JPWO2020065633A5

JPWO2020065633A5 -

Info

Publication number: JPWO2020065633A5
Application number: JP2021517870A
Authority: JP
Publication date: 2022-10-07
Anticipated expiration: 2039-09-30

Claims

obtaining, at a user device of a primary user for splitting transaction keys, a number of users in a group of users for managing said transaction keys and a first predetermined value, said obtaining, wherein a first predetermined value indicates a minimum number of users in said group of users for recovering said transaction key;
randomly generating, at the user device of the primary user, the transaction key based on messages from management devices related to further users in the group of users, wherein the transaction key is currently wherein the message includes at least the public key of the further user;
at the user device of the primary user , dividing the transaction key into a plurality of subkeys, wherein the number of subkeys is the same as the number of users;
at the user device of the primary user, encrypting each of the plurality of subkeys with the public key of the corresponding one of the users in the group of users associated with the given subkey; When,
and sending said plurality of encrypted subkeys from said user device of said primary user to said management device.

2. The method of claim 1, wherein the primary user is specified from the group of users or randomly determined by the management device.

said message from said managed device relating to said further user comprising:
certification of said managed device;
signature information for verifying said public key of said further user;
identity of said further user;
2. The method of claim 1, indicating at least one of: signature information of a hash value of the merged data of said further user; and a validity period of said message.

The step of randomly generating a transaction key includes:
Determining whether the public key of the additional user is valid based on the signature information of the public key of the additional user in response to determining that the certification of the managed device is valid. a step;
Randomly generating a plurality of random numbers for constructing a splitting polynomial in response to the public key of the further user being valid, the number of random numbers being equal to the first predetermined value; 4. The method of claim 3, wherein the plurality of random numbers for constructing the splitting polynomial are the same and include the transaction key.

Dividing the transaction key into the plurality of subkeys comprises:
determining the plurality of subkeys based on the number of users in the group of users and the plurality of random numbers for constructing the splitting polynomial, wherein each of the plurality of subkeys is , comprising the first sub-key data and the second sub-key data.

The encrypting step comprises:
2. The method of claim 1, further comprising encrypting said subkey based on said public key of said user corresponding to said subkey and a validity period of said message relating to said further user.

responsive to determining that the signature data from the management device is valid, signing the signature data based on a preset private key at the user device, wherein the signature data is at least , including a random number signed by the managed device;
responsive to a user being determined as an organizing primary user for organizing the group of users, providing to the managing device group information about the group of users and the user device of the organizing primary user; and the signature data signed with the private key of the user device of the organized primary user, wherein the group information is at least the number of users in the group of users and the first predetermined value.

2. The method of claim 1, wherein the user device comprises a hardware USB key with a processing unit.

A method of key management between groups of users, comprising:
Restoring from a managed device to restore the transaction key at a user device of the restoring user in response to a user from the group of users being determined as a restoring user for restoring the transaction key. obtaining a message, wherein the restored message indicates at least the number of confirming users in the group of users and the identifying information of the restoring users, the confirming users approving the current transaction; a step of obtaining;
Determining the transaction key based on the subkeys of the confirming users obtained from the management device in response to determining that the number of confirming users is greater than or equal to a first predetermined value. determining that the subkeys of the verifying user were generated by previously dividing the transaction key;
and signing a transaction request for the current transaction based on the determined transaction key.

10. The method of claim 9, wherein the restore user is specified by the management device from the group of users or randomly determined.

10. The method of claim 9, wherein the subkey of the confirming user is sent by the confirming user to the management device, and wherein the subkey of the confirming user is encrypted with the recovery user's public key.

at the user device of the verifying user, wherein the subkey of the verifying user is the public key of the restoring user obtained via the management device and a current transaction random number associated with the current transaction; 12. The method of claim 11, encrypted.

The restoration message is
a current transaction random number associated with said current transaction;
said subkey of said verifying user and said current transaction random number signed with said restoring user's public key;
signature information of said verifying user;
10. The method of claim 9, further indicating at least one of: a certificate of the managed device; and signature information of a hash value of the restored message.

A method of key management involving a group of users, wherein said group of users includes an organizing primary user for creating said group of users and a primary user for dividing transaction keys. teeth,
obtaining, at a management device, group information about the group of users from user devices of the organized primary users, wherein the group information comprises at least a number of users in the group of users; a predetermined value, wherein the first predetermined value indicates a minimum number of users for recovering a transaction key, and the group of users is used to manage the transaction key; a step;
sending a message to a user device of said primary user for splitting said transaction key, said message being said in said group of users other than said primary user for splitting said transaction key. sending, wherein said message relates to a first of said users and wherein said message indicates at least a public key of said first of said users;
obtaining a plurality of subkeys from the primary user for splitting the transaction key, wherein the number of subkeys is the same as the number of users in the group of users, and the plurality of a subkey is generated by the primary user for splitting the transaction key by randomly generating the transaction key and then splitting the transaction key, the plurality of subkeys comprising: obtaining, encrypted with the respective user's public key;
and C. caching said plurality of subkeys for transmission to said respective users.

In said group of users,
at least one of the organized primary user and the primary user for splitting the transaction key, and at least one of a recovery user for recovering the transaction key, either designated or randomly 15. The method of claim 14, further comprising determining.

responsive to receiving a request for a current transaction, sending transaction information to users of the group of users for determining whether the current transaction is approved; indicates at least the transaction content of the current transaction and the identity of the restoring user;
obtaining a subkey of each verifying user in said group of users, wherein said verifying user approves said current transaction and said subkey of said verifying user is signed with said restoring user's public key. a step of obtaining
16. The method of claim 15, further comprising sending a recovery message to the recovery user to recover the transaction key in response to determining that a condition for the current transaction is met.

sending signature data of said managed device to said user devices in response to registration requests from user devices of users in said group of users, said signature data being at least signed by said managed device; sending the random number;
determining whether the user device is valid based on signature data from the user device, the signature data being received in response to determining that the managed device is valid; , generated by signing the random number by the user device based on a private key preset in the user device;
15. The method of claim 14, further comprising determining that the group of users is valid in response to determining that a user device of each user in the group of users is valid.

15. The method of claim 14, wherein said user device comprises a hardware USB key with a processing unit.

A user device for key management,
a memory configured to store one or more computer programs;
a processing unit coupled to the memory and configured to execute the one or more computer programs to cause the device to perform the method of any one of claims 1 to 13; A user device comprising:

A management device for key management,
a memory configured to store one or more computer programs;
a processing unit coupled to the memory and configured to execute the one or more computer programs to cause the device to perform the method of any one of claims 14 to 18; A managed device, comprising:

19. A method according to any one of claims 1 to 18, a non-transitory computer-readable storage medium comprising machine-executable instructions stored thereon, said machine-executable instructions, when executed, to a machine. A non-transitory computer-readable storage medium that causes the steps of .

19. A computer program tangibly stored on a non-transitory computer-readable medium and comprising machine-executable instructions, said machine-executable instructions, when executed, causing a machine to: A computer program causing the steps of any one of the methods to be performed.