, 22 (11), 612-613 (1979) Martin Tompa, Heather Woll, "How to Share a Secret with Cheaters", Journal of Cryptology, vol.1, pages 133-138, 1988 Wakaha Ogata, Kaoru Kurosawa, Douglas R Stinson, "Optimum Secret Sharing Scheme Secure Against Cheating", SIAM Journal on Discrete Mathematics, vol.20, no1, pages 79-95, 2006 T. Rabin and M. Ben-Or, "Verifiable Secret Sharing and Multiparty Protocols with Honest Majority", Proc. STOC'89, pp. 73--85, 1989 K. Kurosawa, S. Obana and W. Ogata, "t-Cheater Identifiable (k, n) Secret Sharing Schemes," Proc. Crypto'95, Lecture Notes in Computer Science, vol. 963, Springer Verlag, pp. 410- -423, 1995 W. Ogata and K. Kurosawa, "Provably Secure Metering Scheme", Proc. Asiacrypt'00, Lecture Notes in Computer Science, vol. 1976, Springer Verlag, pp. 388--398, 2000 Ohana, "Sub-optimal secret sharing method that can identify up to t unauthorized persons", 2007 Cryptography and Information Security Symposium, 3D1-1, 2007

  However, the size of the distributed secret information in each scheme for the case of k ≧ 2t + 1 shown in Non-Patent Document 4 and Non-Patent Document 6 is (3n−2) when the bit length of the secret information is L. ) L bits and (2k + 1) L bits, and there is a problem that the size of the distributed secret information becomes very large.

  The present invention has been made to solve the above-described problems of the technology, and a distributed information generation device, a restoration device, a secret sharing system, and information that can reduce the data size of the distributed information. The purpose is to provide processing and programs.

In order to achieve the above object, the distributed information generating apparatus of the present invention provides:
When the secret information, the threshold value k, and the total number n of shared information are input, the distributed secret information generation unit that generates n pieces of distributed secret information regarding the secret information and outputs it to the n storage devices,
When n pieces of distributed secret information generated by the distributed secret information generation unit, the total number n of shared information, and the assumed number of unauthorized persons t are input, a first for verifying the non-falsification of the distributed secret information Generate one verification information, generate n pieces of distributed information obtained by performing distributed encoding so that the first verification information can be restored from any t + 1 of the n pieces, and output the generated information to the n storage devices. A verification information generation unit;
The n pieces of distributed secret information generated by the distributed secret information generation unit, the first verification information generated by the first verification information generation unit, the total number n of the distributed information, and the assumed number of unauthorized persons t When input, the second verification information having a predetermined relationship with the first verification information is generated, and the second verification information is distributedly encoded so that the second verification information can be restored from any t + 1 out of n a second verification information generation unit that generates n pieces of distributed information and outputs the n pieces of shared information to the n storage devices;
It is the structure which has.

In addition, the restoration device of the present invention is
When threshold k and distributed secret information stored in each of k or more and n or less storage devices are input, a secret information restoring unit capable of restoring secret information from k or more distributed secret information,
The distributed secret information stored in each of the t + 1 storage devices, the shared information of the first verification information for verifying the non-falsification of the distributed secret information, and the assumed number of unauthorized persons t are input. A first verification information restoring unit that restores the first verification information from t + 1 pieces of the shared information;
When the distributed secret information stored in the t + 1 storage devices, the shared information of the second verification information for verifying the non-falsification of the distributed secret information, and the assumed number of unauthorized persons t , A second verification information restoration unit that restores the second verification information from t + 1 pieces of the shared information;
Among the k or more storage devices, information stored in t + 1 storage devices of all combinations is set as a subset, and for each subset, t + 1 shared secret information and the first Output the shared information of the verification information to the first verification information restoring unit, and output the t + 1 pieces of the distributed secret information and the shared information of the second verification information to the second verification information restoring unit, all the parts For the set, it is determined whether the first verification information restored by the first verification information restoration unit and the second verification information restored by the second verification information restoration unit satisfy a predetermined relationship, and When the two verification information satisfies a predetermined relationship, the secret information restoring unit restores the secret information, and when there is a subset in which the two verification information does not satisfy the predetermined relationship, A subset of verification information that satisfies a predetermined relationship A consistency determination unit that outputs a list of storage devices after removing the combined storage device from the n storage devices as a storage device in which the falsified distributed secret information is stored, and
It is the structure which has.

An information processing method of the present invention is an information processing method by a secret information distribution system having a distributed information generation device and a restoration device,
When the shared information generating device receives the secret information, the threshold value k, and the shared information total number n, the shared information generating device generates n distributed secret information related to the secret information and outputs the generated information to the n storage devices.
When the assumed number of unauthorized persons t is input, the shared information generating apparatus, based on the n number of distributed secret information, the total number of distributed information n, and the assumed number of unauthorized persons t Generate the first verification information to verify
The shared information generation device generates n pieces of shared information that are distributed and encoded so that the first verification information can be restored from arbitrary t + 1 out of n, and outputs the generated information to the n storage devices.
The shared information generation device has a second relationship that is in a predetermined relationship with the first verification information based on the shared secret information, the first verification information, the total number n of shared information, and the assumed number of unauthorized persons t. Generate verification information,
The shared information generation device generates n pieces of shared information in which the second verification information is reversibly encoded from any t + 1 out of n and outputs the generated information to the n storage devices. after that,
The restoration device includes, as a subset, information stored in t + 1 storage devices in all combinations among k or more and n or less storage devices, and for each subset, t + 1 Based on the shared secret information and the shared information of the first verification information and the assumed number of unauthorized persons t, the first verification information is restored,
The restoration device restores the second verification information for each subset based on the t + 1 pieces of distributed secret information and the shared information of the second verification information, and the assumed number of unauthorized persons t.
The restoration apparatus determines whether the restored first verification information and the restored second verification information satisfy a predetermined relationship for all the subsets, and these two pieces of verification information are predetermined. If the relationship is satisfied, the secret information is restored from k or more distributed secret information, and if there is a subset in which the two verification information does not satisfy the predetermined relationship, the two verification information is determined in advance. The storage devices after removing the subset of storage devices satisfying the relationship from the n storage devices are output as a list as storage devices storing the falsified distributed secret information.

The program of the present invention is a computer ,
When the secret information, the threshold value k, and the total number n of shared information are input, the distributed secret information generation of the distributed information generation device generates n pieces of distributed secret information regarding the secret information and outputs them to the n storage devices. Function as a part ,
When the assumed number of unauthorized persons t is input, a first for verifying the non-falsification of the distributed secret information based on the n distributed secret information, the distributed information total number n, and the assumed unauthorized person number t It generates verification information, and generates n distributed information recoverable distributed encoding the first verification information from an arbitrary t + 1 pieces of the n outputs the n memory devices, dispersion Function as the first verification information generation unit of the information generation device ,
Based on the distributed secret information, the first verification information, the total number of shared information n, and the assumed number of unauthorized persons t, second verification information having a predetermined relationship with the first verification information is generated, and n The second verification of the shared information generation device that generates n pieces of distributed information that are reversibly encoded so that the second verification information can be restored from any t + 1 of the number, and outputs the generated information to the n storage devices It functions as an information generation unit .

Further, the program of the present invention is a computer ,
Among the storage devices not less than the threshold value k and not more than n, information stored in t + 1 storage devices in all combinations is set as a subset, and for each subset, t + 1 distributed secret information and A first verification information restoration unit of a restoration device that restores the first verification information based on the shared information of the first verification information for verifying the non-falsification of the distributed secret information and the assumed number of unauthorized persons t Function as
For each subset, based on the t + 1 pieces of distributed secret information, the distributed information of the second verification information for verifying the non-falsification of the distributed secret information, and the assumed number of unauthorized persons t Restore the verification information, function as a second verification information restoration unit of the restoration device ,
For all subsets, it is determined whether the restored first verification information and the restored second verification information satisfy a predetermined relationship , and these two verification information do not satisfy the predetermined relationship If there is a subset, the storage device after the storage device of the subset satisfying the predetermined relationship between the two verification information is removed from the n storage devices is stored in the falsified distributed secret information. Output as a list as a device, function as a verification information consistency determination unit of the restoration device,
When the two verification information satisfy a predetermined relationship, the verification information is made to function as a secret information restoration unit of a restoration device that restores secret information from k or more pieces of distributed secret information .

  According to the present invention, the data size of shared information related to secret information can be reduced.

It is a block diagram which shows the example of 1 structure of the distribution | distributed information generation apparatus of this embodiment. It is a block diagram which shows the example of 1 structure of the decompression | restoration apparatus of this embodiment. It is a block diagram which shows an example in the case of implement | achieving the shared information production | generation apparatus and restoration | reconstruction apparatus of this embodiment with a computer. It is a flowchart which shows operation | movement of the shared information generation apparatus of this embodiment. It is a flowchart which shows operation | movement of the decompression | restoration apparatus of this embodiment.

  When storing the secret information, the secret information sharing system according to the present embodiment generates distributed secret information obtained by distributedly encoding the secret information according to the threshold and the total number of shared information, and the generated shared information secret information is the number of the total number of shared information. The first verification information and the second verification information are generated according to the distributed secret information that has been distributed and stored, and the number of assumed unauthorized persons, and are distributed and encoded. The stored information is stored in the corresponding storage device.

  Also, when restoring the secret information, the secret information sharing system of the present embodiment reads the distributed secret information and the corresponding first verification information and second verification information from the number of storage devices corresponding to the threshold value. Identifying the distributed secret information that has been tampered with. If the altered distributed secret information is not detected, the secret information is restored.

  The secret information distribution system of this embodiment will be described with reference to FIGS.

  FIG. 1 is a block diagram showing a configuration example of the shared information generation apparatus, and FIG. 2 is a block diagram showing a configuration example of the restoration apparatus.

  The secret information sharing system of this embodiment includes a shared information generation device 100 and a restoration device 200. Each of the shared information generating device 100 and the restoring device 200 is connected to a plurality (n) of storage devices 300-1 to 300-n. The storage devices 300-1 to 300-n include distributed secret information storage units 301-1 to 301-n in which distributed encoded distributed secret information is stored, and distributed information in which first verification information is distributed encoded. First verification information storage units 302-1 to 302-n to be stored and second verification information storage units 303-1 to 303-n in which the second verification information is distributed and encoded but the distributed information is stored I have. The first verification information and the second verification information are information for verifying the non-falsification of the distributed secret information.

  First, the configuration of the shared information generating apparatus 100 will be described with reference to FIG.

  As illustrated in FIG. 1, the shared information generation device 100 includes a distributed secret information generation unit 101, a first verification information generation unit 102, and a second verification information generation unit 103.

  When the secret information s that is the source of the secret information set, the threshold value k, the total number n of shared information, and the assumed number of unauthorized persons t are input, the shared information generation device 100 receives each shared secret of the storage devices 300-1 to 300-n. The output of the distributed secret information generation unit 101 is stored in the information storage units 301-1 to 301-n, and the first verification information storage units 302-1 to 302-n of the storage devices 300-1 to 300-n are first stored. The output of the verification information generation unit 102 is stored, and the output of the second verification information generation unit 103 is stored in each of the second verification information storage units 303-1 to 303-n of the storage devices 300-1 to 300-n.

  When the secret information s, the threshold k, and the total number n of shared information are input, the distributed secret information generation unit 101 stores n pieces of shared information vi (i = 1, 2,..., N) in a corresponding storage device. It is stored in the distributed secret information storage section 301-i of 300-i.

  The first verification information generation unit 102 receives n pieces of distributed secret information v1, ..., vn, the assumed number of unauthorized persons t, and the total number n of distributed information, which are outputs of the distributed secret information generation unit 101. Then, the first verification information stored in the storage device 300-i is stored as the shared information A {1, i} of the first verification information corresponding to the n pieces of shared information vi (i = 1, 2,..., N). Stored in the unit 302-i.

  The second verification information generation unit 103 is the output of the distributed secret information generation unit 101, n pieces of distributed secret information v1, ..., vn, the assumed number of unauthorized persons t, and the first verification information generation unit 102 When the first verification information that is output and the total number n of shared information are input, the shared information A of the second verification information corresponding to n pieces of shared information vi (i = 1, 2,..., N) {2, i} is stored in the second verification information storage unit 303-i of the storage device 300-i.

  Next, the configuration of the restoration device 200 will be described with reference to FIG.

  As illustrated in FIG. 2, the restoration device 200 includes a secret information restoration unit 201, a first verification information restoration unit 202, a second verification information restoration unit 203, and a verification information consistency determination unit 204.

  The restoration apparatus 200 receives the threshold value k and the assumed number of unauthorized persons t. The restoration device 200 includes the distributed secret information v {from the distributed secret information storage units 301-i_1 to 301-i_m included in the k or more storage devices 300-i_1 to 300-i_m among the storage devices 300-1 to 300-n. i_1} to v {i_m} are read, and the first verification information distributed information A {1, i_1} to A from the first verification information storage units 302-i_1 to 302-i_m included in the storage devices 300-i_1 to 300-i_k {1, i_m} is read, and the second verification information shared information A {2, i_1} to A {2 from the second verification information storage units 303-i_1 to 303-i_m included in the storage devices 300-i_1 to 300-i_k. , i_m}. Then, when detecting the unauthorized person from the read information, the restoration device 200 outputs a set including a symbol indicating that the unauthorized person has been detected and the identifier of the unauthorized person as elements, and the unauthorized person is not detected. In the case of a failure, the restored secret information and an empty set indicating that no unauthorized person exists are output.

  The first verification information restoration unit 202 receives the number of assumed unauthorized persons t and the information stored in the t + 1 storage devices output from the verification information consistency determination unit 204. First verification information is output based on the information.

  The second verification information restoration unit 203 receives the number of assumed unauthorized persons t and the information stored in the t + 1 storage devices output from the verification information consistency determination unit 204. The second verification information is output based on the information.

  The verification information consistency determination unit 204 is input when the information stored in the m storage devices 300-i_1 to 300-i_m and the assumed number of unauthorized persons t are input to the restoration device 200. Further, for all t + 1 subsets of m pieces of information, the first verification information restoration unit 202 and the second verification information restoration unit 203 store the t + 1 pieces of storage devices 300, respectively. By inputting the received information, the first verification information restored from the first verification information restoration unit 202 is received, and the second verification information restored from the second verification information restoration unit 203 is received. Then, the verification information consistency determination unit 204 checks whether or not these two verification information satisfy a predetermined relationship, and if the relationship is satisfied, the corresponding t + 1 storage devices are tampered with. The process of determining that the distributed secret information is not included is repeated, and after determining all t + 1 subsets, a list of storage devices on which the distributed secret information has been tampered is output. .

  When the information stored in the m storage devices 300, the output L of the verification information consistency determination unit 204, and the threshold value k are input to the secret information recovery unit 201, The secret information is restored only when is an empty set, and the restored secret information is output. If L is not an empty set, secret information restoring section 201 outputs a symbol indicating that fraud has been detected.

  1 and 2 are functional block diagrams. The distributed information generation apparatus 100 shown in FIG. 1 and the restoration apparatus 200 shown in FIG. 2 are, for example, an LSI (Large Scale Integration) or DSP composed of a logic circuit or the like. This is realized by a semiconductor integrated circuit such as (Digital Signal Processor).

  Further, each of the distributed information generation device 100 and the restoration device 200, as shown in FIG. 3, executes a predetermined process according to a program, and inputs a command, information, and the like to the processing device 10 The input device 20 and the output device 30 for monitoring the processing result of the processing device 10 may be implemented by a computer.

  The processing device 10 shown in FIG. 3 includes a CPU (Central Processing Unit) 11, a main storage device 12 that temporarily stores information necessary for the processing of the CPU 11, and the CPU 11 as a distributed information generation device 100 or a restoration device 200. Data transfer between the recording medium 13 in which a program for executing the process is recorded, the data storage device 14 in which secret information and access structure data are stored, the main storage device 12, the recording medium 13, and the data storage device 14 The memory control interface unit 15 to be controlled and the I / O interface unit 16 which is an interface device with the input device 20 and the output device 30 are connected to each other via a bus 18.

  The data storage device 14 is not necessarily provided in the processing device 10, and may be provided independently of the processing device 10. The data storage device 14 may be a storage device 300 including a distributed secret information storage unit 301, a first verification information storage unit 302, and a second verification information storage unit 303.

  The processing device 10 realizes a function as the distributed information generation device 100 or the restoration device 200 according to the program recorded in the recording medium 13. The recording medium 13 may be a magnetic disk, a semiconductor memory, an optical disk, or other recording medium.

  Next, the operation of the secret information distribution system of this exemplary embodiment will be described with reference to FIGS.

  FIG. 4 is a flowchart showing the operation of the shared information generation apparatus, and FIG. 5 is a flowchart showing the operation of the restoration apparatus.

  As shown in FIG. 4, secret information s, threshold value k, shared information total number n, and assumed fraudulent number t are input to the shared information generating apparatus 100 (step A1).

  The secret information sharing apparatus 100, when the secret information s, the threshold k, and the total number n of shared information are input to the distributed secret information generation unit 101, is distributed and encoded so that the secret information s can be restored with arbitrary k pieces of shared information. Then, it is stored in the distributed secret information storage unit 301 of the storage device 300 (step A2).

  Next, when the secret information sharing apparatus 100 inputs the number of assumed unauthorized persons t, the total number n of shared information, and the output v1, ..., vn of the distributed secret information generation unit 101 to the first verification information generation unit 102, the first verification information generation unit 102 Verification information e0 is generated (step A3), distributedly encoded so that e0 can be restored with arbitrary t + 1 pieces of distributed information, and stored in the first verification information storage unit 302 of the storage device 300 (step A4).

  Next, the secret information sharing apparatus 100 sends the second verification information generation unit 103 to the assumed number of unauthorized persons t, the total number n of shared information, the outputs v1, ..., vn of the distributed secret information generation unit 101, and the first verification information. When e0 is input, e1 having a predetermined relationship with e0 is generated as second verification information (step A5), and e1 is distributedly encoded so that it can be restored with arbitrary t + 1 pieces of distributed information, and a storage device It is stored in the second verification information storage section 303 of 300 (step A6).

  As shown in FIG. 5, when the threshold value k and the assumed number of unauthorized persons t are input to the restoration device 200, the restoration device 200 reads data stored in m storage devices 300 where m ≧ k (step B1).

  The restoration device 200 inputs the information V {i_1},..., V {i_m} read from the m storage devices and the assumed number t of unauthorized persons t to the verification information consistency determination unit 204, and {V { The following steps B3 to B6 are repeated for all subsets of the element number t + 1 of i_1},..., V {i_m}} (step B2).

  The restoration device 200 inputs t + 1 pieces of information and the assumed number of unauthorized persons t to the first verification information restoration unit 202 to restore the first verification information e0 (step B3).

  Next, the restoration device 200 inputs t + 1 pieces of information and the assumed number of unauthorized persons t to the second verification information restoration unit 203 to restore the second verification information e1 (step B4).

  The restoration device 200 inputs the first verification information restored in step B3 and the second verification information restored in step B4 to the verification information consistency determination unit 204, and the relationship between the two verification information is determined in advance. It is determined whether or not it is satisfied (step B5). If the two verification information satisfies a predetermined relationship as a result of the determination, the restoration device 200 determines that the distributed secret information has not been tampered with in the t + 1 pieces of information, and the distributed secret information has been tampered with. The corresponding t + 1 storage devices are removed from the storage device candidates (step B6), and then the process returns to step B2.

  As a result of the determination in step B5, when the two pieces of verification information do not satisfy the predetermined relationship, the restoration device 200 returns to step B2 without changing the list of storage device candidates in which the distributed secret information is altered. However, the initial value of the list of storage device candidates whose distributed secret information has been tampered with is a list of all storage devices from which the information has been read.

  After the processing of steps B2 to B6 is performed on all the t + 1 subsets, the restoration device 200 determines that the distributed secret information, which is the output of the verification information consistency determination unit 204, has been tampered with. It is checked whether or not the storage device list L is an empty set (step B7). As a result of step B7, when it is determined that L is an empty set, that is, all the distributed secret information read in step B1 has not been tampered with, the restoration device 200 causes the secret information restoration unit 201 to restore and output the secret information ( Step B8). If L is not an empty set as a result of step B7, the restoring device 200 outputs a list indicating the storage devices that have been determined that the distributed secret information has been tampered with (step B9).

  In the present embodiment, the first verification information and the second verification information can be restored from any t + 1 shared information, and if even one of the distributed secret information is falsified, the falsified distributed secret information is To detect distributed secret information and its falsification by using the property that two verification information restored from t + 1 distributed secret information included satisfies only a predetermined relationship with a very low probability. The data size of the information including the distributed information can be reduced.

  Examples of the present embodiment will be described below. In each embodiment, GF (p) is used for the data set of secret information. GF (p) is a finite field with respect to a prime number or a power p of a prime number, addition on the finite field is represented by “+”, subtraction is represented by “−”, multiplication is represented by “*”, and division is performed. “/” And ／ multiplication are represented by “^”.

(First embodiment)
In the first embodiment, the distributed secret information generation unit 101 uses the (k, n) threshold method described in Non-Patent Document 1 to perform distributed encoding of the secret information and the check data, and the secret information restoration unit 201 It is assumed that secret information is restored using a restoration method corresponding to the (k, n) threshold method.

  Next, the shared information generation device 100 and the restoration device 200 of the first embodiment will be described.

  The shared information generating apparatus 100 of the first embodiment receives the secret information s, the threshold k, the total number n of shared information, and the assumed number of unauthorized persons t. In this embodiment, it is assumed that k ≧ 2t + 1 holds.

  When the secret information s, the threshold k, the total number of shared information n, and the assumed number of unauthorized persons t are input, the shared information generation apparatus 100 receives the constant term on GF (p) as s in the shared secret information generation unit 101. A random k-1 order polynomial is generated. This k-1 order polynomial is denoted as fs (x).

  The distributed secret information generation unit 101 calculates fs (1), fs (2), ..., fs (n), and a pair of the calculation result and input Vi = (i, vi) (i = 1,2 ,..., n, vi = fs (i)) are stored in the distributed secret information storage unit 301-i of the storage device 300-i.

  The first verification information generation unit 102 in the first embodiment is configured as follows.

  When the total number of shared information n and the assumed number of unauthorized persons t are input to the first verification information generation unit 102, the first verification information generation unit 102 outputs the output Vi = (i, vi) of the distributed secret information generation unit 101. Read and calculate xi = φ (i, vi) (i = 1,2, ..., n) on GF (q) for q such that q ≧ n * p. Here, φ is an arbitrary integral function such that GF (p) → GF (q). Then, the first verification information generation unit 102 randomly generates the first verification information e0 from GF (q), and generates a t-order polynomial f0 (x) on GF (q) where f0 (0) = e0. Randomly generate and let A {1, i} = f0 (xi). Furthermore, the first verification information generation unit 102 stores the generated A {1, i} in the first verification information storage unit 302-i of the storage device 300-i, and also converts the first verification information e0 into the second verification information. The data is output to the generation unit 103.

  The second verification information generation unit 103 in the first embodiment is configured as follows.

  When the total number n of shared information, the assumed number of unauthorized persons t, and the first verification information e0 are input to the second verification information generation unit 103, the second verification information generation unit 103 outputs Vi = (i, vi) is read, and xi = φ (i, vi) (i = 1,2,..., n) is calculated on GF (q) in the same manner as the first verification information generation unit 102. Here, φ is the same integral function as in the case of the first verification information generation unit 102. Then, the second verification information generation unit 103 generates the second verification information e1 from the first verification information e0 by e1 = e0, and f1 (0) = e1. x) is generated at random, and this is assumed to be A {2, i} = f1 (xi). Further, the second verification information generation unit 103 stores the generated A {2, i} in the second verification information storage unit 303-i of the storage device 300-i.

  On the other hand, the threshold value k and the assumed number of unauthorized persons t are input to the restoration device 200 of the first embodiment.

  The restoration device 200 receives data V {i_j} = (i_j, v {i_j}) (j = 1, j from the distributed secret information storage units 301 of the storage devices 300-i_1, 300-i_2,..., 300-i_m. 2, ..., m), data A {1, i_j} (j = 1,2, ..., m) is read from the first verification information storage unit 302, and from the second verification information storage unit 303 Read data A {2, i_j} (j = 1,2, ..., m).

  Next, the verification information consistency determination unit 204 sets a subset {l_1, l_2,..., L_ {t that is the number of elements t + 1 of all combinations for {i_1, i_2,. For (+1)}, the following (1) to (4) are repeated.

  (1) (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1, 2,..., T + 1) This is input to the second verification information restoration unit 203.

  (2) t + 1 data (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1,2, ..., t + 1) are input Then, the first verification information restoration unit 202 restores e0 = f0 (0) from (V_ {l_j}, A {1, l_j}) and outputs it. As a method for obtaining f0 (0), there are a method of solving simultaneous equations of (t + 1) -element primary, a method using Lagrange interpolation, and the like.

  (3) Similarly, t + 1 data (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1,2, ..., t + 1) When inputted, the second verification information restoration unit 203 restores e1 = f1 (0) from (V_ {l_j}, A {2, l_j}) and outputs it. As a method for obtaining f1 (0), there are a method for solving simultaneous equations of (t + 1) elements, a method using Lagrange interpolation, and the like, as in the method for obtaining f0 (0).

  (4) The verification information consistency determination unit 204 checks whether or not e0 = e1 is satisfied, and if e0 = e1 is satisfied, an invalid value with an initial value L = {i_1, ..., i_m} Remove all elements {l_1, ..., l_ {t + 2}} from the user list. When e0 = e1 is not established, the verification information consistency determination unit 204 does not perform processing for L.

  After performing the processes (1) to (4) for all the subsets of the element number t + 1, the verification information consistency determination unit 204 outputs the list L as an unauthorized person list.

  When the unauthorized person list L is an empty set, the secret information restoration unit 201 restores s = fs (0) from (i_j, v {i_j}), and outputs s as secret information. As a method for obtaining fs (0), there are a method of solving simultaneous equations of k-element primary, a method of using Lagrange interpolation, and the like.

  The restoration device 200 uses the output L of the verification information consistency determination unit 204 and the output of the secret information restoration unit 201 as the output of the device.

  In the secret information sharing system of the first embodiment, the size of the secret information is p, and the size of the shared information including the distributed secret information and the shared information of the first verification information and the second verification information is p * q ^ 2. Yes, the bit length is about three times the bit length of the secret information. This is compared to the fact that the bit length of each shared information of the methods shown in Non-Patent Document 4 and Non-Patent Document 6 is (3n-2) times (2k + 1) times that of secret information. It is confirmed that it is very small.

(Second embodiment)
The secret information sharing system of the second embodiment is a system in which two verification information restoration methods are generalized to the first embodiment.

  In the second embodiment, the distributed secret information generation unit 101 uses the (k, n) threshold method described in Non-Patent Document 1 to distribute and encode the secret information and the check data, and the secret information restoration unit 201 It is assumed that secret information is restored using a restoration method corresponding to the (k, n) threshold method.

  Next, the shared information generation device 100 and the restoration device 200 of the second embodiment will be described.

  The shared information generating apparatus 100 according to the second embodiment receives the secret information s, the threshold k, the total number n of shared information, and the assumed number of unauthorized persons t. In this embodiment, it is assumed that k ≧ 2t + 1 holds.

  When the secret information s, the threshold k, the total number of shared information n, and the assumed number of unauthorized persons t are input, the shared information generation device 100 has the constant term on GF (p) as s in the shared secret information generation unit 101. Generate k-1 degree polynomial at random. This k-1 order polynomial is denoted as fs (x).

  The distributed secret information generation unit 101 calculates fs (1), fs (2), ..., fs (n), and a pair of the calculation result and input Vi = (i, vi) (i = 1,2 ,..., n, vi = fs (i)) are respectively stored in the distributed secret information storage unit 301-i of the storage device 300-i.

  The first verification information generation unit 102 in the second embodiment is configured as follows.

  When the total number n of shared information and the assumed number of unauthorized persons t are input to the first verification information generation unit 102, the first verification information generation unit 102 outputs the output Vi = (i, vi) of the distributed secret information generation unit 101. Read out and calculate xi = φ (i, vi) (i = 1, 2,..., N) on GF (q) for q satisfying q ≧ n * p. Here, φ is an arbitrary integral function that satisfies GF (p) → GF (q). Then, the first verification information generation unit 102 randomly generates the first verification information e0 from GF (q), and on the GF (q) where f0 (c0) = e0 with respect to a predetermined constant c0. T-order polynomial f0 (x) is randomly generated, and this is assumed to be A {1, i} = f0 (xi). Furthermore, the first verification information generation unit 102 stores the generated A {1, i} in the first verification information storage unit 302-i of the storage device 300-i, and also converts the first verification information e0 into the second verification information. The data is output to the generation unit 103.

  The second verification information generation unit 103 in the second embodiment is configured as follows.

  When the total number n of shared information, the assumed number of unauthorized persons t, and the first verification information e0 are input to the second verification information generation unit 103, the second verification information generation unit 103 outputs Vi = (i, vi) is read out, and xi = φ (i, vi) (i = 1, 2,..., n) is calculated on GF (q) in the same manner as the first verification information generation unit 102. Here, φ is the same integral function as in the case of the first verification information generation unit 102. Then, the second verification information generation unit 103 generates the second verification information e1 from the first verification information e0 by e1 = e0, and GF (q1) becomes f1 (c1) = e1 with respect to a predetermined constant c1. ) The t-order polynomial f1 (x) above is randomly generated, and this is assumed to be A {2, i} = f1 (xi). Furthermore, the second verification information generation unit 103 stores A {2, i} in the second verification information storage unit 303-i of the storage device 300-i.

  On the other hand, the threshold value k and the assumed number of unauthorized persons t are input to the restoration device 200 of the second embodiment.

  The restoration device 200 receives data V {i_j} = (i_j, v {i_j}) (j = 1, j from the distributed secret information storage units 301 of the storage devices 300-i_1, 300-i_2,..., 300-i_m. 2, ..., m), data A {1, i_j} (j = 1,2, ..., m) is read from the first verification information storage unit 302, and from the second verification information storage unit 303 Read data A {2, i_j} (j = 1,2, ..., m).

  Next, the verification information consistency determination unit 204 sets a subset {l_1, l_2,..., L_ {t that is the number of elements t + 1 of all combinations for {i_1, i_2,. For (+1)}, the following (1) to (4) are repeated.

  (1) (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1, 2,..., T + 1) This is input to the second verification information restoration unit 203.

  (2) t + 1 data (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1,2, ..., t + 1) are input Then, the first verification information restoration unit 202 restores e0 = f0 (c0) from (V_ {l_j}, A {1, l_j}) and outputs it. As a method for obtaining f0 (c0), there are a method of solving simultaneous equations of a (t + 1) -element primary, a method using Lagrange interpolation, and the like.

  (3) Similarly, t + 1 data (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1,2, ..., t + 1) When inputted, the second verification information restoration unit 203 restores e1 = f1 (c1) from (V_ {l_j}, A {2, l_j}) and outputs it. As a method for obtaining f1 (c1), there are a method of solving simultaneous equations of (t + 1) -element primary, a method using Lagrange interpolation, and the like, as in the method of obtaining f0 (c0).

  (4) The verification information consistency determination unit 204 checks whether or not e0 = e1 is satisfied, and if e0 = e1 is satisfied, an invalid value with an initial value L = {i_1, ..., i_m} Remove all elements {l_1, ..., l_ {t + 2}} from the user list. When e0 = e1 is not established, the verification information consistency determination unit 204 does not perform processing for L.

  After performing the processes (1) to (4) for all the subsets of the element number t + 1, the verification information consistency determination unit 204 outputs the list L as an unauthorized person list.

  When the unauthorized person list L is an empty set, the secret information restoration unit 201 restores s = fs (0) from (i_j, v {i_j}), and outputs s as secret information. As a method for obtaining fs (0), there are a method of solving simultaneous equations of k-element primary, a method of using Lagrange interpolation, and the like.

  The restoration device 200 uses the output L of the verification information consistency determination unit 204 and the output of the secret information restoration unit 201 as the output of the device.

  Also in the secret information sharing system of the second embodiment, as in the secret sharing system of the first embodiment, the bit length of the shared information including the distributed secret information and the verification information is about three times the bit length of the secret information. This confirms that the size of the shared information is significantly smaller than any of the methods shown in Non-Patent Document 4 and Non-Patent Document 6.

(Third embodiment)
Unlike the first and second embodiments, the secret information sharing system of the third embodiment does not match the values of the two verification information e0 and e1, and has a relationship of e0 * e1 = 1. It is a system characterized by.

  In the third embodiment, the distributed secret information generation unit 101 uses the (k, n) threshold method described in Non-Patent Document 1 to perform distributed encoding of the secret information and check data, and the secret information restoration unit 201 It is assumed that secret information is restored using a restoration method corresponding to the (k, n) threshold method.

  Next, the shared information generation device 100 and the restoration device 200 of the third embodiment will be described.

  The shared information generating apparatus 100 of the third embodiment receives the secret information s, the threshold k, the total number n of shared information, and the assumed number of unauthorized persons t. In this embodiment, it is assumed that k ≧ 2t + 1 holds.

  When the secret information s, the threshold k, the total number of shared information n, and the assumed number of unauthorized persons t are input, the shared information generation device 100 has the constant term on GF (p) as s in the shared secret information generation unit 101. Generate k-1 degree polynomial at random. This k-1 order polynomial is denoted as fs (x).

  The distributed secret information generation unit 101 calculates fs (1), fs (2), ..., fs (n), and a pair of the calculation result and input Vi = (i, vi) (i = 1,2 ,..., n, vi = fs (i)) are respectively stored in the distributed secret information storage unit 301-i of the storage device 300-i.

  The first verification information generation unit 102 in the third embodiment is configured as follows.

  When the total number n of shared information and the assumed number of unauthorized persons t are input to the first verification information generation unit 102, the first verification information generation unit 102 outputs the output Vi = (i, vi) of the distributed secret information generation unit 101. Read out and calculate xi = φ (i, vi) (i = 1, 2,..., N) on GF (q) for q satisfying q ≧ n * p. Here, φ is an arbitrary integral function that satisfies GF (p) → GF (q). Then, the first verification information generation unit 102 randomly generates the first verification information e0 (where e0 ≠ 0) from GF (q), and f0 (0) = e0. A polynomial f0 (x) is randomly generated, and this is assumed to be A {1, i} = f0 (xi). Furthermore, the first verification information generation unit 102 stores the generated A {1, i} in the first verification information storage unit 302-i of the storage device 300-i, and also converts the first verification information e0 into the second verification information. The data is output to the generation unit 103.

  The second verification information generation unit 103 in the third embodiment is configured as follows.

  When the total number n of shared information, the assumed number of unauthorized persons t, and the first verification information e0 are input to the second verification information generation unit 103, the second verification information generation unit 103 outputs Vi = (i, vi) is read out, and xi = φ (i, vi) (i = 1,2,..., n) is calculated on GF (q) in the same manner as the first verification information generation unit 102. Here, φ is the same integral function as in the case of the first verification information generation unit 102. Then, the second verification information generation unit 103 generates the second verification information e1 from the first verification information e0 by e1 = 1 / e0, and f1 (0) = e1, and the t-order polynomial on GF (q) f1 (x) is randomly generated, and this is A {2, i} = f1 (xi). Further, the second verification information generation unit 103 stores the generated A {2, i} in the second verification information storage unit 303-i of the storage device 300-i.

  On the other hand, the threshold value k and the assumed number of unauthorized persons t are input to the restoration device 200 of the third embodiment.

  The restoration device 200 receives data V {i_j} = (i_j, v {i_j}) (j = 1, j from the distributed secret information storage units 301 of the storage devices 300-i_1, 300-i_2,..., 300-i_m. 2, ..., m), data A {1, i_j} (j = 1,2, ..., m) is read from the first verification information storage unit 302, and from the second verification information storage unit 303 Read data A {2, i_j} (j = 1,2, ..., m).

  Next, the verification information consistency determination unit 204 sets a subset {l_1, l_2,..., L_ {t that is the number of elements t + 1 of all combinations for {i_1, i_2,. For (+1)}, the following (1) to (4) are repeated.

  (1) (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1, 2,..., T + 1) This is input to the second verification information restoration unit 203.

  (2) t + 1 data (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1,2, ..., t + 1) are input Then, the first verification information restoration unit 202 restores e0 = f0 (0) from (V_ {l_j}, A {1, l_j}) and outputs it. As a method for obtaining f0 (0), there are a method of solving simultaneous equations of (t + 1) -element primary, a method using Lagrange interpolation, and the like.

  (3) Similarly, t + 1 data (l_j, V_ {l_j}, A {1, l_j}, A {2, l_j}) (j = 1,2, ..., t + 1) When inputted, the second verification information restoration unit 203 restores e1 = f1 (0) from (V_ {l_j}, A {2, l_j}) and outputs it. As a method for obtaining f1 (0), there are a method for solving simultaneous equations of (t + 1) elements, a method using Lagrange interpolation, and the like, as in the method for obtaining f0 (0).

  (4) The verification information consistency determination unit 204 checks whether or not e0 * e1 = 1 is satisfied. If e0 * e1 = 1 is satisfied, the initial value L = {i_1, ..., i_m } Remove all the elements {l_1, ..., l_ {t + 2}} from the fraudster list. If e0 * e1 = 1 does not hold, the verification information consistency determination unit 204 does not perform processing for L.

  After performing the processes (1) to (4) for all the subsets of the number of elements t + 1, the verification information consistency determination unit 204 outputs the list L as an unauthorized person list.

  When the unauthorized person list L is an empty set, the secret information restoration unit 201 restores s = fs (0) from (i_j, v {i_j}), and outputs s as secret information. As a method for obtaining fs (0), there are a method of solving simultaneous equations of k-element primary, a method of using Lagrange interpolation, and the like.

  The restoration device 200 uses the output L of the verification information consistency determination unit 204 and the output of the secret information restoration unit 201 as the output of the device.

  Also in the secret information sharing system of the third embodiment, as in the secret sharing systems of the first and second embodiments, the bit length of the distributed information including the distributed secret information and the verification information is 3 of the bit length of the secret information. It will be about double. This confirms that the size of the shared information is significantly smaller than any of the methods shown in Non-Patent Document 4 and Non-Patent Document 6.

DESCRIPTION OF SYMBOLS 100 Shared information generation apparatus 101 Distributed secret information generation part 102 1st verification information generation part 103 2nd verification information generation part 200 Restoration apparatus 201 Secret information restoration part 202 1st verification information restoration part 203 2nd verification information restoration part 204 Verification information Consistency determination unit 300-1 to 300-n Storage device 301-1 to 301-n Distributed secret information storage unit 302-1 to 302-n First verification information storage unit 303-1 to 303-n Second verification information storage Part

Claims (10)

When the secret information, the threshold value k, and the total number n of shared information are input, the distributed secret information generation unit that generates n pieces of distributed secret information regarding the secret information and outputs it to the n storage devices,
When n pieces of distributed secret information generated by the distributed secret information generation unit, the total number n of shared information, and the assumed number of unauthorized persons t are input, a first for verifying the non-falsification of the distributed secret information Generate one verification information, generate n pieces of distributed information obtained by performing distributed encoding so that the first verification information can be restored from any t + 1 of the n pieces, and output the generated information to the n storage devices. A verification information generation unit;
The n pieces of distributed secret information generated by the distributed secret information generation unit, the first verification information generated by the first verification information generation unit, the total number n of the distributed information, and the assumed number of unauthorized persons t When input, the second verification information having a predetermined relationship with the first verification information is generated, and the second verification information is distributedly encoded so that the second verification information can be restored from any t + 1 out of n a second verification information generation unit that generates n pieces of distributed information and outputs the n pieces of shared information to the n storage devices;
A distributed information generating apparatus comprising: The shared information generating apparatus according to claim 1,
The n pieces of distributed secret information are v1, v2,... Vn, the first verification information is e0, and the distributed information of the first verification information is A {1, i} (i = 1, 2, ..., n), the second verification information is e1, and the distributed information of the second verification information is A {2, i} (i = 1, 2, ..., n),
The first verification information generation unit includes the n pieces of distributed secret information v1, v2,... Vn, a constant c0, a random t-order polynomial f0 that satisfies f0 (c0) = e0, and an integral function. Based on φ, the distributed information A {1, i} = f0 (φ (i, vi)) of the first verification information e0 is generated,
The second verification information generation unit includes the n pieces of distributed secret information v1, v2,... Vn, a constant c1, a random t-order polynomial f1 that satisfies f1 (c1) = e1, and an integral function. Based on φ, the shared information generating device is characterized in that the shared information A {2, i} = f1 (φ (i, vi)) of the second verification information e1 is generated. When threshold k and distributed secret information stored in each of k or more and n or less storage devices are input, a secret information restoring unit capable of restoring secret information from k or more distributed secret information,
The distributed secret information stored in each of the t + 1 storage devices, the shared information of the first verification information for verifying the non-falsification of the distributed secret information, and the assumed number of unauthorized persons t are input. A first verification information restoring unit that restores the first verification information from t + 1 pieces of the shared information;
When the distributed secret information stored in the t + 1 storage devices, the shared information of the second verification information for verifying the non-falsification of the distributed secret information, and the assumed number of unauthorized persons t , A second verification information restoration unit that restores the second verification information from t + 1 pieces of the shared information;
Among the k or more storage devices, information stored in t + 1 storage devices of all combinations is set as a subset, and for each subset, t + 1 shared secret information and the first Output the shared information of the verification information to the first verification information restoring unit, and output the t + 1 pieces of the distributed secret information and the shared information of the second verification information to the second verification information restoring unit, all the parts For the set, it is determined whether the first verification information restored by the first verification information restoration unit and the second verification information restored by the second verification information restoration unit satisfy a predetermined relationship, and When the two verification information satisfies a predetermined relationship, the secret information restoring unit restores the secret information, and when there is a subset in which the two verification information does not satisfy the predetermined relationship, A subset of verification information that satisfies a predetermined relationship A consistency determination unit that outputs a list of storage devices after removing the combined storage device from the n storage devices as a storage device in which the falsified distributed secret information is stored, and
A restoration apparatus comprising: The restoration device according to claim 3,
The first verification information is e0, the second verification information is e1,
For each subset, the distributed secret information is v {i_j} (i = 1, 2,..., N, j = 1, 2,..., T + 1), and the first verification information is distributed. If the information is A {1, i_j} and the distributed information of the second verification information is A {2, i_j},
The first verification information restoration unit calculates A {1, i_j} = f0 (φ (i_j) from t + 1 v {i_j} and A {1, i_j}, a unitary function φ, and a constant c0. , v {i_j})) to restore the first verification information e0 by obtaining e0 = f0 (c0) for the t-order polynomial f0 satisfying
The second verification information restoration unit calculates A {2, i_j} = f1 (φ (i_j) from t + 1 v {i_j} and A {2, i_j}, a unitary function φ, and a constant c1. , v {i_j})) for the t-order polynomial f1 satisfying e1 = f1 (c1), thereby restoring the second verification information e1. A shared information generating device according to claim 1;
A restoration device according to claim 3;
A secret information distribution system characterized by comprising: The shared information generating device according to claim 2;
A restoration device according to claim 4;
A secret information distribution system characterized by comprising: The secret information distribution system according to claim 6,
A secret information distribution system in which c0 = 0 and c1 = 0. An information processing method by a secret information distribution system having a shared information generating device and a restoring device,
When the shared information generating device receives the secret information, the threshold value k, and the shared information total number n, the shared information generating device generates n distributed secret information related to the secret information and outputs the generated information to the n storage devices.
When the assumed number of unauthorized persons t is input, the shared information generating apparatus, based on the n number of distributed secret information, the total number of distributed information n, and the assumed number of unauthorized persons t Generate the first verification information to verify
The shared information generation device generates n pieces of shared information that are distributed and encoded so that the first verification information can be restored from arbitrary t + 1 out of n, and outputs the generated information to the n storage devices.
The shared information generation device has a second relationship that is in a predetermined relationship with the first verification information based on the shared secret information, the first verification information, the total number n of shared information, and the assumed number of unauthorized persons t. Generate verification information,
The shared information generation device generates n pieces of shared information in which the second verification information is reversibly encoded from any t + 1 out of n and outputs the generated information to the n storage devices. after that,
The restoration device includes, as a subset, information stored in t + 1 storage devices in all combinations among k or more and n or less storage devices, and for each subset, t + 1 Based on the shared secret information and the shared information of the first verification information and the assumed number of unauthorized persons t, the first verification information is restored,
The restoration device restores the second verification information for each subset based on the t + 1 pieces of distributed secret information and the shared information of the second verification information, and the assumed number of unauthorized persons t.
The restoration apparatus determines whether the restored first verification information and the restored second verification information satisfy a predetermined relationship for all the subsets, and these two pieces of verification information are predetermined. If the relationship is satisfied, the secret information is restored from k or more distributed secret information, and if there is a subset in which the two verification information does not satisfy the predetermined relationship, the two verification information is determined in advance. An information processing method characterized in that a storage device after removing a subset of storage devices satisfying the relationship from n storage devices is output as a list as a storage device in which falsified distributed secret information is stored. The computer,
When the secret information, the threshold value k, and the total number n of shared information are input, the distributed secret information generation of the distributed information generation device generates n pieces of distributed secret information regarding the secret information and outputs them to the n storage devices. Function as a part ,
When the assumed number of unauthorized persons t is input, a first for verifying the non-falsification of the distributed secret information based on the n distributed secret information, the distributed information total number n, and the assumed unauthorized person number t It generates verification information, and generates n distributed information recoverable distributed encoding the first verification information from an arbitrary t + 1 pieces of the n outputs the n memory devices, dispersion Function as the first verification information generation unit of the information generation device ,
Based on the distributed secret information, the first verification information, the total number of shared information n, and the assumed number of unauthorized persons t, second verification information having a predetermined relationship with the first verification information is generated, and n The second verification of the shared information generation device that generates n pieces of distributed information that are reversibly encoded so that the second verification information can be restored from any t + 1 of the number, and outputs the generated information to the n storage devices A program for functioning as an information generator . The computer,
Among the storage devices not less than the threshold value k and not more than n, information stored in t + 1 storage devices in all combinations is set as a subset, and for each subset, t + 1 distributed secret information and A first verification information restoration unit of a restoration device that restores the first verification information based on the shared information of the first verification information for verifying the non-falsification of the distributed secret information and the assumed number of unauthorized persons t Function as
For each subset, based on the t + 1 pieces of distributed secret information, the distributed information of the second verification information for verifying the non-falsification of the distributed secret information, and the assumed number of unauthorized persons t Restore the verification information, function as a second verification information restoration unit of the restoration device ,
For all subsets, it is determined whether the restored first verification information and the restored second verification information satisfy a predetermined relationship , and these two verification information do not satisfy the predetermined relationship If there is a subset, the storage device after the storage device of the subset satisfying the predetermined relationship between the two verification information is removed from the n storage devices is stored in the falsified distributed secret information. Output as a list as a device, function as a verification information consistency determination unit of the restoration device,
A program for functioning as a secret information restoration unit of a restoration device that restores secret information from k or more pieces of distributed secret information when the two verification information satisfy a predetermined relationship .

Images