New General Secret Sharing Scheme using Hierarchical Threshold

Scheme: Improvement of Information Rates for Speciﬁed Participants

Kouya Tochikubo

Department of Mathematical Information Engineering, College of Industrial Technology, Nihon University, Japan

Keywords:

Secret Sharing Scheme, General Access Structure, (k,n)-hierarchical Threshold Scheme, Key Management.

Abstract:

In 2015, a new secret sharing scheme realizing general access structures was proposed (T15). This scheme is

based on authorized subsets and the ﬁrst scheme that can reduce the number of shares distributed to speciﬁed

participants. Reducing the numbers of shares distributed to speciﬁed participants is quite useful in secret

sharing schemes. However, this scheme needs to use many secret sharing schemes to obtain shares. In this

paper, we propose a new secret sharing scheme realizing general access structures. The proposed scheme can

reduce the number of secret sharing schemes to obtain shares by using Tassa’s (k,n)-hierarchical threshold

scheme instead of Shamir’s (k, n)-threshold scheme. Thus, the proposed scheme is more efﬁcient than the

scheme A of T15 from the viewpoint of the number of secret sharing schemes to obtain shares.

1 INTRODUCTION

In (k,n)-threshold scheme (Shamir, 1979; Blakley,

1979), every group of k participants can recover the

secret K, but no group of less than k participants can

get any information about the secret from their shares.

The collection of all authorized subsets of partici-

pants is called the access structure. A (k,n)-threshold

scheme can only realize particular access structures

that contain all subsets of k or more participants. Se-

cret sharing schemes realizing more general access

structures than that of a threshold scheme were stud-

ied by numerous authors. Subsequently, Tassa pro-

posed a hierarchical threshold scheme using polyno-

mial derivatives (Tassa, 2007).

On the other hand, Ito, Saito and Nishizeki pro-

posed a multiple assignment secret sharing scheme

for general access structures and showed an explicit

share assignment algorithm for any access struc-

ture (Ito et al., 1987). Their scheme can realize an

arbitrary access structure by assigning one or more

shares to each participant. Benaloh and Leichter

proposed a secret sharing scheme for general ac-

cess structures based on a monotone-circuit (Benaloh

and Leichter, 1990). Secret sharing schemes which

have an explicit assignment algorithm for any access

structure are categorized by two types. One type is

schemes based on unauthorized subsets (Ito et al.,

1987; Tochikubo, 2004; Tochikubo, 2008). Another

type is schemes based on authorized subsets (Be-

naloh and Leichter, 1990; Tochikubo et al., 2005;

Tochikubo, 2013). In this paper, we focus on gen-

eral secret sharing schemes based on authorized sub-

sets. In the implementation of secret sharing schemes

for general access structures, an important issue is the

number of shares distributed to each participant. Ob-

viously, a scheme constructed of small shares is de-

sirable. However, in general, the existing secret shar-

ing schemes for general access structures are imprac-

tical in this respect when the size of the access struc-

ture is very large. Suppose that we want to apply se-

cret sharing schemes to a company. Here, we con-

sider a section which consists of two managers and

20 staff members. A secret can be recovered by a

group of two managers or groups of one manager and

two staff members. In this case, every manager be-

longs to 191 minimal authorized subsets and every

staff member belongs to 38 minimal authorized sub-

sets. We shall realize this access structure by general

secret sharing schemes. Then, each manager has to

hold so many shares. In 2015, a new secret sharing

scheme realizing general access structures was pro-

posed (T15) (Tochikubo, 2015). This scheme is based

on authorized subsets and the ﬁrst scheme that can re-

duce the number of shares distributed to speciﬁed par-

ticipants though this scheme cannot reduce the num-

ber of shares distributed to every participant. There-

fore, reducing the numbers of shares distributed to

speciﬁed participants is quite useful in secret sharing

schemes. However, this scheme needs to use many

Tochikubo, K.

New General Secret Sharing Scheme using Hierarchical Threshold Scheme: Improvement of Information Rates for Speciﬁed Participants.

DOI: 10.5220/0009103506470654

In Proceedings of the 6th International Conference on Information Systems Security and Privacy (ICISSP 2020), pages 647-654

ISBN: 978-989-758-399-5; ISSN: 2184-4356

647

secret sharing schemes to obtain shares.

In this paper, we modify the scheme A of

T15 (Tochikubo, 2015) and propose a new secret

sharing scheme realizing general access structures.

The proposed scheme can reduce the number of

secret sharing schemes to obtain shares by using

Tassa’s (k, n)-hierarchical threshold scheme instead

of Shamir’s (k,n)-threshold scheme. On the other

hand, the number of shares distributed to each partici-

pant is equal to that of the scheme A of T15. Thus, the

proposed scheme is more efﬁcient than the scheme A

of T15.

2 PRELIMINARIES

2.1 Secret Sharing Scheme

Let P = {P

,·· · ,P

} be a set of n participants. Let

D(/∈ P ) denote a dealer who selects a secret and dis-

tributes a share to each participant. Let K and S de-

note a secret set and a share set, respectively. For sets

A and B, we denote a difference set by A − B. The

access structure Γ(⊂ 2

) is the family of subsets of

P which contains the sets of participants qualiﬁed to

recover the secret. For any authorized subset A ∈ Γ,

any superset of A is also an authorized subset. Hence,

the access structure should satisfy the monotone prop-

erty:

A ∈ Γ,A ⊂ A

⊂ P ⇒ A

∈ Γ.

Let Γ

be a family of the minimal sets in Γ, called the

minimal access structure. Γ

is denoted by

= {A ∈ Γ : A

6⊂ A for all A

∈ Γ − {A}}.

For any access structure Γ, there is a family of sets

Γ = 2

− Γ.

Γ contains the sets of participants un-

qualiﬁed to recover the secret. The family of maximal

sets in

Γ is denoted by

. That is,

= {B ∈

Γ : B 6⊂ B

for all B

∈

Γ − {B}}.

In general, the efﬁciency of a perfect secret shar-

ing scheme is measured by the information rate

ρ (Stinson, 2005) deﬁned as

ρ = min{ρ

: 1 ≤ i ≤ n},

log|K |

log|S(P

where S (P

) denotes the set of possible shares that P

might receive. Obviously, a high information rate is

desirable. Throughout the paper, p is a large prime,

and let Z

be a ﬁnite ﬁeld with p elements. In this

paper, we assume K = S = Z

2.2 Shamir’s Threshold Scheme

Shamir’s (k,n)-threshold scheme is described as fol-

lows (Shamir, 1979):

1. A dealer D chooses n distinct nonzero elements

of Z

, denoted by x

,·· · ,x

. The values x

are

public.

2. Suppose D wants to share a secret K ∈ Z

, D

chooses k − 1 elements a

,·· ·a

k−1

from Z

in-

dependently with the uniform distribution.

3. D distributes the share s

= f (x

) to P

(1 ≤ i ≤ n),

where

f (x) = K + a

x + a

+ ··· + a

k−1

is a polynomial over Z

It is known that Shamir’s (k,n)-threshold scheme

is perfect and ideal (Stinson, 2005; Karnin et al.,

1983). This implies that every k participants can re-

cover the secret K, but no group of less than k partic-

ipants can get any information about the secret.

The access structure of (k,n)-threshold scheme is

described as follows:

Γ = {A ∈ 2

: |A| ≥ k}.

2.3 Tassa’s Hierarchical Threshold

Scheme

Let P be a set of n participants and assume that P

is divided into m+ 1 disjoint subsets U

,·· · ,U

i.e.

P =

[

i=0

and U

∩ U

= φ for all 0 ≤ i < j ≤ m.

Let k = {k

}

i=0

be a monotonically increasing se-

quence of integers 0 < k

< · ·· < k

. We set k =

. Tassa’s (k,n)-hierarchical threshold scheme is de-

scribed as follows (Tassa, 2007):

1. Suppose A dealer D wants to share a secret K ∈

, D chooses k − 1 elements a

,·· ·a

k−1

from

independently with the uniform distribution

and deﬁnes a polynomial over Z

f (x) = K + a

x + a

+ ··· + a

k−1

2. D identiﬁes each participant P ∈ P with a ﬁeld

element. For simplicity, the ﬁeld element that

corresponds to P

∈ P will be also denoted by

r (1 ≤ r ≤ n).

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

648

3. D distributes the shares to all participants in the

following manner: Each participant of i th level in

the hierarchy P

∈ U

receives the share f

i−1

)

(r)

where f

i−1

)

(r) denotes the (k

i−1

) th derivative

of f (x) at x = r and k

−1

= 0.

The access structure of Tassa’s (k,n)-hierarchical

threshold scheme is described as follows:

Γ =

(

V ⊂ P :



V ∩

[

j=0



≥ k

∀i ∈ {0,1,. ..,m}

)

It is known that Tassa’s (k, n)-hierarchical thresh-

old scheme is perfect and ideal (Tassa, 2007).

Example 1: Let k = (k

) = (1,3,4), P =

} and

= {P

In this case, the access structure Γ and the minimal ac-

cess structure Γ

of Tassa’s ((1, 3,4), 6)-hierarchical

threshold scheme are described by

Γ=

(

V ⊂ P :



V ∩

[

j=0



≥ k

,∀i ∈ {0,1, 2}

)

and

= {{P

},{P

}},

respectively. Here, we shall realize this access struc-

ture by Tassa’s scheme.

1. D selects a random polynomial

f (x) = K + a

x + a

+ a

2. D distributes the share s

= f (1) to P

3. D distributes the share s

= f

(r) to P

(2 ≤ r ≤ 4),

where

(x) = a

+ 2a

x + 3a

4. D distributes the share s

= f

(3)

(r) to P

(5 ≤ r ≤

6), where

(3)

(x) = 6a

Tassa’s (k,n)-hierarchical threshold scheme can

realize more general access structures than that of

a threshold scheme. If i = 0, then Tassa’s (k, n)-

hierarchical threshold scheme coincides Shamir’s

(k, n)-threshold scheme.

2.4 Secret Sharing Schemes based on

Authorized Subsets

For P = {P

,·· · ,P

}, K ∈ K and Γ, Benaloh and

Leichter’s scheme is described as follows (Benaloh

and Leichter, 1990):

1. Let Γ

= {A

,·· · ,A

}. For A

∈ Γ

, com-

pute |A

| shares s

i,1

i,2

,·· · ,s

i,|A

by using an

(|A

|,|A

|)-threshold scheme with K as a secret in-

dependently for 1 ≤ i ≤ m.

2. One distinct share from s

i,1

i,2

,·· · ,s

i,|A

assigned to each P ∈ A

(1 ≤ i ≤ m).

Example 2: For P = {P

}, consider

the following access structure

= {A

,·· · ,A

}

where

= {P

We shall realize this access structure by Benaloh and

Leichter’s scheme. In this case, shares are distributed

as follows:

: s

1,1

5,1

6,1

: s

1,2

2,1

3,1

5,2

6,2

: s

2,2

4,1

5,3

6,3

: s

3,2

4,2

5,4

6,4

: s

1,3

2,3

3,3

4,3

5,5

: s

1,4

2,4

3,4

4,4

6,5

where s

i, j

is computed by using Shamir’s

(|A

|,|A

|)-threshold scheme with K as a secret

(1 ≤ i ≤ 6, 1 ≤ j ≤ |A

|).

For P = {P

,·· · ,P

},Q (⊂ P), K ∈ K and

Γ, the scheme A of T15 is described as fol-

lows (Tochikubo, 2015):

1. Let A

= {C ⊂ Q : Q ∩ A = C for some A ∈ Γ

}

and represent it as A

= {C

,·· · ,C

2. For C

∈ A

, let

= {B ⊂ P − Q : B ∩C

= φ

and B ∪C

= A for some A ∈ Γ

}

and represent it as A

= {C

,·· · ,C

i|A

New General Secret Sharing Scheme using Hierarchical Threshold Scheme: Improvement of Information Rates for Speciﬁed Participants

649

3. For C

∈ A

(i) if C

= φ then S

= {w

} and w

= K,

(ii) if C

6= φ and A

= {φ} then S

= {w

} and w

(iii) if C

6= φ and A

6= {φ} then compute 2 shares

= {w

} by using Shamir’s (2, 2)-threshold

scheme with K as a secret for 1 ≤ i ≤ m.

4. For C

∈ A

, if C

= φ then S

1,i

= φ, else compute

| shares

1,i

= {s

i,1

i,2

,·· · ,s

i,|C

}

by using Shamir’s (|C

|,|C

|)-threshold scheme

with w

as a secret for 1 ≤ i ≤ m. One distinct

share in S

1,i

is assigned to each P ∈C

(1 ≤ i ≤ m).

5. For C

i j

∈ A

, if C

i j

= φ then S

2,i, j

= φ, else com-

pute |C

i j

| shares

2,i, j

= {s

i, j,1

i, j,2

,·· · ,s

i, j,|C

i j

}

by using Shamir’s (|C

i j

|,|C

i j

|)-threshold scheme

with w

as a secret for 1 ≤ i ≤ m, 1 ≤ j ≤ |A

One distinct share in S

2,i, j

is assigned to each

P ∈ C

i j

(1 ≤ i ≤ m, 1 ≤ j ≤ |A

|).

Example 3: Let Q = {P

}. We shall realize the

access structure of Example 2 by the scheme A of

T15.

• Since Q = {P

}, A

is deﬁned by

= {C

}

where

= {P

= φ.

• A

and A

are deﬁned by

= {{P

},{P

}},

= {{P

},{P

}},

= {{P

}}.

• For C

∈ A

, compute 2 shares

= {w

}

by using Shamir’s (2,2)-threshold scheme with K

as a secret. Since C

= φ, we set

= {w

} and w

= K.

• For C

∈ A

, compute |C

| shares

1,1

= {s

1,1

1,2

= {s

2,1

}

by using (|C

|,|C

|)-threshold scheme with w

as a

secret independently for 1 ≤ i ≤ 2. Since C

= φ,

we set

1,3

= φ.

• For C

i j

∈ A

, compute |C

i j

| shares

2,1,1

= {s

1,1,1

1,1,2

2,1,2

= {s

1,2,1

1,2,2

1,2,3

2,1,3

= {s

1,3,1

1,3,2

1,3,3

2,2,1

= {s

2,1,1

2,1,2

2,1,3

2,2,2

= {s

2,2,1

2,2,2

2,2,3

2,3,1

= {s

3,1,1

3,1,2

3,1,3

3,1,4

}

by using Shamir’s (|C

i j

|,|C

i j

|)-threshold scheme

with w

as a secret independently for 1 ≤ i ≤ 3,1 ≤

j ≤ |A

• In this case, shares are distributed as follows:

: s

1,1

: s

1,2

2,1

: s

1,2,1

1,3,1

2,1,1

3,1,1

: s

1,2,2

1,3,2

2,2,1

3,1,2

: s

1,1,1

1,2,3

2,1,2

2,2,2

3,1,3

: s

1,1,2

1,3,3

2,1,3

2,2,3

3,1,4

Benaloh and Leichter’s scheme needs shares for

each minimal authorized subset. On the other hand,

the scheme A of T15 can reduce the number of shares

distributed to each participant P ∈ Q (⊂ P ).

3 PROPOSED SCHEME

Here, we propose a new secret sharing scheme re-

alizing general access structures. In the proposed

scheme, we can select a subset of participants Q (⊂

P ) without restrictions. The proposed scheme can

reduce the number of shares distributed to P ∈ Q

by dividing Γ

into A

,·· · ,A

according to the

subsets of Q in the same way as the scheme A of

T15. The proposed scheme can reduce the number

of secret sharing schemes to obtain shares by using

Tassa’s (k, n)-hierarchical threshold scheme instead

of Shamir’s (k,n)-threshold scheme. On the other

hand, the number of shares distributed to each par-

ticipant is equal to that of the scheme A of T15.

For P = {P

,·· · ,P

},Q (⊂ P ), K ∈ K and Γ,

the proposed scheme is described as follows:

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

650

1. Let A

= {C ⊂ Q : Q ∩ A = C for some A ∈ Γ

}

and represent it as A

= {C

,·· · ,C

2. For C

∈ A

, let

= {B ⊂ P − Q : B ∩C

= φ

and B ∪C

= A for some A ∈ Γ

}

and represent it as A

= {C

,·· · ,C

i|A

3. For C

∈ A

(i) if C

= φ then set

1,i

= φ,S

2,i

= {s

i,1

i,2

,·· · ,s

i,|A

}

where s

i, j

= K(1 ≤ j ≤ |A

|),

(ii) if C

6= φ and A

= {φ} then compute |C

| shares

1,i

= {s

i,1

i,2

,·· · ,s

i,|C

}

by using Shamir’s (|C

|,|C

|)-threshold scheme

with K as a secret,

(iii) if C

6= φ and A

6= {φ} then by using Tassa’s

((|C

|,|C

| + 1), |C

| + |A

|)-hierarchical thresh-

old scheme with K as a secret, compute |C

| +

| shares

1,i

= {s

i,|A

|+1

,·· · ,s

i,|A

|+|C

2,i

= {s

i,1

i,2

,·· · ,s

i,|A

}

as follows:

i, j



f ( j) (|A

| + 1 ≤ j ≤ |A

| + |C

(|C

( j) (1 ≤ j ≤ |A

|).

One distinct share in S

1,i

is assigned to each

P ∈ C

(1 ≤ i ≤ m).

4. For C

i j

∈ A

, if C

i j

= φ then S

2,i, j

= φ, else com-

pute |C

i j

| shares

2,i, j

= {s

i, j,1

i, j,2

,·· · ,s

i, j,|C

i j

}

by using Shamir’s (|C

i j

|,|C

i j

|)-threshold scheme

with s

i, j

as a secret for 1 ≤ i ≤ m,1 ≤ j ≤ |A

One distinct share in S

2,i, j

is assigned to each

P ∈ C

i j

(1 ≤ i ≤ m, 1 ≤ j ≤ |A

|).

Example 4: Let Q = {P

}. We shall realize

the access structure of Example 2 by the proposed

scheme.

• Since Q = {P

}, A

is deﬁned by A

} where

= {P

= φ.

• A

and A

are deﬁned by

= {{P

},{P

}},

= {{P

},{P

}},

= {{P

}}.

• For C

∈ A

, compute |C

| + |A

| shares

1,1

= {s

1,4

1,5

1,2

= {s

1,1

1,2

1,3

2,1

= {s

2,3

2,2

= {s

2,1

2,2

}

by using Tassa’s ((|C

|,|C

| + 1),|C

| + |A

|)-

hierarchical threshold scheme with K as a se-

cret (1 ≤ i ≤ 2). Since C

= φ, we set S

1,3

φ,S

2,3

= {s

3,1

} where s

3,1

= K

• For C

i j

∈ A

, compute |C

i j

| shares

2,1,1

= {s

1,1,1

1,1,2

2,1,2

= {s

1,2,1

1,2,2

1,2,3

2,1,3

= {s

1,3,1

1,3,2

1,3,3

2,2,1

= {s

2,1,1

2,1,2

2,1,3

2,2,2

= {s

2,2,1

2,2,2

2,2,3

2,3,1

= {s

3,1,1

3,1,2

3,1,3

3,1,4

}

by using Shamir’s (|C

i j

|,|C

i j

|)-threshold scheme

with s

i, j

as a secret for 1 ≤ i ≤ 3, 1 ≤ j ≤ |A

• In this case, shares are distributed as follows:

: s

1,4

: s

1,5

2,3

: s

1,2,1

1,3,1

2,1,1

3,1,1

: s

1,2,2

1,3,2

2,2,1

3,1,2

: s

1,1,1

1,2,3

2,1,2

2,2,2

3,1,3

: s

1,1,2

1,3,3

2,1,3

2,2,3

3,1,4

The next theorem shows the proposed scheme is

perfect.

Theorem 1. Let P = {P

,·· · ,P

} be a set of n

participants. For any Q (⊂ P ) and any access struc-

ture Γ(⊂ 2

), distribute shares for a secret K by using

the proposed scheme A. Then, for any subset X ⊂ P ,

(a) X ∈ Γ ⇒ H(K|X ) = 0,

(b) X 6∈ Γ ⇒ H(K|X ) = H(K).

Proof: Let X

1,i

and X

2,i, j

denote the shares in S

1,i

and S

2,i, j

assigned to X, respectively(1 ≤ i ≤ m,1 ≤

j ≤ |A

|). At ﬁrst, we show H(K|X) = 0 for any X ∈

New General Secret Sharing Scheme using Hierarchical Threshold Scheme: Improvement of Information Rates for Speciﬁed Participants

651

Γ. From the property of the access structure and the

deﬁnition of A

,·· · ,A

and A

, there exists A ∈ Γ

such that

∪C

i j

= A ⊂ X .

In this case, we have

1,i

| = |C

| and |X

2,i, j

| = |C

i j

Since s

i, j,1

i, j,2

,·· · ,s

i, j,|C

i j

are shares computed by

Shamir’s (|C

i j

|,|C

i j

|)-threshold scheme with s

i, j

as a

secret, X can recover s

i, j

if C

i j

6= φ. From the deﬁni-

tion of S

1,i

, S

2,i

and S

2,i, j

, we immediately obtain

H(K|X)

= H(K|X

1,1

,·· · ,X

1,m

2,1,1

,·· · ,X

2,m,|A

)

≤ H(K|X

1,i

2,i, j

)

= 0.

Since H(K|X) ≥ 0 is obvious, we have H(K|X) = 0

for any X ∈ Γ.

Next we show H(K|X) = H(K) for any X 6∈ Γ.

From the property of the access structure and the def-

inition of A

,·· · ,A

and A

, for any A

∈ Γ

, we have

6⊂ X or C

i j

6⊂ X (1 ≤ j ≤ |A

|).

This implies

H(K|X

1,i

2,i, j

) = H(K).

for 1 ≤ i ≤ m,1 ≤ j ≤ |A

|. From the deﬁnition of S

1,i

2,i

and S

2,i, j

, we have

H(K|X

1,i

2,i,1

,·· · ,X

2,i,|A

) = H(K)

for 1 ≤ i ≤ m. This implies

H(X

1,i

2,i,1

,·· · ,X

2,i,|A

|K)

= H(X

1,i

2,i,1

,·· · ,X

2,i,|A

). (1)

In order to show H(K|X) = H(K), we expand

H(K|X) as follows:

H(K|X)

= H(K|X

1,1

,·· · ,X

1,m

2,1,1

,·· · ,X

2,m,|A

)

= H(K)

+H(X

1,1

,·· · ,X

1,m

2,1,1

,·· · ,X

2,m,|A

|K)

−H(X

1,1

,·· · ,X

1,m

2,1,1

,·· · ,X

2,m,|A

). (2)

From the chain rule for entropy, we have

H(X

1,1

,·· · ,X

1,m

2,1,1

,·· · ,X

2,m,|A

|K)

∑

t=1

H(X

1,t

2,t ,1

,·· · ,X

2,t ,|A

|K, X

1,1

,·· ·

··· , X

1,t −1

2,1,1

,·· · ,X

2,t −1,|A

t−1

)

(∗)

∑

t=1

H(X

1,t

2,t ,1

,·· · ,X

2,t ,|A

|K)

∑

t=1

H(X

1,t

2,t ,1

,·· · ,X

2,t ,|A

). (3)

Here, (∗) comes from the fact that X

1,1

,·· · ,X

1,m

and

2,1,1

,·· · ,X

2,m,|A

are mutually independent and the

last equality comes from (1). On the other hand, we

have

H(X

1,1

,·· · ,X

1,m

2,1,1

,·· · ,X

2,m,|A

)

∑

t=1

H(X

1,t

2,t ,1

,·· · ,X

2,t ,|A

1,1

,·· ·

··· , X

1,t −1

2,1,1

,·· · ,X

2,t −1,|A

t−1

)

≤

∑

t=1

H(X

1,t

2,t ,1

,·· · ,X

2,t ,|A

). (4)

Substituting (3) and (4) into (2), we obtain H(K|X) ≥

H(K). Since H(K|X) ≤ H(K) is obvious, we have

H(K|X) = H(K). 

4 EVALUATION OF THE

EFFICIENCY

The number of shares distributed to P ∈ P for the ac-

cess structure of Example are described in Table 1.

Table 1: Comparison of the number of shares distributed to

P ∈ P .

Scheme of BL88 3 5 4 4 5 5

Scheme A of T15 1 2 4 4 5 5

Proposed scheme 1 2 4 4 5 5

This result shows that the proposed scheme and

the scheme A of T15 can reduce the numbers of shares

distributed to P ∈ Q .

Let N(P) be the number of shares distributed

to P ∈ P by using the proposed scheme. Similarly,

let N

(P) and N

T 15

(P) be the number of shares

distributed to P ∈ P by using Benaloh and Leichter’s

scheme and the scheme A of T15, respectively. The

next theorem shows the number of shares distributed

to each participant is equal to that of the scheme A

of T15 in the proposed scheme and the proposed

scheme is more efﬁcient than Benaloh and Leichter’s

scheme and from the viewpoint of the number of

shares distributed to each participant.

Theorem 2. For any P ∈ P , the number of shares

distributed to P is evaluated as follows:

N(P) =







(P) −

∑

i=1

|{P} ∩C

|(|A

| − 1) (P ∈ Q )

(P) (P /∈ Q ),

N(P) = N

T 15

(P) (P ∈ P ).

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

652

Proof: From the deﬁnition of A

,·· · ,A

and A

N(P) and N

T 15

(P) are obtained by

N(P) = N

T 15

(P) = |{C

∈ A

: P ∈ C

∑

i=1

|{P} ∩C

| (5)

for P ∈ Q . On the other hand, N

(P) is obtained by

(P) = |{X ∈ Γ

: P ∈ X }|. (6)

From the deﬁnition of A

,·· · ,A

and A

, we have

{X ∈ Γ

: P ∈ X} =

[

i=1

∪C : P ∈ C

,C ∈ A

} (7)

for P ∈ Q . From (6) and (7), we have

(P) =

∑

i=1

|{C

∪C : P ∈ C

,C ∈ A

∑

i=1

|{P} ∩C

| · |A

| (8)

for P ∈ Q .

Similarly, N(P) and N

T 15

(P) are obtained by

N(P) = N

T 15

(P) =

∑

i=1

|{C ∈ A

: P ∈ C}| (9)

for P 6∈ Q . From the deﬁnition of A

,·· · ,A

and A

we have

{X ∈ Γ

: P ∈ X } =

[

i=1

∪C : P ∈ C ∈ A

} (10)

for P 6∈ Q . From (6) and (10), we have

(P) =

∑

i=1

|{C

∪C : P ∈ C ∈ A

∑

i=1

|{C ∈ A

: P ∈ C}| (11)

for P 6∈ Q . Theorem 2 is easily obtained by (5), (8),

(9) and (11). 

Here, we evaluate the number of secret sharing

schemes to obtain shares. Table 2 shows the number

of secret sharing schemes to obtain shares for Exam-

ple.

This result shows that the proposed scheme can

reduce the number of secret sharing schemes to ob-

tain shares. Actually, we can reduce |A

− {φ}| secret

sharing schemes at most.

Let N

be the number of secret sharing schemes

to obtain shares in the proposed scheme. Similarly,

let N

and N

T 15

be the number of secret sharing

schemes to obtain shares in Benaloh and Leichter’s

scheme and the scheme A of T15, respectively.

Table 2: Comparison of the number of secret sharing

schemes.

Shamir’s Tassa’s total

schemes schemes

Scheme of BL88 6 0 6

Scheme A of T15 10 0 10

Proposed scheme 6 2 8

The next theorem shows the proposed scheme is

more efﬁcient than the scheme A of T15 from the

viewpoint of the number of secret sharing schemes to

obtain shares.

Theorem 3. The number of secret sharing schemes

to obtain shares is evaluated as follows:

= |Γ

T 15

≤ |Γ

| + 2|A

− {φ}|,

≤ |Γ

| + |A

− {φ}|.

Proof: Benaloh and Leichter’s scheme uses secret

sharing schemes for each minimal authorized subset

in Γ

. Thus, we have

= |Γ

The scheme A of T15 uses secret sharing schemes for

each C

in A

−{φ} to obtain S

(1 ≤ i ≤ m), C

in A

−

{φ} to obtain S

1,i

(1 ≤ i ≤ m) and C

i j

in A

to obtain

2,i, j

(1 ≤ i ≤ m,1 ≤ j ≤ |A

|). The proposed scheme

uses secret sharing schemes for each C

in A

− {φ}

to obtain S

1,i

and S

2,i

(1 ≤ i ≤ m) and C

i j

in A

− {φ}

to obtain S

2,i, j

(1 ≤ i ≤ m, 1 ≤ j ≤ |A

|).

On the other hand, from the deﬁnition of

,·· · ,A

and A

, we have

∑

i=1

| ≤ |Γ

Thus, we obtain

T 15

≤ |Γ

| + 2|A

− {φ}|,

≤ |Γ

| + |A

− {φ}|.



5 CONCLUSION

We have proposed a new secret sharing scheme real-

izing general access structures. The proposed scheme

can reduce the number of secret sharing schemes

to obtain shares by using Tassa’s (k,n)-hierarchical

threshold scheme instead of Shamir’s (k,n)-threshold

scheme. On the other hand, the number of shares

distributed to each participant is equal to that of the

scheme A of T15.

New General Secret Sharing Scheme using Hierarchical Threshold Scheme: Improvement of Information Rates for Speciﬁed Participants

653

ACKNOWLEDGEMENTS

This work was supported by JSPS KAKENHI Grant

Number 18K11303.

REFERENCES

Benaloh, J. and Leichter, J. (1990). Generalized secret

sharing and monotone functions. In Proceedings on

Advances in Cryptology, CRYPTO ’88, pages 27–35,

Berlin, Heidelberg. Springer-Verlag.

Blakley, G. R. (1979). Safeguarding cryptographic keys. In

1979 International Workshop on Managing Require-

ments Knowledge (MARK), pages 313–318.

Ito, M., Saito, A., and Nishizeki, T. (1987). Secret sharing

scheme realizing general access structure. In Proc.

IEEE Globecom’87, pages 99–102.

Karnin, E., Greene, J., and Hellman, M. (1983). On secret

sharing systems. IEEE Transactions on Information

Theory, 29(1):35–41.

Shamir, A. (1979). How to share a secret. Commun. ACM,

22(11):612–613.

Stinson, D. R. (2005). Cryptography: theory and practice.

CRC Press, 3rd edition.

Tassa, T. (2007). Hierarchical threshold secret sharing.

Journal of Cryptology, 20:237–264.

Tochikubo, K. (2004). Efﬁcient secret sharing schemes

realizing general access structures. IEICE Transac-

tions on Fundamentals of Electronics, Communica-

tions and Computer Sciences, E87-A(7):1788–1797.

Tochikubo, K. (2008). Efﬁcient secret sharing schemes

based on unauthorized subsets. IEICE Transac-

tions on Fundamentals of Electronics, Communica-

tions and Computer Sciences, E91-A(10):2860–2867.

Tochikubo, K. (2013). New construction methods of secret

sharing schemes based on authorized subsets. Infor-

mation and Media Technologies, 8(4):978–986.

Tochikubo, K. (2015). New secret sharing schemes realiz-

ing general access structures. Journal of Information

Processing, 23(5):570–578.

Tochikubo, K., Uyematsu., T., and Matsumoto, R. (2005).

Efﬁcient secret sharing schemes based on autho-

rized subsets. IEICE Transactions on Fundamentals

of Electronics, Communications and Computer Sci-

ences, E88-A:322–326.

ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy

654