Method for secure key management using multi-threshold secret sharing

摘要

A method and apparatus are disclosed for managing components of a secret key according to a secret sharing scheme. The disclosed secret sharing scheme divides a secret value, R, into n secret components (R₁, R₂, . . . , R_n) and one super component, S, in such a way that R can be computed from (i) any k or more R, components (kn); or (ii) S and any one component of R_l. The secret components (R₁ ,R₂, . . . , R_n) are distributed to a number of authorized users. A multiple threshold secret sharing scheme assigns various users in a group into one of a number of classes. Each user class has a corresponding threshold level that indicates the number of users that must come together with their assigned components to obtain access to the shared secret. The multiple threshold scheme divides the secret into n components each having an assigned threshold level (i.e., the number of such components that are required to obtain the secret). Any component having a lower threshold level can satisfy the role of a component having a higher threshold level. The multiple threshold scheme provides a hierarchical scheme that allows the secret, R, to be shared among different groups of people with different thresholds.