WO2023124364A1

WO2023124364A1 - Anti-fraud secret sharing methods and apparatuses

Info

Publication number: WO2023124364A1
Application number: PCT/CN2022/124345
Authority: WO
Inventors: 张龙; 范瑞彬; 张开翔; 毛嘉宇; 储雨知; 王越; 张俊麒
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2021-12-27
Filing date: 2022-10-10
Publication date: 2023-07-06
Also published as: CN114297487A

Abstract

Provided in the present application are anti-fraud secret sharing methods and apparatuses, which are used for solving the safety hypothesis problem in a secret sharing process. A method comprises: in a secret distribution process, a secret distributor not only provides secret fragments, but also provides a verifiable commitment of the secret fragments. Therefore, while ensuring no leakage of the secret fragments and original secret information, secret fragment holders can verify the correctness of the received secret fragments according to the verifiable commitment, thus ensuring that the original secret can be restored and the correctness can be verified at the secret recovery stage.

Description

Anti-fraud secret sharing method and device

Cross References to Related Applications

This application claims priority to a Chinese patent application filed with the China Patent Office on December 27, 2021, with application number 202111617418.3 and titled "An Anti-fraud Secret Sharing Method and Device", the entire contents of which are hereby incorporated by reference In this application.

technical field

The present application relates to the field of computer technology, in particular to a fraud-proof secret sharing method and device.

Background technique

For any secret S, especially one involving collective interests, the security of the secret is of paramount importance. If the secret is in the hands of a single point, there will be a single point of risk, and the single point can do whatever it wants. If the secret is divided into w parts and handed over to w single points for management, the secret can be restored by collecting the secret fragments in the hands of w single points when necessary. Dissatisfied decisions or lost secret slices will make it impossible to recover the secret.

To solve this problem, the secret sharing method in the prior art provides a certain fault-tolerant mechanism, that is, the secret is divided into w shares, which are respectively handed over to w single points for management, but only t (t<=w) single points are required. Click on the secret slice in your hand to restore the original secret text, and it is not necessary for all secret slice holders to participate to ensure the security of the secret.

However, the above secret sharing algorithm is based on some security assumptions, that is, the secret distributor and the secret slice holder are honest. However, in practical situations, participants may be dishonest, so there must be some security risks. For example, if the secret distributor is malicious and the secret shard sent to the shard holder is wrong, then in the secret recovery phase, enough secret shards cannot recover the correct secret. If the shard holder does evil and provides wrong secret shards, then in the secret recovery phase, the correct secret cannot be recovered based on the collected secret shards.

To sum up, the existing secret sharing algorithm is insecure and not anti-fraud.

Contents of the invention

The present application provides an anti-fraud secret sharing method and device, which are used to prevent fraud during the secret sharing process and improve the security of secret sharing.

In the first aspect, the embodiment of the present application provides a fraud-proof secret sharing method, which can be applied to secret distributors. The method includes: according to the secret polynomial f(x) and the number W of secret slice holders, generating W secret slices of the secret S; generate a polynomial commitment C corresponding to the secret S, and broadcast the polynomial commitment C to the W secret slice holders, and the polynomial commitment C is used for the secret slice The slice holder verifies the received secret slice; distributes the W secret slices to the W secret slice holders.

In the above technical solution, in the secret distribution stage, the secret distributor not only needs to provide the secret slice, but also needs to provide a polynomial commitment that can prove that the secret slice is correct, and the promise will not disclose any information about the secret slice and the original secret. Therefore, the secret distribution phase and the secret recovery phase can verify the correctness of the secret slice, thereby ensuring that the secret sharing algorithm is fraud-proof.

In a possible design, the secret polynomial f(x) is: f(x)=S+a ₁ *x ¹ +a ₂ *x ² +...+a _t-1 * x ^t-1 mod p ; Among them, a _j is a polynomial coefficient, 0≤j≤t-1, p is a prime number.

In a possible design, generating W secret slices of the secret S according to the secret polynomial f(x) and the number W of secret slice holders includes: randomly selecting W unequal x values { x ₁ , x ₂ ,…,x _w }, respectively substitute into the secret polynomial f(x), calculate the corresponding y value {y ₁ ,y ₂ ,…,y _w }, and obtain the W secret slices {S ₁ , S ₂ ,...,S _w }; where, the i-th secret slice S _i =( _xi ,y _i ), 0<i≤w.

In a possible design, the polynomial commitment C={c ₀ ,c ₁ ,...,c _t-1 }, t is the secret recovery threshold, 0<t≤W; the method further includes: according to the formula

Generate the polynomial commitment C; wherein, a ₀ =S, g is a constant prime number.

In the second aspect, the embodiment of this application provides another anti-fraud secret sharing method, which can be applied to the secret slice holder, and the method includes: receiving the polynomial commitment C corresponding to the secret S from the secret distributor; receiving A secret slice S _i of the secret S from the secret distributor; according to the polynomial commitment C, the correctness of the secret slice S _i is verified.

In the above technical solution, in the secret distribution stage, after receiving the polynomial commitment broadcast by the secret distributor and the secret slice distributed to itself, the secret slice holder can verify the correctness of the received secret slice according to the polynomial commitment. Verification, in order to timely identify the situation where the secret distributor distributes the wrong secret slice, so as to avoid security risks caused by the dishonesty of the secret distributor.

In one possible design, the polynomial commitment C={c ₀ ,c ₁ ,...,c _t-1 }; where,

0≤j≤t-1, 0<t≤W, t is the secret restoration threshold, W is the number of secret slice holders, a _j is the polynomial coefficient, a ₀ =S, g is a constant prime number, p is a prime number .

In a possible design, the verification of the secret slice S _i according to the polynomial commitment C includes: if the secret slice S _i (xi _, y _i ) satisfies the formula:

Then it is determined that the verification is successful, otherwise the verification fails.

In the third aspect, the embodiment of the present application provides another anti-fraud secret sharing method, which can be applied to the secret restorer, and the method includes: collecting t secret slices S _i of the secret S; according to the t secret slices S _i , recover the secret S; verify the correctness of the recovered secret S according to the polynomial commitment C corresponding to the secret S.

In the above technical solution, in the secret recovery phase, the secret recoverer can verify the correctness of the secret S recovered by using at least t secret slices S _i collected according to the parameters in the polynomial commitment, so as to identify the secret slices in time The holder provides the wrong secret slice, so as to avoid the security risks caused by the dishonesty of the secret slice holder.

In a possible design, the verifying the correctness of the restored secret S according to the polynomial commitment C corresponding to the secret S includes: if the restored secret S satisfies the formula:

g ^S mod p, it is determined that the recovery is successful, otherwise the recovery fails.

In the fourth aspect, the embodiment of the present application provides a fraud-proof secret sharing device, which may be a device of the secret distributor or a chip or circuit configured in the device of the secret distributor, and the device includes:

A processing module, configured to generate W secret slices of the secret S according to the secret polynomial f(x) and the number W of secret slice holders;

The processing module is further configured to generate a polynomial commitment C corresponding to the secret S, and broadcast the polynomial commitment C to the W secret slice holders, and the polynomial commitment C is used for the secret slice The holder verifies the received secret slice;

A communication module, configured to distribute the W secret slices to the W secret slice holders.

In a possible design, the secret polynomial f(x) is: f(x)=S+a ₁ *x ¹ +a ₂ *x ² +...+a _t-1 *x ^t-1 mod p ; Among them, a _j is a polynomial coefficient, 0≤j≤t-1, p is a prime number.

In a possible design, the processing module is specifically configured to: randomly select W unequal x values {x ₁ , x ₂ ,...,x _w }, respectively substitute them into the secret polynomial f(x), and calculate The corresponding y values {y ₁ , y ₂ ,...,y _w }, get the W secret slices {S ₁ , S ₂ ,...,S _w }; where, the i-th secret slice S _i = (x _i ,y _i ), 0<i≤w.

In a possible design, the polynomial commitment C={c ₀ ,c ₁ ,...,c _t-1 }, t is the secret recovery threshold, 0<t≤W; the processing module is specifically used for: according to formula

In the fifth aspect, the embodiment of the present application provides another anti-fraud secret sharing device, which can be the device of the secret slice holder or a chip or circuit configured in the device of the secret slice holder. include:

The communication module is used to receive the polynomial commitment C corresponding to the secret S from the secret distributor;

The communication module is further configured to receive a secret slice S _i of the secret S from the secret distributor;

A processing module, configured to verify the correctness of the secret slice S _i according to the polynomial commitment C.

In a possible design, the processing module is specifically configured to: if the secret slice S _i ( _xi , y _i ) satisfies the formula:

In the sixth aspect, the embodiment of the present application provides another anti-fraud secret sharing device, which may be the device of the secret restorer or a chip or circuit configured in the device of the secret restorer, and the device includes:

A communication module, configured to collect at least t secret slices S _i of said secret S;

A processing module, configured to restore the secret S according to the collected at least t secret slices S _i ;

The processing module is further configured to verify the correctness of the recovered secret S according to the polynomial commitment C corresponding to the secret S.

In a possible design, the processing module is specifically configured to: if the restored secret S satisfies the formula:

Then it is determined that the recovery is successful, otherwise the recovery fails.

In the seventh aspect, the embodiment of the present application also provides a computer device, including:

memory for storing program instructions;

The processor is configured to call the program instructions stored in the memory, and execute the method as described in various possible designs of the first aspect or the second aspect or the third aspect according to the obtained program instructions.

In the eighth aspect, the embodiment of the present application also provides a computer-readable storage medium, in which computer-readable instructions are stored, and when the computer reads and executes the computer-readable instructions, the above-mentioned first aspect or the second aspect or The method described in any possible design of the third aspect is realized.

In the ninth aspect, the embodiment of the present application also provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed by a processor, any one of the above-mentioned first aspect, second aspect, or third aspect The method implementation described in Possible Design.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings that need to be used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For Those skilled in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a schematic flowchart of a fraud-proof secret sharing method provided by an embodiment of the present application;

Fig. 2 is a schematic diagram of the secret slice calculation process in the embodiment of the present application;

FIG. 3 is a schematic flowchart of another anti-fraud secret sharing method provided by the embodiment of the present application;

FIG. 4 is a schematic flow diagram of the secret distribution process in the embodiment of the present application;

FIG. 5 is a schematic flowchart of another anti-fraud secret sharing method provided by the embodiment of the present application;

FIG. 6 is a schematic flow diagram of the secret recovery process in the embodiment of the present application;

FIG. 7 is a schematic structural diagram of an anti-fraud secret sharing device provided by an embodiment of the present application;

FIG. 8 is a schematic structural diagram of a computer device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the application clearer, the application will be further described in detail below in conjunction with the accompanying drawings. Apparently, the described embodiments are only some of the embodiments of the application, not all of them. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of this application.

In the embodiment of the present application, a plurality refers to two or more than two. Words such as "first" and "second" are only used for the purpose of distinguishing descriptions, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

First, the relevant technical terms involved in the embodiment of the present application are explained.

Fragmentation and restoration: The process in which a data is decomposed into several fragments is called fragmentation. The process of restoring these fragments to original data is called restoration.

Threshold sharding restoration: If a piece of data is decomposed into n pieces, the original data can be restored if and only after k pieces are collected, which is called (n,k) threshold sharding and restoration.

Aiming at the security assumptions existing in the secret sharing algorithm in the prior art, the embodiment of the present application provides a fraud-proof secret sharing method, which can ensure the secret distribution stage and the secret The recovery phase can verify the correctness of the secret slice, so that the secret sharing process can prevent fraud, and the correct secret S can be recovered according to the normal logic.

The secret sharing process in this application includes the secret distribution stage and the secret sharing stage, wherein the secret distribution stage is mainly: the secret distributor divides the secret and distributes it to multiple secret fragment holders, and provides a computable commitment at the same time, The secret slice holder verifies the correctness of the received secret slice according to the computable commitment; the secret recovery stage is mainly: the secret restorer collects enough secret slices, restores the secret, and restores the secret according to the computable commitment The final secret is verified for correctness.

Fig. 1 exemplarily shows a fraud-proof secret sharing method provided by the embodiment of the present application, which is applicable to the secret distribution stage in the secret sharing process, and can be specifically executed by the secret distributor.

As shown in Figure 1, the method includes:

Step 101, the secret distributor generates W secret slices of the secret S according to the secret polynomial f(x) and the number W of secret slice holders.

In this application, when the secret distributor needs to share the secret S, he first constructs a secret polynomial f(x) for obfuscating and encrypting the secret. The secret polynomial f(x) can be expressed as follows:

f(x)＝S+a ₁ *x ¹ +a ₂ *x ² +…+a _t-1 *x ^t-1 mod p

Among them, a _j is a polynomial coefficient, 0≤j≤t-1, t is the secret restoration threshold, 0<t≤W, mod means modulo, and p is a prime number. It should be noted that the polynomial coefficients in the above secret polynomial f(x) may be randomly generated by the secret distributor, and only known by the secret distributor. Furthermore, S<p.

Furthermore, the secret distributor can perform specific operations on the secret S based on the secret polynomial f(x) to obtain W secret slices S _i (0<i≤w). Specifically, as shown in Figure 2, since f(x) is a unary function of x, the secret distributor can randomly select W unequal values of x {x ₁ ,x ₂ ,…,x _w }, and substitute them into the Describe the secret polynomial f(x), calculate the corresponding y value {y ₁ ,y ₂ ,…,y _w }, and get w points: {(x ₁ ,y ₁ ),(x ₂ ,y ₂ ),…, (x _w ,y _w )}. Each point is a secret slice S _i =(x _i , y _i ), 0<i≤w, a total of W secret slices {S ₁ , S ₂ ,...,S _w }.

Since the secret slice S _i contains part of the secret, but it is impossible to get all of the secret, the security of the secret can be ensured by distributing the secret slice S _i .

Step 102, the secret distributor generates a polynomial commitment C corresponding to the secret S, and broadcasts the polynomial commitment C to the W secret slice holders, and the polynomial commitment C is used for the secret slice holding The author verifies the received secret slice.

In this application, the polynomial commitment C can be expressed as C={c ₀ ,c ₁ ,...,c _t-1 }; where,

0≤j≤t-1, g is a constant prime number, a ₀ =S. That is to say:

...

After the secret distributor calculates the polynomial commitment C, it can broadcast the polynomial commitment C to W secret slice holders. Since the polynomial commitment C is an operation on a finite field, obtaining the polynomial commitment C cannot obtain (or calculate) the secret slice S _i or the original secret S.

The polynomial commitment C may also be called a computable commitment or a verifiable commitment, which is not specifically limited in this application.

Step 103, the secret distributor distributes the W secret slices to the W secret slice holders.

After completing the broadcast of the polynomial commitment C, the secret distributor can distribute W secret slices to the corresponding secret slice holders, that is, distribute the secret slice S _i =( _xi ,y _i ) to the secret slice holders There are P _i , 0<i≤w.

After completing the distribution of the secret slices, the secret distributor can disclose the p value in the secret polynomial and destroy the secret polynomial. So far, each secret slice holder _Pi has a secret slice S _i and a set of identical polynomial commitments C={c ₀ ,c ₁ ,…,c _t-1 }.

Fig. 3 exemplarily shows another anti-fraud secret sharing method provided by the embodiment of the present application, which is applicable to the secret distribution stage in the secret sharing process, and can be specifically executed by the secret slice holder. As shown in Figure 3, the method includes:

Step 301, the secret slice holder receives the polynomial commitment C corresponding to the secret S from the secret distributor.

Step 302, the secret slice holder receives a secret slice S _i of the secret S from the secret distributor.

Step 303, the secret slice holder verifies the correctness of the secret slice S _i according to the polynomial commitment C.

In this application, after the secret slice holder receives the secret slice distributed by the secret distributor, he can verify the correctness of the secret slice according to the following formula:

The secret slice holder P _i can substitute the secret slice S _i =( _xi ,y _i ) held by him into the above formula, and calculate the results on the left and right sides of the equal sign respectively. Since the polynomial commitment C binds the coefficients of the secret polynomial f(x), if the secret slice S _i is correct, the above equation will be established, that is, the results on the left and right sides of the equal sign are equal, indicating that the verification is successful, and the secret slice The slice holder _Pi can accept the secret slice S _i . If the secret slice S _i is incorrect, the above equation will not hold true, that is, the results on the left and right sides of the equal sign are not equal, indicating that the verification fails, and the secret slice holder _Pi can reject the secret slice S _i , for example The secret slice S _i can be discarded.

Why does the equation hold when the secret slice S _i is correct.

For the left side of the equation, the proof is as follows:

Optionally, after completing the verification of the secret slice S _i , the secret slice holder P _i may send feedback information to the secret distributor, and the feedback information is used to indicate acceptance or rejection of the secret slice S _i , or Said is used to indicate the success or failure of the verification of the secret segment S _i .

It should be noted that, in the process of secret sharing, each secret slice holder among the W secret slice holders, after receiving the secret slice distributed to him by the secret distributor, can follow the steps shown in Figure 2. The method shown to verify the correctness of the secret slice received by itself. This method helps the holder of the secret slice to identify the situation that the secret distributor distributes the wrong secret slice in time, so as to avoid the potential safety hazard caused by the dishonesty of the secret distributor.

Fig. 4 exemplarily shows another anti-fraud secret sharing method provided by the embodiment of the present application, which is applied to a secret restorer and executed in the secret restoration phase. As shown in Figure 4, the method includes:

Step 401, the secret recoverer recovers the secret S according to at least t secret slices S _i of the secret S collected.

In the secret recovery phase, each secret slice holder P _i can send its own secret slice S _i to the secret restorer. The secret restorer can be the secret distributor or W secret slice holders One of the participants, or other participants in the secret sharing process except the secret distributor and the W secret slice holders, which is not specifically limited in this application.

When the secret restorer has collected at least t secret slices S _i , the secret restorer can calculate the secret S using the Lagrangian interpolation theorem:

Step 402, the secret recoverer verifies the correctness of the recovered secret S according to the polynomial commitment C corresponding to the secret S.

After calculating the secret S, the secret restorer verifies the correctness of the recovered secret S according to the following formula:

If the recovered secret S satisfies the above formula, the verification is passed, indicating that the secret S is recovered correctly. If the above formula is not satisfied, the verification fails, indicating that the currently obtained secret slice is not completely correct.

Since g and c ₀ are publicly known parameters in polynomial commitments, they are easy to verify.

This method helps the secret restorer to timely identify the situation that the secret slice holder provides the wrong secret slice, so as to avoid the potential safety hazard caused by the dishonesty of the secret slice holder.

To sum up, in the secret distribution phase, the secret distributor not only needs to provide the secret slice, but also needs to provide a computable commitment that can prove that the secret slice is correct, and the promise will not reveal any information about the secret slice and the original secret. Therefore, the secret distribution phase and the secret recovery phase can verify the correctness of the secret slice, thereby ensuring that the secret sharing algorithm is fraud-proof.

Fig. 5 exemplarily shows a schematic flow chart of the secret distribution process in the embodiment of the present application. As shown in Fig. 4, the secret distribution process includes the following steps:

Step 501, the secret distributor constructs a secret polynomial according to the secret restoration threshold t.

Step 502, the secret distributor generates W secret slices according to the number W of secret slice holders and the secret polynomial f(x).

Step 503, the secret distributor calculates the polynomial commitment C, and broadcasts the polynomial commitment C to W secret slice holders.

Step 504, the secret distributor distributes W secret slices to corresponding secret slice holders respectively.

Step 505, the secret slice holder verifies whether the secret slice is correct.

Step 506, judging whether the verification is passed.

Step 507, if the verification is passed, the secret slice holder accepts the secret slice.

Step 508, if the verification fails, the secret slice holder rejects the secret slice.

Figure 6 exemplarily shows a schematic flow chart of the secret recovery process in the embodiment of the present application. As shown in Figure 6, the secret recovery process includes the following steps:

Step 601, the secret restorer receives the secret slice sent by the secret slice holder.

Step 602, the secret restorer judges whether the number of collected secret fragments is greater than the secret restoration threshold t.

Step 603, if it is greater than the secret restoration threshold t, the secret restorer calculates the secret S according to Lagrangian theorem.

Step 604, the secret restorer verifies the correctness of the recovered secret S according to the polynomial commitment C.

Step 605, judging whether the verification is passed? If the verification is passed, end.

Step 606, if the verification fails, the secret restorer judges whether there are unreceived secret fragments.

If there are unreceived secret slices, jump to step 601, recalculate and verify the secret S, otherwise, end.

To sum up, this application provides a fraud-proof secret sharing scheme, which can solve the security assumption problem in the secret sharing process. The core is that in the secret distribution process, the secret distributor not only provides the The verifiability commitment of the slice, under the premise of ensuring that the secret slice and the original secret information are not leaked, the secret slice holder can verify the correctness of the received secret slice according to the verifiability promise, and ensure the secret recovery The stage is able to restore the original secret and verify correctness.

The present application also provides an anti-fraud secret sharing device, which is used to implement the anti-fraud secret sharing method in the above method embodiment. The device can be a secret distributor or a secret slice holder or a secret restorer in the secret sharing process.

As shown in FIG. 7 , the apparatus 700 includes: a communication module 710 and a processing module 720 .

When the device is a secret distributor, the processing module 720 is configured to generate W secret slices of the secret S according to the secret polynomial f(x) and the number W of secret slice holders; and, to generate The polynomial commitment C corresponding to the secret S. The communication module 710 is configured to broadcast the polynomial commitment C to the W secret slice holders, and the polynomial commitment C is used for the secret slice holders to verify the received secret slice and, for distributing the W secret slices to the W secret slice holders.

In a possible design, the processing module 720 is specifically configured to: randomly select W unequal values of x {x ₁ , x ₂ ,...,x _w }, and respectively substitute them into the secret polynomial f(x), Calculate the corresponding y value {y ₁ , y ₂ ,…,y _w }, and obtain the W secret slices {S ₁ , S ₂ ,…,S _w }; among them, the i-th secret slice S _i =(x _i , y _i ), 0<i≤w.

In a possible design, the polynomial commitment C={c ₀ , c ₁ ,...,c _t-1 }, t is the secret restoration threshold, 0<t≤W; the processing module 720 is specifically used for: According to the formula

When the device is a secret slice holder, the communication module 710 is configured to receive the polynomial commitment C corresponding to the secret S from the secret distributor; and is configured to receive the secret S from the secret distributor A secret slice S _i of . The processing module 720 is configured to verify the correctness of the secret slice S _i according to the polynomial commitment C.

In a possible design, the processing module 720 is specifically configured to: if the secret slice S _i ( _xi , y _i ) satisfies the formula:

When the device is a secret restorer: the communication module 710 is configured to collect at least t secret slices S _i of the secret S. The processing module 720 is configured to recover the secret S according to the collected at least t secret slices S _i ; and, according to the polynomial commitment C corresponding to the secret S, the recovered secret S Verify correctness.

In a possible design, the processing module 720 is specifically configured to: if the recovered secret S satisfies the formula:

Based on the same technical concept, the embodiment of the present application also provides a computer device, as shown in FIG. 8 , including at least one processor 801, and a memory 802 connected to the at least one processor. The specific connection medium between the processor 801 and the memory 802, the bus connection between the processor 801 and the memory 802 in FIG. 8 is taken as an example. The bus can be divided into address bus, data bus, control bus and so on.

In the embodiment of the present application, the memory 802 stores instructions executable by at least one processor 801, and the at least one processor 801 can implement the steps of the secret sharing method above by executing the instructions stored in the memory 802.

Among them, the processor 801 is the control center of the computer equipment, which can use various interfaces and lines to connect various parts of the computer equipment, by running or executing the instructions stored in the memory 802 and calling the data stored in the memory 802, so as to perform resource set up. Optionally, the processor 801 may include one or more processing units, and the processor 801 may integrate an application processor and a modem processor. The tuner processor mainly handles wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 801 . In some embodiments, the processor 801 and the memory 802 can be implemented on the same chip, and in some embodiments, they can also be implemented on independent chips.

The processor 801 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

The memory 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. Memory 802 may include at least one type of storage medium, for example, may include flash memory, hard disk, multimedia card, card memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk , CD, etc. Memory 802 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory 802 in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, and is used for storing program instructions and/or data.

Based on the same technical concept, the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores computer-readable instructions, and when the computer reads and executes the computer-readable instructions, the above method is implemented implementation of the method in the example.

Based on the same technical concept, the embodiments of the present application further provide a computer program product, including computer readable instructions, and when the computer readable instructions are executed by a processor, the methods in the above method embodiments are implemented.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims

A fraud-proof secret sharing method, characterized in that the method is applied to a secret distributor, and the method includes:

Generate W secret slices of secret S according to the secret polynomial f(x) and the number W of secret slice holders;

Generate a polynomial commitment C corresponding to the secret S, and broadcast the polynomial commitment C to the W secret slice holders, and the polynomial commitment C is used for the secret slice holder to confirm the received secret Fragmentation for verification;

Distributing the W secret slices to the W secret slice holders.
The method according to claim 1, wherein the secret polynomial f (x) is:

f(x)＝S+a 1 *x 1 +a 2 *x 2 +…+a t-1 *x t-1 mod p

Among them, a j is a polynomial coefficient, 0≤j≤t-1, t is a secret restoration threshold, 0<t≤W, and p is a prime number.
The method according to claim 2, wherein generating W secret slices of the secret S according to the secret polynomial f(x) and the number W of secret slice holders includes:

Randomly select W unequal x values {x 1 , x 2 ,…,x w }, respectively substitute into the secret polynomial f(x), and calculate the corresponding y values {y 1 , y 2 ,…,y w } , to obtain the W secret slices {S 1 , S 2 ,...,S w };

Wherein, the i-th secret slice S i =(x i , y i ), 0<i≤w.
The method according to claim 2, wherein the polynomial commitment C={c 0 ,c 1 ,...,c t-1 };

The method also includes:

According to the formula
generating said polynomial commitment C;

Wherein, a 0 =S, g is a constant prime number.
A fraud-proof secret sharing method, characterized in that the method is applied to a secret slice holder, and the method comprises:

Receive the polynomial commitment C corresponding to the secret S from the secret distributor;

receiving a secret slice S i of said secret S from said secret distributor;

According to the polynomial commitment C, the correctness of the secret slice S i is verified.
The method according to claim 5, wherein the polynomial commitment C={c 0 ,c 1 ,...,c t-1 };

in,
0≤j≤t-1, 0<t≤W, t is the secret restoration threshold, W is the number of secret slice holders, a j is the polynomial coefficient, a 0 =S, g is a constant prime number, p is a prime number .
The method according to claim 6, wherein said verifying said secret slice S i according to said polynomial commitment C comprises:

If the secret slice S i (xi , y i ) satisfies the formula:
Then it is determined that the verification is successful, otherwise the verification fails.
A fraud-proof secret sharing method, characterized in that the method is applied to a secret restorer, and the method comprises:

Recover the secret S from the collected at least t secret slices S i of the secret S;

According to the polynomial commitment C corresponding to the secret S, the correctness of the recovered secret S is verified.
The method according to claim 8, wherein the polynomial commitment C={c 0 ,c 1 ,...,c t-1 };

in,
0≤j≤t-1, 0<t≤W, t is the secret restoration threshold, W is the number of secret slice holders, a j is the polynomial coefficient, a 0 =S, g is a constant prime number, p is a prime number .
The method according to claim 9, wherein the verifying the correctness of the recovered secret S according to the polynomial commitment C corresponding to the secret S includes:

If the secret S satisfies the formula after recovery:
Then it is determined that the recovery is successful, otherwise the recovery fails.
An anti-fraud secret sharing device, characterized by comprising:

A processing module, configured to generate W secret slices of the secret S according to the secret polynomial f(x) and the number W of secret slice holders;

The processing module is further configured to generate a polynomial commitment C corresponding to the secret S, and broadcast the polynomial commitment C to the W secret slice holders, and the polynomial commitment C is used for the secret slice The holder verifies the received secret slice;

A communication module, configured to distribute the W secret slices to the W secret slice holders.
An anti-fraud secret sharing device, characterized by comprising:

The communication module is used to receive the polynomial commitment C corresponding to the secret S from the secret distributor;

The communication module is further configured to receive a secret slice S i of the secret S from the secret distributor;

A processing module, configured to verify the correctness of the secret slice S i according to the polynomial commitment C.
An anti-fraud secret sharing device, characterized by comprising:

A communication module for collecting at least t secret slices S i of the secret S;

A processing module, configured to restore the secret S according to the collected at least t secret slices S i of the secret S;

The processing module is further configured to verify the correctness of the recovered secret S according to the polynomial commitment C corresponding to the secret S.
A computer device, characterized in that it includes:

memory for storing program instructions;

The processor is configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 10 according to the obtained program instructions.
A computer-readable storage medium, which is characterized by comprising computer-readable instructions, and when a computer reads and executes the computer-readable instructions, the method according to any one of claims 1 to 10 is implemented.
A computer program product, characterized by comprising computer-readable instructions, which enable the method according to any one of claims 1 to 10 to be implemented when the computer-readable instructions are executed by a processor.