Method and apparatus for secure key management using multi-threshold secret sharing
View Patent ↗A method and apparatus are disclosed for managing components of a secret key according to a secret sharing scheme. The disclosed secret sharing scheme divides a secret value, R, into n secret components (R 1 , R 2 , . . . , R n ) and one super component, S, in such a way that R can be computed from (i) any k or more R i components (k<n); or (ii) S and any one component of R i . The secret components (R 1 , R 2 , . . . , R n ) are distributed to a number of authorized users. A multiple threshold secret sharing scheme assigns various users in a group into one of a number of classes. Each user class has a corresponding threshold level that indicates the number of users that must come together with their assigned components to obtain access to the shared secret. The multiple threshold scheme divides the secret into n components each having an assigned threshold level (i.e., the number of such components that are required to obtain the secret). Any component having a lower threshold level can satisfy the role of a component having a higher threshold level. The multiple threshold scheme provides a hierarchical scheme that allows the secret, R, to be shared among different groups of people with different thresholds.
1. A system for sharing a secret key, comprising:
a memory that stores computer-readable code; and
a processor operatively coupled to said memory, said processor configured to implement said computer-readable code, said computer-readable code configured to:
distribute a plurality of components of said secret key to a plurality of users, each of said components having an assigned weight, wherein any component having an assigned weight, k, can satisfy the role of a component having a threshold higher than k; and
provide said secret key if said assigned weights associated with said plurality of components satisfies a predefined condition.
2. The system of claim 1 , wherein said plurality of components of a given weight, k, are assigned using points on a k−1 dimensional surface defined using said secret key.
3. An article of manufacture for sharing a secret key, comprising:
a computer readable medium having computer readable code means embodied thereon, said computer readable program code means comprising:
a step to distribute a plurality of components of said secret key to a plurality of users, each of said components having an assigned weight, wherein any component having an assigned weight, k, can satisfy the role of a component having a threshold higher than k; and
a step to provide said secret key if said assigned weights associated with said plurality of components satisfies a predefined condition.
4. A system for sharing a secret key, comprising:
a memory that stores computer-readable code; and
a processor operatively coupled to said memory, said processor configured to implement said computer-readable code, said computer-readable code configured to:
distribute a plurality of components of said secret key and one super component of said secret key to a plurality of users; and
provide said secret key if at least one of said plurality of components of said secret key and said super component are received.
5. The system of claim 4 , wherein said super component uniquely defines a surface defined using said secret key.
6. The system of claim 4 , wherein said super component is a center of a surface defined using said secret key.
7. The system of claim 4 , wherein said super component is an offset from a center of a surface defined using said secret key.
8. An article of manufacture for sharing a secret key, comprising:
a computer readable medium having computer readable code means embodied thereon, said computer readable program code means comprising:
a step to distribute a plurality of components of said secret key and one super component of said secret key to a plurality of users; and
a step to provide said secret key if at least one of said plurality of components of said secret key and said super component are received.