Abstract:
The presently disclosed subject matter includes a computerized method and system of implementing a secret management scheme. According to the proposed approach, values derived from a secret are not distributed to the participating entities. Instead, each participating entity provides a respective preexisting identifier that is not derived from the secret.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims the benefit of priority to U.S. Provisional Patent Application No. 62/115,496, entitled “SHARING A SECRET WITHOUT DISCLOSING INFORMATION OR DISTRIBUTING SHARES”, filed Feb. 12, 2015, the entire disclosure of which is hereby incorporated by reference herein. 
     
    
     FIELD OF INVENTION 
       [0002]    The presently disclosed subject matter relates in general to the field of cryptography. 
       BACKGROUND 
       [0003]    A shared secret is a mechanism in cryptography which allows secure communication and data sharing between two or more entities. Secret sharing is a type of shared secret where the secret is broken into different parts (aka “secret shares”) and distributed among participants in a group of entities. The secret can be reconstructed only when a sufficient number of secret shares are obtained and combined together. 
         [0004]    One known secret sharing scheme is Shamir secret sharing which involves generating a polynomial f(x) of a degree K−1, where the secret is the constant term a 0  of the polynomial, and sharing points of the polynomial to N entities. A subset of K points retrieved from K entities is required for calculating the polynomial and obtaining the secret. 
         [0005]    See the following reference which is incorporated herein by reference in its entirety: Adi Shamir “How to share a Secret”, Communications of the ACM, November 1979, 22 (11): 612-613, Blakley, G. R. (1979). “Safeguarding cryptographic keys”, Proceedings of the National Computer Conference 48: 313-317) For example, Adi Shamir in “How to share a Secret”, Communications of the ACM, November 1979, 22 (11): 612-613, Blakley, G. R. (1979). “Safeguarding cryptographic keys”, Proceedings of the National Computer Conference 48: 313-317. This 
       GENERAL DESCRIPTION 
       [0006]    The presently disclosed subject matter includes a computerized method and system of implementing a secret management scheme. According to the proposed approach, values derived from a secret (referred to herein as “derived values”) are not distributed to the participating entities. Instead, each participating entity provides a respective identifier that is not derived from the secret. The identifiers are used by a central authority to generate the “derived values” that are not distributed to the participating entities but rather stored in a data-storage accessible by a central authority. 
         [0007]    In order to share a secret S amongst N entities and require a quorum of at least K entities for reconstructing the secret, a polynomial f(x) of degree K−1 is generated using the shared secret as the coefficient for the 0 th  degree (the constant term a 0  of the polynomial). The polynomial is represented by coefficients A i  (0≦i≦K). 
         [0008]    Each entity E i  submits a respective unique identifier X i  from which a respective Y i  value is generated using the polynomial with the coefficients A i  (0≦i≦K). The generated Y i  values are stored in a data-storage accessible by the central authority. Reconstruction of the secret is executed by the central authority. In order to reconstruct the secret at least K bi-tuples of (X i , Y i ) are required. 
         [0009]    In the event it is desired to add a new entity E N+1  to the existing pool of entities a new Y N+1  can be calculated based on a respective identifier received from the new entity. 
         [0010]    In case it is desired to change the value of K, a new polynomial of a degree which equals to the new K value −1 can be generated. In case not all identifiers of all entities are available, K identifiers are retrieved from K participating entities and can be used together with the Y i  values to reconstruct the polynomial. The X i  values of those entities that did not submit their identifiers (referred herein as “non-participating entities”) can be calculated using the reconstructed polynomial and respective stored Y i  values. Once all X i  values are available, new respective Y i  values can be calculated and stored using the newly generated polynomial. Notably, this process requires interaction only with K entities. 
         [0011]    Thus, on the one hand, as essential information (derived values) is available only at the central authority, the central authority has a role in the process of reconstructing the secret. On the other hand, because before reconstruction of the secret, information with respect to the identifiers is available only at the respective participating entities, a quorum of (K) entities is also required for reconstructing the secret. Distribution of the information necessary for reconstructing the secret between the central authority and the different entities makes unlawful reconstruction of the secret more difficult. 
         [0012]    In addition, as information regarding secret shares is not required to be transmitted from the central authority to the participating entities, a trusted transmission channel (i.e. transmission channel protected from unlawful access) between the central authority and the entities is not required for this purpose. 
         [0013]    As the information (identifier) stored at each entity is meaningless without the corresponding “derived share” that is stored in the central authority, leakage of the information from multiple entities (even more than K entities) does not compromise the secret without the additional information stored at the central authority. 
         [0014]    Although in some cases this may be preferable, the entities are not required to store different secret shares generated for different secrets. Rather the entities can use the same identifier with many different secrets. 
         [0015]    Thus, according to one aspect of the presently disclosed subject matter there is provided a system comprising: a central authority operatively configured to communicate with a plurality of entities; wherein each entity is assigned with a unique identifier; the central authority is configured to store a deconstructed master secret such that at least a sub-set of K out of N available unique identifiers is needed in order to reconstruct the master key; wherein N is the number of identifiers assigned to the entities in the system. 
         [0016]    According to another aspect of the presently disclosed subject matter there is provided a system comprising: a computerized device configured for authorizing execution of a restricted operation, wherein the restricted operation is authorized only if a secret key is available; the computerized device comprising at least one computer processor operatively connected to a computer data storage; the computer processor is configured for reconstructing the secret key to: 
         [0017]    receive at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective entity; retrieve from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs; wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a 0  of the polynomial is the secret key; and reconstruct the polynomial based on the K (identifiers, derived value) pairs; and render the secret key available for enabling execution of the restricted operation. 
         [0018]    In addition to the above features, the system according to this aspect of the presently disclosed subject matter can optionally comprise one or more of features (i) to (xiv) below, in any technically possible combination or permutation: 
         [0019]    (i). wherein the at least one computer processor is further configured for deconstructing the secret key to: receive the N identifiers; use the polynomial of degree K−1 for generating a respective derived value for each of N received identifiers; store the derived values in the data storage and discard the identifiers, the polynomial and the secret. 
         [0020]    (ii). wherein the at least one computer processor is further configured, responsive to obtaining the secret key, to transmit the secret to one or more entities to enable the execution of the restricted operation by the entity. 
         [0021]    (iii). wherein the at least one computer processor is configured, responsive to obtaining the secret key, to generate a command instructing to execute the restricted operation. 
         [0022]    (iv). wherein the derived values are not shared with the entities. 
         [0023]    (v). wherein each identifier is received from a respective entity. 
         [0024]    (vi). wherein an entity is a computerized device being capable of performing the restricted operation only if the secret key is available at the computerized device. 
         [0025]    (vii). wherein an entity is a person. 
         [0026]    (viii). The system further comprises an input device configured for receiving from each entity user input data including a respective identifier. 
         [0027]    (ix). wherein the derived values are stored in the data storage together with information enabling to identify a respective entity assigned to each identifier. 
         [0028]    (x). wherein the identifiers include a combination of identifiers of various types. 
         [0029]    (xi). wherein the identifiers include one or more of the following: biometric data of any kind or a derivative thereof; and password of any kind. 
         [0030]    (xii). wherein the at least one computer processor is further configured for adding a new entity to existing N entities, to: 
         [0031]    retrieve at least K identifiers from K respective entities; retrieve from the data-storage the respective derived values of the retrieved identifiers; use the at least K identifiers and respective derived values to reconstruct the polynomial; apply the polynomial to the new identifier, identifying the new entity, and obtain a new derived value; and store the derived value in the data-storage. 
         [0032]    (xiii). wherein the computer processor is further configured for changing the secret key, to: 
         [0033]    retrieve at least K identifiers from K respective entities; generate a new polynomial of a degree K−1, where the constant term a 0  of the polynomial is a new secret key; use the new polynomial for generating a respective derived value for each of the at least K identifiers; 
         [0034]    in the event that not all N identifiers are available, the at least one processor is configured to: 
         [0035]    retrieve from the computer data storage for each of the at least K identifiers a respective derived value to obtain at least K (identifiers, derived value) pairs; use K (identifiers, derived value) pairs to reconstruct the polynomial; use the derived values for calculating the remaining identifiers; apply the new polynomial to the calculated identifiers to obtain respective derived values; and store the derived values in the data-storage. 
         [0036]    (xiv). The system is a data-storage system, the entities being N data-storage devices constituting a physical storage space of the data-storage system; the computerized device is configured for managing at least one secret key for enabling execution of one or more restricted operations at the N storage devices. 
         [0037]    According to another aspect of the presently disclosed subject matter there is provided a computer implemented method of authorizing execution of a restricted operation, wherein the restricted operation is authorized only if a secret key is available; the computer comprising at least one computer processor operatively connected to a computer data storage; the method comprising operating the computer processor for reconstructing the secret key, comprising: 
         [0038]    receiving at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective entity; retrieving from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs; wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a 0  of the polynomial is the secret key; reconstructing the polynomial based on the K (identifiers, derived value) pairs; and rendering the secret key available for enabling execution of the restricted operation by the computer or by another device. 
         [0039]    In addition to the above features, the method according to the above aspect of the presently disclosed subject matter can optionally comprise one or more of features (i) to (xiv) above, in any technically possible combination or permutation: 
         [0040]    According to another aspect of the presently disclosed subject matter there is provided a non-transitory program storage device readable by a computer, tangibly embodying computer readable instructions executable by the computer to perform a method of authorizing execution of a restricted operation, wherein the restricted operation is authorized only if a secret key is available; the computer comprising at least one computer processor operatively connected to a computer data storage; the method comprising operating the computer processor for reconstructing the secret key, comprising: 
         [0041]    receiving at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective entity; 
         [0042]    retrieving from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs; wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a 0  of the polynomial is the secret key; 
         [0043]    reconstructing the polynomial based on the K (identifiers, derived value) pairs; and rendering the secret key available for enabling execution of the restricted operation by the computer or by another device. 
         [0044]    In addition to the above features, the data-storage device according to the above aspect aspect of the presently disclosed subject matter can optionally comprise one or more of features (i) to (xiv) above, in any technically possible combination or permutation: 
         [0045]    According to another aspect of the presently disclosed subject matter there is provided a data-storage system comprising: a control layer comprising one or more control devices operatively connected to N data-storage devices, the data-storage devices constituting a physical storage space of the data-storage system; wherein at least one of the control devices is configured for managing at least one secret key required for enabling execution of one or more restricted operations at the N storage devices; the at least one control device comprising at least one computer processor operatively connected to a computer data storage; the computer processor is configured for reconstructing the secret key to: 
         [0046]    receive at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective data-storage device; retrieve from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs; wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a 0  of the polynomial is the secret key; and reconstruct the polynomial based on the K (identifiers, derived value) pairs and render the secret key available for enabling execution of the restricted operation. 
         [0047]    In addition to the above features, the data-storage system according to the above aspect of the presently disclosed subject matter can optionally comprise one or more of features (i) to (xiv) above, in any technically possible combination or permutation: 
         [0048]    According to another aspect of the presently disclosed subject matter there is provided a method of managing at least one secret key in a data-storage system, the key is required for enabling execution of one or more restricted operations at N storage devices; the data-storage system comprising at least one control device operatively connected to the N data-storage devices, the N data-storage devices constituting a physical storage space of the data-storage system; the method comprising operating the at least one control device for reconstructing the secret key, comprising: 
         [0049]    receiving at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective entity; 
         [0050]    retrieving from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs; wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a 0  of the polynomial is the secret key; reconstructing the polynomial based on the K (identifiers, derived value) pairs; and 
         [0051]    rendering the secret key available for enabling execution of the restricted operation by the computer or by another device. 
         [0052]    In addition to the above features, the method according to the above aspect of the presently disclosed subject matter can optionally comprise one or more of features (i) to (xiv) above, in any technically possible combination or permutation: 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0053]    In order to understand the presently disclosed subject matter and to see how it may be carried out in practice, the subject matter will now be described, by way of non-limiting examples only, with reference to the accompanying drawings, in which: 
           [0054]      FIG. 1  is a schematic illustration of a general view of a computer system layout comprising central authority connected to a plurality of entities, in accordance with an example of the presently disclosed subject matter; 
           [0055]      FIG. 2  is a functional block diagram of a data-storage system, in accordance with an example of the presently disclosed subject matter; 
           [0056]      FIG. 3 a    is a functional block diagram of central authority management unit, in accordance with an example of the presently disclosed subject matter; 
           [0057]      FIG. 3 b    is a functional block diagram of device management unit, in accordance with an example of the presently disclosed subject matter; 
           [0058]      FIG. 4  is a flowchart showing an example of a sequence of operations related to secret deconstruction, in accordance with an example of the presently disclosed subject matter; 
           [0059]      FIG. 5  is a flowchart showing an example of a sequence of operations related to secret deconstruction, in accordance with an example of the presently disclosed subject matter; 
           [0060]      FIG. 6  is a flowchart showing an example of a sequence of operations related to adding a new entity, in accordance with an example of the presently disclosed subject matter; 
           [0061]      FIG. 7  is a flowchart showing an example of a sequence of operations related to changing secret S, in accordance with an example of the presently disclosed subject matter; and 
           [0062]      FIG. 8  is a flowchart showing an example of a sequence of operations related to removing an existing entity, in accordance with an example of the presently disclosed subject matter. 
       
    
    
     DETAILED DESCRIPTION 
       [0063]    Unless specifically stated otherwise, as apparent from the following discussions, it is appreciated that throughout the specification discussions utilizing terms such as “receiving”, “retrieving”, “reconstructing”, “deconstructing”, “transmitting”, “applying” or the like, include actions and/or processes of a computer that manipulate and/or transform data into other data, said data represented as physical quantities, e.g. such as electronic quantities, and/or said data representing the physical objects. 
         [0064]    Central authority  101  as well as entity device  330  described below are computerized devices. The terms “computer/computerized device”, “computer”, “processing unit”, “control device” or variations thereof should be expansively construed to cover any kind of electronic device with data processing capabilities, including, by way of non-limiting example, a processor (e.g. digital signal processor (DSP), a microcontroller, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc.), or a device comprising a processor and computer memory such as a personal computer, a server, a computing system, a communication device, any other electronic computing device, and or any combination thereof. 
         [0065]    As used herein, the phrase “for example,” “such as”, “for instance” and variants thereof describe non-limiting embodiments of the presently disclosed subject matter. Reference in the specification to “one case”, “some cases”, “other cases” or variants thereof means that a particular feature, structure or characteristic described in connection with the embodiment(s) is included in at least one embodiment of the presently disclosed subject matter. Thus the appearance of the phrase “one case”, “some cases”, “other cases” or variants thereof does not necessarily refer to the same embodiment(s). 
         [0066]    It is appreciated that certain features of the presently disclosed subject matter, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the presently disclosed subject matter, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination. 
         [0067]    In embodiments of the presently disclosed subject matter, fewer, more and/or different stages than those shown in  FIGS. 4, 5, 6, 7 and 8  may be executed. In embodiments of the presently disclosed subject matter one or more stages illustrated in  FIGS. 4, 5, 6, 7 and 8  may be executed in a different order and/or one or more groups of stages may be executed simultaneously. For example, operations described with reference to block  430  can be performed in some example, before or at the same time as operations described with reference to block  425 . 
         [0068]      FIGS. 1, 2 and 3   a ,  3   b  illustrate a general schematic of the system architecture in accordance with an embodiment of the presently disclosed subject matter. Elements in  FIGS. 1, 2 and 3   a ,  3   b  can be made up of a combination of hardware with firmware and/or with software that performs the functions as defined and explained herein. Elements in  FIGS. 1, 2 and 3   a ,  3   b  may be centralized in one location or dispersed over more than one location. In other embodiments of the presently disclosed subject matter, the system may comprise fewer, more, and/or different elements than those shown in  FIGS. 1, 2 and 3   a ,  3   b.    
         [0069]    Bearing this in mind, attention is drawn to  FIG. 1  illustrating schematically a general view of a computer system layout comprising a central authority computer device  101  connected to entities  104   (1−n) , according to an example of the presently disclosed subject matter. 
         [0070]    Central authority  101  is configured to manage secret keys which are required for providing permission to perform one or more restricted operations, where, only if the secret key is available, permission to perform a restricted operation is granted. Central authority device can be implemented as part of a computerized device or a computer system configured for managing secret, including operations such as: deconstruction and reconstruction of the secret, adding and removing entities and changing secrets. Central authority can be also configured for authorizing execution of a restricted operation. 
         [0071]    Entities  104   (1−n)  can be any group of elements where each element is assigned with a unique identifier and is capable to provide the identifier to central authority  101 . For example entities  104   (1−n)  can be a group of people or a group of computerized devices which are allowed to perform a certain restricted operation only if K out of N entities are available. 
         [0072]    Examples of restricted operations include: access to a certain restricted area (e.g. opening an entrance door or gate to a building or compound or opening a vault), where access is granted only if at least K out of N people provide their respective identifiers; performing a certain operation (e.g. operate a weapon, access a restricted storage area in a computer system, read an encrypted piece of data), where only if at least K out of N people provide their respective identifiers, permission to perform the operation is granted; performing a certain operation by a computer device, where only if at least K out of N computers provide their respective identifiers, permission to perform the operation is granted. 
         [0073]    Entities  104   (1−n)  are capable to communicate with the central authority  101  which is accessible for receiving the respective identifiers from entities  104   (1−n) . Communication between central authority  101  and entities  104   (1−n)  can be realized by any suitable communication network (including hardwired and wireless networks) and communication technology, protocol or standard (WiFi, 3G, LTE, etc). 
         [0074]    According to one example, central authority  101  comprises or is otherwise operatively connected to one or more user terminals for enabling different entities (e.g. individual people) to interact therewith. User terminals can be configured as an integral part of central authority  101 . For example, a user terminal can be configured as a work station or a finger print reader directly connected to the central authority  101  (e.g. a finger print reader located near an entrance door). Alternatively or additionally, user terminals can be implemented as user computerized devices (e.g. Smartphone, laptop computer, PC computer, tablet device, etc.) connected to central authority  101  over a communication network (e.g. the Internet) running for example a user interface (the interface comprising for example, dedicated software, input device and display) configured to allow an individual to provide to the central authority  101  its respective identifier. 
         [0075]    As mentioned above, in some examples entities  104   (1−n)  include a group of computerized devices which are allowed to perform a certain operation only if K out of N devices provide their assigned identifier.  FIG. 2  illustrates a general functional block diagram of data-storage system (e.g. a highly available data-storage system) implementing secret management, according to the presently disclosed subject matter. 
         [0076]    Storage system  200  comprises two or more storage devices SD (1−n)  constituting a physical storage space of the storage system. Storage devices may be any one of hard disk storage devices (HDD) or solid state drives (SSD, comprising for example, a plurality of NAND elements) or any other appropriate storage device. 
         [0077]    Data-storage system  200  further comprises a control layer  210  comprising one or more control devices  205   (1−n)  (e.g. implemented by server computer devices) operatively connected to the physical storage space and possibly also to one or more hosts (1−n) , and configured to control and execute various operations in the storage system (e.g. I/O operations). Control devices  205   (1−n)  in control layer  210  as well as storage devices SD (1−n)  constituting the physical storage space can be consolidated in a single unit, or can be otherwise distributed over one or more computer nodes connected across a computer network. 
         [0078]    Data-storage system  200  further comprises central authority  101  which can be implemented in various manners. For example, central authority  101  can be implemented as part of one of the control devices  205   (1−n) , be distributed over a plurality of control devices  205   (1−n) , or be implemented as a dedicated control device. Central authority  101  can also be mirrored in at least two control devices to ensure operational persistency. Central authority  101  is operatively connectable to N entities in this case represented by SD (1−n)  storage device. According to this example, secret management principles disclosed herein are utilized for reducing the risk of fraudulently accessing the data-storage devices and performing operations unlawfully. 
         [0079]    Each storage device is configured to store a unique identifier in a dedicated storage area. Central authority  101  is configured to obtain the identifiers from storage device SD (1−n)  and responsive to receiving N unique identifiers from N storage devices, to deconstruct a secret key into K derived values and store the K derived values in a data storage device  230 . Data storage device  230  can be configured as part of the control layer or be otherwise operatively connected to central authority  101 . 
         [0080]    A request to perform a restricted operation (e.g. access any one of the storage devices SD (1−n)  for writing or reading) which is received at the central authority  101  is granted only if at least K out of N entities submit their respective identifiers to the central authority  101 . 
         [0081]    The central authority  101  is configured to use the identifiers, received from at least K entities, together with the stored derived values in order to reconstruct the secret and make it available for performing the restricted operation. 
         [0082]      FIG. 3 a    illustrates a functional block diagram of central authority  101 , in accordance with an example of the presently disclosed subject matter. Central authority  101  comprises for example: central secrets management unit  301 , communication module  305 , authorization module  307  and one or more computer processors  309 . Central secrets management unit  301  can comprise or be otherwise operatively connected to: a reconstruction module  317  and a deconstruction module  319  random and number generator  313 . Central secrets management unit  301  is configured to execute various secret management operations including for example, secret deconstruction, secret reconstruction, polynomial generation, etc. 
         [0083]    Authorization module  307  is configured for authorizing the execution, and possibly also for executing, a restricted operation. Authorization of the restricted operation can be done in various ways. For example, authorization module  307  can be configured, responsive to successful reconstruction of the secret, to send the reconstructed secret to the device where the restricted operation is supposed to be executed. In another example, authorization module  307  can be configured, responsive to successful reconstruction of the secret, to send some type of command authorizing execution of the restricted operation to the device where the restricted operation is supposed to be executed. In yet another example, authorization module  307  can be configured, responsive to successful reconstruction of the secret, to generate and send a command (e.g. constituting a signal or digital data) instructing to execute the restricted operation. 
         [0084]    Communication module  305  is configured for facilitating communication with central authority  101 , e.g. between central authority and entities. Computer processor  309  is configured for controlling and executing operations described as described herein. According to some examples the processor can be configured to execute several functional modules (as described below with reference to  FIGS. 4 to 8 ) in accordance with computer-readable instructions implemented on a non-transitory computer usable medium. 
         [0085]    Central authority can further comprise or be otherwise operatively connected to input device  306  configured for receiving input data from a user. Input device  306  includes for example one or more of: mouse, keyboard, touch screen, touchpad, fingerprint reader, iris scanner, or any other input device. 
         [0086]      FIG. 3 b    shows a functional block diagram of an entity device  330 , in accordance with an example of the presently disclosed subject matter. The term “entity device” includes any computerized device configured to operate autonomously or be operated by a person for interacting with central authority  101  (including a dedicated computerized device or a user computerized device as mentioned above) and a computerized device being controlled by central authority  101  (e.g. data storage devices SD (1−n)  as described above with reference to  FIG. 2 ). 
         [0087]    Entity device  330  can comprise for example: secret management module  331 ; data storage  332 ; communication module  333 ; and one or more input devices  334 . Secret management module  331  is configured in general to execute operations related to secret management including for example providing one or more identifiers to central authority  101 . Communication module  333  is configured for enabling communication over a communication network including communication with central authority  101 . Data storage  332  can be used for example for storing identifiers. Input device  334  (e.g. keyboard, mouse, mouse pad, etc.) can be used for receiving user input (e.g. instruction to send an identifier to central authority). Entity device  330  further comprises one or more computer processors  335  for controlling and executing operations. According to some examples the processor can be configured to execute several functional modules in accordance with computer-readable instructions implemented on a non-transitory computer usable medium. 
         [0088]      FIG. 4  is a flowchart showing a sequence of operations related to a secret deconstruction process, according to an example of the presently disclosed subject matter. Operations described with reference to  FIG. 4  can be executed for example by central authority  101  (e.g. with the help of deconstruction module  319 ). 
         [0089]    At block  405  central authority receives from each one of entities  104   (1−n)  a unique identifier assigned to the entity. Identifiers can include any piece of information which uniquely identifies a respective entity. An identifier can be for example a password or a biometric identifier such as: fingerprint or any derivative thereof iris scan or any derivative thereof voice signature or any derivative thereof; DNA sequencing or any derivative thereof. 
         [0090]    Notably, different entities in a single pool of entities can use different types of identifiers. For example, in case the entities are people communicating with a central authority via a computerized device, different people can choose a different type of identifier (e.g. some may provide a password while others may provide fingerprint or iris authentication data generated by an appropriate fingerprint reader or iris scanner). 
         [0091]    The central authority ensures that all the submitted identifiers are indeed unique. If not, a request can be sent to one or more entities asking to provide a different identifier. 
         [0092]    At block  410  K−1 random numbers are generated (e.g. with the help of random number generator  313 ). The random number can be for example a number between 1 and a very large prime number (e.g. 2 256 −189) for the purpose of assuring uniqueness of the generated number (e.g. all of the calculations are performed mod P where P is a very large prime number.) 
         [0093]    At block  415  a polynomial function of degree K−1 is generated using the K−1 random numbers as coefficients A i  (0≦i≦K) for the i th  degree and the secret S as the coefficient for 0 th  degree of the polynomial. 
         [0094]    The secret key can be generated for example by central authority  101  (e.g. by random number generator) or by an external source such as a remote device or user. Whenever the secret is available, the secret can be used for encrypting and/or locking an object. The object can be for example a device (e.g. data storage device, entrance door, weapon, safe, vehicle, etc.) or a piece of data (e.g. file or folder, etc.). After encryption, certain operations (referred to herein as “restricted operations”) can be performed with respect to the encrypted object only if the secret is available and is used for decrypting and/or unlocking the object. 
         [0095]    Notably, the entities are not necessarily equal to the encrypted/locked object. In some cases, the entities which provide the identifiers are also the objects which are encrypted or locked by the secret. This is so in the data-storage example, in case the identifiers are used for identifying the storage devices and the secret is used for restricting access to the same storage devices. In other cases, the entities which provide the identifiers are not the objects which are encrypted or locked by the secret. This is so in an entrance door example, where a quorum of K individuals is required for opening a door lock. The identifiers are used for identifying the individuals (the entities) and the secret is used for restricting access via the locked door (the object). 
         [0096]    At block  420  the polynomial is applied to each one of the X i  identifiers received from entities  104   (1−n)  to provide a respective f(X i ) values (i.e. derived value Y i ). The derived values are stored in data storage  230  (block  425 ). According to some examples, each derived value is stored together with information identifying the entity which provided the respective X i  value (e.g. unique entity name). 
         [0097]    At block  430  the received identifiers, the polynomial and secret S are discarded. Since only the derived values Y i  are available at the central authority  101 , the central authority is unable to reconstruct the secret and accordingly are unable to perform or authorize the restricted operation without first obtaining K X i  values. The Y i  values and the secret are not transmitted to entities  104   (1−n)  and therefore each one of the entities, which has access only to its respective identifier, are unable to reconstruct the secret as well. 
         [0098]    Notably, as it is not necessary to transmit secret shares from central authority  101  to 
         [0099]    entities  104   (1−n)  a trusted (secure) communication link between central authority to entities  104   (1−n)  for such data transmission is not necessary. 
         [0100]      FIG. 5  shows a flowchart of a sequence of operations related to secret reconstruction, according to an example of the presently disclosed subject matter. Operations described with reference to  FIG. 5  can be executed for example by central authority  101  (e.g. with the help of reconstruction module  317 ). 
         [0101]    At block  505  central authority  101  receives from at least K entities out of entities  104   (1−n)  their respective identifiers. Submission of the identifiers can occur for example in response to a request issued by the central authority or by another entity to execute a restricted operation. 
         [0102]    At block  510  central authority  101  retrieves the derived values Y i  from the data storage  230 . Previously, it has been mentioned that each Y i  value is stored together with data identifying a respective entity which provided the corresponding X i  values. This information can now be used for matching the stored Y i  values with their respective X i  values retrieved from the entities. 
         [0103]    At block  515  the polynomial is reconstructed using K (identifier, derived value) pairs ((X i , Y i ) bi-tuples). By reconstructing the polynomial, the value of the 0 th  coefficient (i.e. secret S) is obtained. The reconstruction of the polynomial can be accomplished for example by implementing Lagrange Interpolation on the (X i , Y i ) bi-tuples or by any other method for reconstructing polynomials which is known in the art. 
         [0104]    Optionally, in case more than K identifiers of more than K entities are available, the polynomial and the respective secret can be reconstructed by applying the polynomial interpolation on different permutations of the available (X i , Y i ) bi-tuples. This can assist in verifying that the obtained secret is indeed correct. 
         [0105]    Once the secret is available, execution of the restricted operation is allowed (block  520 ). In response, central authority  101  can send a command authorizing the execution of a restricted operation and/or send a command directed for executing the restricted operation. As mentioned above, in some examples authorization module  307  in central authority  101  can be configured to govern final execution of the restricted operation. 
         [0106]    For example, where central authority  101  is operating in a data-storage system as described above with reference to  FIG. 2 , central authority  101  (e.g. by authorization module  307 ) can be configured to distribute the reconstructed secret key to the storage devices allowing each data storage device to use the secret for decrypting the storage device and gain access to read and/or write the stored data. Likewise, central authority  101  can send a command to a weapon system for unlocking a weapon system and making it ready for activation. 
         [0107]    According to another example, central authority can be configured, responsive to obtaining the secret, to send a command directed to actually execute the restricted operation. Examples of this include: sending a signal to a locking mechanism of an entrance door directed for unlocking the door; sending a signal to a weapon system for activating the weapon; sending a signal to safe lock for unlocking the safe; sending a command to data decoder for decoding an encryption and making a file or folder accessible. 
         [0108]    Notably, the term “command” should be construed to include commands in different forms such as a signal (e.g. electric signal (voltage), optical signal, electromagnetic signal, etc.) or digital data transfer (e.g. one or more bits of data or a digital signature). 
         [0109]    Turning to  FIG. 6 , it shows a sequence of operations related to adding a new entity, according to an example of the presently disclosed subject matter. Operations described with reference to  FIG. 6  can be executed for example by central authority  101  (e.g. with the help of update module  315 ). 
         [0110]    In some cases an additional entity may be added to the pool of existing entities  104   (1−n) . For example, this may occur when an additional storage device is added to a data-storage system. In such an event central authority  101  receives a respective unique identifier (X N+1 ) submitted by the new entity (block  605 ). 
         [0111]    At block  610 , at least K identifiers X i  of K respective entities are obtained by the central authority. The respective derived values Y i  of the retrieved identifiers X i  are obtained from data-storage  230  (block  615 ). 
         [0112]    At block  620  the (identifier, derived value) pairs ((X i , Y i ) bi-tuples) are used in order to build a set of K equations with K unknowns, where the unknowns are the original A i  coefficients and the new coefficients are the values of the X i  raised to the i th  power. At block  607  the K equations are solved and the A i  coefficients are determined and the original polynomial is obtained. 
         [0113]    Optionally, in case more than K identifiers of more than K entities are available, the operations described with respect to blocks  615  to  620  are repeated using different permutations of the assembled (X i , Y i ) bi-tuples in order to verify that the correct result has been obtained. 
         [0114]    Once the polynomial is available, a respective derived value (derived Y i  value) is calculated for the new identifier (X n+1 ) of the added entity (block  625 ). The new Y i  value is stored in data-storage  230  and the identifiers and secret are discarded as explained above with reference to  FIG. 4 . 
         [0115]    Optionally, in the event that not all the identifiers of all entities  104   (1−n)  are available, the K degree polynomial and the available Y i  values are used for calculating the remaining X i  values (block  630 ). This operation can be executed in case it is desired to calculate new derived values Y i  for additional, or possibly all, entities  104   (1−n) , for example, in case it is desired to maintain a certain ratio between K and N and accordingly a new polynomial of a greater degree is calculated as described above with reference to  FIG. 4 . 
         [0116]    Turning to  FIG. 7 , it shows a flowchart of a sequence of operations related to changing secret S, according to an example of the presently disclosed subject matter. Operations described according to  FIG. 7  can be carried out for example by central authority  101  (e.g. with the help of update module  315  in unit  301 ). 
         [0117]    In some cases it may be desired to change a current secret S to a new secret S′. For example, a secret may be periodically changed in order to increase the system security. 
         [0118]    At block  705  a new secret s′ is obtained. For example, random number generator  313  can be configured to generate a new secret key or a new secret can be obtained from an external source. At block  710 , central authority  101  receives from at least K entities out of entities  104   (1−n)  their respective identifiers. 
         [0119]    Assuming K or more (i.e. K+M identifiers, where M≧0) identifiers are retrieved, the operations described above with reference to blocks  410  to  430  are repeated using the new secret for generating a new polynomial and respective derived values (block  715 ). 
         [0120]    In the event that not all the identifiers of all entities  104   (1−n)  are available (K+M&lt;N) and it is desired to provide derived values also to the entities whose identifiers are not available (non-participating entities), the respective derived values Y i  of the retrieved identifiers X i  are obtained from data-storage  230  and the old K−1 degree polynomial is reconstructed as described above with reference to  FIG. 5  (block  720 ). The old polynomial and the available Y i  values are used for calculating the remaining X i  values (block  725 ). The new polynomial is applied to the calculated identifiers X i  to obtain respective Y i  derived values (block  730 ). The calculated Y i  can be stored in data-storage  230  (block  735 ) and the identifiers, polynomial and secret are discarded (block  740 ) as explained above with reference to  FIG. 4 . 
         [0121]    Optionally, in case more than K identifiers of more than K entities are available, the operations described with respect to block  715  are repeated using different permutations of the assembled (X i , Y i ) bi-tuples in order to verify that the correct result has been obtained. 
         [0122]    In some environments, the ability of the central authority to reconstruct the X i  values of the non-participating entities may be considered to be a security risk as it would mean that compromising the central authority of one secret leads to the leakage of the X i  values and usage of them in order to fraudulently reconstruct other secrets. In such an environment, each entity may have more than one identifier, each identifier assigned to a different secret. In this type of environment, central authority  101  is configured to manage multiple secrets and store for each secret respective derived values. Likewise, each entity device can be configured to manage multiple identifiers and use the proper identifier with the appropriate secret. 
         [0123]    As explained above, the principles of the presently disclosed subject matter can be implemented in a data-storage system for encrypting the storage devices and allowing access to the storage devices only with an appropriate encryption key (secret). Assuming the data-storage system comprises N storage devices (drives) that can be locked and/or encrypted by the use of a key, each storage device is assigned with a respective unique identifier. According to one example, the identifier can be assigned to the storage device during the manufacturing stage. Alternatively, each storage device can be configured to generate a unique identifier. For example, secret management unit  331  can comprise a random number generator configured to generate a random number uniquely identifying the respective device. 
         [0124]    The generated identifier can be written to a dedicated area of the storage space in each storage device. For example, in the SCSI standards it is described as an application log. The dedicated area can be physically and/or logically separated from the remaining storage space in the device dedicated for storing data. Unlike the remaining storage space, it is not encrypted by the secret key. 
         [0125]    During an encrypting phase, the operations described above with reference to  FIG. 4  are executed. Likewise, during a decryption phase, the operations described above with reference to  FIG. 5  are executed. 
         [0126]    In addition to the above, the method and system disclosed herein enables the removal of an entity from an existing pool of entities. Assuming there is a group of N entities it may be desired to remove one of the entities (e.g. in case a data storage device is removed from a data-storage system, or in case an individual is no longer allowed to access a certain area or building) and accordingly also omit the respective identifier from the group of N identifiers. According to one example, the respective derived value Y i  can be simply deleted from the data-storage. In such case, the identifier of the omitted entity cannot be used for reconstructing the polynomial and obtaining the secret and is therefore useless. Note, that this allows omitting an entity from the pool of entities while keeping the entity unaware of this operation. 
         [0127]    In some cases, additional operations may be carried out during the process of omitting an entity, for example, in case it is desired to generate a new secret and polynomial or only a new polynomial. Turing to  FIG. 8  it shows a flowchart of a sequence of operations related to removal of an entity, according to an example of the presently disclosed subject matter. Operations related to removal of an entity includes those described according to  FIG. 8  can be carried out for example by central authority  101  (e.g. with the help of update module  315  in unit  301 ). 
         [0128]    According to one example this can be done by retrieving the identifiers from all or part of the entities in the pool of entities, possibly aside from the entity which is being omitted (block  805 ). 
         [0129]    Notably, whether or not the identifier of the omitted entity is retrieved, can depend on the specific circumstances. In some cases, it may be desired to retrieve the identifier of the omitted entity, e.g. in case other identifiers in the pool of identifiers are missing and the identifier of the omitted entity is required for the purpose of obtaining K identifiers for reconstructing the polynomial and calculating the missing identifiers as described above with reference to  FIG. 7 . In other cases, it may be desired to avoid retrieving the identifier of the omitted entity, e.g. in case it is desired to that the omitted entity remains unaware of the omission. 
         [0130]    At block  810  operation described above with reference to block  410  to  430  are repeated. The new value of K (K′) may vary depending on the specific circumstances. In any case, as the pool of N entities has been decremented by 1, K′ equals or smaller than N−1, unless a different entity was added to replace the one which has been removed. Notably, in some cases the same secret can be used with a different polynomial possibly of a different degree. 
         [0131]    Optionally, in case not all identifiers are available the old polynomial can be reconstructed using at least K identifiers (block  815 ). Calculate the missing identifiers using the old polynomial and the respective derived values (block  820 ). Apply the new polynomial to the new pool of identifiers (block  825 ) store the respective derived values in the data-storage (block  830 ) and discard the secret, polynomial and identifiers (block  835 ). 
         [0132]    It is to be understood that the system according to the presently disclosed subject matter may be a suitably programmed computer. Likewise, the presently disclosed subject matter contemplates a non-transitory computer storage device being readable by a computer for executing the method of the presently disclosed subject matter. The presently disclosed subject matter further contemplates a computer-readable memory (transitory and non-transitory) tangibly embodying a program of instructions executable by the computer for executing the method of the presently disclosed subject matter. 
         [0133]    It is also to be understood that the presently disclosed subject matter is not limited in its application to the details set forth in the description contained herein or illustrated in the drawings. The presently disclosed subject matter is capable of other embodiments and of being practiced and carried out in various ways. Hence, it is to be understood that the phraseology and terminology employed herein are for the purpose of description and should not be regarded as limiting. As such, those skilled in the art will appreciate that the conception upon which this disclosure is based may readily be utilized as a basis for designing other structures, methods, and systems for carrying out the several purposes of the present presently disclosed subject matter.