JP6495858B2 - Server device, error correction system, error correction method, program - Google Patents

Description

  The present invention relates to a server device, an error correction system, an error correction method, and a program that specify the position of an error that has occurred in any server device that stores a piece of secret information and correct the error.

In the secret sharing system, when an error occurs in any of the fragments, for example, the following conventional techniques can be combined in order to identify and correct this error.
<1. Parallel Consistency Check (Non-Patent Document 1)>
According to the technique of Non-Patent Document 1, it can be determined whether or not there is an error in a certain fragment group.
<2. Share reconstruction (Non-Patent Document 2)>
According to the technique of Non-Patent Document 2, a fragment with an error can be regenerated from a fragment of a server device having a correct fragment.

  It is possible to specify the error in a binary search using the method of Non-Patent Document 1 a plurality of times, and then regenerate a fragment of the error position specified using the method of Non-Patent Document 2.

Dai IKARASHI et al., “Actively Private and Correct MPC Scheme in t <n / 2 from Passively Secure Schemes with Small Overhead”, IACR Cryptology ePrint Archive, 2014, p.304 University of Igarashi, 3 others, “Data falsification detection method in secret sharing that can calculate multi-party”, 2013 Symposium on Cryptography and Information Security Symposium, SCIS, January 2013, 3C3-1

The above-described conventional techniques have the following problems.
<About identification of errors>
Since the method of Non-Patent Document 1 outputs only the presence / absence of an error, in order to identify in which fragment an error has occurred, this process is applied multiple times in a binary search, and the position of the error is determined. It is necessary to narrow down.

  In the method of Non-Patent Document 1, each server device needs to output a checksum each time it is applied, and check each other, so communication between the server devices is required each time.

<Error correction>
When correcting an incorrect fragment to a correct and correct fragment using the method of Non-Patent Document 2, it is necessary to perform communication a plurality of times between each participant.

  Therefore, the conventional method has a problem that a lot of processing and communication are required to identify and correct the error position of the fragment in the secret calculation.

  Therefore, an object of the present invention is to provide a server device that can realize location and correction of an error generated in a fragment with a smaller processing amount and communication amount than conventional ones.

  n and k are natural numbers satisfying n> k, m is a natural number of 2 or more, and j is a natural number of 1 to m.

  The server apparatus according to the present invention stores n pieces of fragments obtained by distributing each of m pieces of secret information from the first to mth pieces into n pieces, one piece for each piece of secret information, as a total of m pieces of pieces. Among the devices, the fragment corresponding to the jth secret information stored in each of the k server devices occurred in a fragment group of any server device in the secret sharing system capable of restoring the jth secret information. Locate the error and correct the error.

  The server device of the present invention includes a parity polynomial partial term generation unit, a parity polynomial partial term transmission unit, and an error correction unit.

The parity polynomial partial term generation unit, when there is no error in the fragment group stored in the own device, a Lagrange interpolation coefficient β corresponding to the own device, a fragment group matrix C expressing the fragment group of the own device, A partial term D of the parity polynomial is generated using the first matrix A _C and the second matrix A _R whose elements are powers of the roots of the Reed-Solomon code generator polynomial.

  The parity polynomial partial term transmission unit transmits the generated partial term D of the parity polynomial to the server apparatus in which an error has occurred.

  When the error correction unit receives the partial term D of the parity polynomial from the k server devices, the error correction unit acquires a matrix R representing the coefficient of the parity polynomial using the received partial term D of the parity polynomial, and the Reed-Solomon code Based on the procedure, the position of the error generated in the fragment group of the own device is specified, and the error is corrected.

  According to the server device of the present invention, it is possible to identify and correct an error occurring in a fragment with a smaller processing amount and communication amount than conventional ones.

1 is a diagram illustrating a schematic configuration of an error correction system according to a first embodiment. 1 is a block diagram illustrating a configuration of a server device according to a first embodiment. The flowchart which shows operation | movement of the server apparatus in which the data error has not generate | occur | produced. The flowchart which shows operation | movement of the server apparatus in which the data error generate | occur | produced. FIG. 3 is a diagram illustrating a schematic configuration of an error correction system according to a second embodiment.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  The schematic configuration of the error correction system 1 according to the first embodiment will be described below with reference to FIG. FIG. 1 is a diagram showing a schematic configuration of an error correction system 1 of the present embodiment. Note that m described later is a natural number of 2 or more, and j is a natural number of 1 or more and m or less.

  As shown in FIG. 1, the error correction system 1 of this embodiment is based on a secret sharing system 7. The secret sharing system 7 serving as a base includes fragments (first fragments 9-*-) in which m pieces of secret information (first secret information 9-1,..., M-th secret information 9-m) are each distributed in three. 1, second fragment 9-*-2, third fragment 9-*-3, * is the number of secret information), one for each secret information, and the server device 10 is stored as a total of m fragment groups The configuration includes three units (hereinafter, 10-1, 10-2, and 10-3 are attached when calling each server device). For example, the first fragment 9-1-1,..., The first fragment 9-m-1 is stored in the server device 10-1.

  The secret sharing system 7 uses the fragment corresponding to the j-th secret information stored in each of the two server devices 10-1, 10-2, and 10-3, to generate the j-th secret. Information can be restored. This is also called (2,3) -secret sharing.

  It is assumed that the three server apparatuses 10-1, 10-2, and 10-3 can communicate via the network 8.

  The error correction system 1 of the present embodiment is configured to include the three server devices 10-1, 10-2, 10-3 described above. Hereinafter, the configuration of the server device 10 in the error correction system 1 of the present embodiment will be described with reference to FIG. FIG. 2 is a block diagram illustrating the configuration of the server device 10 according to the present embodiment.

As shown in FIG. 2, the server apparatus 10 of this embodiment includes a parity polynomial partial term generation unit 11, a parity polynomial partial term transmission unit 12, an error correction unit 13, a fragment storage unit 14, and a matrix storage unit 15. It is the composition which includes. The fragment storage unit 14 stores the m fragments described in FIG. The matrix storage unit 15 stores, in advance, matrices A _C and A _R related to Reed-Solomon codes, which are necessary for processing described later.

  It is assumed that the server device in which an error has occurred is clarified by a prior check. In the following, it is assumed that an error has occurred in the fragment group stored in the server device 10-3.

  Hereinafter, with reference to FIG. 3, the operation of the server devices (here, the server devices 10-1 and 10-2) in which no data error has occurred will be described. FIG. 3 is a flowchart showing the operation of the server apparatus in which no data error has occurred.

A fragment corresponding to the j-th secret information of the server apparatus 10-1 is expressed as [a _j ] ₁ . Similarly, a fragment corresponding to the j-th secret information of the server apparatus 10-2 is expressed as [a _j ] ₂ . At this time, using the fragment [a _j ] ₁ and the fragment [a _j ] ₂ , the fragment [a _j ] ₃ of the server device 10-3 can be expressed as follows.

However, (beta) _i shall be the Lagrange interpolation coefficient of server apparatus 10-i.

The coefficient r _l (l = 0,..., 2t−1) of the parity polynomial R (x) for the correct fragment group [a _j ] ₃ (j = 1,..., M) of the server apparatus 10-3, where t represents the number of errors)

And a matrix having the elements of the server device 10-i as elements,

The matrix R representing the coefficient of the parity polynomial is expressed by using the first matrix A _C and the second matrix A _R whose elements are the powers of the roots of the Reed-Solomon generator polynomial.

It can be expressed as.

  Applying equation (1) above,

It becomes. With this matrix R, it is possible to specify and correct error positions. That is, the server devices 10-1 and 10-2 are respectively connected to the server device 10-3.

Can be generated in the server device 10-3. Accordingly, the parity polynomial partial term generation unit 11 of the server apparatuses 10-1 and 10-2 includes Lagrange interpolation coefficients β ₁ and β ₂ corresponding to the own apparatus and a fragment group matrix C ₁ representing the fragment group of the own apparatus. The partial terms D ₁ and D ₂ of the parity polynomial described above are generated using C ₂ and the first matrix A _C and the second matrix A _R whose elements are powers of roots of the Reed-Solomon code generator polynomial. (S11). The parity polynomial partial term transmission unit 12 of the server apparatuses 10-1 and 10-2 transmits the generated partial terms D ₁ and D ₂ of the parity polynomial to the server apparatus 10-3 in which an error has occurred (S12).

  Hereinafter, the operation of the server device (here, the server device 10-3) in which a data error has occurred will be described with reference to FIG. FIG. 4 is a flowchart showing the operation of the server apparatus in which a data error has occurred.

Error correction unit of the server device 10 - 13, when the two server devices 10-1 and 10-2 receives the partial section _D 1, _{D 2} of the parity polynomial, partial section _{D 1} of the received parity polynomial , D ₂

Thus, the matrix R representing the coefficient of the parity polynomial is acquired, the position of the error generated in the fragment group of the own apparatus is specified based on the Reed-Solomon code procedure, and the error is corrected (S13).

  According to the error correction system 1 of the present embodiment, the secret calculation process can be performed only when the matrix R is generated, and the communication between the server apparatuses can be performed only when the matrix R is transmitted. As a result, it is possible to identify and correct an error occurring in a fragment with a smaller amount of processing and communication than in the past.

  In the first embodiment, the error correction system 1 based on the (2, 3) -secret sharing secret sharing system 7 has been described. In this embodiment, an error correction system 2 based on a secret sharing system 6 extended to (k, n) -secret sharing will be described.

  Note that n and k are natural numbers satisfying n> k. As in the first embodiment, m is a natural number of 2 or more, and j is a natural number of 1 or more and m or less.

  The schematic configuration of the error correction system 2 according to the second embodiment will be described below with reference to FIG. FIG. 5 is a diagram showing a schematic configuration of the error correction system 2 of the present embodiment. As shown in FIG. 5, the error correction system 2 of this embodiment is based on a secret sharing system 6 extended to (k, n) -secret sharing. The secret sharing system 6 serving as a base includes fragments (first fragments 9-*-) in which m pieces of secret information (first secret information 9-1,..., M-th secret information 9-m) are distributed into n pieces. 1,..., N-th fragment 9-*-n, where * is the secret information number), one for each secret information, and a total of n server devices 10 for storing a total of m fragment groups (hereinafter referred to as each When the server devices are called, 10-1,..., 10-n are attached). For example, the first fragment 9-1-1,..., The first fragment 9-m-1 is stored in the server device 10-1. The server device 10 has the same function and configuration as that of the first embodiment.

  The secret sharing system 6 uses the fragment corresponding to the j-th secret information stored in each of the k server devices among the n server devices 10-1,. It can be restored ((k, n) -secret sharing).

  Assume that the n server apparatuses 10-1 to 10 -n can communicate with each other via the network 8.

  The error correction system 1 of the present embodiment is configured to include the n server devices 10-1, ..., 10-n described above.

  In addition, it is clear from the prior check whether the server device in which an error has occurred, and in the following, it is assumed that an error has occurred in the fragment group stored in the server device 10-p. Assume.

In this case, the fragment [a _j ] _p corresponding to the j-th secret information of the server device 10-p in which the data error has occurred corresponds to the j-th secret information owned by any k server devices. Using fragments, it can be expressed as follows:

However, l represents an index that satisfies l = 1,..., K and uniquely identifies any k server apparatuses. Thus, when (k, n) -secret sharing is used, the matrix R created from the coefficient r _{l of} the parity polynomial R (x) can be expressed as follows.

  Therefore, also in the secret sharing system 6 extended to (k, n) -secret sharing, the error correction system 2 can be constructed by the same server device 10 as in the first embodiment.

That is, the parity polynomial partial term generation unit 11 of the arbitrary k server devices described above expresses the Lagrange interpolation coefficient β _l (l = 1,..., K) corresponding to the own device and the fragment group of the own device. By using the fragment group matrix C _l (l = 1,..., K) and the first matrix A _C and the second matrix A _R whose elements are powers of the roots of the Reed-Solomon generator polynomial, A partial term D _l (l = 1,..., K) is generated (S11).

The parity polynomial partial term transmission unit 12 of any of the k server devices described above transmits the generated partial terms D _l (l = 1,..., K) of the parity polynomial to the server device 10-p in which an error has occurred. Transmit (S12).

The error correction unit 13 of the server device 10-p in which an error has occurred receives the parity polynomial partial term D _l (l = 1,..., K) from the k server devices. The matrix R representing the coefficient of the parity polynomial is obtained using the subterm D _l (l = 1,..., K), and the position of the error generated in the fragment group of the own device is specified based on the Reed-Solomon code procedure. Then, the error is corrected (S13).

  According to the error correction system 2 of the present embodiment, an error that has occurred in any server device in the (k, n) -secret sharing secret sharing system can be fragmented with a smaller amount of processing and communication than before. The location and correction of the generated error can be realized.

<Outline of error correction processing for general Reed-Solomon codes>
The following is an outline of error correction processing in a general Reed-Solomon code. First, in the encoding phase, the transmission code X (x) is
X (x) = C (x) + R (x)
It expresses. here,

It is. However, a represents original data and t represents the number of errors. R (x) represents a parity polynomial. At this time, the generator polynomial G (x) is

given that,
R (x) = C (x) modG (x).

If there is no error in the data, the transmission code X (x) is divisible by the generator polynomial G (x). Reed-Solomon code error correction technology uses this property. That is, the property that X (α ⁱ ) = 0 is used.

In the reception phase, α ⁰ , α ¹ ,..., Α ^2t−1 that are solutions of the generator polynomial G (x) are substituted into the reception code Y (x). When there is no error, since Y (x) = X (x), syndrome S _i = Y (α ⁱ ) = 0. If there is an error, the syndrome S _i = Y (α ⁱ ) ≠ 0.

In the error position polynomial generation phase, the error position is specified by obtaining the error position polynomial ρ (x) from the syndrome S _i = Y (α ⁱ ). ρ (x) is defined by a coefficient ρ _i defined by the following matrix.

In the error position identification and correction phase, α ⁱ (i = 0,..., M) is substituted into the error position polynomial ρ (x), and the inverse element of α ⁱ where ρ (x) = 0 is the error position. Will be expressed.

<Supplementary note>
The apparatus of the present invention includes, for example, a single hardware entity as an input unit to which a keyboard or the like can be connected, an output unit to which a liquid crystal display or the like can be connected, and a communication device (for example, a communication cable) capable of communicating outside the hardware entity. Can be connected to a communication unit, a CPU (Central Processing Unit, may include a cache memory or a register), a RAM or ROM that is a memory, an external storage device that is a hard disk, and an input unit, an output unit, or a communication unit thereof , A CPU, a RAM, a ROM, and a bus connected so that data can be exchanged between the external storage devices. If necessary, the hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device of the hardware entity stores a program necessary for realizing the above functions and data necessary for processing the program (not limited to the external storage device, for example, reading a program) It may be stored in a ROM that is a dedicated storage device). Data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device.

  In the hardware entity, each program stored in an external storage device (or ROM or the like) and data necessary for processing each program are read into a memory as necessary, and are interpreted and executed by a CPU as appropriate. . As a result, the CPU realizes a predetermined function (respective component requirements expressed as the above-described unit, unit, etc.).

  The present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above embodiment may be executed not only in time series according to the order of description but also in parallel or individually as required by the processing capability of the apparatus that executes the processing. .

  As described above, when the processing functions in the hardware entity (the apparatus of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. Then, by executing this program on a computer, the processing functions in the hardware entity are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, a hardware entity is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (4)

n, k is a natural number satisfying n> k,
m is a natural number of 2 or more,
j is a natural number between 1 and m,
Of the n server devices that store m pieces of secret information from the first to mth pieces in n pieces, each of which is stored as a group of m pieces, one for each piece of secret information, k pieces Identifying the position of an error that has occurred in a fragment group of any server device of the secret sharing system capable of restoring the j-th secret information by using a fragment corresponding to the j-th secret information stored in each server device; A server device for correcting the error,
When there is no error in the fragment group stored in the own device, the Lagrange interpolation coefficient β corresponding to the own device, the fragment group matrix C representing the fragment group of the own device, and the root of the generator polynomial of the Reed-Solomon code A parity polynomial partial term generation unit that generates a partial term D of a parity polynomial using a first matrix A _C and a second matrix A _R that are powers of
A parity polynomial partial term transmitter that transmits the generated partial term D of the parity polynomial to the server device in which the error occurs;
When the parity polynomial partial term D is received from k server devices, a matrix R representing the parity polynomial coefficient is obtained using the received parity polynomial partial term D, and the procedure is based on the Reed-Solomon code procedure. An error correction unit that identifies the position of an error that has occurred in the fragment group of the device and corrects the error;
Server device including n, k is a natural number satisfying n> k,
m is a natural number of 2 or more,
j is a natural number between 1 and m,
Of the n server devices that store m pieces of secret information from the first to mth pieces in n pieces, each of which is stored as a group of m pieces, one for each piece of secret information, k pieces Identifying the position of an error that has occurred in a fragment group of any server device of the secret sharing system capable of restoring the j-th secret information by using a fragment corresponding to the j-th secret information stored in each server device; An error correction system for correcting the error,
The server device
When there is no error in the fragment group stored in the own device, the Lagrange interpolation coefficient β corresponding to the own device, the fragment group matrix C representing the fragment group of the own device, and the root of the generator polynomial of the Reed-Solomon code A parity polynomial partial term generation unit that generates a partial term D of a parity polynomial using a first matrix A _C and a second matrix A _R that are powers of
A parity polynomial partial term transmitter that transmits the generated partial term D of the parity polynomial to the server device in which the error occurs;
When the parity polynomial partial term D is received from k server devices, a matrix R representing the parity polynomial coefficient is obtained using the received parity polynomial partial term D, and the procedure is based on the Reed-Solomon code procedure. An error correction unit that identifies the position of an error that has occurred in the fragment group of the device and corrects the error;
Including error correction system. n, k is a natural number satisfying n> k,
m is a natural number of 2 or more,
j is a natural number between 1 and m,
Of the n server devices that store m pieces of secret information from the first to mth pieces in n pieces, each of which is stored as a group of m pieces, one for each piece of secret information, k pieces Identifying the position of an error that has occurred in a fragment group of any server device of the secret sharing system capable of restoring the j-th secret information by using a fragment corresponding to the j-th secret information stored in each server device; An error correction method for correcting the error, comprising:
The server device
When there is no error in the fragment group stored in the own device, the Lagrange interpolation coefficient β corresponding to the own device, the fragment group matrix C representing the fragment group of the own device, and the root of the generator polynomial of the Reed-Solomon code Generating a partial term D of a parity polynomial using a first matrix A _C and a second matrix A _R whose elements are powers of:
Transmitting the generated parity polynomial partial term D to the server device in which the error occurs;
When the parity polynomial partial term D is received from k server devices, a matrix R representing the parity polynomial coefficient is obtained using the received parity polynomial partial term D, and the procedure is based on the Reed-Solomon code procedure. Identifying a position of an error that has occurred in the fragment group of the device and correcting the error;
An error correction method to execute.   A program causing a computer to function as the server device according to claim 1.

Images