WO2013080290A1 - Data dividing device and data dividing program - Google Patents

Data dividing device and data dividing program Download PDF

Info

Publication number
WO2013080290A1
WO2013080290A1 PCT/JP2011/077431 JP2011077431W WO2013080290A1 WO 2013080290 A1 WO2013080290 A1 WO 2013080290A1 JP 2011077431 W JP2011077431 W JP 2011077431W WO 2013080290 A1 WO2013080290 A1 WO 2013080290A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
divided
secret
partial
matrix
Prior art date
Application number
PCT/JP2011/077431
Other languages
French (fr)
Japanese (ja)
Inventor
松本　勉
武暢 清藤
佐藤　敦
昭輝 鴨志田
敏文 新谷
Original Assignee
国立大学法人 横浜国立大学
株式会社野村総合研究所
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 国立大学法人 横浜国立大学, 株式会社野村総合研究所 filed Critical 国立大学法人 横浜国立大学
Priority to PCT/JP2011/077431 priority Critical patent/WO2013080290A1/en
Priority to JP2013500690A priority patent/JP5530025B2/en
Publication of WO2013080290A1 publication Critical patent/WO2013080290A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes

Definitions

  • the present invention relates to a technique for concealing electronic data, and in particular, a technique that is effective when applied to a data division apparatus and a data division program used to divide important data into a plurality of non-important data using a secret sharing technique. It is about.
  • important data when important data is stored, it is also stored by taking measures to conceal the data and prevent falsification.
  • important data is encrypted and stored using an encryption key.
  • the encrypted data includes all important data information. Therefore, for example, when encrypted data is acquired by a third party, important data is easily restored when the encryption key is also acquired and decrypted by the third party for some reason. Even if the encryption key is not acquired, since the encryption key has a finite length, theoretically, there is a possibility that important data may be restored from the encrypted data after a finite number of trials.
  • secret sharing technology is also used as a method for strongly concealing important data.
  • important data is divided into a number of non-critical data that cannot be recovered by itself (important data cannot be recovered or guessed), and some non-critical data is obtained by a third party.
  • Non-Patent Document 1 Various methods have been proposed as secret sharing methods, and for example, a (k, n) threshold secret sharing method described in Non-Patent Document 1 has been used.
  • (k, n) threshold secret sharing secret data to be kept secret is divided into n pieces of divided data. By collecting at least k pieces (k ⁇ n) or more of the n pieces of divided data, the secret data can be restored from these pieces of divided data.
  • the number of collected divided data is less than k, it is impossible to restore secret data from these divided data or to infer the contents (to obtain information on the secret data).
  • (k, n) threshold secret sharing technique In this (k, n) threshold secret sharing technique, generally, operations for dividing and restoring secret data are performed using polynomial operations and remainder operations. However, when these calculations are performed by information processing on a computer, the calculation load increases. Therefore, if the amount of secret data increases, CPU (Central Processing Unit) resources are consumed in large quantities, and processing performance deteriorates. Have the problem of In contrast, (k, n) threshold secret sharing processing is described as a bitwise exclusive OR (eXclusive OR: hereinafter referred to as “XOR”), and a “+” operator. A method of realizing by calculation is also proposed.
  • eXclusive OR hereinafter referred to as “XOR”
  • Patent Document 1 a plurality of original partial data (secret partial data) is generated by dividing original data (secret data) into predetermined lengths.
  • a random number having the same length as the secret data or a random number shorter than the secret data is divided for each predetermined length to generate a plurality of random number partial data, and a predetermined definition formula
  • a technique for efficiently dividing secret data by relatively simple processing by performing exclusive OR operation of secret part data and random number part data based on the above and generating a plurality of divided data is performed by performing exclusive OR operation of secret part data and random number part data based on the above and generating a plurality of divided data .
  • the size of the secret data is the same as the size of each of the n pieces of divided data generated by performing the secret sharing.
  • the total amount of the n divided data after the execution is n times the data amount of the secret data, and there is a problem that resources such as storage capacity and network bandwidth when storing the data are wasted. Have.
  • a technique for reducing the data amount of divided data generated by secret sharing has been proposed in consideration of use in an actual system.
  • a so-called ramp type (k, L, n) threshold secret sharing technique as described in Non-Patent Document 2 has been proposed.
  • the size of each of the generated n pieces of divided data can be reduced to 1 / L of the size of the secret data, instead of relaxing the security condition for the confidentiality of the data. That is, the data amount of all n pieces of divided data can be reduced to 1 / L in the case of (k, n) threshold secret sharing.
  • the secret data can be restored by collecting at least k of the n divided data, as in the case of (k, n) threshold secret sharing. is there.
  • the number of collected divided data is (k ⁇ L) or less (1 ⁇ L ⁇ k)
  • the secret data will not be restored / estimated, but even if it is less than k
  • these mobile terminals usually have less processing power than desktop PCs, and the network for accessing the server or the like for storing the divided data is also wireless. In many cases, such as communication, there is no bandwidth. Therefore, particularly efficient and high-speed processing is required for secret sharing processing, and the amount of divided data to be generated is also required to be small.
  • the security condition is slightly relaxed, but the size of each of the n pieces of divided data is reduced to 1 / L.
  • the total data amount can be reduced to 1 / L.
  • a method has been proposed in which the XOR operation of data obtained by dividing secret data and random numbers is used to increase the efficiency and speed of generation of divided data by arithmetic processing in a computer.
  • an object of the present invention is to conceal secret data by dividing it into n pieces of divided data by (k, L, n) ramp type threshold secret sharing, and from (k, L, n, n)
  • the data dividing apparatus divides secret data into n pieces of divided data by (k, L, n) ramp type threshold secret sharing, and the n pieces of divided data are different from each other.
  • a data dividing device for distributed storage in a storage device which has the following characteristics.
  • the data dividing device divides the unit secret data of length S extracted from the secret data into a plurality of secret part data, and is a random number that is the same length as the secret part data and half the number of the secret part data Generate partial data and define an XOR operation for generating divided partial data from one or more of the secret part data, the random part data, and one or more of the secret part data and the random part data Based on the divided matrix, a plurality of the divided partial data are generated, and the plurality of divided partial data generated by the XOR operation including the different random number partial data are concatenated to obtain n types of length S / L.
  • a division processing unit that generates unit divided data and generates n pieces of divided data by connecting the unit divided data for each type is provided.
  • the present invention can also be applied to a program that causes a computer to function as the above-described data dividing device.
  • a data dividing device divides secret data into n pieces of divided data by (k, L, n) ramp type threshold secret sharing, and these divided data are respectively sent to different servers or the like.
  • the data is stored in a storage device in a distributed manner.
  • the ramp-type secret sharing is used, although the security condition is slightly relaxed, the size of each of the n pieces of divided data is reduced to 1 / L, and the total data amount is (k, n).
  • the threshold secret sharing case it is reduced to 1 / L. This reduces the amount of resources used such as network bandwidth and storage area when transmitting and storing each divided data.
  • (k, L, n) ramp type threshold secret sharing in order to reduce the amount of CPU resources used by increasing the efficiency and speed of processing, as with known techniques,
  • the divided data is generated based on the XOR operation of the secret partial data obtained by dividing the secret data and the random number partial data having the same length as that suitable for the bit operation.
  • ramp-type threshold secret sharing a calculation formula and a calculation procedure for performing an XOR operation are adjusted, and a plurality of secret sharing is performed from secret data. The overall processing performance is improved when generating divided data and when restoring secret data from a plurality of divided data.
  • FIG. 1 is a diagram showing an outline of a configuration example of a data dividing apparatus according to an embodiment of the present invention.
  • secret data 400 that is a target of secret sharing is created by the user, such as an information processing terminal such as a PC or a mobile terminal used by the user, or a file server to which the plurality of information processing terminals are connected. Or a general computer device holding the same.
  • the data dividing apparatus 100 can be connected to a plurality of servers 200 via a network 300 such as the Internet.
  • the number of servers 200 may be n or more in the (k, L, n) ramp-type threshold secret sharing (four in this embodiment because it is (3, 2, 4) ramp-type threshold secret sharing). desirable.
  • Each of these servers 200 stores the divided data 410 generated by secret sharing from the secret data 400 by the data dividing device 100 and transmitted via the network 300 in a storage device such as an HDD (Hard Disk Drive). It consists of file servers, storage devices, etc.
  • HDD Hard Disk Drive
  • the data dividing device 100 is implemented by, for example, a division processing unit 110, a distribution management unit 120, a restoration processing unit 130, and an interface implemented as a software program that runs on an OS (Operating System) (not shown).
  • OS Operating System
  • Each part such as the part 140 is included.
  • the division processing unit 110 is based on, for example, a division matrix 111 that defines an arithmetic expression by XOR described later and a divided intermediate expression 112 from secret data 400 instructed to be securely stored by a user via an interface unit 140 described later. Then, according to a predetermined procedure, (k, L, n) ramp-type threshold secret sharing (in this embodiment, (3, 2, 4) ramp-type threshold secret sharing) is distributed to n servers 200 (this embodiment) In this embodiment, four pieces of divided data 410 are generated. Further, it has a random number generation unit 113 that generates a random number used in the above-described XOR calculation.
  • the random number generation method is not particularly limited, and any known technique can be used as long as it can generate a random number having a predetermined length or more.
  • the distribution management unit 120 transmits, for example, each divided data 410 generated from the secret data 400 by the division processing unit 110 to each server 200 according to a predetermined condition based on the setting content of the setting information 122 and stores the divided data. Information relating to which server 200 stores each piece of divided data 410 is recorded in the distribution status 121 and managed.
  • the setting information 122 includes, for example, access information (IP address, host name, etc.) for each server 200 serving as a distributed storage destination, and when there are more servers 200 than n (four in this embodiment), n Criteria and conditions for selecting individual servers 200 (for example, priority order of servers 200, an ordered list, a rotation method, and the like) can be set in advance.
  • the distribution management unit 120 is based on the content of the distribution status 121 and the setting content of the setting information 122 based on a request from the restoration processing unit 130 when the restoration processing unit 130 described below restores the secret data 400.
  • m pieces of divided data 410 for restoring the secret data 400 are collected from each server 200 and transferred to the restoration processing unit 130.
  • the divided data 410 is stored from the target server 200 according to the criteria, conditions, failure, and the like for selecting the target m servers 200. It is possible to set in advance a method for determining the server 200 as an alternative in the case where acquisition is not possible.
  • any of the n pieces of divided data 410 cannot be stored in each server 200 when the divided data 410 is distributed and stored due to a failure of the server 200, or more than k pieces cannot be collected when the divided data 410 is collected. In such a case, an error may be returned to the user.
  • the data dividing apparatus 100 and each server 200 transmit / receive the information after performing predetermined encryption on the divided data 410, respectively. The risk of leakage may be further reduced.
  • the restoration processing unit 130 divides the divided data 410 more than the number necessary for restoring the secret data 400. Request to get. Furthermore, from the acquired divided data 410, (k, L, n) ramp-type threshold secret sharing (this embodiment) is performed according to a predetermined procedure based on a restoration matrix 131 that defines an arithmetic expression by XOR described later and a restoration intermediate expression 132. In the embodiment, the secret data 400 is restored by (3, 2, 4) ramp-type threshold secret sharing).
  • the interface unit 140 has a user interface such as a screen display in the data dividing apparatus 100 (or a client terminal (not shown) for the data dividing apparatus 100) and an input / output function such as data transmission / reception.
  • the user can use the functions of the data dividing apparatus 100 by using, for example, a file management screen of a general OS.
  • the division processing unit 110 and the distribution management unit 120 automatically generate n pieces of divided data 410 (four pieces in the present embodiment) using the important data as secret data 400, and each piece of divided data 410 Can be distributed and stored in each server 200 without making the user aware of the above.
  • the secret data 400 is deleted from the data dividing device 100 (and the user's client terminal for the data dividing device 100).
  • the secret data 400 corresponds to the secret data 400 so that the user is not conscious on the file management screen. Create and keep a dummy file etc.
  • the user performs operations such as reference and editing of the secret data 400 by operating the dummy file of the secret data 400 managed in a specific folder on the file management screen.
  • the distributed management unit 120 and the restoration processing unit 130 automatically set m secret data 400 corresponding to the dummy file or the like from each server 200 (k ⁇ m ⁇ n, book
  • three or four pieces of divided data 410 are collected, and the secret data 400 can be restored and made available to the user.
  • FIG. 2 is a flowchart showing an outline of an example of a flow of division processing for generating the division data 410 from the secret data 400 by secret sharing in the division processing unit 110 of the data division device 100.
  • secret sharing processing is performed by (3, 2, 4) ramp-type threshold secret sharing.
  • FIG. 3 is a diagram showing an outline of an example of processing for generating four pieces of divided data 410 from the secret data 400 by (3, 2, 4) ramp-type threshold secret sharing.
  • the division processing unit 110 When the important data to be secret shared is designated by the user via the interface unit 140, the division processing unit 110 first sets the important data as the secret data 400, and has a predetermined length S from the top of the secret data 400.
  • the unit secret data is extracted (S01).
  • This unit secret data is data that becomes a processing unit when performing secret sharing processing by XOR operation, and in the present embodiment, the length S is an arbitrary length of multiple bits of 6.
  • the secret data 400 is padded with predetermined data such as zero to obtain the unit secret data of length S for the less than S And
  • the extracted unit secret data 401 is divided to generate six secret partial data (S02). Specifically, as shown in FIG. 3, the unit secret data 401 of length S extracted from the secret data 400 is divided into six equal parts, and six pieces of secret partial data 402 of length S / 6 (s1 to s6). ) Generate.
  • the random number generation unit 113 generates three random number partial data 403 having the same length (S / 6) as the secret partial data 402, which is half the number of the secret partial data 402 (S03). Specifically, as shown in FIG. 3, three pieces (r1 to r3) of random number partial data 403 having the same length S / 6 as the secret partial data 402 are generated.
  • the random number generation unit 113 may individually generate three of r1 to r3, or the random number generation unit 113 generates one random number longer than S / 2.
  • the division processing unit 110 may divide this and extract three random numbers having a length of S / 6.
  • the secret part data 402 (s1 to s6) and the random number part data 403 for each of the plurality of divided intermediate expressions 112 that are defined in advance for use in performing an XOR operation for generating divided part data, which will be described later.
  • a value is calculated by performing an XOR operation based on (r1 to r3) (S04).
  • This divided intermediate expression 112 is obtained by extracting an XOR operation expression that repeatedly appears a plurality of times as the divided intermediate expression 112 in the entire XOR operation for generating divided partial data described later.
  • the value of the divided intermediate expression 112 is calculated and held in advance, and the calculation result is used in the XOR operation based on the divided matrix 111, which will be described later. To increase speed and speed. Details of the divided intermediate expression 112 will be described later.
  • an XOR operation is performed based on the contents defined in the partition matrix 111, and the twelve divided part data 412 are obtained.
  • Generate (S05). Specifically, as shown in FIG. 3, a 9 ⁇ 1 matrix including a partition matrix 111 defining an XOR operation, random number partial data 403 (r1 to r3), and secret partial data 402 (s1 to s6).
  • 12 divided partial data 412 (a1 to a3, b1 to b3, c1 to c3, d1 to d3) each having a length S / 6 are obtained.
  • 12 divided partial data 412 are obtained by the following equations obtained by multiplication of the divided matrix 111 and the secret data matrix 114.
  • each divided intermediate expression 112 calculated in advance in step S04 is added to the portion of the XOR operation that coincides with each divided intermediate expression 112 in each of the above expressions. By substituting, the total number of XOR operations is reduced.
  • unit divided data 411a having a length of S / 2 is generated by concatenating divided partial data 412 of a1 to a3.
  • the divided partial data 412 of b1 to b3, c1 to c3, and d1 to d3 are respectively connected to generate unit divided data 411b to 411d.
  • the generated four unit divided data 411 are connected to the end of the corresponding divided data 410 (S07).
  • unit divided data 411a to 411d of length S / 2 are connected to the end of divided data A (410a) to divided data D (410d), respectively.
  • each unit divided data 411 itself is set as divided data 410.
  • Each piece of divided data 410 includes information for identifying whether it is of divided data A (410a), divided data B (410b), divided data C (410c), or divided data D (410d). Is added to the header or the like.
  • the unit divided data 411 constituting the divided data 410 is constituted by any divided partial data 412 of a1 to a3, b1 to b3, c1 to c3, or d1 to d3.
  • the unit secret data 401 is extracted by padding data such as zero because the length of the secret data 400 is less than S in step S01, the validity of the last unit secret data 401 is valid.
  • a length of information or the like may be added.
  • the four pieces of divided data 410 (divided data A to D) obtained by the above processing using the divided matrix 111 shown in FIG. 3 satisfy the requirement of (3, 2, 4) ramp-type threshold secret sharing. Is. That is, the information of the unit secret data 401 constituting the secret data 400 (the information of the secret partial data 402 of s1 to s6) cannot be obtained from each of the unit divided data 411 constituting each of the divided data 410.
  • the information of the divided partial data 412 of a1 to a3 can be obtained from the unit divided data 411a constituting the divided data A (410a). Even if the third party knows that the divided partial data 412 is generated from the three expressions of Expressions 1 to 3, r1 consisting of Expressions 1 to 3 Simultaneous equations with ⁇ r3 and s1 to s6 as variables cannot be solved.
  • any information (solution) of the secret partial data 402 of s1 to s6 cannot be obtained ( That is, the normalized information entropy is 1.) Accordingly, the confidentiality of the secret data 400 (unit secret data 401 including the secret partial data 402 of s1 to s6) is maintained. The same applies to the divided data 410 of the divided data B (410b) to the divided data D (410d).
  • each formula is expressed as “one or two or more different secret partial data 402 (s1 to s6) and one or two or more different random number partial data 403 (r1 If the division matrix 111 is configured as expressed as “XOR operation of r3”, each piece of divided data 410 (unit divided data 411) has randomness equivalent to that of random number data. Information of the secret data 400 (unit secret data 401) cannot be obtained from the data 410.
  • each of the three calculation formulas has only one random number partial data 403 that is different from each other (for example, Formula 1 is only r1, Formula 2 is only r2, and Formula 3 is only r3). It is said.
  • the secret data 400 can be restored. That is, it is possible to obtain all of the information of the unit secret data 401 (information of the secret partial data 402 of s1 to s6) constituting the secret data 400 from each of the unit divided data 411 constituting the three different divided data 410. it can.
  • the nine pieces of Equations 1 to 9 are used. A simultaneous equation consisting of independent equations will be obtained.
  • the partition matrix 111 used for the partitioning process in the (3, 2, 4) ramp-type threshold secret sharing shown in FIG. 3 is the restoration used for the restoration process of the secret data 400 from the partitioned data 410 described later.
  • the number of XOR operations in the entire division / restoration secret sharing process is adjusted to be small.
  • the number of XOR operations was analyzed to obtain a pattern with a small number, that is, a high processing efficiency as a whole.
  • the partition matrix 111 shown in FIG. 3 is the adjusted partition matrix 111 obtained by the above procedure.
  • the divided portion data 412 (a1 to a3, b1 to b3, c1 to c3, d1 to d3) is calculated based on the above equations 1 to 12 in step S05 in FIG.
  • the divided intermediate expression 112 is used so that the number of XOR operations to be performed (the “+” operator in Expressions 1 to 12) is reduced. That is, an XOR operation expression that appears repeatedly in the above formulas 1 to 12 is defined in advance as the divided intermediate expression 112, and the value of each divided intermediate expression 112 is calculated in advance in step S04 of FIG. .
  • FIG. 4 shows a case where the divided portion data 412 (a1 to a3, b1 to b3, c1 to c3, d1 to d3) is calculated from the secret portion data 402 (s1 to s6) and the random number portion data 403 (r1 to r3). It is the figure which showed the outline
  • the upper diagram of FIG. 4 schematically shows the contents of the partition matrix 111 shown in FIG. 3 as a table, and the rows and columns of the table correspond to the rows and columns of the partition matrix 111 shown in FIG. ing.
  • each row of the table of the partition matrix 111 shown in FIG. 4 shows the contents of the XOR operation shown in the above equations 1 to 12.
  • seven divided intermediate expressions 112 from t1 to t7 are defined, and these are columns in which “1” stands (each in FIG. 4). (Corresponding to the column of the division matrix 111 shown in the upper stage) represents the calculation of the following equation.
  • the number of XOR operations is greatly reduced to 25 (reduction rate 34.2%). Accordingly, rather than directly executing the XOR operation based on the partition matrix 111 (the above formulas 1 to 12), the split intermediate formula 112 (the above formulas 13 to 19) is calculated in advance, By performing the XOR operation based on the partition matrix 111 by using the above (Equation 1 ′ to Equation 12 ′ above), it is possible to increase the efficiency and speed of the processing relating to the XOR operation.
  • FIG. 5 is a flowchart showing an outline of an example of the flow of restoration processing for generating the secret data 400 from the divided data 410 by secret sharing in the restoration processing unit 130 of the data dividing device 100.
  • secret sharing processing is performed by (3, 2, 4) ramp-type threshold secret sharing.
  • FIG. 6 is a diagram showing an overview of an example of processing for generating (restoring) secret data 400 from three pieces of divided data 410 by (3, 2, 4) ramp-type threshold secret sharing.
  • restoration processing unit 130 when important data to be used for reference or editing, for example, important data to be restored is designated by the user via the interface unit 140, the restoration processing unit 130 The data is set as the secret data 400, and the distribution management unit 120 is requested and acquired as many pieces of divided data 410 as necessary (three or more in the present embodiment) to restore the data.
  • FIG. 6 a case is shown in which three pieces of divided data 410 of divided data 410a, 410b, 410c are used for restoration.
  • three pieces of divided data 410 of the divided data 410a, 410b, 410c are acquired via the distribution management unit 120 and used for restoration, and all four pieces of division data 410 are obtained via the distribution management unit 120.
  • the case where the data 410 is acquired and three of the divided data 410a, 410b, and 410c are used for restoration is included.
  • each unit divided data 411 (a, b, c) extracted from each divided data 410 (a, b, c) is unit divided data based on information added to a header or the like. 411a, 411b, 411c (or unit divided data 411d) is specified.
  • three divided partial data 412 are extracted from each extracted unit divided data 411 (S13). Specifically, as shown in FIG. 6, three unit divided data 411 (a, b, c) having a length S / 2 are divided into three equal parts, and divided partial data 412 having a length S / 6. Are generated three by one (a1 to a3, b1 to b3, c1 to c3).
  • a plurality of restoration intermediate formulas 132 defined for each combination of the types of the unit divided data 411 identified in step S12. For each, an XOR operation is performed based on the divided partial data 412 extracted in step S13 to calculate values (S14).
  • the restore intermediate formula 132 extracts an XOR formula that repeatedly appears multiple times as the restore intermediate formula 132 in the entire XOR calculation for generating secret partial data 402 described later. Is.
  • this restoration intermediate formula 132 is calculated and held in advance, and the calculation result is used in the XOR operation based on the restoration matrix 131, thereby eliminating the XOR operation with overlapping contents as much as possible and improving the processing efficiency. Increase speed.
  • the details of the restoration intermediate formula 132 will be described later.
  • Pieces of secret partial data 402 are generated (S15). Specifically, as shown in FIG. 6, a restoration matrix that defines an XOR operation for each combination of types of unit divided data 411 (in the example of FIG. 6, three unit divided data 411 of a, b, and c). 131 (restoration matrix 131a in the example of FIG. 6) and a divided data matrix 133a of 9 rows and 1 column whose elements are the divided partial data 412 (a1 to a3, b1 to b3, and c1 to c3 in the example of FIG. 6). By multiplication, six pieces of secret partial data 402 (s1 to s6) each having a length S / 6 are obtained.
  • unit secret data 401 is generated from the six secret partial data 402 (S16). Specifically, as shown in FIG. 6, the secret partial data 402 of s1 to s6 are concatenated to generate unit secret data 401 of length S. Next, the generated unit secret data 401 is linked to the end of the secret data 400 (S17). Specifically, as shown in FIG. 6, the unit secret data 401 having a length S is connected to the end of the secret data 400. If there is no secret data 400 to be linked, the unit secret data 401 itself is set as the secret data 400.
  • the secret data 400 (unit secret data 401 including the secret partial data 402 of s1 to s6) obtained based on the restoration matrix 131 as shown in FIG.
  • the plurality of restoration matrices 131 defined for each type of combination of the unit divided data 411 identified in step S12 are inverse matrices obtained from the portion related to the combination in the divided matrix 111. is there.
  • FIG. 7 is a diagram showing an example of processing for obtaining the restoration matrix 131a used for restoring the secret data 400 from the divided data 410 (a, b, c) from the divided matrix 111.
  • the row corresponding to the divided data 410 (a, b, c) used in the restoration in the divided matrix 111 that is, the corresponding row.
  • Nine rows (shaded portions in the figure) from which the divided portion data 412 (a1 to a3, b1 to b3, c1 to c3) can be obtained are extracted, and 9 rows and 9 columns as shown in the lower left part of FIG. Get the submatrix of.
  • This inverse matrix becomes the restoration matrix 131a.
  • the element value “1” in the partition matrix 111 indicates a bit for determining an element to be XORed instead of the numerical value “1”. Therefore, for example, when the inverse matrix is obtained by using the sweep-out method, the restoration matrix 131 can be obtained by treating it as “1” even when the element value becomes ⁇ 1 by the subtraction process in the procedure. .
  • FIG. 8 is a diagram showing an example of processing for obtaining the restoration matrix 131b used for restoring the secret data 400 from the divided data 410 (a, b, d) from the divided matrix 111.
  • the row corresponding to the divided data 410 (a, b, d) used in the restoration in the divided matrix 111 that is, the divided partial data 412 (a1 to a3
  • Nine rows (shaded portions in the figure) from which b1 to b3 and d1 to d3) can be obtained are extracted to obtain a 9 ⁇ 9 submatrix as shown in the lower left part of FIG.
  • the inverse matrix obtained from this partial matrix is the restoration matrix 131b.
  • FIG. 9 is a diagram showing an example of processing for obtaining the restoration matrix 131c used for restoring the secret data 400 from the divided data 410 (a, c, d) from the divided matrix 111.
  • the row corresponding to the divided data 410 (a, c, d) used in the restoration in the divided matrix 111 that is, the divided partial data 412 (a1 to a3, 9 rows (shaded portions in the figure) from which c1 to c3 and d1 to d3) can be obtained are extracted to obtain a 9 ⁇ 9 submatrix as shown in the lower left part of FIG.
  • the inverse matrix obtained from this partial matrix is the restoration matrix 131c.
  • FIG. 10 is a diagram showing an example of processing for obtaining the restoration matrix 131d used for restoring the secret data 400 from the divided data 410 (b, c, d) from the divided matrix 111.
  • the row corresponding to the divided data 410 (b, c, d) used in the restoration in the divided matrix 111 that is, the divided partial data 412 (b1 to b3, b) corresponding thereto.
  • Nine rows (shaded portions in the figure) from which c1 to c3 and d1 to d3) can be obtained are extracted to obtain a 9 ⁇ 9 submatrix as shown in the lower left part of FIG.
  • the inverse matrix obtained from this partial matrix is the restoration matrix 131d.
  • FIG. 11 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (a1 to a3, b1 to b3, c1 to c3). Similar to FIG. 4 described above, the upper diagram of FIG. 11 schematically shows the contents of the restoration matrix 131a shown in FIG. 7 as a table, and the rows and columns of the table are the restoration matrix shown in FIG. This corresponds to the row / column 131a.
  • five restoration intermediate expressions 132a w1 to w5 are defined, and these are columns in which “1” stands (each in FIG. 11). (Corresponding to the column of the restoration matrix 131a shown in the upper part) represents the calculation of the following equation.
  • the restoration intermediate equation 132a is calculated in advance (the above equations 26 to 30), and the restoration intermediate equation 132a is By using this to execute the XOR operation based on the restoration matrix 131a (formulas 20 ′ to 25 ′ described above), it is possible to increase the efficiency and speed of the processing relating to the XOR operation.
  • FIG. 12 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (a1 to a3, b1 to b3, d1 to d3).
  • the upper diagram of FIG. 12 schematically shows the contents of the restoration matrix 131b shown in FIG. 8 as a table, and the rows and columns of the table correspond to the rows and columns of the restoration matrix 131b shown in FIG. ing.
  • five restoration intermediate expressions 132b of x1 to x5 are defined, and these are columns in which “1” stands (each in FIG. 12). (Corresponding to the column of the restoration matrix 131b shown in the upper part) represents the calculation of the following equation.
  • the formulas (not shown) for obtaining the six secret partial data 402 (s1 to s6) are represented by the following simplified formulas, respectively.
  • FIG. 13 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (a1 to a3, c1 to c3, d1 to d3).
  • the upper diagram of FIG. 13 schematically shows the contents of the restoration matrix 131c shown in FIG. 9 as a table, and the rows and columns of the table correspond to the rows and columns of the restoration matrix 131c shown in FIG. ing.
  • five restoration intermediate expressions 132c from y1 to y5 are defined, and each of these is a column in which “1” stands (see FIG. 13). (Corresponding to the column of the restoration matrix 131c shown in the upper part) represents the calculation of the following equation.
  • multiplication of the restoration matrix 131c and the divided data matrix having the divided partial data 412 (a1 to a3, c1 to c3, d1 to d3) as elements is performed.
  • the formulas (not shown) for obtaining the six secret partial data 402 (s1 to s6) are represented by the following simplified formulas, respectively.
  • FIG. 14 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (b1 to b3, c1 to c3, d1 to d3).
  • the upper diagram of FIG. 14 schematically shows the contents of the restoration matrix 131d shown in FIG. 10 as a table, and the rows and columns of the table correspond to the rows and columns of the restoration matrix 131d shown in FIG. ing.
  • two restoration intermediate expressions 132d z1 to z2 are defined, and each of these is a sequence in which “1” stands (see FIG. 14). (Corresponding to the column of the restoration matrix 131d shown in the upper stage) represents the calculation of the following equation.
  • z1 a1 + a3 Formula 53
  • z2 a2 + b1 Formula 54
  • multiplication of the restoration matrix 131d and the divided data matrix having the divided partial data 412 (b1 to b3, c1 to c3, d1 to d3) as elements is performed.
  • the formulas (not shown) for obtaining the six secret partial data 402 (s1 to s6) are represented by the following simplified formulas, respectively.
  • the adjusted partition matrix 111 and the partition intermediate expression 112, and the restoration matrix 131 and the restoration intermediate expression 132 in the case of using (3, 2, 4) ramp-type threshold secret sharing are specifically described.
  • the partition matrix 111 and the restoration matrix 131 are obtained with the same idea, and the middle of the partition It is possible to reduce the number of XOR operations by defining the expression 112 and the restoration intermediate expression 132, thereby making the processing more efficient and faster.
  • the secret data 400 is converted into the (k, L, n) ramp type threshold value.
  • the data is divided into n pieces of divided data 410 by secret sharing, and these divided data 410 are distributed and stored in different servers 200 or the like.
  • the confidentiality of the secret data 400 against loss, theft, unauthorized acquisition, etc. of the divided data 410 can be improved, and the availability of the secret data 400 against damage, loss, etc. of the divided data 410 can be increased.
  • the size of each of the n pieces of divided data 410 is reduced to 1 / L, and the total data amount is reduced to (k, n ) Reduced to 1 / L compared to threshold secret sharing. This makes it possible to reduce the amount of resources used such as the bandwidth and storage area of the network 300 when transmitting and storing each divided data 410.
  • secret sharing processing is performed by XOR calculation so as to be suitable for bit calculation in a computer. That is, an XOR operation of one or more of the secret partial data 402 obtained by dividing the secret data 400 and one of the random number partial data 403 that is the same length as the secret partial data 402 and half the secret partial data 402 is performed. Based on this, a plurality of divided portion data 412 is generated, and a plurality of divided portion data 412 generated by an XOR operation including different random number portion data 403 is concatenated to generate unit divided data 411 and divided data 400. This makes it possible to increase the efficiency and speed of the secret sharing process.
  • the present invention can be used for a data division apparatus and a data division program used to divide important data into a plurality of non-important data using a secret sharing technique and conceal it.
  • DESCRIPTION OF SYMBOLS 100 Data division
  • Network, 400 Secret data
  • 401 Unit secret data
  • 402 Secret partial data
  • 403 Random number partial data, 410, 410a to d ... Divided data, 411, 411a to d ... Unit divided data, 412 ... Divided partial data.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)

Abstract

Provided is a data dividing device that enables overall optimization and acceleration of XOR calculation when dividing confidential data into n items of divided data using (k, L, n) ramp threshold secret sharing and concealing the same, and when restoring confidential data from at least k divided data items. In this representative embodiment the following are performed: unit confidential data of length S that is extracted from confidential data is divided into a plurality of confidential portion data items, and random number portion data items are generated, the number of items being half the number of confidential portion data items and the length of each item being the same as that of the confidential portion data items; a plurality of divided portion data items are generated on the basis of a divided matrix that defined XOR calculation for generating confidential portion data, random number portion data, and divided portion data from at least one confidential portion data item and one random number portion data item; n types of unit divided data of length S/L are generated by linking a plurality of divided portion data items generated by XOR calculation and including respectively different random number portion data items, and the unit divided data items are linked by type and n items of divided data are generated.

Description

データ分割装置およびデータ分割プログラムData division apparatus and data division program
　本発明は、電子データを秘匿化する技術に関し、特に、重要データを秘密分散技術により複数の非重要データに分割して秘匿化する際のデータ分割装置およびデータ分割プログラムに適用して有効な技術に関するものである。 The present invention relates to a technique for concealing electronic data, and in particular, a technique that is effective when applied to a data division apparatus and a data division program used to divide important data into a plurality of non-important data using a secret sharing technique. It is about.
　情報システムを有する企業等においては、情報漏洩などの情報セキュリティ事故を防止するため、機密性の高いデータなどの重要なデータを保護する手段を講じる必要がある。これに対し、これらを実現するための様々な手段も提案されている。 Companies that have an information system need to take measures to protect important data such as highly confidential data in order to prevent information security incidents such as information leakage. On the other hand, various means for realizing these have been proposed.
　重要データを保護するための手段として、例えば、企業等が重要データをセキュリティ対策が多重に施されたデータセンターに保管することが考えられる。しかしながら、外部からアクセス可能なプライベートなデータセンターを独自に構築・運用するのは技術面・コスト面等で多大な負荷を要し、容易に実現できるものではない。 As a means for protecting important data, for example, it is conceivable that a company or the like stores important data in a data center where multiple security measures are taken. However, the construction and operation of a private data center that can be accessed from the outside requires a great load in terms of technology and cost, and cannot be easily realized.
　これに対して第三者が運用してサービスとして外部に提供しているデータセンターを利用することも考えられる。しかし、第三者が運用管理するデータセンターに自社の重要データを保管することはセキュリティ面で高いリスクが伴う。ましてや近年利用が拡大しているクラウドコンピューティング環境における仮想データセンターや仮想サーバに重要データを保管することは非常にリスクが高いことから、重要データを取り扱う業務を行う情報システムをクラウドコンピューティング環境を利用して構築するということがなかなか普及しない一因ともなっている。 In contrast, it is possible to use a data center that is operated by a third party and provided as a service to the outside. However, storing important company data in a data center operated and managed by a third party involves a high security risk. In addition, storing important data in virtual data centers and virtual servers in cloud computing environments that have been increasingly used in recent years is extremely risky. Using it for construction is also one of the reasons why it is not popular.
　一方、重要データを保管する際に、データを秘匿化したり改竄を防止したりする手段を講じて保管することも行われている。一般的には、暗号鍵を用いて重要データを暗号化して保管することが行われているが、この場合、暗号化されたデータには重要データの情報が全て含まれている。従って、例えば暗号化データが第三者に取得されたような場合、何らかの理由で当該第三者に暗号鍵も取得、解読された場合は容易に重要データが復元されてしまう。また、暗号鍵を取得されなくとも、暗号鍵が有限長であることから、理論上は有限回数の試行によって暗号化されたデータから重要データが復元されてしまう可能性を有する。 On the other hand, when important data is stored, it is also stored by taking measures to conceal the data and prevent falsification. In general, important data is encrypted and stored using an encryption key. In this case, the encrypted data includes all important data information. Therefore, for example, when encrypted data is acquired by a third party, important data is easily restored when the encryption key is also acquired and decrypted by the third party for some reason. Even if the encryption key is not acquired, since the encryption key has a finite length, theoretically, there is a possibility that important data may be restored from the encrypted data after a finite number of trials.
　これに対し、重要データを強固に秘匿化する手法として、いわゆる秘密分散の技術も用いられている。秘密分散では、重要データを、それだけでは意味のない（重要データを復元・推測できない）複数の非重要データに分割・分散することで、一部の非重要データが第三者に取得された場合でも、第三者による重要データの復元を理論上も不可能とすることができる。 On the other hand, so-called secret sharing technology is also used as a method for strongly concealing important data. In secret sharing, important data is divided into a number of non-critical data that cannot be recovered by itself (important data cannot be recovered or guessed), and some non-critical data is obtained by a third party. However, it is theoretically impossible to restore important data by a third party.
　秘密分散の手法としては種々のものが提案されているが、例えば、非特許文献１に記載されているような（ｋ，ｎ）閾値秘密分散の手法が従来から用いられている。（ｋ，ｎ）閾値秘密分散では、秘匿すべき秘密データを、ｎ個の分割データに分割する。このｎ個の分割データのうち、少なくともｋ個（ｋ≦ｎ）以上を集めることにより、これらの分割データから秘密データを復元することができる。一方で、集めた分割データの数がｋ個未満の場合は、これらの分割データから秘密データを復元したり内容を推測したりする（秘密データに関する情報を得る）ことができないというものである。 Various methods have been proposed as secret sharing methods, and for example, a (k, n) threshold secret sharing method described in Non-Patent Document 1 has been used. In (k, n) threshold secret sharing, secret data to be kept secret is divided into n pieces of divided data. By collecting at least k pieces (k ≦ n) or more of the n pieces of divided data, the secret data can be restored from these pieces of divided data. On the other hand, when the number of collected divided data is less than k, it is impossible to restore secret data from these divided data or to infer the contents (to obtain information on the secret data).
　従って、例えばいくつかの分割データが第三者により不正に集められたような場合であっても、その数がｋ個未満である場合には秘密データが復元・推測されることがなく、秘密データを強固に秘匿化することができる。また、例えばいくつかの分割データが毀損・滅失等したような場合であっても、その数が（ｎ－ｋ）個以下である（ｋ個以上の分割データが残っている）場合には秘密データを復元することができるため、秘密データの可用性を高めることもできる。 Therefore, for example, even when some divided data is illegally collected by a third party, if the number is less than k, the secret data is not restored or guessed, Data can be strongly concealed. Further, for example, even when some divided data is damaged or lost, it is a secret if the number is (nk) or less (k or more divided data remains). Since data can be restored, the availability of secret data can also be increased.
　この（ｋ，ｎ）閾値秘密分散の手法では、一般的に、多項式演算や剰余演算を用いて秘密データの分割や復元の演算が行われる。しかしながら、これらの演算をコンピュータでの情報処理によって行う場合、演算負荷が大きくなってしまうため、秘密データのデータ量が大きくなるとＣＰＵ（Central Processing Unit）のリソースを大量に消費し、処理性能が悪化するという問題を有している。これに対し、（ｋ，ｎ）閾値秘密分散の処理を、コンピュータでのビット演算に適したビット単位の排他的論理和（eXclusive OR：以下では「ＸＯＲ」と記載し、「＋」の演算子で表す）演算により実現するという手法も提案されている。 In this (k, n) threshold secret sharing technique, generally, operations for dividing and restoring secret data are performed using polynomial operations and remainder operations. However, when these calculations are performed by information processing on a computer, the calculation load increases. Therefore, if the amount of secret data increases, CPU (Central Processing Unit) resources are consumed in large quantities, and processing performance deteriorates. Have the problem of In contrast, (k, n) threshold secret sharing processing is described as a bitwise exclusive OR (eXclusive OR: hereinafter referred to as “XOR”), and a “+” operator. A method of realizing by calculation is also proposed.
　例えば、特開２０１１－４１３２６号公報（特許文献１）には、元データ（秘密データ）を所定の長さ毎に区切って、複数の元部分データ（秘密部分データ）を生成し、複数の秘密部分データの各々に対応して、秘密データと同じ長さの乱数または秘密データより短い長さの乱数を前記所定の長さ毎に区切って、複数の乱数部分データを生成し、所定の定義式に基づく、秘密部分データと乱数部分データとの排他的論理和演算を行い、複数の分割データを生成することにより、比較的簡単な処理により秘密データを効率的に分割する技術が開示されている。 For example, in Japanese Patent Application Laid-Open No. 2011-41326 (Patent Document 1), a plurality of original partial data (secret partial data) is generated by dividing original data (secret data) into predetermined lengths. Corresponding to each of the partial data, a random number having the same length as the secret data or a random number shorter than the secret data is divided for each predetermined length to generate a plurality of random number partial data, and a predetermined definition formula A technique for efficiently dividing secret data by relatively simple processing by performing exclusive OR operation of secret part data and random number part data based on the above and generating a plurality of divided data .
　さらに、一般的な（ｋ，ｎ）閾値秘密分散の手法では、秘密データのサイズと、秘密分散を行って生成されたｎ個の各分割データのサイズとがそれぞれ同じとなるため、秘密分散を行った後のｎ個の分割データ全体のデータ量は、秘密データのデータ量のｎ倍となってしまい、データを保管する際の記憶容量やネットワーク帯域などのリソースを浪費してしまうという問題も有している。これに対し、実システムでの利用を考慮して、秘密分散によって生成される分割データのデータ量を小さくするための技術も提案されている。 Furthermore, in the general (k, n) threshold secret sharing technique, the size of the secret data is the same as the size of each of the n pieces of divided data generated by performing the secret sharing. The total amount of the n divided data after the execution is n times the data amount of the secret data, and there is a problem that resources such as storage capacity and network bandwidth when storing the data are wasted. Have. On the other hand, a technique for reducing the data amount of divided data generated by secret sharing has been proposed in consideration of use in an actual system.
　例えば、非特許文献２に記載されているような、いわゆるランプ型と呼ばれる（ｋ，Ｌ，ｎ）閾値秘密分散の手法が提案されている。ランプ型の秘密分散法では、データの秘匿性に対する安全性の条件を緩める代わりに、生成されたｎ個の各分割データのサイズをそれぞれ秘密データのサイズの１／Ｌに縮小することができる。すなわち、ｎ個の分割データ全体のデータ量を、（ｋ，ｎ）閾値秘密分散の場合の１／Ｌに縮小することができる。 For example, a so-called ramp type (k, L, n) threshold secret sharing technique as described in Non-Patent Document 2 has been proposed. In the ramp-type secret sharing method, the size of each of the generated n pieces of divided data can be reduced to 1 / L of the size of the secret data, instead of relaxing the security condition for the confidentiality of the data. That is, the data amount of all n pieces of divided data can be reduced to 1 / L in the case of (k, n) threshold secret sharing.
　なお、ランプ型の秘密分散の場合、ｎ個の分割データのうち、少なくともｋ個以上を集めることにより秘密データを復元することができる点は、（ｋ，ｎ）閾値秘密分散の場合と同様である。一方で、集められた分割データの数が（ｋ－Ｌ）個以下（１≦Ｌ≦ｋ）である場合には秘密データが復元・推測されることはないものの、ｋ個未満であっても（ｋ－Ｌ）個より多い数の分割データが集められた場合には、部分的に秘密データの情報が得られてしまうという特性を有し、この点で（ｋ，ｎ）閾値秘密分散とは異なる。なお、Ｌ＝１の場合は、（ｋ，ｎ）閾値秘密分散と同じことになる（いわゆるパーフェクト型）。 In the case of ramp-type secret sharing, the secret data can be restored by collecting at least k of the n divided data, as in the case of (k, n) threshold secret sharing. is there. On the other hand, if the number of collected divided data is (k−L) or less (1 ≦ L ≦ k), the secret data will not be restored / estimated, but even if it is less than k When more than (k−L) pieces of divided data are collected, there is a characteristic that secret data information is partially obtained. In this respect, (k, n) threshold secret sharing and Is different. When L = 1, this is the same as (k, n) threshold secret sharing (so-called perfect type).
特開２０１１－４１３２６号公報JP 2011-41326 A
　近年、ノート型ＰＣ（Personal Computer）やタブレット型ＰＣ、いわゆるスマートフォンなどの携帯可能な情報処理端末が広く利用されるに従って、これらの端末自体の盗難や紛失等に伴う情報漏洩のリスクが高まっている。これに対して、端末内の重要データを含むデータを外部のサーバ等に保管することで端末の紛失等に伴う情報漏洩のリスクを低減することが考えられる。このとき、重要データをそのまま外部のサーバ等に保管するのではなく、例えば、上述した秘密分散の技術を利用して重要データを非重要データに分割・分散して分割データとし、これを外部のサーバ等に分散保管することで、例えば、クラウドコンピューティング環境における仮想データセンターや仮想サーバなどに保管するような場合においても情報漏洩のリスクを低減させることが可能である。 In recent years, as portable information processing terminals such as notebook PCs (Personal Computers), tablet PCs, and so-called smartphones are widely used, the risk of information leakage associated with theft or loss of these terminals themselves has increased. . On the other hand, it is conceivable to reduce the risk of information leakage due to loss of the terminal by storing data including important data in the terminal in an external server or the like. At this time, the important data is not stored in an external server or the like as it is, but for example, the secret data is divided into the non-important data by using the secret sharing technique described above to be divided into non-important data. By distributing and storing in a server or the like, for example, it is possible to reduce the risk of information leakage even when storing in a virtual data center or virtual server in a cloud computing environment.
　しかしながら、これらの携帯端末では、デスクトップ型のＰＣ等に比べて演算処理能力に余裕がないことが通常であり、また、分割データを保管する先のサーバ等にアクセスするためのネットワークについても、無線通信など、帯域幅に余裕がないものであることが多い。従って、秘密分散の処理には、特に効率的かつ高速な処理が求められ、また、生成される分割データのデータ量も小さいものであることが求められる。 However, these mobile terminals usually have less processing power than desktop PCs, and the network for accessing the server or the like for storing the divided data is also wireless. In many cases, such as communication, there is no bandwidth. Therefore, particularly efficient and high-speed processing is required for secret sharing processing, and the amount of divided data to be generated is also required to be small.
　この点、上述の特許文献１に記載された技術では、秘密部分データと乱数部分データとのＸＯＲ演算により複数の分割データを生成することで、処理の効率化・高速化を図るとともに、ランプ型の閾値秘密分散ではないものの、ｎ個の分割データ全体のデータ量を一般的な（ｋ，ｎ）閾値秘密分散法の場合よりも小さくすることが可能である。 In this regard, in the technique described in Patent Document 1 described above, a plurality of pieces of divided data are generated by XOR operation of the secret part data and the random number part data, thereby improving the efficiency and speed of the process and the ramp type. Although it is not the threshold secret sharing, it is possible to make the data amount of the entire n pieces of divided data smaller than in the case of the general (k, n) threshold secret sharing method.
　特許文献１に記載された技術では、ＸＯＲ演算の対象として、複数の秘密部分データの各々に対応して、原則として秘密データと同じ長さの乱数から秘密部分データと同じ長さに区切った秘密部分データと同数の乱数部分データを必要とする。一方で、秘密データより短い長さの乱数に対しては、同様に秘密部分データと同じ長さに区切って乱数部分データを生成した上で、足りない分は既に生成されている乱数部分データを再利用することで、複数の秘密部分データの各々に対応させるものとしている。このとき、生成される分割データの１つを乱数部分データのみからなるようにし、当該分割データを生成する際に、再利用している乱数部分データの保持を省略して重複を回避することで、乱数部分データのみからなる分割データのデータ量を小さくすることを可能とする。 In the technique described in Patent Document 1, as a target of XOR operation, in principle, a secret random number having the same length as that of the secret data is divided into the same length as that of the secret data corresponding to each of the plurality of secret data. The same number of random number partial data as the partial data is required. On the other hand, for random numbers with a length shorter than that of the secret data, similarly generate the random number partial data by dividing it into the same length as the secret partial data. By reusing it, each of the plurality of secret partial data is made to correspond. At this time, one of the generated divided data is made up of only the random number partial data, and when the divided data is generated, the holding of the reused random number partial data is omitted to avoid duplication. This makes it possible to reduce the data amount of the divided data composed only of the random number partial data.
　しかしながら、特許文献１に記載された手法では、ｎ個の分割データ全体でのデータ量は小さくなるものの、実際にサイズが小さくなるのは乱数部分データのみからなる１つの分割データのみであり、他の分割データのサイズは秘密データと同じサイズとなる。従って、全体でのデータ量の縮小効果はそれほど大きくならず、また、他の分割データについては送信・保管する際のリソースの消費量が全く削減されないことになる。また、乱数部分データのみからなる分割データがサイズから識別可能となってしまうというリスクが生じるなど、実システムでの利用に際しては課題を有する。 However, in the method described in Patent Document 1, although the data amount of the entire n pieces of divided data is reduced, the size is actually reduced only by one piece of divided data consisting only of random number partial data. The size of the divided data is the same as that of the secret data. Therefore, the effect of reducing the overall data amount is not so great, and the consumption of resources when transmitting and storing other divided data is not reduced at all. In addition, there is a problem in use in an actual system, for example, there is a risk that the divided data consisting only of random number partial data can be identified from the size.
　一方で、上述したランプ型の（ｋ，Ｌ，ｎ）閾値秘密分散の手法によれば、安全性の条件は若干緩められるものの、ｎ個の各分割データのサイズを１／Ｌに縮小して、全体でのデータ量を１／Ｌに縮小することができる。また、実際の演算処理についても、秘密データを分割したデータと乱数とのＸＯＲ演算とすることにより、コンピュータでの演算処理による分割データの生成を効率化・高速化する手法が提案されている。 On the other hand, according to the ramp-type (k, L, n) threshold secret sharing technique described above, the security condition is slightly relaxed, but the size of each of the n pieces of divided data is reduced to 1 / L. The total data amount can be reduced to 1 / L. As for the actual arithmetic processing, a method has been proposed in which the XOR operation of data obtained by dividing secret data and random numbers is used to increase the efficiency and speed of generation of divided data by arithmetic processing in a computer.
　しかしながら、ＸＯＲ演算により（ｋ，Ｌ，ｎ）閾値秘密分散を行う際の具体的な計算方法（実際の計算式）としては種々のものが考えられ、計算式次第で処理性能は大きく変わる。また、秘密データから秘密分散により分割データを生成する際の処理性能だけでなく、複数の分割データから秘密データを復元する際の処理性能についても合わせて、全体としての処理の効率化・高速化が求められる。 However, there are various concrete calculation methods (actual calculation formulas) for performing (k, L, n) threshold secret sharing by XOR operation, and the processing performance varies greatly depending on the calculation formula. Also, not only the processing performance when generating divided data from secret data by secret sharing, but also the processing performance when restoring secret data from multiple divided data, the overall efficiency and speed of processing Is required.
　そこで本発明の目的は、秘密データを（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散によりｎ個の分割データに分割して秘匿化する際、およびｋ個以上の分割データから（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散により秘密データを復元する際のＸＯＲ演算の処理を全体として効率化および高速化することを可能とするデータ分割装置およびデータ分割プログラムを提供することにある。本発明の前記ならびにその他の目的と新規な特徴は、本明細書の記述および添付図面から明らかになるであろう。 Therefore, an object of the present invention is to conceal secret data by dividing it into n pieces of divided data by (k, L, n) ramp type threshold secret sharing, and from (k, L, n, n) To provide a data division apparatus and a data division program that can improve the efficiency and speed of the XOR operation when restoring secret data by ramp-type threshold secret sharing. The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.
　本願において開示される発明のうち、代表的なものの概要を簡単に説明すれば、以下のとおりである。 Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
　本発明の代表的な実施の形態によるデータ分割装置は、秘密データを（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散によりｎ個の分割データに分割して、ｎ個の前記分割データをそれぞれ異なる記憶装置に分散保管するデータ分割装置であって、以下の特徴を有するものである。 The data dividing apparatus according to the exemplary embodiment of the present invention divides secret data into n pieces of divided data by (k, L, n) ramp type threshold secret sharing, and the n pieces of divided data are different from each other. A data dividing device for distributed storage in a storage device, which has the following characteristics.
　すなわち、データ分割装置は、前記秘密データから抽出した長さＳの単位秘密データを複数の秘密部分データに分割し、前記秘密部分データと同じ長さで、前記秘密部分データの数の半数の乱数部分データを生成し、前記秘密部分データ、前記乱数部分データ、および前記秘密部分データのうちの１個以上と前記乱数部分データのうちの１個から分割部分データを生成するためのＸＯＲ演算を定義した分割行列に基づいて、複数の前記分割部分データを生成し、それぞれ異なる前記乱数部分データを含むＸＯＲ演算により生成された複数の前記分割部分データを連結してｎ種類の長さＳ／Ｌの単位分割データを生成し、前記単位分割データを種類毎に連結してｎ個の分割データを生成する分割処理部を有することを特徴とする。 That is, the data dividing device divides the unit secret data of length S extracted from the secret data into a plurality of secret part data, and is a random number that is the same length as the secret part data and half the number of the secret part data Generate partial data and define an XOR operation for generating divided partial data from one or more of the secret part data, the random part data, and one or more of the secret part data and the random part data Based on the divided matrix, a plurality of the divided partial data are generated, and the plurality of divided partial data generated by the XOR operation including the different random number partial data are concatenated to obtain n types of length S / L. A division processing unit that generates unit divided data and generates n pieces of divided data by connecting the unit divided data for each type is provided.
　また、本発明は、コンピュータを上記のようなデータ分割装置として機能させるプログラムにも適用することができる。 The present invention can also be applied to a program that causes a computer to function as the above-described data dividing device.
　本願において開示される発明のうち、代表的なものによって得られる効果を簡単に説明すれば以下のとおりである。 Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.
　本発明の代表的な実施の形態によれば、秘密データを（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散によりｎ個の分割データに分割して秘匿化する際、およびｋ個以上の分割データから（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散により秘密データを復元する際のＸＯＲ演算の処理を全体として効率化および高速化することが可能となる。 According to a typical embodiment of the present invention, when secret data is concealed by dividing it into n pieces of divided data by (k, L, n) ramp-type threshold secret sharing, and k or more pieces of divided data From (k, L, n) ramp type threshold secret sharing, it is possible to improve the efficiency and speed of the XOR operation processing when restoring secret data as a whole.
本発明の一実施の形態であるデータ分割装置の構成例について概要を示した図である。It is the figure which showed the outline | summary about the structural example of the data division | segmentation apparatus which is one embodiment of this invention. 本発明の一実施の形態における秘密データから秘密分散により分割データを生成する分割処理の流れの例について概要を示したフローチャートである。It is the flowchart which showed the outline | summary about the example of the flow of the division | segmentation process which produces | generates division | segmentation data by secret sharing from the secret data in one embodiment of this invention. 本発明の一実施の形態における秘密データから（３，２，４）ランプ型閾値秘密分散により４つの分割データを生成する処理の例について概要を示した図である。It is the figure which showed the outline | summary about the example of the process which produces | generates four division | segmentation data by (3,2,4) ramp type | mold threshold value secret sharing from the secret data in one embodiment of this invention. 本発明の一実施の形態における秘密部分データと乱数部分データから分割部分データを算出する際の例について概要を示した図である。It is the figure which showed the outline | summary about the example at the time of calculating divided | segmented partial data from the secret partial data and random number partial data in one embodiment of this invention. 本発明の一実施の形態における分割データから秘密分散により秘密データを生成する復元処理の流れの例について概要を示したフローチャートである。It is the flowchart which showed the outline | summary about the example of the flow of the decompression | restoration process which produces | generates secret data from division | segmentation data in one embodiment of this invention by secret sharing. 本発明の一実施の形態における３つの分割データから（３，２，４）ランプ型閾値秘密分散により秘密データを生成する処理の例について概要を示した図である。It is the figure which showed the outline | summary about the example of the process which produces | generates secret data by (3, 2, 4) ramp type | mold threshold value secret sharing from three division | segmentation data in one embodiment of this invention. 本発明の一実施の形態における分割データ（ａ、ｂ、ｃ）から秘密データを復元するために用いる復元行列を分割行列から得る処理の例を示した図である。It is the figure which showed the example of the process which acquires the decompression | restoration matrix used in order to decompress | restore secret data from the division | segmentation data (a, b, c) in one embodiment of this invention from a division | segmentation matrix. 本発明の一実施の形態における分割データ（ａ、ｂ、ｄ）から秘密データを復元するために用いる復元行列を分割行列から得る処理の例を示した図である。It is the figure which showed the example of the process which acquires the decompression | restoration matrix used in order to decompress | restore secret data from the division | segmentation data (a, b, d) in one embodiment of this invention from a division | segmentation matrix. 本発明の一実施の形態における分割データ（ａ、ｃ、ｄ）から秘密データを復元するために用いる復元行列を分割行列から得る処理の例を示した図である。It is the figure which showed the example of the process which acquires the decompression | restoration matrix used in order to decompress | restore secret data from the division | segmentation data (a, c, d) in one embodiment of this invention from a division | segmentation matrix. 本発明の一実施の形態における分割データ（ｂ、ｃ、ｄ）から秘密データを復元するために用いる復元行列を分割行列から得る処理の例を示した図である。It is the figure which showed the example of the process which acquires the decompression | restoration matrix used in order to decompress | restore secret data from the division | segmentation data (b, c, d) in one embodiment of this invention from a division | segmentation matrix. 本発明の一実施の形態における分割部分データ（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３）から秘密部分データを算出する際の例について概要を示した図である。It is the figure which showed the outline | summary about the example at the time of calculating secret partial data from the division | segmentation partial data (a1-a3, b1-b3, c1-c3) in one embodiment of this invention. 本発明の一実施の形態における分割部分データ（ａ１～ａ３、ｂ１～ｂ３、ｄ１～ｄ３）から秘密部分データを算出する際の例について概要を示した図である。It is the figure which showed the outline | summary about the example at the time of calculating secret partial data from the division | segmentation partial data (a1-a3, b1-b3, d1-d3) in one embodiment of this invention. 本発明の一実施の形態における分割部分データ（ａ１～ａ３、ｃ１～ｃ３、ｄ１～ｄ３）から秘密部分データを算出する際の例について概要を示した図である。It is the figure which showed the outline | summary about the example at the time of calculating secret partial data from the division | segmentation partial data (a1-a3, c1-c3, d1-d3) in one embodiment of this invention. 本発明の一実施の形態における分割部分データ（ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）から秘密部分データを算出する際の例について概要を示した図である。It is the figure which showed the outline | summary about the example at the time of calculating secret partial data from the division | segmentation partial data (b1-b3, c1-c3, d1-d3) in one embodiment of this invention.
　以下、本発明の実施の形態を図面に基づいて詳細に説明する。なお、実施の形態を説明するための全図において、同一部には原則として同一の符号を付し、その繰り返しの説明は省略する。 Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.
　本発明の一実施の形態であるデータ分割装置は、秘密データを（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散によりｎ個の分割データに分割して、これらの分割データをそれぞれ異なるサーバ等の記憶装置に分散保管するものである。これにより、分割データの紛失・盗難・不正取得等に対する秘密データの秘匿性を高めるとともに、分割データの毀損・滅失等に対する秘密データの可用性を高めることを可能とする。また、ランプ型の秘密分散を用いることから、安全性の条件は若干緩められるものの、ｎ個の各分割データのサイズを１／Ｌに縮小して、全体でのデータ量を（ｋ，ｎ）閾値秘密分散の場合と比べて１／Ｌに縮小する。これにより、各分割データを送信・保管する際のネットワーク帯域や記憶領域などのリソース使用量を低減させる。 A data dividing device according to an embodiment of the present invention divides secret data into n pieces of divided data by (k, L, n) ramp type threshold secret sharing, and these divided data are respectively sent to different servers or the like. The data is stored in a storage device in a distributed manner. As a result, it is possible to improve the confidentiality of the secret data against loss, theft, illegal acquisition, etc. of the divided data, and to increase the availability of the secret data against damage, loss, etc. of the divided data. In addition, since the ramp-type secret sharing is used, although the security condition is slightly relaxed, the size of each of the n pieces of divided data is reduced to 1 / L, and the total data amount is (k, n). Compared to the threshold secret sharing case, it is reduced to 1 / L. This reduces the amount of resources used such as network bandwidth and storage area when transmitting and storing each divided data.
　また、本実施の形態では、（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散において、処理を効率化・高速化してＣＰＵリソースの使用量を低減させるため、公知の技術と同様に、コンピュータでのビット演算に適するよう、秘密データを分割した秘密部分データと、これと同じ長さの乱数部分データとのＸＯＲ演算に基づいて分割データを生成する。さらに、本実施の形態では、具体的に、（３，２，４）ランプ型閾値秘密分散において、ＸＯＲ演算を行うための計算式および計算手順を調整して、秘密データから秘密分散により複数の分割データを生成する際、および複数の分割データから秘密データを復元する際の処理性能を全体として向上させる。 In the present embodiment, in (k, L, n) ramp type threshold secret sharing, in order to reduce the amount of CPU resources used by increasing the efficiency and speed of processing, as with known techniques, The divided data is generated based on the XOR operation of the secret partial data obtained by dividing the secret data and the random number partial data having the same length as that suitable for the bit operation. Furthermore, in the present embodiment, specifically, in (3, 2, 4) ramp-type threshold secret sharing, a calculation formula and a calculation procedure for performing an XOR operation are adjusted, and a plurality of secret sharing is performed from secret data. The overall processing performance is improved when generating divided data and when restoring secret data from a plurality of divided data.
　＜システム構成＞
　図１は、本発明の一実施の形態であるデータ分割装置の構成例について概要を示した図である。データ分割装置１００は、例えば、ユーザが利用するＰＣや携帯端末などの情報処理端末、もしくはこれら複数の情報処理端末が接続されるファイルサーバ等、ユーザにより秘密分散の対象の秘密データ４００が作成され、もしくはこれを保持する一般的なコンピュータ機器からなる。 <System configuration>
FIG. 1 is a diagram showing an outline of a configuration example of a data dividing apparatus according to an embodiment of the present invention. In the data dividing apparatus 100, for example, secret data 400 that is a target of secret sharing is created by the user, such as an information processing terminal such as a PC or a mobile terminal used by the user, or a file server to which the plurality of information processing terminals are connected. Or a general computer device holding the same.
　データ分割装置１００は、インターネット等のネットワーク３００を介して複数のサーバ２００に接続可能となっている。サーバ２００の数は、（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散におけるｎ個（本実施の形態では（３，２，４）ランプ型閾値秘密分散であるため４個）以上であることが望ましい。これらのサーバ２００は、それぞれ、データ分割装置１００によって秘密データ４００から秘密分散により生成されネットワーク３００を介して送信されてきた分割データ４１０を、ＨＤＤ（Hard Disk Drive）等の記憶装置に保管することができるファイルサーバやストレージ機器等からなる。 The data dividing apparatus 100 can be connected to a plurality of servers 200 via a network 300 such as the Internet. The number of servers 200 may be n or more in the (k, L, n) ramp-type threshold secret sharing (four in this embodiment because it is (3, 2, 4) ramp-type threshold secret sharing). desirable. Each of these servers 200 stores the divided data 410 generated by secret sharing from the secret data 400 by the data dividing device 100 and transmitted via the network 300 in a storage device such as an HDD (Hard Disk Drive). It consists of file servers, storage devices, etc.
　データ分割装置１００は、上述した機能を実現するため、例えば、図示しないＯＳ（Operating System）上で稼働するソフトウェアプログラムとして実装される分割処理部１１０、分散管理部１２０、復元処理部１３０、およびインタフェース部１４０などの各部を有する。 In order to realize the above-described functions, the data dividing device 100 is implemented by, for example, a division processing unit 110, a distribution management unit 120, a restoration processing unit 130, and an interface implemented as a software program that runs on an OS (Operating System) (not shown). Each part such as the part 140 is included.
　分割処理部１１０は、例えば、後述するインタフェース部１４０を介してユーザからセキュアな保管を指示された秘密データ４００から、後述するＸＯＲによる演算式を定義した分割行列１１１、および分割中間式１１２に基づいて、所定の手順に従って（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散（本実施の形態では（３，２，４）ランプ型閾値秘密分散）により各サーバ２００に分散保管するｎ個（本実施の形態では４個）の分割データ４１０を生成する。また、上記のＸＯＲによる演算の際に用いる乱数を生成する乱数生成部１１３を有する。なお、乱数生成の手法は特に限定されず、所定の長さ以上の乱数を生成することができるものであれば、任意の公知の技術を用いることができる。 The division processing unit 110 is based on, for example, a division matrix 111 that defines an arithmetic expression by XOR described later and a divided intermediate expression 112 from secret data 400 instructed to be securely stored by a user via an interface unit 140 described later. Then, according to a predetermined procedure, (k, L, n) ramp-type threshold secret sharing (in this embodiment, (3, 2, 4) ramp-type threshold secret sharing) is distributed to n servers 200 (this embodiment) In this embodiment, four pieces of divided data 410 are generated. Further, it has a random number generation unit 113 that generates a random number used in the above-described XOR calculation. The random number generation method is not particularly limited, and any known technique can be used as long as it can generate a random number having a predetermined length or more.
　分散管理部１２０は、例えば、分割処理部１１０により秘密データ４００から生成された各分割データ４１０について、設定情報１２２の設定内容に基づく所定の条件に従って各サーバ２００に送信して分散保管するとともに、各分割データ４１０がいずれのサーバ２００に保管されているかの対応に係る情報を分散状況１２１に記録して管理する。設定情報１２２には、例えば、分散保管先となる各サーバ２００に対するアクセス情報（ＩＰアドレスやホスト名等）、ｎ個（本実施の形態では４個）より多数のサーバ２００が存在する場合にｎ個のサーバ２００を選択するための基準や条件（例えばサーバ２００の優先順位や順序付けされたリスト、ローテーションする際の方法等）などを予め設定しておくことができる。 The distribution management unit 120 transmits, for example, each divided data 410 generated from the secret data 400 by the division processing unit 110 to each server 200 according to a predetermined condition based on the setting content of the setting information 122 and stores the divided data. Information relating to which server 200 stores each piece of divided data 410 is recorded in the distribution status 121 and managed. The setting information 122 includes, for example, access information (IP address, host name, etc.) for each server 200 serving as a distributed storage destination, and when there are more servers 200 than n (four in this embodiment), n Criteria and conditions for selecting individual servers 200 (for example, priority order of servers 200, an ordered list, a rotation method, and the like) can be set in advance.
　また、分散管理部１２０は、後述する復元処理部１３０による秘密データ４００の復元の際に、復元処理部１３０からの要求に基づいて、分散状況１２１の内容、および設定情報１２２の設定内容に基づく所定の条件に従って、各サーバ２００から、秘密データ４００を復元するためのｍ個の分割データ４１０を収集して復元処理部１３０に受け渡す。 Also, the distribution management unit 120 is based on the content of the distribution status 121 and the setting content of the setting information 122 based on a request from the restoration processing unit 130 when the restoration processing unit 130 described below restores the secret data 400. In accordance with a predetermined condition, m pieces of divided data 410 for restoring the secret data 400 are collected from each server 200 and transferred to the restoration processing unit 130.
　なお、収集する分割データ４１０の個数ｍの値は、秘密データ４００を復元するために必要な分割データ４１０の数ｋ以上である必要があり、また、ｎ個全ての分割データ４１０を収集するものとしてもよい（すなわちｋ≦ｍ≦ｎ。本実施の形態ではｍ＝３もしくは４）。設定情報１２２には、例えば、ｍの値や、ｍ＜ｎである場合に、対象となるｍ個のサーバ２００を選択するための基準や条件、障害等により対象のサーバ２００から分割データ４１０を取得できなかった場合の代替となるサーバ２００の決定方法などを予め設定しておくことができる。 The number m of the divided data 410 to be collected must be equal to or more than the number k of the divided data 410 necessary for restoring the secret data 400, and all n pieces of divided data 410 are collected. (That is, k ≦ m ≦ n. In this embodiment, m = 3 or 4). In the setting information 122, for example, when m is m or m <n, the divided data 410 is stored from the target server 200 according to the criteria, conditions, failure, and the like for selecting the target m servers 200. It is possible to set in advance a method for determining the server 200 as an alternative in the case where acquisition is not possible.
　なお、サーバ２００の障害等により、分割データ４１０の分散保管時にｎ個の分割データ４１０のうちいずれかを各サーバ２００に保管できなかった場合や、分割データ４１０の収集時にｋ個以上収集できなかった場合は、ユーザに対してエラーを応答するようにしてもよい。また、各サーバ２００との間で分割データ４１０の送受信を行う際に、データ分割装置１００および各サーバ２００がそれぞれ分割データ４１０に対して所定の暗号化を施した上で送受信することで、情報漏洩のリスクをさらに低減させるようにしてもよい。 If any of the n pieces of divided data 410 cannot be stored in each server 200 when the divided data 410 is distributed and stored due to a failure of the server 200, or more than k pieces cannot be collected when the divided data 410 is collected. In such a case, an error may be returned to the user. In addition, when the divided data 410 is transmitted / received to / from each server 200, the data dividing apparatus 100 and each server 200 transmit / receive the information after performing predetermined encryption on the divided data 410, respectively. The risk of leakage may be further reduced.
　復元処理部１３０は、例えば、インタフェース部１４０を介してユーザから参照や編集等の利用を指示された秘密データ４００について、これを復元するために必要な数以上の分割データ４１０を分散管理部１２０に要求して取得する。さらに、取得した分割データ４１０から、後述するＸＯＲによる演算式を定義した復元行列１３１、および復元中間式１３２に基づいて、所定の手順に従って（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散（本実施の形態では（３，２，４）ランプ型閾値秘密分散）により秘密データ４００を復元する。 For example, for the secret data 400 that is instructed to be used for reference or editing by the user via the interface unit 140, the restoration processing unit 130 divides the divided data 410 more than the number necessary for restoring the secret data 400. Request to get. Furthermore, from the acquired divided data 410, (k, L, n) ramp-type threshold secret sharing (this embodiment) is performed according to a predetermined procedure based on a restoration matrix 131 that defines an arithmetic expression by XOR described later and a restoration intermediate expression 132. In the embodiment, the secret data 400 is restored by (3, 2, 4) ramp-type threshold secret sharing).
　インタフェース部１４０は、データ分割装置１００（もしくはデータ分割装置１００に対する図示しないクライアント端末）における画面表示等のユーザインタフェースやデータの送受信などの入出力機能を有する。ユーザは、例えば、一般的なＯＳが有するファイル管理用の画面等を利用して、データ分割装置１００の機能を利用することができる。 The interface unit 140 has a user interface such as a screen display in the data dividing apparatus 100 (or a client terminal (not shown) for the data dividing apparatus 100) and an input / output function such as data transmission / reception. The user can use the functions of the data dividing apparatus 100 by using, for example, a file management screen of a general OS.
　例えば、ファイル管理用の画面においてユーザが重要データを特定のフォルダ等にドラッグ＆ドロップなどの簡易な操作により移動する。これをトリガとして、分割処理部１１０および分散管理部１２０によって、自動的に当該重要データを秘密データ４００としてｎ個（本実施の形態では４個）の分割データ４１０を生成し、各分割データ４１０をユーザに意識させずに各サーバ２００に分散保管することができる。なお、このとき秘密データ４００はデータ分割装置１００（およびデータ分割装置１００に対するユーザのクライアント端末）から削除するが、ファイル管理用の画面上では、ユーザに意識させないよう、例えば、秘密データ４００に対応するダミーファイル等を作成して残しておく。 For example, on the file management screen, the user moves important data to a specific folder or the like by a simple operation such as drag and drop. With this as a trigger, the division processing unit 110 and the distribution management unit 120 automatically generate n pieces of divided data 410 (four pieces in the present embodiment) using the important data as secret data 400, and each piece of divided data 410 Can be distributed and stored in each server 200 without making the user aware of the above. At this time, the secret data 400 is deleted from the data dividing device 100 (and the user's client terminal for the data dividing device 100). However, for example, the secret data 400 corresponds to the secret data 400 so that the user is not conscious on the file management screen. Create and keep a dummy file etc.
　また、例えば、ユーザは、ファイル管理用の画面において特定のフォルダにて管理されている秘密データ４００のダミーファイル等に対して操作を行うことで、秘密データ４００に対する参照や編集等の操作を行うことができる。すなわち、ダミーファイル等に対する操作をトリガとして、分散管理部１２０および復元処理部１３０によって、ダミーファイル等に対応する秘密データ４００について、自動的に各サーバ２００からｍ個（ｋ≦ｍ≦ｎ、本実施の形態では３個もしくは４個）の分割データ４１０を収集し、秘密データ４００を復元してユーザに利用可能とすることができる。 Further, for example, the user performs operations such as reference and editing of the secret data 400 by operating the dummy file of the secret data 400 managed in a specific folder on the file management screen. be able to. That is, with the operation on the dummy file or the like as a trigger, the distributed management unit 120 and the restoration processing unit 130 automatically set m secret data 400 corresponding to the dummy file or the like from each server 200 (k ≦ m ≦ n, book In the embodiment, three or four pieces of divided data 410 are collected, and the secret data 400 can be restored and made available to the user.
　＜処理フロー（分割処理）＞
　図２は、データ分割装置１００の分割処理部１１０における、秘密データ４００から秘密分散により分割データ４１０を生成する分割処理の流れの例について概要を示したフローチャートである。なお、本実施の形態では、上述したように、（３，２，４）ランプ型閾値秘密分散により秘密分散処理を行うものとする。また、図３は、秘密データ４００から（３，２，４）ランプ型閾値秘密分散により４個の分割データ４１０を生成する処理の例について概要を示した図である。 <Processing flow (split processing)>
FIG. 2 is a flowchart showing an outline of an example of a flow of division processing for generating the division data 410 from the secret data 400 by secret sharing in the division processing unit 110 of the data division device 100. In the present embodiment, as described above, secret sharing processing is performed by (3, 2, 4) ramp-type threshold secret sharing. FIG. 3 is a diagram showing an outline of an example of processing for generating four pieces of divided data 410 from the secret data 400 by (3, 2, 4) ramp-type threshold secret sharing.
　インタフェース部１４０を介してユーザから秘密分散の対象となる重要データが指定されると、分割処理部１１０は、まず、当該重要データを秘密データ４００とし、秘密データ４００の先頭から所定の長さＳの単位秘密データを抽出する（Ｓ０１）。この単位秘密データは、ＸＯＲ演算による秘密分散処理を行う際の処理単位となるデータであり、本実施の形態では、長さＳは６の倍数ビットの任意の長さであるものとする。なお、秘密データ４００の長さがＳに満たない場合は、例えば、秘密データ４００に対してＳに満たない分をゼロ等の所定のデータでパディングして長さＳの単位秘密データを得るものとする。 When the important data to be secret shared is designated by the user via the interface unit 140, the division processing unit 110 first sets the important data as the secret data 400, and has a predetermined length S from the top of the secret data 400. The unit secret data is extracted (S01). This unit secret data is data that becomes a processing unit when performing secret sharing processing by XOR operation, and in the present embodiment, the length S is an arbitrary length of multiple bits of 6. In addition, when the length of the secret data 400 is less than S, for example, the secret data 400 is padded with predetermined data such as zero to obtain the unit secret data of length S for the less than S And
　次に、抽出した単位秘密データ４０１を分割して秘密部分データを６個生成する（Ｓ０２）。具体的には、図３に示すように、秘密データ４００から抽出した長さＳの単位秘密データ４０１を６等分して、長さＳ／６の秘密部分データ４０２を６個（ｓ１～ｓ６）生成する。 Next, the extracted unit secret data 401 is divided to generate six secret partial data (S02). Specifically, as shown in FIG. 3, the unit secret data 401 of length S extracted from the secret data 400 is divided into six equal parts, and six pieces of secret partial data 402 of length S / 6 (s1 to s6). ) Generate.
　さらに、乱数生成部１１３により、秘密部分データ４０２と同じ長さ（Ｓ／６）の乱数部分データ４０３を秘密部分データ４０２の数の半数である３個生成する（Ｓ０３）。具体的には、図３に示すように、秘密部分データ４０２と同じ長さＳ／６の乱数部分データ４０３を３個（ｒ１～ｒ３）生成する。乱数部分データ４０３の生成に際しては、例えば、乱数生成部１１３がｒ１～ｒ３の３個をそれぞれ個別に生成してもよいし、乱数生成部１１３がＳ／２より長い乱数を１個生成して、分割処理部１１０がこれを区切ってＳ／６の長さの乱数を３個抽出するようにしてもよい。 Furthermore, the random number generation unit 113 generates three random number partial data 403 having the same length (S / 6) as the secret partial data 402, which is half the number of the secret partial data 402 (S03). Specifically, as shown in FIG. 3, three pieces (r1 to r3) of random number partial data 403 having the same length S / 6 as the secret partial data 402 are generated. When generating the random number partial data 403, for example, the random number generation unit 113 may individually generate three of r1 to r3, or the random number generation unit 113 generates one random number longer than S / 2. The division processing unit 110 may divide this and extract three random numbers having a length of S / 6.
　次に、後述する分割部分データを生成するためのＸＯＲ演算を行う際に用いるために予め定義された複数の分割中間式１１２のそれぞれについて、秘密部分データ４０２（ｓ１～ｓ６）と乱数部分データ４０３（ｒ１～ｒ３）に基づいてＸＯＲ演算を行って値を算出しておく（Ｓ０４）。この分割中間式１１２は、後述する分割部分データを生成するためのＸＯＲ演算の全体において、複数回繰り返し現れるＸＯＲ演算の式を分割中間式１１２として抽出したものである。この分割中間式１１２の値を予め計算して保持しておき、後述する分割行列１１１に基づくＸＯＲ演算の際に計算結果を利用することで、内容が重複するＸＯＲ演算を極力廃し、処理の効率化・高速化を図る。なお、分割中間式１１２の詳細については後述する。 Next, the secret part data 402 (s1 to s6) and the random number part data 403 for each of the plurality of divided intermediate expressions 112 that are defined in advance for use in performing an XOR operation for generating divided part data, which will be described later. A value is calculated by performing an XOR operation based on (r1 to r3) (S04). This divided intermediate expression 112 is obtained by extracting an XOR operation expression that repeatedly appears a plurality of times as the divided intermediate expression 112 in the entire XOR operation for generating divided partial data described later. The value of the divided intermediate expression 112 is calculated and held in advance, and the calculation result is used in the XOR operation based on the divided matrix 111, which will be described later. To increase speed and speed. Details of the divided intermediate expression 112 will be described later.
　次に、秘密部分データ４０２（ｓ１～ｓ６）と乱数部分データ４０３（ｒ１～ｒ３）に基づいて、分割行列１１１に定義された内容に基づいてＸＯＲ演算を行い、１２個の分割部分データ４１２を生成する（Ｓ０５）。具体的には、図３に示すように、ＸＯＲ演算を定義した分割行列１１１と、乱数部分データ４０３（ｒ１～ｒ３）および秘密部分データ４０２（ｓ１～ｓ６）を要素とする９行１列の秘密データ行列１１４との乗算によって、それぞれが長さＳ／６の１２個の分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）を得る。 Next, based on the secret part data 402 (s1 to s6) and the random number part data 403 (r1 to r3), an XOR operation is performed based on the contents defined in the partition matrix 111, and the twelve divided part data 412 are obtained. Generate (S05). Specifically, as shown in FIG. 3, a 9 × 1 matrix including a partition matrix 111 defining an XOR operation, random number partial data 403 (r1 to r3), and secret partial data 402 (s1 to s6). By multiplying with the secret data matrix 114, 12 divided partial data 412 (a1 to a3, b1 to b3, c1 to c3, d1 to d3) each having a length S / 6 are obtained.
　すなわち、分割行列１１１と秘密データ行列１１４との乗算によって得られる以下の各式によって１２個の分割部分データ４１２を得る。 That is, 12 divided partial data 412 are obtained by the following equations obtained by multiplication of the divided matrix 111 and the secret data matrix 114.
　　ａ１＝ｒ１＋ｓ１＋ｓ２　　　　　　　　　　…式１
　　ａ２＝ｒ２＋ｓ３＋ｓ４　　　　　　　　　　…式２
　　ａ３＝ｒ３＋ｓ５＋ｓ６　　　　　　　　　　…式３
　　ｂ１＝ｒ１＋ｓ３＋ｓ５　　　　　　　　　　…式４
　　ｂ２＝ｒ２＋ｓ１＋ｓ３＋ｓ５＋ｓ６　　　　…式５
　　ｂ３＝ｒ３＋ｓ２＋ｓ４＋ｓ６　　　　　　　…式６
　　ｃ１＝ｒ１＋ｓ３＋ｓ４＋ｓ６　　　　　　　…式７
　　ｃ２＝ｒ２＋ｓ２＋ｓ３＋ｓ４＋ｓ５　　　　…式８
　　ｃ３＝ｒ３＋ｓ１＋ｓ３＋ｓ３＋ｓ５＋ｓ６　…式９
　　ｄ１＝ｒ１＋ｓ１＋ｓ２＋ｓ３＋ｓ５　　　　…式１０
　　ｄ２＝ｒ２＋ｓ１＋ｓ４＋ｓ５＋ｓ６　　　　…式１１
　　ｄ３＝ｒ３＋ｓ２＋ｓ４＋ｓ５　　　　　　　…式１２
　なお、上記各式における演算子の“＋”はＸＯＲを意味する。また、実際の計算の際には、後述するように、上記各式において各分割中間式１１２と一致するＸＯＲ演算の部分に、ステップＳ０４で予め計算しておいた各分割中間式１１２の値を代入することで、全体でのＸＯＲ演算の数を低減させる。 a1 = r1 + s1 + s2 Formula 1
a2 = r2 + s3 + s4 Formula 2
a3 = r3 + s5 + s6 Formula 3
b1 = r1 + s3 + s5 Formula 4
b2 = r2 + s1 + s3 + s5 + s6 Formula 5
b3 = r3 + s2 + s4 + s6 Formula 6
c1 = r1 + s3 + s4 + s6 Equation 7
c2 = r2 + s2 + s3 + s4 + s5 Equation 8
c3 = r3 + s1 + s3 + s3 + s5 + s6 Formula 9
d1 = r1 + s1 + s2 + s3 + s5 Equation 10
d2 = r2 + s1 + s4 + s5 + s6 Formula 11
d3 = r3 + s2 + s4 + s5 Equation 12
In addition, "+" of the operator in each of the above expressions means XOR. In the actual calculation, as described later, the value of each divided intermediate expression 112 calculated in advance in step S04 is added to the portion of the XOR operation that coincides with each divided intermediate expression 112 in each of the above expressions. By substituting, the total number of XOR operations is reduced.
　次に、１２個の分割部分データ４１２から４個（４種類）の単位分割データを生成する（Ｓ０６）。具体的には、図３に示すように、ａ１～ａ３の分割部分データ４１２を連結して、長さＳ／２の単位分割データ４１１ａを生成する。同様に、ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３の分割部分データ４１２をそれぞれ連結して、単位分割データ４１１ｂ～ｄを生成する。次に、生成した４個の単位分割データ４１１をそれぞれ対応する種類の分割データ４１０の末尾等に連結する（Ｓ０７）。具体的には、図３に示すように、長さＳ／２の単位分割データ４１１ａ～ｄを、それぞれ分割データＡ（４１０ａ）～分割データＤ（４１０ｄ）の末尾に連結する。なお、連結すべき分割データ４１０が存在しない場合は、各単位分割データ４１１自身をそれぞれ分割データ４１０とする。 Next, four (four types) of unit divided data are generated from the twelve divided partial data 412 (S06). Specifically, as shown in FIG. 3, unit divided data 411a having a length of S / 2 is generated by concatenating divided partial data 412 of a1 to a3. Similarly, the divided partial data 412 of b1 to b3, c1 to c3, and d1 to d3 are respectively connected to generate unit divided data 411b to 411d. Next, the generated four unit divided data 411 are connected to the end of the corresponding divided data 410 (S07). Specifically, as shown in FIG. 3, unit divided data 411a to 411d of length S / 2 are connected to the end of divided data A (410a) to divided data D (410d), respectively. When there is no divided data 410 to be linked, each unit divided data 411 itself is set as divided data 410.
　なお、各分割データ４１０には、自身が分割データＡ（４１０ａ）、分割データＢ（４１０ｂ）、分割データＣ（４１０ｃ）、もしくは分割データＤ（４１０ｄ）のいずれの種類であるかを識別する情報をヘッダ等に付加するものとする。これにより、復元時に取得した各分割データ４１０について、これを構成する単位分割データ４１１が、ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３、もしくはｄ１～ｄ３のいずれの分割部分データ４１２により構成されているのかをヘッダ等の情報から知ることができる。この他にも、例えば、ステップＳ０１において、秘密データ４００の長さがＳに満たないためにゼロ等のデータをパディングして単位秘密データ４０１を抽出した場合の、末尾の単位秘密データ４０１の有効な長さの情報などを付加してもよい。 Each piece of divided data 410 includes information for identifying whether it is of divided data A (410a), divided data B (410b), divided data C (410c), or divided data D (410d). Is added to the header or the like. Thereby, for each divided data 410 acquired at the time of restoration, the unit divided data 411 constituting the divided data 410 is constituted by any divided partial data 412 of a1 to a3, b1 to b3, c1 to c3, or d1 to d3. Can be known from information such as headers. In addition to this, for example, when the unit secret data 401 is extracted by padding data such as zero because the length of the secret data 400 is less than S in step S01, the validity of the last unit secret data 401 is valid. A length of information or the like may be added.
　その後、秘密データ４００にまだ処理していない残部があるか否かを判定し（Ｓ０８）、残部がある場合にはステップＳ０１に戻って上記の一連の処理を秘密データ４００に残部がなくなるまで繰り返す。秘密データ４００に未処理の残部がない場合は、分割処理を終了する。 Thereafter, it is determined whether or not there is a remainder that has not yet been processed in the secret data 400 (S08). If there is a remainder, the process returns to step S01 and the above series of processing is repeated until there is no remainder in the secret data 400. . If there is no unprocessed remainder in the secret data 400, the division process ends.
　なお、図３に示した分割行列１１１を用いて上記の処理により得られる４個の分割データ４１０（分割データＡ～Ｄ）は、（３，２，４）ランプ型閾値秘密分散の要件を満たすものである。すなわち、各分割データ４１０を構成する各単位分割データ４１１のそれぞれからは、秘密データ４００を構成する単位秘密データ４０１の情報（ｓ１～ｓ６の秘密部分データ４０２の情報）を全く得ることはできない。 Note that the four pieces of divided data 410 (divided data A to D) obtained by the above processing using the divided matrix 111 shown in FIG. 3 satisfy the requirement of (3, 2, 4) ramp-type threshold secret sharing. Is. That is, the information of the unit secret data 401 constituting the secret data 400 (the information of the secret partial data 402 of s1 to s6) cannot be obtained from each of the unit divided data 411 constituting each of the divided data 410.
　例えば、第三者が、分割データＡ（４１０ａ）を取得した場合、これを構成する単位分割データ４１１ａからはａ１～ａ３の分割部分データ４１２の情報を得ることができる。仮に、これらの分割部分データ４１２が、上記の式１～式３の３個の式から生成されたものであることを当該第三者が知ったとしても、式１～式３からなる、ｒ１～ｒ３、およびｓ１～ｓ６を変数とする連立方程式を解くことはできない。 For example, when a third party acquires the divided data A (410a), the information of the divided partial data 412 of a1 to a3 can be obtained from the unit divided data 411a constituting the divided data A (410a). Even if the third party knows that the divided partial data 412 is generated from the three expressions of Expressions 1 to 3, r1 consisting of Expressions 1 to 3 Simultaneous equations with ˜r3 and s1 to s6 as variables cannot be solved.
　また、式１～式３からなる連立方程式からは、乱数成分であるｒ１～ｒ３を消去することができないため、ｓ１～ｓ６の秘密部分データ４０２のいずれの情報（解）も得ることができない（すなわち、正規化した情報エントロピーは１である）。従って、秘密データ４００（ｓ１～ｓ６の秘密部分データ４０２からなる単位秘密データ４０１）の秘匿性は保たれる。これは、分割データＢ（４１０ｂ）～分割データＤ（４１０ｄ）の各分割データ４１０についても同様である。 Further, since the random equations r1 to r3 cannot be deleted from the simultaneous equations consisting of the equations 1 to 3, any information (solution) of the secret partial data 402 of s1 to s6 cannot be obtained ( That is, the normalized information entropy is 1.) Accordingly, the confidentiality of the secret data 400 (unit secret data 401 including the secret partial data 402 of s1 to s6) is maintained. The same applies to the divided data 410 of the divided data B (410b) to the divided data D (410d).
　換言すれば、４個の異なる単位分割データ４１１（例えば、単位分割データ４１１ａ）をそれぞれ構成する３個の分割部分データ４１２（例えば、ａ１～ａ３）をそれぞれ得るための３個の計算式（例えば、上記の式１～式３）において、各式が、「１個または相異なる２個以上の秘密部分データ４０２（ｓ１～ｓ６）と１個または相異なる２個以上の乱数部分データ４０３（ｒ１～ｒ３）のＸＯＲ演算」として表されるように分割行列１１１を構成すれば、各分割データ４１０（単位分割データ４１１）は乱数データと同等の乱数性を有することになるため、１個の分割データ４１０からは秘密データ４００（単位秘密データ４０１）の情報を得ることはできないことになる。なお、本実施の形態では、３個の各計算式がそれぞれ互いに異なる１個の乱数部分データ４０３のみ（例えば、式１はｒ１のみ、式２はｒ２のみ、式３はｒ３のみ）を有するものとしている。 In other words, three calculation formulas (for example, for obtaining three divided partial data 412 (for example, a1 to a3) respectively constituting four different unit divided data 411 (for example, unit divided data 411a)) In the above formulas 1 to 3), each formula is expressed as “one or two or more different secret partial data 402 (s1 to s6) and one or two or more different random number partial data 403 (r1 If the division matrix 111 is configured as expressed as “XOR operation of r3”, each piece of divided data 410 (unit divided data 411) has randomness equivalent to that of random number data. Information of the secret data 400 (unit secret data 401) cannot be obtained from the data 410. In the present embodiment, each of the three calculation formulas has only one random number partial data 403 that is different from each other (for example, Formula 1 is only r1, Formula 2 is only r2, and Formula 3 is only r3). It is said.
　一方、３個の異なる分割データ４１０があれば、秘密データ４００を復元することができる。すなわち、３個の異なる分割データ４１０を構成する各単位分割データ４１１からは、秘密データ４００を構成する単位秘密データ４０１の情報（ｓ１～ｓ６の秘密部分データ４０２の情報）の全てを得ることができる。例えば、ユーザが分割データＡ（４１０ａ）、分割データＢ（４１０ｂ）、分割データＣ（４１０ｃ）の３個の分割データ４１０を集めた場合、上記と同様に、式１～式９の９個の独立した式からなる連立方程式が得られることになる。これを解くことにより、ｒ１～ｒ３、およびｓ１～ｓ３の９個の変数の情報（解）を得ることができ、ｓ１～ｓ６の秘密部分データ４０２の情報から単位秘密データ４０１および秘密データ４００を復元することができる（すなわち、正規化した情報エントロピーはゼロである）。 On the other hand, if there are three different pieces of divided data 410, the secret data 400 can be restored. That is, it is possible to obtain all of the information of the unit secret data 401 (information of the secret partial data 402 of s1 to s6) constituting the secret data 400 from each of the unit divided data 411 constituting the three different divided data 410. it can. For example, when the user collects three pieces of divided data 410, that is, divided data A (410a), divided data B (410b), and divided data C (410c), as in the above case, the nine pieces of Equations 1 to 9 are used. A simultaneous equation consisting of independent equations will be obtained. By solving this, information (solution) of nine variables r1 to r3 and s1 to s3 can be obtained, and the unit secret data 401 and the secret data 400 are obtained from the information of the secret partial data 402 of s1 to s6. Can be recovered (ie, normalized information entropy is zero).
　なお、２個の異なる分割データ４１０がある場合には、秘密データ４００の情報の一部を得ることが可能である。例えば、ユーザが分割データＡ（４１０ａ）、分割データＢ（４１０ｂ）の２個の分割データ４１０を集めた場合、上記と同様に、式１～式６の６個の式からなる連立方程式が得られることになる。この連立方程式では、ｒ１～ｒ３、ｓ１～ｓ６の全ての情報（解）を得ることはできないが、例えば、式１と式４、式２と式５、式３と式６によりそれぞれ乱数成分であるｒ１～ｒ３を消去することができるため、ｓ１～ｓ６の間の関係を簡易な一次式として得ることができる。理論上は、これらの式からｓ１～ｓ６のうち半分の情報を得ることが可能である（正規化した情報エントロピーは０．５である）。 If there are two different pieces of divided data 410, it is possible to obtain a part of the information of the secret data 400. For example, when the user collects two pieces of divided data 410 of divided data A (410a) and divided data B (410b), similar equations to the above, simultaneous equations consisting of six equations of Equations 1 to 6 are obtained. Will be. In this simultaneous equation, it is not possible to obtain all the information (solutions) r1 to r3 and s1 to s6. For example, the equations 1 and 4, the equations 2 and 5, and the equations 3 and 6 can be used as random components. Since certain r1 to r3 can be erased, the relationship between s1 to s6 can be obtained as a simple primary expression. Theoretically, half of the information s1 to s6 can be obtained from these equations (the normalized information entropy is 0.5).
　本実施の形態では、図３に示した（３，２，４）ランプ型閾値秘密分散での分割処理に用いる分割行列１１１は、後述する分割データ４１０からの秘密データ４００の復元処理に用いる復元行列１３１と合わせて、分割・復元の秘密分散処理全体でのＸＯＲ演算の数が少なくなるよう調整している。具体的には、分割行列１１１として成立し得る行列の各パターン（およびこれに対して得られる復元行列１３１）について、後述する中間式による影響も考慮して、分割・復元の秘密分散処理全体でのＸＯＲ演算の数を解析し、数が少なくなる、すなわち全体として処理効率のよいパターンを得た。図３に示した分割行列１１１は、上記の手順により得た調整された分割行列１１１である。 In the present embodiment, the partition matrix 111 used for the partitioning process in the (3, 2, 4) ramp-type threshold secret sharing shown in FIG. 3 is the restoration used for the restoration process of the secret data 400 from the partitioned data 410 described later. Together with the matrix 131, the number of XOR operations in the entire division / restoration secret sharing process is adjusted to be small. Specifically, with respect to each pattern of the matrix that can be established as the partition matrix 111 (and the restoration matrix 131 obtained for this), in consideration of the influence of an intermediate expression to be described later, The number of XOR operations was analyzed to obtain a pattern with a small number, that is, a high processing efficiency as a whole. The partition matrix 111 shown in FIG. 3 is the adjusted partition matrix 111 obtained by the above procedure.
　さらに本実施の形態では、図２のステップＳ０５において上記の式１～式１２に基づいて分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）を算出する際に実行されるＸＯＲ演算（式１～式１２における“＋”演算子）の回数が少なくなるよう、分割中間式１１２を利用する。すなわち、上記の式１～式１２において複数回繰り返し現れるＸＯＲ演算の式を予め分割中間式１１２として定義しておき、図２のステップＳ０４において、各分割中間式１１２の値を予め計算しておく。その後、ステップＳ０５で式１～式１２におけるＸＯＲ演算により分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）を算出する際に、各分割中間式１１２と一致する部分については、予め計算された分割中間式１１２の計算結果を利用することで、重複するＸＯＲ演算を極力廃し、処理の効率化・高速化を図る。 Furthermore, in the present embodiment, it is executed when the divided portion data 412 (a1 to a3, b1 to b3, c1 to c3, d1 to d3) is calculated based on the above equations 1 to 12 in step S05 in FIG. The divided intermediate expression 112 is used so that the number of XOR operations to be performed (the “+” operator in Expressions 1 to 12) is reduced. That is, an XOR operation expression that appears repeatedly in the above formulas 1 to 12 is defined in advance as the divided intermediate expression 112, and the value of each divided intermediate expression 112 is calculated in advance in step S04 of FIG. . Thereafter, when the divided partial data 412 (a1 to a3, b1 to b3, c1 to c3, d1 to d3) is calculated by the XOR operation in the equations 1 to 12 in step S05, the portions that coincide with the divided intermediate equations 112 For the above, by using the calculation result of the divided intermediate expression 112 calculated in advance, the redundant XOR operation is eliminated as much as possible, and the processing efficiency and speed are increased.
　＜分割中間式＞
　図４は、秘密部分データ４０２（ｓ１～ｓ６）と乱数部分データ４０３（ｒ１～ｒ３）から分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）を算出する際の例について概要を示した図である。図４の上段の図は、図３に示した分割行列１１１の内容を模式的に表として示しており、表の行・列は、図３に示した分割行列１１１の行・列に対応している。各行で、“１”が立っている列に対応する要素（例えば、１行目の場合はｒ１、ｓ１、およびｓ２）についてＸＯＲ演算する（例えば、１行目の場合はｒ１＋ｓ１＋ｓ２）ことで、各行に対応する分割部分データ４１２（例えば、１行目の場合はａ１）を得ることができることを示している。すなわち、図４に示す分割行列１１１の表の各行は、それぞれ上記の式１～式１２に示したＸＯＲ演算の内容を示している。 <Split intermediate type>
FIG. 4 shows a case where the divided portion data 412 (a1 to a3, b1 to b3, c1 to c3, d1 to d3) is calculated from the secret portion data 402 (s1 to s6) and the random number portion data 403 (r1 to r3). It is the figure which showed the outline | summary about the example. The upper diagram of FIG. 4 schematically shows the contents of the partition matrix 111 shown in FIG. 3 as a table, and the rows and columns of the table correspond to the rows and columns of the partition matrix 111 shown in FIG. ing. By performing an XOR operation (for example, r1 + s1 + s2 for the first row) for each row (for example, r1, s1, and s2 for the first row) corresponding to the column where “1” stands. It is shown that the divided partial data 412 (for example, a1 in the case of the first row) can be obtained. That is, each row of the table of the partition matrix 111 shown in FIG. 4 shows the contents of the XOR operation shown in the above equations 1 to 12.
　ここで、本実施の形態では、図４の下段に示すように、ｔ１～ｔ７の７個の分割中間式１１２を定義しており、これらはそれぞれ“１”が立っている列（図４の上段に示す分割行列１１１の列に対応する）により、以下の式の演算を表している。 Here, in the present embodiment, as shown in the lower part of FIG. 4, seven divided intermediate expressions 112 from t1 to t7 are defined, and these are columns in which “1” stands (each in FIG. 4). (Corresponding to the column of the division matrix 111 shown in the upper stage) represents the calculation of the following equation.
　　ｔ１＝ｓ３＋ｓ４　　　　　…式１３
　　ｔ２＝ｓ１＋ｓ２　　　　　…式１４
　　ｔ３＝ｓ３＋ｓ５　　　　　…式１５
　　ｔ４＝ｓ５＋ｓ６　　　　　…式１６
　　ｔ５＝ｒ３＋ｓ２＋ｓ４　　…式１７
　　ｔ６＝ｔ２＋ｔ３　　　　　…式１８
　　ｔ７＝ｒ２＋ｓ１＋ｔ４　　…式１９
　また、上記のｔ１～ｔ７の分割中間式１１２を用いることにより、上記の式１～式１２がそれぞれ以下の式により簡略化されることを表している。 t1 = s3 + s4 Equation 13
t2 = s1 + s2 Formula 14
t3 = s3 + s5 Formula 15
t4 = s5 + s6 Equation 16
t5 = r3 + s2 + s4 Equation 17
t6 = t2 + t3 Equation 18
t7 = r2 + s1 + t4 Equation 19
In addition, by using the divided intermediate expression 112 of t1 to t7, the expressions 1 to 12 are simplified by the following expressions, respectively.
　　ａ１＝ｒ１＋ｔ２　　　　　　　　…式１’
　　ａ２＝ｒ２＋ｔ１　　　　　　　　…式２’
　　ａ３＝ｒ３＋ｔ４　　　　　　　　…式３’
　　ｂ１＝ｒ１＋ｔ３　　　　　　　　…式４’
　　ｂ２＝ｓ３＋ｔ７　　　　　　　　…式５’
　　ｂ３＝ｓ６＋ｔ５　　　　　　　　…式６’
　　ｃ１＝ｒ１＋ｓ６＋ｔ１　　　　　…式７’
　　ｃ２＝ｒ２＋ｓ２＋ｓ５＋ｔ１　　…式８’
　　ｃ３＝ｒ３＋ｓ６＋ｔ６　　　　　…式９’
　　ｄ１＝ｒ１＋ｔ６　　　　　　　　…式１０’
　　ｄ２＝ｓ４＋ｔ７　　　　　　　　…式１１’
　　ｄ３＝ｓ５＋ｔ５　　　　　　　　…式１２’
　ここで、簡略化する前の上記の式１～式１２では、２入力のＸＯＲ演算の数（すなわち“＋”演算子の数）は３８個であるが、上記の式１’～式１２’（および分割中間式１１２である式１３～式１９）では、ＸＯＲ演算の数は２５個に大きく低減されている（低減率３４．２％）。従って、分割行列１１１に基づくＸＯＲ演算を直接実行する（上記の式１～式１２）よりも、分割中間式１１２（上記の式１３～式１９）を予め計算した上で、分割中間式１１２を利用して分割行列１１１に基づくＸＯＲ演算を実行する（上記の式１’～式１２’）ことで、ＸＯＲ演算に係る処理の効率化・高速化することができる。 a1 = r1 + t2 Formula 1 ′
a2 = r2 + t1 Formula 2 ′
a3 = r3 + t4 Formula 3 ′
b1 = r1 + t3 Formula 4 ′
b2 = s3 + t7 Formula 5 ′
b3 = s6 + t5 Formula 6 ′
c1 = r1 + s6 + t1 Formula 7 ′
c2 = r2 + s2 + s5 + t1 Equation 8 ′
c3 = r3 + s6 + t6 Formula 9 ′
d1 = r1 + t6 Formula 10 ′
d2 = s4 + t7 Formula 11 ′
d3 = s5 + t5 Formula 12 ′
Here, in the above Expressions 1 to 12 before the simplification, the number of 2-input XOR operations (that is, the number of “+” operators) is 38, but the above Expression 1 ′ to Expression 12 ′. In (and the equations 13 to 19 which are the divided intermediate equations 112), the number of XOR operations is greatly reduced to 25 (reduction rate 34.2%). Accordingly, rather than directly executing the XOR operation based on the partition matrix 111 (the above formulas 1 to 12), the split intermediate formula 112 (the above formulas 13 to 19) is calculated in advance, By performing the XOR operation based on the partition matrix 111 by using the above (Equation 1 ′ to Equation 12 ′ above), it is possible to increase the efficiency and speed of the processing relating to the XOR operation.
　なお、分割行列１１１の内容を調整することで、分割処理時のＸＯＲ演算の数を２５個からさらに低減させることも可能であるが、この場合は、後述する復元処理時のＸＯＲ演算の回数が増え、分割・復元の処理全体としてはＸＯＲ演算の数は必ずしも最小とはならない。分割・復元の処理全体として考えた場合に、解析により処理効率がよい（ＸＯＲ演算の数が少ない）ものとして得られたものが、図３に示した分割行列１１１である。 It is possible to further reduce the number of XOR operations during the dividing process from 25 by adjusting the contents of the dividing matrix 111. In this case, however, the number of XOR operations during the restoring process described later can be reduced. As a result, the number of XOR operations is not necessarily minimized as the entire division / restoration process. When considering the entire division / restoration process, what is obtained as a result of analysis having a high processing efficiency (the number of XOR operations is small) is the division matrix 111 shown in FIG.
　＜処理フロー（復元処理）＞
　図５は、データ分割装置１００の復元処理部１３０における、分割データ４１０から秘密分散により秘密データ４００を生成する復元処理の流れの例について概要を示したフローチャートである。なお、本実施の形態では、上述したように、（３，２，４）ランプ型閾値秘密分散により秘密分散処理を行うものとする。また、図６は、３個の分割データ４１０から（３，２，４）ランプ型閾値秘密分散により秘密データ４００を生成（復元）する処理の例について概要を示した図である。 <Processing flow (restoration processing)>
FIG. 5 is a flowchart showing an outline of an example of the flow of restoration processing for generating the secret data 400 from the divided data 410 by secret sharing in the restoration processing unit 130 of the data dividing device 100. In the present embodiment, as described above, secret sharing processing is performed by (3, 2, 4) ramp-type threshold secret sharing. FIG. 6 is a diagram showing an overview of an example of processing for generating (restoring) secret data 400 from three pieces of divided data 410 by (3, 2, 4) ramp-type threshold secret sharing.
　まず、復元処理の前処理として、インタフェース部１４０を介してユーザから参照や編集等の利用を行う重要データ、すなわち復元の対象となる重要データが指定されると、復元処理部１３０は、この重要データを秘密データ４００として、これを復元するために必要な数以上（本実施の形態では３個以上）の分割データ４１０を分散管理部１２０に要求して取得する。 First, as pre-processing of restoration processing, when important data to be used for reference or editing, for example, important data to be restored is designated by the user via the interface unit 140, the restoration processing unit 130 The data is set as the secret data 400, and the distribution management unit 120 is requested and acquired as many pieces of divided data 410 as necessary (three or more in the present embodiment) to restore the data.
　図６の例では、分割データ４１０ａ、４１０ｂ、４１０ｃの３個の分割データ４１０を復元に用いる場合を示している。これには、分散管理部１２０を介して分割データ４１０ａ、４１０ｂ、４１０ｃの３個の分割データ４１０を取得し、これらを復元に用いる場合、および、分散管理部１２０を介して４個全ての分割データ４１０を取得し、そのうちの分割データ４１０ａ、４１０ｂ、４１０ｃの３個を復元に用いる場合が含まれる。 In the example of FIG. 6, a case is shown in which three pieces of divided data 410 of divided data 410a, 410b, 410c are used for restoration. For this purpose, three pieces of divided data 410 of the divided data 410a, 410b, 410c are acquired via the distribution management unit 120 and used for restoration, and all four pieces of division data 410 are obtained via the distribution management unit 120. The case where the data 410 is acquired and three of the divided data 410a, 410b, and 410c are used for restoration is included.
　復元処理部１３０は、３個の分割データ４１０を取得すると、まず、３個の分割データ４１０の先頭からそれぞれ所定の長さＳ／２の単位分割データ４１１（ａ、ｂ、ｃ）を抽出する（Ｓ１１）。この単位分割データ４１１は、ＸＯＲ演算による秘密分散処理を行う際の処理単位となるデータである。次に、抽出した各単位分割データ４１１について、それぞれいずれの種類のものであるかを特定する（Ｓ１２）。図６の例では、各分割データ４１０（ａ、ｂ、ｃ）から抽出した各単位分割データ４１１（ａ、ｂ、ｃ）について、ヘッダ等に付加された情報等に基づき、それぞれが単位分割データ４１１ａ、４１１ｂ、４１１ｃ（もしくは単位分割データ４１１ｄ）のいずれであるかを特定する。 When the restoration processing unit 130 acquires the three pieces of divided data 410, first, the unit divided data 411 (a, b, c) having a predetermined length S / 2 is extracted from the head of the three pieces of divided data 410, respectively. (S11). This unit division data 411 is data that becomes a processing unit when performing secret sharing processing by XOR operation. Next, for each extracted unit division data 411, it is specified which type it is (S12). In the example of FIG. 6, each unit divided data 411 (a, b, c) extracted from each divided data 410 (a, b, c) is unit divided data based on information added to a header or the like. 411a, 411b, 411c (or unit divided data 411d) is specified.
　次に、抽出した各単位分割データ４１１からそれぞれ、３個の分割部分データ４１２を抽出する（Ｓ１３）。具体的には、図６に示すように、長さＳ／２の３個の単位分割データ４１１（ａ、ｂ、ｃ）をそれぞれ３等分して、長さＳ／６の分割部分データ４１２を３個ずつ（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３）生成する。 Next, three divided partial data 412 are extracted from each extracted unit divided data 411 (S13). Specifically, as shown in FIG. 6, three unit divided data 411 (a, b, c) having a length S / 2 are divided into three equal parts, and divided partial data 412 having a length S / 6. Are generated three by one (a1 to a3, b1 to b3, c1 to c3).
　次に、後述する秘密部分データ４０２を生成するためのＸＯＲ演算を行う際に用いるために、ステップＳ１２で特定した各単位分割データ４１１の種類の組み合わせ毎に定義された複数の復元中間式１３２のそれぞれについて、ステップＳ１３で抽出した分割部分データ４１２に基づいてＸＯＲ演算を行って値を算出しておく（Ｓ１４）。この復元中間式１３２は、上記の分割中間式１１２と同様に、後述する秘密部分データ４０２を生成するためのＸＯＲ演算の全体において、複数回繰り返し現れるＸＯＲ演算の式を復元中間式１３２として抽出したものである。この復元中間式１３２の値を予め計算して保持しておき、復元行列１３１に基づくＸＯＲ演算の際に計算結果を利用することで、内容が重複するＸＯＲ演算を極力廃し、処理の効率化・高速化を図る。なお、復元中間式１３２の詳細については後述する。 Next, for use in performing an XOR operation for generating secret partial data 402, which will be described later, a plurality of restoration intermediate formulas 132 defined for each combination of the types of the unit divided data 411 identified in step S12. For each, an XOR operation is performed based on the divided partial data 412 extracted in step S13 to calculate values (S14). In the same way as the above-described split intermediate formula 112, the restore intermediate formula 132 extracts an XOR formula that repeatedly appears multiple times as the restore intermediate formula 132 in the entire XOR calculation for generating secret partial data 402 described later. Is. The value of this restoration intermediate formula 132 is calculated and held in advance, and the calculation result is used in the XOR operation based on the restoration matrix 131, thereby eliminating the XOR operation with overlapping contents as much as possible and improving the processing efficiency. Increase speed. The details of the restoration intermediate formula 132 will be described later.
　次に、ステップＳ１３で抽出した分割部分データ４１２に基づいて、ステップＳ１２で特定した各単位分割データ４１１の種類の組み合わせ毎に定義された復元行列１３１に定義された内容に従ってＸＯＲ演算を行い、６個の秘密部分データ４０２を生成する（Ｓ１５）。具体的には、図６に示すように、単位分割データ４１１の種類の組み合わせ（図６の例では、ａ、ｂ、ｃの３個の単位分割データ４１１）毎にＸＯＲ演算を定義した復元行列１３１（図６の例では復元行列１３１ａ）と、分割部分データ４１２（図６の例ではａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３）を要素とする９行１列の分割データ行列１３３ａとの乗算によって、それぞれが長さＳ／６の６個の秘密部分データ４０２（ｓ１～ｓ６）を得る。 Next, based on the divided partial data 412 extracted in step S13, an XOR operation is performed according to the contents defined in the restoration matrix 131 defined for each type of unit divided data 411 identified in step S12. Pieces of secret partial data 402 are generated (S15). Specifically, as shown in FIG. 6, a restoration matrix that defines an XOR operation for each combination of types of unit divided data 411 (in the example of FIG. 6, three unit divided data 411 of a, b, and c). 131 (restoration matrix 131a in the example of FIG. 6) and a divided data matrix 133a of 9 rows and 1 column whose elements are the divided partial data 412 (a1 to a3, b1 to b3, and c1 to c3 in the example of FIG. 6). By multiplication, six pieces of secret partial data 402 (s1 to s6) each having a length S / 6 are obtained.
　すなわち、図６の例に示すように、分割データ４１０ａ、４１０ｂ、４１０ｃの３個の分割データ４１０に基づく場合は、復元行列１３１ａと、分割データ行列１３３ａとの乗算によって得られる以下の各式によって６個の秘密部分データ４０２を得る。 That is, as shown in the example of FIG. 6, in the case of being based on the three pieces of divided data 410 of the divided data 410a, 410b, and 410c, the following equations obtained by multiplication of the restoration matrix 131a and the divided data matrix 133a are used. Six pieces of secret data 402 are obtained.
　　ｓ１＝ａ２＋ｂ１＋ｂ２＋ｃ１　　　　　　　　…式２０
　　ｓ２＝ａ１＋ａ２＋ａ３＋ｂ１＋ｃ２＋ｃ３　　…式２１
　　ｓ３＝ａ１＋ｂ２＋ｃ１＋ｃ２　　　　　　　　…式２２
　　ｓ４＝ａ２＋ａ３＋ｂ３＋ｃ２　　　　　　　　…式２３
　　ｓ５＝ａ１＋ａ３＋ｂ１＋ｃ３　　　　　　　　…式２４
　　ｓ６＝ａ１＋ａ２＋ｂ３＋ｃ１＋ｃ２＋ｃ３　　…式２５
　なお、上記の行列の乗算からは、乱数部分データ４０３（ｒ１～ｒ３）も得ることができるが、秘密データ４００の復元に際しては不要であるため処理を省略する。また、分割処理時と同様に、実際の計算の際には、後述するように、式２０～式２５の各式において各復元中間式１３２と一致するＸＯＲ演算の部分に、ステップＳ１４で予め計算しておいた各復元中間式１３２の値を代入することで、全体でのＸＯＲ演算の数を低減させる。 s1 = a2 + b1 + b2 + c1 Equation 20
s2 = a1 + a2 + a3 + b1 + c2 + c3 Equation 21
s3 = a1 + b2 + c1 + c2 Equation 22
s4 = a2 + a3 + b3 + c2 Equation 23
s5 = a1 + a3 + b1 + c3 Expression 24
s6 = a1 + a2 + b3 + c1 + c2 + c3 Formula 25
Note that the random number partial data 403 (r1 to r3) can also be obtained from the matrix multiplication described above, but the process is omitted because it is not necessary for restoring the secret data 400. Further, as in the case of the division processing, in the actual calculation, as will be described later, in the equations 20 to 25, the XOR operation portion corresponding to each restored intermediate equation 132 is calculated in advance in step S14. By substituting the value of each restored intermediate expression 132, the total number of XOR operations is reduced.
　次に、６個の秘密部分データ４０２から単位秘密データ４０１を生成する（Ｓ１６）。具体的には、図６に示すように、ｓ１～ｓ６の秘密部分データ４０２を連結して、長さＳの単位秘密データ４０１を生成する。次に、生成した単位秘密データ４０１を秘密データ４００の末尾等に連結する（Ｓ１７）。具体的には、図６に示すように、長さＳの単位秘密データ４０１を秘密データ４００の末尾に連結する。なお、連結すべき秘密データ４００が存在しない場合は、単位秘密データ４０１自身を秘密データ４００とする。 Next, unit secret data 401 is generated from the six secret partial data 402 (S16). Specifically, as shown in FIG. 6, the secret partial data 402 of s1 to s6 are concatenated to generate unit secret data 401 of length S. Next, the generated unit secret data 401 is linked to the end of the secret data 400 (S17). Specifically, as shown in FIG. 6, the unit secret data 401 having a length S is connected to the end of the secret data 400. If there is no secret data 400 to be linked, the unit secret data 401 itself is set as the secret data 400.
　その後、各分割データ４１０にまだ処理していない残部があるか否かを判定し（Ｓ１８）、残部がある場合にはステップＳ１１に戻って上記の一連の処理を各分割データ４１０に残部がなくなるまで繰り返す。各分割データ４１０に未処理の残部がない場合は、復元処理を終了する。 Thereafter, it is determined whether or not there is a remaining portion that has not yet been processed in each divided data 410 (S18). If there is a remaining portion, the process returns to step S11 and the above series of processing is not left in each divided data 410. Repeat until. If there is no unprocessed remainder in each divided data 410, the restoration process is terminated.
　なお、上述した手順によって、図６に示したような復元行列１３１に基づいて得られる秘密データ４００（ｓ１～ｓ６の秘密部分データ４０２からなる単位秘密データ４０１）は、元の重要データの内容と同じものである。これは、ステップＳ１２で特定した各単位分割データ４１１の種類の組み合わせ毎に定義された複数の復元行列１３１が、上記の分割行列１１１における当該組み合わせに係る部分から求められた逆行列であるためである。 Note that the secret data 400 (unit secret data 401 including the secret partial data 402 of s1 to s6) obtained based on the restoration matrix 131 as shown in FIG. The same thing. This is because the plurality of restoration matrices 131 defined for each type of combination of the unit divided data 411 identified in step S12 are inverse matrices obtained from the portion related to the combination in the divided matrix 111. is there.
　図７は、分割データ４１０（ａ、ｂ、ｃ）から秘密データ４００を復元するために用いる復元行列１３１ａを分割行列１１１から得る処理の例を示した図である。復元行列１３１ａを得るためには、図７の上段に示すように、分割行列１１１のうち、復元の際に用いられる分割データ４１０（ａ、ｂ、ｃ）に対応する行、すなわちこれに対応する分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３）を得ることができる９行（図中の網掛け部分）を抽出して、図７の下段左側に示すような９行９列の部分行列を得る。 FIG. 7 is a diagram showing an example of processing for obtaining the restoration matrix 131a used for restoring the secret data 400 from the divided data 410 (a, b, c) from the divided matrix 111. In order to obtain the restored matrix 131a, as shown in the upper part of FIG. 7, the row corresponding to the divided data 410 (a, b, c) used in the restoration in the divided matrix 111, that is, the corresponding row. Nine rows (shaded portions in the figure) from which the divided portion data 412 (a1 to a3, b1 to b3, c1 to c3) can be obtained are extracted, and 9 rows and 9 columns as shown in the lower left part of FIG. Get the submatrix of.
　この部分行列から、例えば掃き出し法などにより、図７の下段右側に示すような逆行列を求める。この逆行列が復元行列１３１ａとなる。なお、分割行列１１１における要素の値の“１”は、数値の１ではなくＸＯＲの対象となる要素を決定するビットを示している。従って、例えば掃き出し法を用いて逆行列を求める際に、手順の課程での減算処理により要素の値が－１になった場合でも“１”として取り扱うことにより、復元行列１３１を得ることができる。 From this submatrix, an inverse matrix as shown on the lower right side of FIG. This inverse matrix becomes the restoration matrix 131a. Note that the element value “1” in the partition matrix 111 indicates a bit for determining an element to be XORed instead of the numerical value “1”. Therefore, for example, when the inverse matrix is obtained by using the sweep-out method, the restoration matrix 131 can be obtained by treating it as “1” even when the element value becomes −1 by the subtraction process in the procedure. .
　同様に、図８は、分割データ４１０（ａ、ｂ、ｄ）から秘密データ４００を復元するために用いる復元行列１３１ｂを分割行列１１１から得る処理の例を示した図である。図８の上段に示すように、分割行列１１１のうち、復元の際に用いられる分割データ４１０（ａ、ｂ、ｄ）に対応する行、すなわちこれに対応する分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｄ１～ｄ３）を得ることができる９行（図中の網掛け部分）を抽出して、図８の下段左側に示すような９行９列の部分行列を得る。この部分行列から求めた逆行列が復元行列１３１ｂとなる。 Similarly, FIG. 8 is a diagram showing an example of processing for obtaining the restoration matrix 131b used for restoring the secret data 400 from the divided data 410 (a, b, d) from the divided matrix 111. 8, the row corresponding to the divided data 410 (a, b, d) used in the restoration in the divided matrix 111, that is, the divided partial data 412 (a1 to a3, Nine rows (shaded portions in the figure) from which b1 to b3 and d1 to d3) can be obtained are extracted to obtain a 9 × 9 submatrix as shown in the lower left part of FIG. The inverse matrix obtained from this partial matrix is the restoration matrix 131b.
　同様に、図９は、分割データ４１０（ａ、ｃ、ｄ）から秘密データ４００を復元するために用いる復元行列１３１ｃを分割行列１１１から得る処理の例を示した図である。図９の上段に示すように、分割行列１１１のうち、復元の際に用いられる分割データ４１０（ａ、ｃ、ｄ）に対応する行、すなわちこれに対応する分割部分データ４１２（ａ１～ａ３、ｃ１～ｃ３、ｄ１～ｄ３）を得ることができる９行（図中の網掛け部分）を抽出して、図９の下段左側に示すような９行９列の部分行列を得る。この部分行列から求めた逆行列が復元行列１３１ｃとなる。 Similarly, FIG. 9 is a diagram showing an example of processing for obtaining the restoration matrix 131c used for restoring the secret data 400 from the divided data 410 (a, c, d) from the divided matrix 111. 9, the row corresponding to the divided data 410 (a, c, d) used in the restoration in the divided matrix 111, that is, the divided partial data 412 (a1 to a3, 9 rows (shaded portions in the figure) from which c1 to c3 and d1 to d3) can be obtained are extracted to obtain a 9 × 9 submatrix as shown in the lower left part of FIG. The inverse matrix obtained from this partial matrix is the restoration matrix 131c.
　同様に、図１０は、分割データ４１０（ｂ、ｃ、ｄ）から秘密データ４００を復元するために用いる復元行列１３１ｄを分割行列１１１から得る処理の例を示した図である。図１０の上段に示すように、分割行列１１１のうち、復元の際に用いられる分割データ４１０（ｂ、ｃ、ｄ）に対応する行、すなわちこれに対応する分割部分データ４１２（ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）を得ることができる９行（図中の網掛け部分）を抽出して、図１０の下段左側に示すような９行９列の部分行列を得る。この部分行列から求めた逆行列が復元行列１３１ｄとなる。 Similarly, FIG. 10 is a diagram showing an example of processing for obtaining the restoration matrix 131d used for restoring the secret data 400 from the divided data 410 (b, c, d) from the divided matrix 111. As shown in the upper part of FIG. 10, the row corresponding to the divided data 410 (b, c, d) used in the restoration in the divided matrix 111, that is, the divided partial data 412 (b1 to b3, b) corresponding thereto. Nine rows (shaded portions in the figure) from which c1 to c3 and d1 to d3) can be obtained are extracted to obtain a 9 × 9 submatrix as shown in the lower left part of FIG. The inverse matrix obtained from this partial matrix is the restoration matrix 131d.
　＜復元中間式＞
　図１１は、分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３）から秘密部分データ４０２（ｓ１～ｓ６）を算出する際の例について概要を示した図である。上述の図４と同様に、図１１の上段の図は、図７に示した復元行列１３１ａの内容を模式的に表として示しており、表の行・列は、図７に示した復元行列１３１ａの行・列に対応している。 <Restore intermediate expression>
FIG. 11 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (a1 to a3, b1 to b3, c1 to c3). Similar to FIG. 4 described above, the upper diagram of FIG. 11 schematically shows the contents of the restoration matrix 131a shown in FIG. 7 as a table, and the rows and columns of the table are the restoration matrix shown in FIG. This corresponds to the row / column 131a.
　ここで、本実施の形態では、図１１の下段に示すように、ｗ１～ｗ５の５個の復元中間式１３２ａを定義しており、これらはそれぞれ“１”が立っている列（図１１の上段に示す復元行列１３１ａの列に対応する）により、以下の式の演算を表している。 Here, in the present embodiment, as shown in the lower part of FIG. 11, five restoration intermediate expressions 132a w1 to w5 are defined, and these are columns in which “1” stands (each in FIG. 11). (Corresponding to the column of the restoration matrix 131a shown in the upper part) represents the calculation of the following equation.
　　ｗ１＝ｂ２＋ｃ１　　…式２６
　　ｗ２＝ａ３＋ｂ１　　…式２７
　　ｗ３＝ａ１＋ｃ３　　…式２８
　　ｗ４＝ａ２＋ｃ２　　…式２９
　　ｗ５＝ｗ３＋ｗ４　　…式３０
　また、上記のｗ１～ｗ５の復元中間式１３２ａを用いることにより、上記の式２０～式２５がそれぞれ以下の式により簡略化されることを表している。 w1 = b2 + c1 Formula 26
w2 = a3 + b1 Equation 27
w3 = a1 + c3 Expression 28
w4 = a2 + c2 Equation 29
w5 = w3 + w4 Equation 30
Further, by using the w1 to w5 restoration intermediate equation 132a, the above equations 20 to 25 are simplified by the following equations, respectively.
　　ｓ１＝ａ２＋ｂ１＋ｗ１　　…式２０’
　　ｓ２＝ｗ２＋ｗ５　　　　　…式２１’
　　ｓ３＝ａ１＋ｃ２＋ｗ１　　…式２２’
　　ｓ４＝ａ３＋ｂ３＋ｗ４　　…式２３’
　　ｓ５＝ｗ２＋ｗ３　　　　　…式２４’
　　ｓ６＝ｂ３＋ｃ１＋ｗ５　　…式２５’
　ここで、簡略化する前の上記の式２０～式２５では、２入力のＸＯＲ演算の数は２２個であるが、上記の式２０’～式２５’（および復元中間式１３２ａである式２６～式３０）では、ＸＯＲ演算の数は１５個に大きく低減されている（低減率３１．８％）。従って、復元行列１３１ａに基づくＸＯＲ演算を直接実行する（上記の式２０～式２５）よりも、復元中間式１３２ａを予め計算した上で（上記の式２６～式３０）、復元中間式１３２ａを利用して復元行列１３１ａに基づくＸＯＲ演算を実行する（上記の式２０’～式２５’）ことで、ＸＯＲ演算に係る処理の効率化・高速化することができる。 s1 = a2 + b1 + w1 Equation 20 ′
s2 = w2 + w5 Formula 21 ′
s3 = a1 + c2 + w1 Formula 22 ′
s4 = a3 + b3 + w4 Formula 23 ′
s5 = w2 + w3 Formula 24 ′
s6 = b3 + c1 + w5 Formula 25 ′
Here, in Expressions 20 to 25 before simplification, the number of two-input XOR operations is 22, but the above Expressions 20 ′ to 25 ′ (and Expression 26 which is the restoration intermediate expression 132a). In Expression 30), the number of XOR operations is greatly reduced to 15 (a reduction rate of 31.8%). Accordingly, rather than directly executing the XOR operation based on the restoration matrix 131a (the above equations 20 to 25), the restoration intermediate equation 132a is calculated in advance (the above equations 26 to 30), and the restoration intermediate equation 132a is By using this to execute the XOR operation based on the restoration matrix 131a (formulas 20 ′ to 25 ′ described above), it is possible to increase the efficiency and speed of the processing relating to the XOR operation.
　同様に、図１２は、分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｄ１～ｄ３）から秘密部分データ４０２（ｓ１～ｓ６）を算出する際の例について概要を示した図である。図１２の上段の図は、図８に示した復元行列１３１ｂの内容を模式的に表として示しており、表の行・列は、図８に示した復元行列１３１ｂの行・列に対応している。ここで、本実施の形態では、図１２の下段に示すように、ｘ１～ｘ５の５個の復元中間式１３２ｂを定義しており、これらはそれぞれ“１”が立っている列（図１２の上段に示す復元行列１３１ｂの列に対応する）により、以下の式の演算を表している。 Similarly, FIG. 12 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (a1 to a3, b1 to b3, d1 to d3). The upper diagram of FIG. 12 schematically shows the contents of the restoration matrix 131b shown in FIG. 8 as a table, and the rows and columns of the table correspond to the rows and columns of the restoration matrix 131b shown in FIG. ing. Here, in this embodiment, as shown in the lower part of FIG. 12, five restoration intermediate expressions 132b of x1 to x5 are defined, and these are columns in which “1” stands (each in FIG. 12). (Corresponding to the column of the restoration matrix 131b shown in the upper part) represents the calculation of the following equation.
　　ｘ１＝ａ１＋ａ３　　　　　　　　…式３１
　　ｘ２＝ａ２＋ｂ１　　　　　　　　…式３２
　　ｘ３＝ｂ２＋ｂ３＋ｄ２＋ｘ１　　…式３３
　　ｘ４＝ｄ３＋ｘ１＋ｘ２　　　　　…式３４
　　ｘ５＝ａ３＋ｂ２＋ｄ１＋ｘ２　　…式３５
　また、上記のｘ１～ｘ５の復元中間式１３２ｂを用いることにより、復元行列１３１ｂと、分割部分データ４１２（ａ１～ａ３、ｂ１～ｂ３、ｄ１～ｄ３）を要素とする分割データ行列との乗算によって６個の秘密部分データ４０２（ｓ１～ｓ６）を得る式（記載は省略）が、それぞれ以下の簡略化された式によって表されることを示している。 x1 = a1 + a3 Expression 31
x2 = a2 + b1 Formula 32
x3 = b2 + b3 + d2 + x1 Equation 33
x4 = d3 + x1 + x2 Formula 34
x5 = a3 + b2 + d1 + x2 Equation 35
Further, by using the above-described x1 to x5 restoration intermediate expression 132b, multiplication of the restoration matrix 131b and the divided data matrix having the divided partial data 412 (a1 to a3, b1 to b3, d1 to d3) as elements is performed. The formulas (not shown) for obtaining the six secret partial data 402 (s1 to s6) are represented by the following simplified formulas, respectively.
　　ｓ１＝ｂ１＋ｘ３　　…式３６’
　　ｓ２＝ｄ１＋ｘ３　　…式３７’
　　ｓ３＝ｂ２＋ｘ４　　…式３８’
　　ｓ４＝ｄ２＋ｘ４　　…式３９’
　　ｓ５＝ｄ３＋ｘ５　　…式４０’
　　ｓ６＝ｂ３＋ｘ５　　…式４１’
　ここで、簡略化する前では、ＸＯＲ演算の数は３０個であるが、上記の式３６’～式４１’（および復元中間式１３２ｂである式３１～式３５）では、ＸＯＲ演算の数は１６個に大きく低減されている（低減率４６．６％）。 s1 = b1 + x3 Formula 36 ′
s2 = d1 + x3 Expression 37 ′
s3 = b2 + x4 Formula 38 ′
s4 = d2 + x4 Equation 39 ′
s5 = d3 + x5 Expression 40 ′
s6 = b3 + x5 Formula 41 ′
Here, before simplification, the number of XOR operations is 30. However, in the above Expressions 36 ′ to 41 ′ (and Expressions 31 to 35 which are the restoration intermediate expressions 132b), the number of XOR operations is as follows. The number is greatly reduced to 16 (reduction rate 46.6%).
　同様に、図１３は、分割部分データ４１２（ａ１～ａ３、ｃ１～ｃ３、ｄ１～ｄ３）から秘密部分データ４０２（ｓ１～ｓ６）を算出する際の例について概要を示した図である。図１３の上段の図は、図９に示した復元行列１３１ｃの内容を模式的に表として示しており、表の行・列は、図９に示した復元行列１３１ｃの行・列に対応している。ここで、本実施の形態では、図１３の下段に示すように、ｙ１～ｙ５の５個の復元中間式１３２ｃを定義しており、これらはそれぞれ“１”が立っている列（図１３の上段に示す復元行列１３１ｃの列に対応する）により、以下の式の演算を表している。 Similarly, FIG. 13 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (a1 to a3, c1 to c3, d1 to d3). The upper diagram of FIG. 13 schematically shows the contents of the restoration matrix 131c shown in FIG. 9 as a table, and the rows and columns of the table correspond to the rows and columns of the restoration matrix 131c shown in FIG. ing. Here, in this embodiment, as shown in the lower part of FIG. 13, five restoration intermediate expressions 132c from y1 to y5 are defined, and each of these is a column in which “1” stands (see FIG. 13). (Corresponding to the column of the restoration matrix 131c shown in the upper part) represents the calculation of the following equation.
　　ｙ１＝ａ２＋ｃ２　　…式４２
　　ｙ２＝ａ３＋ｃ３　　…式４３
　　ｙ３＝ｃ２＋ｄ２　　…式４４
　　ｙ４＝ａ１＋ｃ１　　…式４５
　　ｙ５＝ｃ３＋ｄ３　　…式４６
　また、上記のｙ１～ｙ５の復元中間式１３２ｃを用いることにより、復元行列１３１ｃと、分割部分データ４１２（ａ１～ａ３、ｃ１～ｃ３、ｄ１～ｄ３）を要素とする分割データ行列との乗算によって６個の秘密部分データ４０２（ｓ１～ｓ６）を得る式（記載は省略）が、それぞれ以下の簡略化された式によって表されることを示している。 y1 = a2 + c2 Formula 42
y2 = a3 + c3 Formula 43
y3 = c2 + d2 Formula 44
y4 = a1 + c1 Formula 45
y5 = c3 + d3 Formula 46
In addition, by using the above-described intermediate expression 132c for y1 to y5, multiplication of the restoration matrix 131c and the divided data matrix having the divided partial data 412 (a1 to a3, c1 to c3, d1 to d3) as elements is performed. The formulas (not shown) for obtaining the six secret partial data 402 (s1 to s6) are represented by the following simplified formulas, respectively.
　　ｓ１＝ａ１＋ｄ１＋ｙ１＋ｙ２　　…式４７’
　　ｓ２＝ｙ４＋ｙ５　　　　　　　　…式４８’
　　ｓ３＝ｃ１＋ｄ１＋ｙ１＋ｙ５　　…式４９’
　　ｓ４＝ｙ３＋ｙ４　　　　　　　　…式５０’
　　ｓ５＝ｓ２＋ｙ１　　　　　　　　…式５１’
　　ｓ６＝ｙ２＋ｙ３　　　　　　　　…式５２’
　ここで、簡略化する前では、ＸＯＲ演算の数は２４個であるが、上記の式４７’～式５２’（および復元中間式１３２ｃである式４２～式４６）では、ＸＯＲ演算の数は１５個に大きく低減されている（低減率３７．５％）。 s1 = a1 + d1 + y1 + y2 Equation 47 ′
s2 = y4 + y5 Formula 48 ′
s3 = c1 + d1 + y1 + y5 Formula 49 ′
s4 = y3 + y4 Formula 50 ′
s5 = s2 + y1 Formula 51 ′
s6 = y2 + y3 ... Formula 52 '
Here, before the simplification, the number of XOR operations is 24, but in the above equations 47 ′ to 52 ′ (and equations 42 to 46 which are the restoration intermediate equations 132c), the number of XOR operations is The number is greatly reduced to 15 (reduction rate 37.5%).
　同様に、図１４は、分割部分データ４１２（ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）から秘密部分データ４０２（ｓ１～ｓ６）を算出する際の例について概要を示した図である。図１４の上段の図は、図１０に示した復元行列１３１ｄの内容を模式的に表として示しており、表の行・列は、図１０に示した復元行列１３１ｄの行・列に対応している。ここで、本実施の形態では、図１４の下段に示すように、ｚ１～ｚ２の２個の復元中間式１３２ｄを定義しており、これらはそれぞれ“１”が立っている列（図１４の上段に示す復元行列１３１ｄの列に対応する）により、以下の式の演算を表している。 Similarly, FIG. 14 is a diagram showing an outline of an example of calculating the secret part data 402 (s1 to s6) from the divided part data 412 (b1 to b3, c1 to c3, d1 to d3). The upper diagram of FIG. 14 schematically shows the contents of the restoration matrix 131d shown in FIG. 10 as a table, and the rows and columns of the table correspond to the rows and columns of the restoration matrix 131d shown in FIG. ing. Here, in this embodiment, as shown in the lower part of FIG. 14, two restoration intermediate expressions 132d z1 to z2 are defined, and each of these is a sequence in which “1” stands (see FIG. 14). (Corresponding to the column of the restoration matrix 131d shown in the upper stage) represents the calculation of the following equation.
　　ｚ１＝ａ１＋ａ３　　…式５３
　　ｚ２＝ａ２＋ｂ１　　…式５４
　また、上記のｚ１～ｚ２の復元中間式１３２ｄを用いることにより、復元行列１３１ｄと、分割部分データ４１２（ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３）を要素とする分割データ行列との乗算によって６個の秘密部分データ４０２（ｓ１～ｓ６）を得る式（記載は省略）が、それぞれ以下の簡略化された式によって表されることを示している。 z1 = a1 + a3 Formula 53
z2 = a2 + b1 Formula 54
Further, by using the above-described restoration intermediate expression 132d of z1 to z2, multiplication of the restoration matrix 131d and the divided data matrix having the divided partial data 412 (b1 to b3, c1 to c3, d1 to d3) as elements is performed. The formulas (not shown) for obtaining the six secret partial data 402 (s1 to s6) are represented by the following simplified formulas, respectively.
　　ｓ１＝ｄ１＋ｚ２　　　　　　　　…式５５’
　　ｓ２＝ｂ１＋ｚ２　　　　　　　　…式５６’
　　ｓ３＝ｂ２＋ｄ２＋ｓ４　　　　　…式５７’
　　ｓ４＝ｂ１＋ｄ３＋ｚ１　　　　　…式５８’
　　ｓ５＝ｂ２＋ｃ１＋ｃ２＋ｄ１　　…式５９’
　　ｓ６＝ｂ３＋ｄ３＋ｓ５　　　　　…式６０’
　ここで、簡略化する前では、ＸＯＲ演算の数は２６個であるが、上記の式５５’～式６０’（および復元中間式１３２ｄである式５３～式５４）では、ＸＯＲ演算の数は１５個に大きく低減されている（低減率４２．３％）。 s1 = d1 + z2 (Formula 55 ′)
s2 = b1 + z2 (Formula 56 ′)
s3 = b2 + d2 + s4 Equation 57 ′
s4 = b1 + d3 + z1 ... Formula 58 '
s5 = b2 + c1 + c2 + d1 Equation 59 ′
s6 = b3 + d3 + s5 Equation 60 ′
Here, before the simplification, the number of XOR operations is 26, but in the above-described Expression 55 ′ to Expression 60 ′ (and Expression 53 to Expression 54 which is the restoration intermediate expression 132d), the number of XOR operations is It is greatly reduced to 15 (reduction rate: 42.3%).
　なお、本実施の形態では、（３，２，４）ランプ型閾値秘密分散を用いる場合における、調整された分割行列１１１や分割中間式１１２、および復元行列１３１や復元中間式１３２について具体的に説明したが、（３，２，４）型に限らず、他の（ｋ，Ｌ，ｎ）型の場合であっても同様の思想で分割行列１１１や復元行列１３１を求め、また、分割中間式１１２や復元中間式１３２を定義してＸＯＲ演算の数を低減させ、処理を効率化・高速化させることが可能である。 In the present embodiment, the adjusted partition matrix 111 and the partition intermediate expression 112, and the restoration matrix 131 and the restoration intermediate expression 132 in the case of using (3, 2, 4) ramp-type threshold secret sharing are specifically described. As described above, not only the (3, 2, 4) type but also the other (k, L, n) type, the partition matrix 111 and the restoration matrix 131 are obtained with the same idea, and the middle of the partition It is possible to reduce the number of XOR operations by defining the expression 112 and the restoration intermediate expression 132, thereby making the processing more efficient and faster.
　以上に説明したように、本発明の一実施の形態であるデータ分割装置１００およびデータ分割装置１００上で稼働するデータ分割プログラムによれば、秘密データ４００を（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散によりｎ個の分割データ４１０に分割して、これらの分割データ４１０をそれぞれ異なるサーバ２００等に分散保管する。これにより、分割データ４１０の紛失・盗難・不正取得等に対する秘密データ４００の秘匿性を高めるとともに、分割データ４１０の毀損・滅失等に対する秘密データ４００の可用性を高めることが可能となる。 As described above, according to the data division apparatus 100 and the data division program operating on the data division apparatus 100 according to the embodiment of the present invention, the secret data 400 is converted into the (k, L, n) ramp type threshold value. The data is divided into n pieces of divided data 410 by secret sharing, and these divided data 410 are distributed and stored in different servers 200 or the like. As a result, the confidentiality of the secret data 400 against loss, theft, unauthorized acquisition, etc. of the divided data 410 can be improved, and the availability of the secret data 400 against damage, loss, etc. of the divided data 410 can be increased.
　また、ランプ型の秘密分散を用いることから、安全性の条件は若干緩められるものの、ｎ個の各分割データ４１０のサイズを１／Ｌに縮小して、全体でのデータ量を（ｋ，ｎ）閾値秘密分散の場合と比べて１／Ｌに縮小する。これにより、各分割データ４１０を送信・保管する際のネットワーク３００の帯域や記憶領域などのリソース使用量を低減させることが可能となる。 In addition, since the security condition is slightly relaxed because ramp-type secret sharing is used, the size of each of the n pieces of divided data 410 is reduced to 1 / L, and the total data amount is reduced to (k, n ) Reduced to 1 / L compared to threshold secret sharing. This makes it possible to reduce the amount of resources used such as the bandwidth and storage area of the network 300 when transmitting and storing each divided data 410.
　また、（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散において、コンピュータでのビット演算に適するよう、ＸＯＲ演算により秘密分散処理を行う。すなわち、秘密データ４００を分割した秘密部分データ４０２のうちの１個以上と、秘密部分データ４０２と同じ長さで秘密部分データ４０２の半数の乱数部分データ４０３のうちの１個とのＸＯＲ演算に基づいて複数の分割部分データ４１２を生成し、それぞれ異なる乱数部分データ４０３を含むＸＯＲ演算により生成された複数の分割部分データ４１２を連結して単位分割データ４１１および分割データ４００を生成する。これにより、秘密分散処理を効率化・高速化することが可能となる。 Also, in (k, L, n) ramp type threshold secret sharing, secret sharing processing is performed by XOR calculation so as to be suitable for bit calculation in a computer. That is, an XOR operation of one or more of the secret partial data 402 obtained by dividing the secret data 400 and one of the random number partial data 403 that is the same length as the secret partial data 402 and half the secret partial data 402 is performed. Based on this, a plurality of divided portion data 412 is generated, and a plurality of divided portion data 412 generated by an XOR operation including different random number portion data 403 is concatenated to generate unit divided data 411 and divided data 400. This makes it possible to increase the efficiency and speed of the secret sharing process.
　さらに、本実施の形態では、具体的に（３，２，４）ランプ型閾値秘密分散において、ＸＯＲ演算を行うための計算式（分割行列１１１、および復元行列１３１）を調整し、また、中間式（分割中間式１１２、および復元中間式１３２）を用いて計算手順を調整することで、ＸＯＲ演算の数を大きく低減させる（上述の分割中間式および復元中間式の例では中間式による低減率は平均すると４０．２％）ことを実現している。これにより、秘密データ４００から（３，２，４）ランプ型閾値秘密分散により複数の分割データ４１０を生成し、また複数の分割データ４１０から秘密データ４００を復元することを実際に可能とし、さらにそれらの際の処理性能を全体として向上させることが可能となる。 Further, in the present embodiment, specifically, in (3, 2, 4) ramp type threshold secret sharing, calculation formulas (partition matrix 111 and restoration matrix 131) for performing an XOR operation are adjusted, and intermediate The number of XOR operations is greatly reduced by adjusting the calculation procedure using the equations (the divided intermediate equation 112 and the restored intermediate equation 132) (in the above example of the divided intermediate equation and the restored intermediate equation, the reduction rate by the intermediate equation) (40.2% on average). Thereby, it is actually possible to generate a plurality of divided data 410 from the secret data 400 by (3, 2, 4) ramp-type threshold secret sharing, and to restore the secret data 400 from the plurality of divided data 410, It becomes possible to improve the processing performance at that time as a whole.
　以上、本発明者によってなされた発明を実施の形態に基づき具体的に説明したが、本発明は前記実施の形態に限定されるものではなく、その要旨を逸脱しない範囲で種々変更可能であることはいうまでもない。 As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.
　本発明は、重要データを秘密分散技術により複数の非重要データに分割して秘匿化する際のデータ分割装置およびデータ分割プログラムに利用可能である。 The present invention can be used for a data division apparatus and a data division program used to divide important data into a plurality of non-important data using a secret sharing technique and conceal it.
　１００…データ分割装置、１１０…分割処理部、１１１…分割行列、１１２…分割中間式、１１３…乱数生成部、１１４…秘密データ行列、１２０…分散管理部、１２１…分散状況、１２２…設定情報、１３０…復元処理部、１３１、１３１ａ～ｄ…復元行列、１３２、１３２ａ～ｄ…復元中間式、１３３ａ…分割データ行列、１４０…インタフェース部、
　２００…サーバ、
　３００…ネットワーク、
　４００…秘密データ、４０１…単位秘密データ、４０２…秘密部分データ、４０３…乱数部分データ、４１０、４１０ａ～ｄ…分割データ、４１１、４１１ａ～ｄ…単位分割データ、４１２…分割部分データ。
 
 
  DESCRIPTION OF SYMBOLS 100 ... Data division | segmentation apparatus, 110 ... Division | segmentation process part, 111 ... Division | segmentation matrix, 112 ... Division | segmentation intermediate type | formula, 113 ... Random number generation part, 114 ... Secret data matrix, 120 ... Distribution | distribution management part, 121 ... Distribution | distribution status, 122 ... Setting information , 130: Restoration processing unit, 131, 131a to d ... Restoration matrix, 132, 132a to d ... Restoration intermediate formula, 133a ... Divided data matrix, 140 ... Interface unit,
200 ... server,
300 ... Network,
400: Secret data, 401: Unit secret data, 402: Secret partial data, 403: Random number partial data, 410, 410a to d ... Divided data, 411, 411a to d ... Unit divided data, 412 ... Divided partial data.


Claims (15)

  1. 　秘密データを（ｋ，Ｌ，ｎ）ランプ型閾値秘密分散によりｎ個の分割データに分割して、ｎ個の前記分割データをそれぞれ異なる記憶装置に分散保管するデータ分割装置であって、
    　前記秘密データから抽出した長さＳの単位秘密データを複数の秘密部分データに分割し、
    　前記秘密部分データと同じ長さで、前記秘密部分データの数の半数の乱数部分データを生成し、
    　前記秘密部分データ、前記乱数部分データ、および前記秘密部分データのうちの１個以上と前記乱数部分データのうちの１個から分割部分データを生成するためのＸＯＲ演算を定義した分割行列に基づいて、複数の前記分割部分データを生成し、
    　それぞれ異なる前記乱数部分データを含むＸＯＲ演算により生成された複数の前記分割部分データを連結してｎ種類の長さＳ／Ｌの単位分割データを生成し、
    　前記単位分割データを種類毎に連結してｎ個の分割データを生成する分割処理部を有することを特徴とするデータ分割装置。     A data dividing device that divides secret data into n pieces of divided data by (k, L, n) ramp-type threshold secret sharing, and distributes and stores the n pieces of divided data in different storage devices,
    Dividing the unit secret data of length S extracted from the secret data into a plurality of secret partial data;
    Generating random number partial data having the same length as the secret partial data and half the number of the secret partial data;
    Based on a division matrix defining an XOR operation for generating divided partial data from one or more of the secret partial data, the random number partial data, and the secret partial data and one of the random number partial data Generating a plurality of the divided portion data,
    A plurality of the divided partial data generated by the XOR operation including the different random number partial data are concatenated to generate n types of unit divided data of length S / L,
    A data dividing apparatus comprising a division processing unit that generates n pieces of divided data by connecting the unit divided data for each type.
  2. 　請求項１に記載のデータ分割装置において、
    　ｋ個の前記分割データのそれぞれから抽出した長さＳ／２の前記単位分割データから複数の前記分割部分データをそれぞれ抽出し、
    　前記分割データの種類の組み合わせに対応した前記分割行列の部分行列に対する逆行列である復元行列に基づく、抽出した前記分割部分データのＸＯＲ演算により、複数の前記秘密部分データを生成し、
    　生成した前記秘密部分データを連結して長さＳの前記単位秘密データを生成し、
    　生成した前記単位秘密データを連結して前記秘密データを生成する復元処理部を有することを特徴とするデータ分割装置。     The data dividing device according to claim 1, wherein
    extracting a plurality of the divided partial data from the unit divided data of length S / 2 extracted from each of the k pieces of divided data;
    A plurality of the secret partial data is generated by an XOR operation of the extracted partial partial data based on a restoration matrix that is an inverse matrix with respect to the partial matrix of the partial matrix corresponding to the combination of the types of the divided data,
    Concatenating the generated secret part data to generate the unit secret data of length S,
    A data division apparatus comprising: a restoration processing unit that concatenates the generated unit secret data to generate the secret data.
  3. 　請求項２に記載のデータ分割装置において、
    　前記分割処理部もしくは前記復元処理部は、前記分割行列もしくは前記復元行列に基づくＸＯＲ演算において、複数回重複して現れるＸＯＲ演算の式を中間式として定義しておき、前記分割行列または前記復元行列に基づくＸＯＲ演算の際に、前記中間式と一致する部分に予め算出しておいた前記中間式の値を代入することを特徴とするデータ分割装置。     The data dividing device according to claim 2, wherein
    In the XOR operation based on the partition matrix or the restoration matrix, the partition processing unit or the restoration processing unit defines an XOR operation expression that appears multiple times as an intermediate expression, and the partition matrix or the restoration matrix A data dividing device, wherein the value of the intermediate expression calculated in advance is substituted into a portion that matches the intermediate expression in the XOR operation based on the above.
  4. 　秘密データを（３，２，４）ランプ型閾値秘密分散により４個の分割データに分割して、４個の前記分割データをそれぞれ異なる記憶装置に分散保管するデータ分割装置であって、
    　前記秘密データから抽出した長さＳの単位秘密データを長さＳ／６の６個の秘密部分データに分割し、
    　長さＳ／６の３個の乱数部分データを生成し、
    　前記秘密部分データ、前記乱数部分データ、および前記秘密部分データのうちの１個以上と前記乱数部分データのうちの１個から分割部分データを生成するためのＸＯＲ演算を定義した分割行列に基づいて、１２個の前記分割部分データを生成し、
    　それぞれ異なる前記乱数部分データを含むＸＯＲ演算により生成された３個の前記分割部分データを連結して４種類の長さＳ／２の単位分割データを生成し、
    　前記単位分割データを種類毎に連結して４個の分割データを生成する分割処理部を有することを特徴とするデータ分割装置。     A data dividing device that divides secret data into four divided data by (3, 2, 4) ramp-type threshold secret sharing, and distributes and stores the four divided data in different storage devices,
    Dividing unit secret data of length S extracted from the secret data into six secret partial data of length S / 6,
    Generate three random number partial data of length S / 6,
    Based on a division matrix defining an XOR operation for generating divided partial data from one or more of the secret partial data, the random number partial data, and the secret partial data and one of the random number partial data , 12 pieces of the partial data are generated,
    Four pieces of unit divided data having a length of S / 2 are generated by concatenating the three pieces of divided partial data generated by the XOR operation including different random number partial data,
    A data dividing apparatus comprising a division processing unit that generates four pieces of divided data by connecting the unit divided data for each type.
  5. 　請求項４に記載のデータ分割装置において、
    　３個の前記分割データのそれぞれから抽出した長さＳ／２の前記単位分割データから３個の前記分割部分データをそれぞれ抽出し、
    　前記分割データの種類の組み合わせに対応した前記分割行列の部分行列に対する逆行列である復元行列に基づく、抽出した前記分割部分データのＸＯＲ演算により、６個の前記秘密部分データを生成し、
    　生成した前記秘密部分データを連結して長さＳの前記単位秘密データを生成し、
    　生成した前記単位秘密データを連結して前記秘密データを生成する復元処理部を有することを特徴とするデータ分割装置。     The data dividing device according to claim 4, wherein
    Extracting each of the three divided partial data from the unit divided data of length S / 2 extracted from each of the three divided data;
    Six secret partial data are generated by XOR operation of the extracted divided partial data based on a restoration matrix that is an inverse matrix of the partial matrix of the divided matrix corresponding to the combination of types of the divided data,
    Concatenating the generated secret part data to generate the unit secret data of length S,
    A data division apparatus comprising: a restoration processing unit that concatenates the generated unit secret data to generate the secret data.
  6. 　請求項４に記載のデータ分割装置において、
    　前記分割行列により定義された、前記秘密部分データ（ｓ１～ｓ６）のうちの１個以上と前記乱数部分データ（ｒ１～ｒ３）のうちの１個から、１２個の前記分割部分データを生成するためのＸＯＲ演算の式は、
    　　ａ１＝ｒ１＋ｓ１＋ｓ２
    　　ａ２＝ｒ２＋ｓ３＋ｓ４
    　　ａ３＝ｒ３＋ｓ５＋ｓ６
    　　ｂ１＝ｒ１＋ｓ３＋ｓ５
    　　ｂ２＝ｒ２＋ｓ１＋ｓ３＋ｓ５＋ｓ６
    　　ｂ３＝ｒ３＋ｓ２＋ｓ４＋ｓ６
    　　ｃ１＝ｒ１＋ｓ３＋ｓ４＋ｓ６
    　　ｃ２＝ｒ２＋ｓ２＋ｓ３＋ｓ４＋ｓ５
    　　ｃ３＝ｒ３＋ｓ１＋ｓ３＋ｓ３＋ｓ５＋ｓ６
    　　ｄ１＝ｒ１＋ｓ１＋ｓ２＋ｓ３＋ｓ５
    　　ｄ２＝ｒ２＋ｓ１＋ｓ４＋ｓ５＋ｓ６
    　　ｄ３＝ｒ３＋ｓ２＋ｓ４＋ｓ５
    で表され、ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３の各３個の前記分割部分データをそれぞれ連結して、Ａ～Ｄの４種類の前記単位部分データを生成することを特徴とするデータ分割装置。     The data dividing device according to claim 4, wherein
    Twelve pieces of divided partial data are generated from one or more of the secret partial data (s1 to s6) and one of the random number partial data (r1 to r3) defined by the divided matrix. The XOR operation formula for
    a1 = r1 + s1 + s2
    a2 = r2 + s3 + s4
    a3 = r3 + s5 + s6
    b1 = r1 + s3 + s5
    b2 = r2 + s1 + s3 + s5 + s6
    b3 = r3 + s2 + s4 + s6
    c1 = r1 + s3 + s4 + s6
    c2 = r2 + s2 + s3 + s4 + s5
    c3 = r3 + s1 + s3 + s3 + s5 + s6
    d1 = r1 + s1 + s2 + s3 + s5
    d2 = r2 + s1 + s4 + s5 + s6
    d3 = r3 + s2 + s4 + s5
    Each of the three divided partial data a1 to a3, b1 to b3, c1 to c3, and d1 to d3 is connected to generate four types of unit partial data A to D. Characteristic data dividing device.
  7. 　請求項６に記載のデータ分割装置において、
    　前記復元行列に基づく、前記分割部分データから前記秘密部分データを生成するためのＸＯＲ演算の式は、前記分割データの種類がＡ、Ｂ、Ｃの場合は、
    　　ｓ１＝ａ２＋ｂ１＋ｂ２＋ｃ１
    　　ｓ２＝ａ１＋ａ２＋ａ３＋ｂ１＋ｃ２＋ｃ３
    　　ｓ３＝ａ１＋ｂ２＋ｃ１＋ｃ２
    　　ｓ４＝ａ２＋ａ３＋ｂ３＋ｃ２
    　　ｓ５＝ａ１＋ａ３＋ｂ１＋ｃ３
    　　ｓ６＝ａ１＋ａ２＋ｂ３＋ｃ１＋ｃ２＋ｃ３
    で表され、前記分割データの種類がＡ、Ｂ、Ｄの場合は、
    　　ｓ１＝ａ１＋ａ３＋ｂ１＋ｂ２＋ｂ３＋ｄ２
    　　ｓ２＝ａ１＋ａ３＋ｂ２＋ｂ３＋ｄ１＋ｄ２
    　　ｓ３＝ａ１＋ａ２＋ａ３＋ｂ１＋ｂ２＋ｄ３
    　　ｓ４＝ａ１＋ａ２＋ａ３＋ｂ１＋ｄ２＋ｄ３
    　　ｓ５＝ａ２＋ａ３＋ｂ１＋ｂ２＋ｄ１＋ｄ３
    　　ｓ６＝ａ２＋ａ３＋ｂ１＋ｂ２＋ｂ３＋ｄ１
    で表され、前記分割データの種類がＡ、Ｃ、Ｄの場合は、
    　　ｓ１＝ａ１＋ａ２＋ａ３＋ｃ２＋ｃ３＋ｄ１
    　　ｓ２＝ａ１＋ｃ１＋ｃ３＋ｄ３
    　　ｓ３＝ａ２＋ｃ１＋ｃ２＋ｃ３＋ｄ１＋ｄ３
    　　ｓ４＝ａ１＋ｃ１＋ｃ２＋ｄ２
    　　ｓ５＝ａ１＋ａ２＋ｃ１＋ｃ２＋ｃ３＋ｄ３
    　　ｓ６＝ａ３＋ｃ２＋ｃ３＋ｄ２
    で表され、前記分割データの種類がＢ、Ｃ、Ｄの場合は、
    　　ｓ１＝ｂ３＋ｃ１＋ｃ２＋ｃ３＋ｄ１＋ｄ２
    　　ｓ２＝ｂ１＋ｂ３＋ｃ１＋ｃ２＋ｃ３＋ｄ２
    　　ｓ３＝ｂ１＋ｂ２＋ｂ３＋ｃ１＋ｄ２＋ｄ３
    　　ｓ４＝ｂ１＋ｂ３＋ｃ１＋ｄ３
    　　ｓ５＝ｂ２＋ｃ１＋ｃ２＋ｄ１
    　　ｓ６＝ｂ２＋ｂ３＋ｃ１＋ｃ２＋ｄ１＋ｄ３
    で表され、ｓ１～ｓ６の６個の前記秘密部分データを連結して前記単位部分データを生成することを特徴とするデータ分割装置。     The data dividing device according to claim 6, wherein
    The formula of the XOR operation for generating the secret partial data from the divided partial data based on the restoration matrix is as follows when the type of the divided data is A, B, C:
    s1 = a2 + b1 + b2 + c1
    s2 = a1 + a2 + a3 + b1 + c2 + c3
    s3 = a1 + b2 + c1 + c2
    s4 = a2 + a3 + b3 + c2
    s5 = a1 + a3 + b1 + c3
    s6 = a1 + a2 + b3 + c1 + c2 + c3
    When the divided data types are A, B, and D,
    s1 = a1 + a3 + b1 + b2 + b3 + d2
    s2 = a1 + a3 + b2 + b3 + d1 + d2
    s3 = a1 + a2 + a3 + b1 + b2 + d3
    s4 = a1 + a2 + a3 + b1 + d2 + d3
    s5 = a2 + a3 + b1 + b2 + d1 + d3
    s6 = a2 + a3 + b1 + b2 + b3 + d1
    And when the type of the divided data is A, C, D,
    s1 = a1 + a2 + a3 + c2 + c3 + d1
    s2 = a1 + c1 + c3 + d3
    s3 = a2 + c1 + c2 + c3 + d1 + d3
    s4 = a1 + c1 + c2 + d2
    s5 = a1 + a2 + c1 + c2 + c3 + d3
    s6 = a3 + c2 + c3 + d2
    When the divided data types are B, C, and D,
    s1 = b3 + c1 + c2 + c3 + d1 + d2
    s2 = b1 + b3 + c1 + c2 + c3 + d2
    s3 = b1 + b2 + b3 + c1 + d2 + d3
    s4 = b1 + b3 + c1 + d3
    s5 = b2 + c1 + c2 + d1
    s6 = b2 + b3 + c1 + c2 + d1 + d3
    A data dividing device characterized in that the unit partial data is generated by concatenating the six secret partial data s1 to s6.
  8. 　請求項６に記載のデータ分割装置において、
    　前記分割処理部は、前記分割行列に基づくＸＯＲ演算の式において、
    　　ｔ１＝ｓ３＋ｓ４
    　　ｔ２＝ｓ１＋ｓ２
    　　ｔ３＝ｓ３＋ｓ５
    　　ｔ４＝ｓ５＋ｓ６
    　　ｔ５＝ｒ３＋ｓ２＋ｓ４
    　　ｔ６＝ｔ２＋ｔ３
    　　ｔ７＝ｒ２＋ｓ１＋ｔ４
    の各式を分割中間式として、前記各分割中間式の値を予め算出しておき、前記分割行列に基づくＸＯＲ演算の際に、前記分割中間式と一致する部分に前記分割中間式の値を代入することを特徴とするデータ分割装置。     The data dividing device according to claim 6, wherein
    In the XOR operation formula based on the partition matrix, the partition processing unit includes:
    t1 = s3 + s4
    t2 = s1 + s2
    t3 = s3 + s5
    t4 = s5 + s6
    t5 = r3 + s2 + s4
    t6 = t2 + t3
    t7 = r2 + s1 + t4
    The values of each of the divided intermediate expressions are calculated in advance, and the value of the divided intermediate expression is set to a portion that matches the divided intermediate expression in the XOR operation based on the divided matrix. A data dividing device characterized by substituting.
  9. 　請求項７に記載のデータ分割装置において、
    　前記復元処理部は、前記復元行列に基づくＸＯＲ演算の式において、前記分割データの種類がＡ、Ｂ、Ｃの場合は、
    　　ｗ１＝ｂ２＋ｃ１
    　　ｗ２＝ａ３＋ｂ１
    　　ｗ３＝ａ１＋ｃ３
    　　ｗ４＝ａ２＋ｃ２
    　　ｗ５＝ｗ３＋ｗ４
    の各式を復元中間式とし、前記分割データの種類がＡ、Ｂ、Ｄの場合は、
    　　ｘ１＝ａ１＋ａ３
    　　ｘ２＝ａ２＋ｂ１
    　　ｘ３＝ｂ２＋ｂ３＋ｄ２＋ｘ１
    　　ｘ４＝ｄ３＋ｘ１＋ｘ２
    　　ｘ５＝ａ３＋ｂ２＋ｄ１＋ｘ２
    の各式を復元中間式とし、前記分割データの種類がＡ、Ｃ、Ｄの場合は、
    　　ｙ１＝ａ２＋ｃ２
    　　ｙ２＝ａ３＋ｃ３
    　　ｙ３＝ｃ２＋ｄ２
    　　ｙ４＝ａ１＋ｃ１
    　　ｙ５＝ｃ３＋ｄ３
    の各式を復元中間式とし、前記分割データの種類がＢ、Ｃ、Ｄの場合は、
    　　ｚ１＝ａ１＋ａ３
    　　ｚ２＝ａ２＋ｂ１
    の各式を復元中間式として、前記各復元中間式の値を予め算出しておき、前記復元行列に基づくＸＯＲ演算の際に、前記復元中間式と一致する部分に前記復元中間式の値を代入することを特徴とするデータ分割装置。     The data dividing device according to claim 7, wherein
    In the XOR operation formula based on the restoration matrix, the restoration processing unit, when the type of the divided data is A, B, C,
    w1 = b2 + c1
    w2 = a3 + b1
    w3 = a1 + c3
    w4 = a2 + c2
    w5 = w3 + w4
    If each of the formulas is a restoration intermediate formula and the types of the divided data are A, B, D,
    x1 = a1 + a3
    x2 = a2 + b1
    x3 = b2 + b3 + d2 + x1
    x4 = d3 + x1 + x2
    x5 = a3 + b2 + d1 + x2
    When each of the above formulas is a restoration intermediate formula and the types of the divided data are A, C, and D,
    y1 = a2 + c2
    y2 = a3 + c3
    y3 = c2 + d2
    y4 = a1 + c1
    y5 = c3 + d3
    If each of the formulas is a restoration intermediate formula and the type of the divided data is B, C, D,
    z1 = a1 + a3
    z2 = a2 + b1
    The values of each of the restoration intermediate expressions are calculated in advance, and the value of the restoration intermediate expression is set to a portion that matches the restoration intermediate expression in the XOR operation based on the restoration matrix. A data dividing device characterized by substituting.
  10. 　秘密データを（３，２，４）ランプ型閾値秘密分散により４個の分割データに分割するデータ分割装置としてコンピュータを機能させるデータ分割プログラムであって、
    　前記秘密データから抽出した長さＳの単位秘密データを長さＳ／６の６個の秘密部分データに分割するステップと、
    　長さＳ／６の３個の乱数部分データを生成するステップと、
    　前記秘密部分データ、前記乱数部分データ、および前記秘密部分データのうちの１個以上と前記乱数部分データのうちの１個から分割部分データを生成するためのＸＯＲ演算を定義した分割行列に基づいて、１２個の前記分割部分データを生成するステップと、
    　それぞれ異なる前記乱数部分データを含むＸＯＲ演算により生成された３個の前記分割部分データを連結して４種類の長さＳ／２の単位分割データを生成するステップと、
    　前記単位分割データを種類毎に連結して４個の分割データを生成するステップとを実行することを特徴とするデータ分割プログラム。     A data division program that causes a computer to function as a data division device that divides secret data into four divided data by (3, 2, 4) ramp-type threshold secret sharing,
    Dividing unit secret data of length S extracted from the secret data into six pieces of secret partial data of length S / 6;
    Generating three random number partial data of length S / 6;
    Based on a division matrix defining an XOR operation for generating divided partial data from one or more of the secret partial data, the random number partial data, and the secret partial data and one of the random number partial data Generating twelve pieces of partial data;
    Concatenating three pieces of the divided partial data generated by the XOR operation including the different random number partial data to generate four types of unit divided data of length S / 2;
    And a step of generating four pieces of divided data by connecting the unit divided data for each type.
  11. 　請求項１０に記載のデータ分割プログラムにおいて、
    　３個の前記分割データのそれぞれから抽出した長さＳ／２の前記単位分割データから３個の前記分割部分データをそれぞれ抽出するステップと、
    　前記分割データの種類の組み合わせを特定するステップと、
    　前記分割データの種類の組み合わせに対応した前記分割行列の部分行列に対する逆行列である復元行列に基づく、抽出した前記分割部分データのＸＯＲ演算により、６個の前記秘密部分データを生成するステップと、
    　生成した前記秘密部分データを連結して長さＳの前記単位秘密データを生成するステップと、
    　生成した前記単位秘密データを連結して前記秘密データを生成する復元処理部を有することを特徴とするデータ分割プログラム。     The data division program according to claim 10,
    Extracting each of the three divided partial data from the unit divided data of length S / 2 extracted from each of the three divided data;
    Identifying a combination of types of the divided data;
    Generating six pieces of the secret partial data by XOR operation of the extracted partial partial data based on a restoration matrix that is an inverse matrix for the partial matrix of the partial matrix corresponding to the combination of the types of the divided data;
    Concatenating the generated secret partial data to generate the unit secret data of length S;
    A data division program, comprising: a restoration processing unit that concatenates the generated unit secret data to generate the secret data.
  12. 　請求項１０に記載のデータ分割プログラムにおいて、
    　前記分割行列により定義された、前記秘密部分データ（ｓ１～ｓ６）のうちの１個以上と前記乱数部分データ（ｒ１～ｒ３）のうちの１個から、１２個の前記分割部分データを生成するためのＸＯＲ演算の式は、
    　　ａ１＝ｒ１＋ｓ１＋ｓ２
    　　ａ２＝ｒ２＋ｓ３＋ｓ４
    　　ａ３＝ｒ３＋ｓ５＋ｓ６
    　　ｂ１＝ｒ１＋ｓ３＋ｓ５
    　　ｂ２＝ｒ２＋ｓ１＋ｓ３＋ｓ５＋ｓ６
    　　ｂ３＝ｒ３＋ｓ２＋ｓ４＋ｓ６
    　　ｃ１＝ｒ１＋ｓ３＋ｓ４＋ｓ６
    　　ｃ２＝ｒ２＋ｓ２＋ｓ３＋ｓ４＋ｓ５
    　　ｃ３＝ｒ３＋ｓ１＋ｓ３＋ｓ３＋ｓ５＋ｓ６
    　　ｄ１＝ｒ１＋ｓ１＋ｓ２＋ｓ３＋ｓ５
    　　ｄ２＝ｒ２＋ｓ１＋ｓ４＋ｓ５＋ｓ６
    　　ｄ３＝ｒ３＋ｓ２＋ｓ４＋ｓ５
    で表され、ａ１～ａ３、ｂ１～ｂ３、ｃ１～ｃ３、ｄ１～ｄ３の各３個の前記分割部分データをそれぞれ連結して、Ａ～Ｄの４種類の前記単位部分データを生成することを特徴とするデータ分割プログラム。     The data division program according to claim 10,
    Twelve pieces of divided partial data are generated from one or more of the secret partial data (s1 to s6) and one of the random number partial data (r1 to r3) defined by the divided matrix. The XOR operation formula for
    a1 = r1 + s1 + s2
    a2 = r2 + s3 + s4
    a3 = r3 + s5 + s6
    b1 = r1 + s3 + s5
    b2 = r2 + s1 + s3 + s5 + s6
    b3 = r3 + s2 + s4 + s6
    c1 = r1 + s3 + s4 + s6
    c2 = r2 + s2 + s3 + s4 + s5
    c3 = r3 + s1 + s3 + s3 + s5 + s6
    d1 = r1 + s1 + s2 + s3 + s5
    d2 = r2 + s1 + s4 + s5 + s6
    d3 = r3 + s2 + s4 + s5
    Each of the three divided partial data a1 to a3, b1 to b3, c1 to c3, and d1 to d3 is connected to generate four types of unit partial data A to D. A featured data partitioning program.
  13. 　請求項１１に記載のデータ分割プログラムにおいて、
    　前記復元行列に基づく、前記分割部分データから前記秘密部分データを生成するためのＸＯＲ演算の式は、前記分割データの種類がＡ、Ｂ、Ｃの場合は、
    　　ｓ１＝ａ２＋ｂ１＋ｂ２＋ｃ１
    　　ｓ２＝ａ１＋ａ２＋ａ３＋ｂ１＋ｃ２＋ｃ３
    　　ｓ３＝ａ１＋ｂ２＋ｃ１＋ｃ２
    　　ｓ４＝ａ２＋ａ３＋ｂ３＋ｃ２
    　　ｓ５＝ａ１＋ａ３＋ｂ１＋ｃ３
    　　ｓ６＝ａ１＋ａ２＋ｂ３＋ｃ１＋ｃ２＋ｃ３
    で表され、前記分割データの種類がＡ、Ｂ、Ｄの場合は、
    　　ｓ１＝ａ１＋ａ３＋ｂ１＋ｂ２＋ｂ３＋ｄ２
    　　ｓ２＝ａ１＋ａ３＋ｂ２＋ｂ３＋ｄ１＋ｄ２
    　　ｓ３＝ａ１＋ａ２＋ａ３＋ｂ１＋ｂ２＋ｄ３
    　　ｓ４＝ａ１＋ａ２＋ａ３＋ｂ１＋ｄ２＋ｄ３
    　　ｓ５＝ａ２＋ａ３＋ｂ１＋ｂ２＋ｄ１＋ｄ３
    　　ｓ６＝ａ２＋ａ３＋ｂ１＋ｂ２＋ｂ３＋ｄ１
    で表され、前記分割データの種類がＡ、Ｃ、Ｄの場合は、
    　　ｓ１＝ａ１＋ａ２＋ａ３＋ｃ２＋ｃ３＋ｄ１
    　　ｓ２＝ａ１＋ｃ１＋ｃ３＋ｄ３
    　　ｓ３＝ａ２＋ｃ１＋ｃ２＋ｃ３＋ｄ１＋ｄ３
    　　ｓ４＝ａ１＋ｃ１＋ｃ２＋ｄ２
    　　ｓ５＝ａ１＋ａ２＋ｃ１＋ｃ２＋ｃ３＋ｄ３
    　　ｓ６＝ａ３＋ｃ２＋ｃ３＋ｄ２
    で表され、前記分割データの種類がＢ、Ｃ、Ｄの場合は、
    　　ｓ１＝ｂ３＋ｃ１＋ｃ２＋ｃ３＋ｄ１＋ｄ２
    　　ｓ２＝ｂ１＋ｂ３＋ｃ１＋ｃ２＋ｃ３＋ｄ２
    　　ｓ３＝ｂ１＋ｂ２＋ｂ３＋ｃ１＋ｄ２＋ｄ３
    　　ｓ４＝ｂ１＋ｂ３＋ｃ１＋ｄ３
    　　ｓ５＝ｂ２＋ｃ１＋ｃ２＋ｄ１
    　　ｓ６＝ｂ２＋ｂ３＋ｃ１＋ｃ２＋ｄ１＋ｄ３
    で表され、ｓ１～ｓ６の６個の前記秘密部分データを連結して前記単位部分データを生成することを特徴とするデータ分割プログラム。     The data division program according to claim 11,
    The formula of the XOR operation for generating the secret partial data from the divided partial data based on the restoration matrix is as follows when the type of the divided data is A, B, C:
    s1 = a2 + b1 + b2 + c1
    s2 = a1 + a2 + a3 + b1 + c2 + c3
    s3 = a1 + b2 + c1 + c2
    s4 = a2 + a3 + b3 + c2
    s5 = a1 + a3 + b1 + c3
    s6 = a1 + a2 + b3 + c1 + c2 + c3
    When the divided data types are A, B, and D,
    s1 = a1 + a3 + b1 + b2 + b3 + d2
    s2 = a1 + a3 + b2 + b3 + d1 + d2
    s3 = a1 + a2 + a3 + b1 + b2 + d3
    s4 = a1 + a2 + a3 + b1 + d2 + d3
    s5 = a2 + a3 + b1 + b2 + d1 + d3
    s6 = a2 + a3 + b1 + b2 + b3 + d1
    And when the type of the divided data is A, C, D,
    s1 = a1 + a2 + a3 + c2 + c3 + d1
    s2 = a1 + c1 + c3 + d3
    s3 = a2 + c1 + c2 + c3 + d1 + d3
    s4 = a1 + c1 + c2 + d2
    s5 = a1 + a2 + c1 + c2 + c3 + d3
    s6 = a3 + c2 + c3 + d2
    When the divided data types are B, C, and D,
    s1 = b3 + c1 + c2 + c3 + d1 + d2
    s2 = b1 + b3 + c1 + c2 + c3 + d2
    s3 = b1 + b2 + b3 + c1 + d2 + d3
    s4 = b1 + b3 + c1 + d3
    s5 = b2 + c1 + c2 + d1
    s6 = b2 + b3 + c1 + c2 + d1 + d3
    A data division program characterized in that the unit partial data is generated by concatenating six secret partial data s1 to s6.
  14. 　請求項１２に記載のデータ分割プログラムにおいて、
    　前記分割行列に基づくＸＯＲ演算により前記分割部分データを生成するステップの前に、前記分割行列に基づくＸＯＲ演算の式において、
    　　ｔ１＝ｓ３＋ｓ４
    　　ｔ２＝ｓ１＋ｓ２
    　　ｔ３＝ｓ３＋ｓ５
    　　ｔ４＝ｓ５＋ｓ６
    　　ｔ５＝ｒ３＋ｓ２＋ｓ４
    　　ｔ６＝ｔ２＋ｔ３
    　　ｔ７＝ｒ２＋ｓ１＋ｔ４
    の各式を分割中間式として、前記各分割中間式の値を予め算出しておくステップを実行し、
    　前記分割行列に基づくＸＯＲ演算により前記分割部分データを生成するステップにおいて、前記分割中間式と一致する部分に前記分割中間式の値を代入することを特徴とするデータ分割プログラム。     The data division program according to claim 12,
    Before the step of generating the divided partial data by the XOR operation based on the partition matrix, in the formula of the XOR operation based on the partition matrix,
    t1 = s3 + s4
    t2 = s1 + s2
    t3 = s3 + s5
    t4 = s5 + s6
    t5 = r3 + s2 + s4
    t6 = t2 + t3
    t7 = r2 + s1 + t4
    Each of the formulas as divided intermediate formulas, and executing the step of calculating the value of each divided intermediate formula in advance,
    In the step of generating the divided partial data by an XOR operation based on the divided matrix, a value of the divided intermediate expression is substituted into a portion that matches the divided intermediate expression.
  15. 　請求項１３に記載のデータ分割プログラムにおいて、
    　前記復元行列に基づくＸＯＲ演算により前記秘密部分データを生成するステップの前に、前記復元行列に基づくＸＯＲ演算の式において、前記分割データの種類がＡ、Ｂ、Ｃの場合は、
    　　ｗ１＝ｂ２＋ｃ１
    　　ｗ２＝ａ３＋ｂ１
    　　ｗ３＝ａ１＋ｃ３
    　　ｗ４＝ａ２＋ｃ２
    　　ｗ５＝ｗ３＋ｗ４
    の各式を復元中間式とし、前記分割データの種類がＡ、Ｂ、Ｄの場合は、
    　　ｘ１＝ａ１＋ａ３
    　　ｘ２＝ａ２＋ｂ１
    　　ｘ３＝ｂ２＋ｂ３＋ｄ２＋ｘ１
    　　ｘ４＝ｄ３＋ｘ１＋ｘ２
    　　ｘ５＝ａ３＋ｂ２＋ｄ１＋ｘ２
    の各式を復元中間式とし、前記分割データの種類がＡ、Ｃ、Ｄの場合は、
    　　ｙ１＝ａ２＋ｃ２
    　　ｙ２＝ａ３＋ｃ３
    　　ｙ３＝ｃ２＋ｄ２
    　　ｙ４＝ａ１＋ｃ１
    　　ｙ５＝ｃ３＋ｄ３
    の各式を復元中間式とし、前記分割データの種類がＢ、Ｃ、Ｄの場合は、
    　　ｚ１＝ａ１＋ａ３
    　　ｚ２＝ａ２＋ｂ１
    の各式を復元中間式として、前記各復元中間式の値を予め算出しておくステップを実行し、
    　前記復元行列に基づくＸＯＲ演算により前記秘密部分データを生成するステップにおいて、前記復元中間式と一致する部分に前記復元中間式の値を代入することを特徴とするデータ分割プログラム。
     
     
     
     
     
     
          In the data division program according to claim 13,
    Before the step of generating the secret partial data by the XOR operation based on the restoration matrix, in the XOR operation formula based on the restoration matrix, when the type of the divided data is A, B, C,
    w1 = b2 + c1
    w2 = a3 + b1
    w3 = a1 + c3
    w4 = a2 + c2
    w5 = w3 + w4
    If each of the formulas is a restoration intermediate formula and the types of the divided data are A, B, D,
    x1 = a1 + a3
    x2 = a2 + b1
    x3 = b2 + b3 + d2 + x1
    x4 = d3 + x1 + x2
    x5 = a3 + b2 + d1 + x2
    When each of the above formulas is a restoration intermediate formula and the types of the divided data are A, C, and D,
    y1 = a2 + c2
    y2 = a3 + c3
    y3 = c2 + d2
    y4 = a1 + c1
    y5 = c3 + d3
    If each of the formulas is a restoration intermediate formula and the type of the divided data is B, C, D,
    z1 = a1 + a3
    z2 = a2 + b1
    And performing the step of calculating the value of each restoration intermediate expression in advance,
    In the step of generating the secret partial data by an XOR operation based on the restoration matrix, a data division program characterized by substituting the value of the restoration intermediate expression for a portion that matches the restoration intermediate expression.






PCT/JP2011/077431 2011-11-28 2011-11-28 Data dividing device and data dividing program WO2013080290A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2011/077431 WO2013080290A1 (en) 2011-11-28 2011-11-28 Data dividing device and data dividing program
JP2013500690A JP5530025B2 (en) 2011-11-28 2011-11-28 Data division apparatus and data division program

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2011/077431 WO2013080290A1 (en) 2011-11-28 2011-11-28 Data dividing device and data dividing program

Publications (1)

Publication Number Publication Date
WO2013080290A1 true WO2013080290A1 (en) 2013-06-06

Family

ID=48534818

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2011/077431 WO2013080290A1 (en) 2011-11-28 2011-11-28 Data dividing device and data dividing program

Country Status (2)

Country Link
JP (1) JP5530025B2 (en)
WO (1) WO2013080290A1 (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2017040851A (en) * 2015-08-21 2017-02-23 富士フイルム株式会社 Secret distribution device, data restoration device, secret distribution method, data restoration method and control program therefor
JP6300293B1 (en) * 2017-07-07 2018-03-28 株式会社Ａｓｊ Encoding / decoding structure and distributed data system using the same
WO2019008792A1 (en) * 2017-07-07 2019-01-10 株式会社Ａｓｊ Encoding/decoding structure, and distribution data system using same

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005303776A (en) * 2004-04-14 2005-10-27 Nippon Telegr & Teleph Corp <Ntt> Electronic data encoding device, electronic data decoding device, and program
JP2006352357A (en) * 2005-06-14 2006-12-28 Fujitsu Ltd Communication control unit and communication control method
JP2009037093A (en) * 2007-08-03 2009-02-19 Kddi Corp Apparatus for generating distributed information, apparatus for restoring secret information, method for generating distributed information, secret method for restoring secret information and program
JP2009182375A (en) * 2008-01-29 2009-08-13 Kddi Corp Device for generating distributed information, device for recovering secret information, method for generating distributed information, method and program for recovering secret information
JP2011004206A (en) * 2009-06-19 2011-01-06 Kddi Corp Distribution information generation device, secret information restoring device, distribution information generation method, secret information restoring method and program

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005303776A (en) * 2004-04-14 2005-10-27 Nippon Telegr & Teleph Corp <Ntt> Electronic data encoding device, electronic data decoding device, and program
JP2006352357A (en) * 2005-06-14 2006-12-28 Fujitsu Ltd Communication control unit and communication control method
JP2009037093A (en) * 2007-08-03 2009-02-19 Kddi Corp Apparatus for generating distributed information, apparatus for restoring secret information, method for generating distributed information, secret method for restoring secret information and program
JP2009182375A (en) * 2008-01-29 2009-08-13 Kddi Corp Device for generating distributed information, device for recovering secret information, method for generating distributed information, method and program for recovering secret information
JP2011004206A (en) * 2009-06-19 2011-01-06 Kddi Corp Distribution information generation device, secret information restoring device, distribution information generation method, secret information restoring method and program

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
TORU TAKAARA: "A Fast (k,L,n)-Threshold Secret Sharing ramp Scheme using XOR Operations", COMPUTER SECURITY SYMPOSIUM 2009, vol. 2, 19 October 2009 (2009-10-19), pages 949 - 954 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2017040851A (en) * 2015-08-21 2017-02-23 富士フイルム株式会社 Secret distribution device, data restoration device, secret distribution method, data restoration method and control program therefor
JP6300293B1 (en) * 2017-07-07 2018-03-28 株式会社Ａｓｊ Encoding / decoding structure and distributed data system using the same
WO2019008792A1 (en) * 2017-07-07 2019-01-10 株式会社Ａｓｊ Encoding/decoding structure, and distribution data system using same
US11064024B1 (en) 2017-07-07 2021-07-13 Asj Inc. Encoding/decoding structure and distributed data system using the same

Also Published As

Publication number Publication date
JP5530025B2 (en) 2014-06-25
JPWO2013080290A1 (en) 2015-04-27

Similar Documents

Publication Publication Date Title
US10608813B1 (en) Layered encryption for long-lived data
US9209971B2 (en) Method and system for shielding data in untrusted environments
US20160344553A1 (en) Storing and retrieving ciphertext in data storage
CN104520873A (en) Systems and methods for securing and restoring virtual machines
US10601580B2 (en) Secure order preserving string compression
WO2019114122A1 (en) Encryption method for login information, device, electronic device, and medium
US10476663B1 (en) Layered encryption of short-lived data
CN110391895B (en) Data preprocessing method, ciphertext data acquisition method, device and electronic equipment
WO2014007296A1 (en) Order-preserving encryption system, encryption device, decryption device, encryption method, decryption method, and programs thereof
CN104618096A (en) Method and device for protecting secret key authorized data, and TPM (trusted platform module) secrete key management center
Latha et al. Block based data security and data distribution on multi cloud environment
Sivakumar et al. Securing data and reducing the time traffic using AES encryption with dual cloud
KR20200143197A (en) Data management device that enables distributed encryption management of data based on blockchain and operating method thereof
JP2023008395A (en) Secure, robust federated learning system by multi-party type homomorphic encryption and federated learning method
CN109544164A (en) A kind of encryption system based on internet payment, method and storage medium
US20190132133A1 (en) Associating identical fields encrypted with different keys
CN112000978B (en) Private data output method, data processing system and storage medium
JP5530025B2 (en) Data division apparatus and data division program
US10929151B2 (en) Computer-implemented method for replacing a data string by a placeholder
US11356254B1 (en) Encryption using indexed data from large data pads
EP4080488B1 (en) Secret random number generation system, secret calculation device, secret random number generation method, and program
US9336363B2 (en) Method and system for secure deployment of information technology (IT) solutions in untrusted environments
CN116132065A (en) Key determination method, device, computer equipment and storage medium
JP6693503B2 (en) Secret search system, server device, secret search method, search method, and program
KR20150002821A (en) Method for protecting confidentiality of a file distributed and stored at a plurality of storage service providers

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2013500690

Country of ref document: JP

Kind code of ref document: A

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11876814

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11876814

Country of ref document: EP

Kind code of ref document: A1