# A Multi-Secret Reputation Adjustment Method in the Secret Sharing for Internet of Vehicles

Authors: Jingbang Wu; Xiyu Chen; Luyuan Zhang; Shufen Zhou; Daoshun Wang
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Secure data sharing for the Internet of Vehicles (IoV) has drawn much attention in developing smart cities and smart transportation. One way to achieve that is based on the reputation of the participant vehicles and the interaction between them. Most of the reputation adjustment schemes are aimed at single-secret situations, and there are cases where shared information leaks after reconstruction; and the shared information of all participants need to be updated again. This paper uses binary asymmetric polynomials to realize the asynchronous reconstruction of secrets, that is, multiple secrets are distributed at once, and each secret is independent of each other when it is restored. Each participant holds the shared divided information part of a one-variable polynomial. When the secret is reconstructed, the shared information part is not directly shown to ensure that the shared information is not leaked. Furthermore, we provide another way to keep the secret unchanged and modify the secret threshold.


---

## Body

## 1. Introduction

The Internet of Vehicles (IoV) is an important branch of the Internet of Things in the field of intelligent transportation. It is the main goal of improving traffic safety, transportation efficiency, and so on. In recent years, IoV has received extensive attention from academia and industry. IoV integrates technologies in multiple fields such as electronics, information, and transportation, and provides various types of information services by collecting road traffic equipment sensor data and communicating information between nodes in real-time. Information services usually use appropriate information distribution methods to push service data to specific vehicles [1], to achieve intelligent traffic management and vehicle intelligent control, and other purposes.In IoV, due to the strong mobility and a large number of vehicles, secure information distribution in transportation services mainly adopts the form of broadcasting. Among them, a roadside unit (RSU) collects various types of traffic service information and sends service data to mobile vehicles through a wireless broadcast channel. Due to the open characteristics of the wireless network, the transmitted data are easily eavesdropped on and tampered within the link, resulting in data modification and loss [2]. Attackers can use wireless channels to deliberately inject false information and eavesdrop on broadcast messages in wireless channels, which seriously violates the privacy of drivers and endangers the safety of public transportation. In addition, on the Internet of Vehicles, the information that needs to be distributed is mainly traffic service information. If traffic service information cannot be accurately distributed to specific vehicles according to the current traffic situation, it will not only seriously affect the quality of information services but also may even reduce the level of road network operation and affect residents’ travel experience. Therefore, it is of great significance to construct the safe and accurate distribution of information under the framework of IoV [3].One way to achieve secret data sharing for IoV is the reputation scheme. The reputation value of the participants will be dynamically adjusted along with the participation process and is a long-term cumulative effect, and there are situations in which the number of participants and secret values are dynamically changed. The secret sharing in IoV generally consists of three parts: secret distribution, dynamic adjustment, and secret reconstruction. Compared with the traditional secret-sharing scheme, the dynamic adjustment process is added. In the process of social dynamic adjustment, the scheme dynamically adds, deletes participants, and dynamically changes the secret value according to the reconstruction situation; the scheme will be based on each participant in the secret reconstruction process. The interactive behaviors between each other are evaluated for each other, each person’s reputation value is adjusted, and then the amount of each person’s share deposit is adjusted according to each reputation value.In summary, we propose a multisecret reputation adjustment scheme, which details the specific implementation of the dynamic adjustment of the reputation weight value when the scheme distributes multiple secret values on the Internet of Vehicle at a time. The solution can realize the situation of distributing multiple secret values at once, which proves the asynchronous and independent reconstruction of multiple secrets, and during the secret reconstruction, the security of the shared information is guaranteed by showing the subsecret value instead of directly showing the shared information; after the construction is completed, the program can dynamically adjust the reputation value based on the interactive behavior between participants. At the same time, it is proved that when a participant conducts a collision attack, the attacker cannot steal other unrecovered secrets value-related information, ensuring the security of the unrecovered secret. Furthermore, we provide another way to keep the secret unchanged and modify the secret threshold. The idea is to share the existing shares of the participants again, and then use the Vandermonde matrix to modify the threshold fromt to t′.


## 2. Related Work

Since the data on the Internet of Vehicles directly affects the lives and property safety of personnel, it is particularly important to ensure the safety of their data. On the Internet of Vehicles, the confidentiality, integrity, reliability, and nonrepudiation of data need to be guaranteed [4], and so on. Different from the traditional network, the Internet of Vehicles is in an open environment, and vehicles enter and exit the network frequently, and the existence of malicious node intrusion cannot be ruled out. Known types of attacks include eavesdropping, tampering, suppression, and replay of information, DoS attacks that deliberately disrupt the network, injection of false information, etc., which will cause real information to be modified, delayed, and discarded, and false information floods the network, causing serious problems and consequences [5]. In response to these security issues, most of the existing research work mainly focuses on identity authentication, privacy protection, false message filtering, and malicious node detection [6].The identity authentication mechanism based on public key infrastructure (Public Key Infrastructure, PKI) was first introduced to the Internet of Vehicles. Selvalakshmi et al. [7] designed a scheme based on digital certificates, in which the user confirms the sender’s identity by verifying the certificate issued by the trusted center. However, the existence of a large number of certificates has increased the storage management burden of the certification center. To this end, Biswas et al. proposed an identity-based authentication framework, which generates a user’s public key through the user’s identity, and uses the correspondence between the public and private keys to achieve identity authentication [8]. To improve the efficiency of identity authentication, Bayat et al. proposed a framework that supports batch identity authentication, which improves the real-time nature of authentication [9]. Regarding privacy protection, there are two main privacy issues on the Internet of Vehicles: identity privacy and location privacy. To protect the privacy of user identity, Chim et al. proposed a pseudonym substitution scheme. The calculated pseudonym is used to represent the user’s identity so that the attacker cannot know the user’s real identity [10]. He et al. [11] also proposed an identity authentication scheme with a privacy protection function and realized conditional privacy by storing pseudonyms in the design management center. To achieve location privacy protection, Shokri et al. used the k-anonymity method to obscure the user’s location information so that the attacker could not distinguish the vehicles in the anonymous set [12]. Sun et al. also used the concept of the mixed zone to obscure vehicle location attribute to protect privacy [13].On the Internet of Vehicles, vehicles can broadcast messages arbitrarily, and there are many false messages to deliberately disrupt the network. For this reason, Caballero-Gild et al. proposed a reputation mechanism, which evaluates the credibility of messages by defining the similarity between vehicle contents, and discards messages whose reputation is less than a set threshold [14]. Guo et al. [15] set a series of rules to correlate messages between vehicles for cross-validation, thereby filtering false messages.To detect malicious nodes, Zaidi et al. [16] used statistical methods to detect malicious nodes spreading false messages in the network and established a vehicle network intrusion detection system model. Daeinabi et al. [17] set up a special verification node to detect malicious nodes by observing abnormal messages transmitted on the Internet of Vehicles. Many scholars have also proposed solutions based on trust management. For example, Li et al. [18] proposed a trust management framework, which comprehensively evaluates the trust of the vehicle through the vehicle’s attributes and feedback information from other vehicles, and realizes the detection of malicious nodes. In addition to the abovementioned research issues, it is essential to ensure the safe distribution of information.Information distribution mostly uses broadcast [19], and the transmitted data is more vulnerable to attacks in wireless channels. Security and privacy have become the most important research issues in information distribution on the Internet of Vehicles [20]. Information distribution, as one of the common application scenarios of the Internet of Vehicles, pays more attention to the confidentiality and integrity of the distributed information. Existing research mainly focuses on secure communication mechanisms, secure authentication technology, and access control technology [21].The security communication mechanism is mainly studied to ensure the confidentiality of information through encryption and other means [22]. Raya and Hubaux [23] and others use PKI technology to ensure the secure communication of vehicles and to protect the identity of the vehicle through an anonymous public key, to a certain extent, to achieve secure and anonymous communication. Federrath et al. [24] use the Diffie–Hellman algorithm for key agreement and encrypt information according to the negotiated symmetric key to realize the secure communication between the RSU and the vehicle. Zhu et al. [25] achieve secure communication between vehicles and vehicles and infrastructure through lightweight symmetric cryptography.Security authentication technology includes message authentication and identity authentication. Among them, the main purpose of message authentication is to verify that the message has not been tampered with. To this end, Mondal et al. [26] proposed a timestamp-based hash algorithm, which generates a digest to verify message integrity. The main purpose of identity authentication is to authenticate legitimate users. Liu Hui et al. [27] proposed a group key management mechanism based on traditional identity authentication technology to realize identity authentication within the group while reducing the burden of the key management center. Given the privacy risks that identity authentication will bring, there are also related scholars to achieve privacy protection by constructing vehicle groups [28] and anonymity [29].Access control is an important technical means to realize the confidentiality and integrity of information. It ensures that only legitimate users can access protected resources and prevents unauthorized users from unauthorized access. With the introduction of new public-key cryptosystems such as attribute-based encryption, new methods are provided for access control of encrypted data [30]. Huang et al. introduced the attribute-based encryption method based on ciphertext strategy to the Internet of Vehicles for the first time and proposed an attribute-based security policy formulation framework to achieve fine-grained access control during message sending [31]. In addition, given the problem that attribute-based encryption algorithms are time-consuming and difficult to apply to the Internet of Vehicles environment with high real-time requirements, relevant scholars have studied outsourcing computing solutions and safely outsourced some complex operations to a third party, which improved the efficiency of vehicle decryption [32]. Nojoumian et al. used the resharing method to reconstruct the polynomial with the sub-secret information as the secret value, and distributed it, and then used the symmetric encryption formed by the symmetric polynomial to encrypt the distributed information to ensure the security of the distributed information [33]. Harn and Hsu used binary symmetric polynomials to distribute multiple secret information and realized the distribution of multiple secrets at a time, but they could not resist the collusion attack of k − 1 participants after recovering the secret value [34].


## 3. Multisecret Reputation Adjustment Scheme

### 3.1. Overview of the Secret-Sharing in the IoV

In the secret sharing of the Internet of Vehicles, the credibility of the distributor and the security of the interaction channel between distributors and participants should be ensured during distribution. The distributor determines the initial reputation value for each participant, and each participant receives the same amount of stored information as to its reputation value at initialization. Many times in secret reconstruction according to each of the participants in the process of reconstruction in the process of the interaction between the behavior and dynamic adjustment of the popularity of the participants’ weight value, to improve the popularity of the cooperative participant values, to make its increase in the number of points to save information, to reduce the reputation of the not cooperative participant, to reduce its holdings of points to save information, namely make the cooperation of participants higher than not-cooperative participant’s reputation, more storage values are received. The specific scheme is described as follows:


#### 3.1.1. Secret-Sharing Phase

(1)
In the secret sharing scheme of the Internet of Vehicles oft,n, the participant Pi represents the i-th 1≤i≤n participant, and each participant Pi holds a reputation value of mi. Suppose the distributor randomly constructs a polynomial of order fx=a0+a1x+a2x2+⋯+at−1xt−1modp, fx∈Zp (The constant value is the secret information, that is, f0=S); according to the reputation value mi of participant Pi1≤i≤n, the distributor calculates the shared information part and sends the corresponding parts to the participant Pi, after which the distributor leaves the scheme. Generate shared information part values and send them to participants according to the following formula:(1)ϕij=fvij,1≤j≤mi,wherevij=im−m+j, m is the maximum weight of all participants, m<t, ϕij represents the j-th shared information part of the i-th participant. After the secret value is reconstructed once each time, the reputation of the participants is dynamically adjusted and updated according to their behaviors in the last reconstruction process.(2)
LetVn×m represent the identity matrix of participants, where n is the number of participants, m is the maximum weight value of all participants, elements in Vn×m are different nonzero elements on Zp, and Zp represents a finite field. For example, in the case of V2×2, where the elements v11 and v12 are identifiers for participant P1, and v21 and v22 are identifiers for participant P2. The distributor assigns each participant a corresponding amount of stored information based on their reputation value:(2)Vn×m=V2×2=v11v21v12v22.


#### 3.1.2. Secret Refactoring Phase

(1)
When the sum of weights of reconstructed participants is greater than or equal to the threshold value, the secret value can be reconstructed, and the subsecret value of each participantPi can be obtained by using the shared information part calculation formula (3):(3)wi=∑j=1mifvij∏l=1,vnl≠vijmn0−vnlvij−vnlmodp.(2)
After calculatingwi for each participant, the secret value can be obtained by calculating wi using fformula (4):(4)S=f0=∑i=1nwimodp.


#### 3.1.3. Reputation Adjustment Phase

In the secret sharing of the Internet of Vehicles, the weight information of participants’ reputation is open, so the secret distributor can dynamically adjust the stored information held by participants according to the reputation value of participants in each round. In the whole process of social adjustment, when the participant’s reputation value increases, it can activate the new identity of the participant and assign it the new shared information part value. When the reputation value of participants decreases, the corresponding identity information value can be frozen according to the reputation value, and the corresponding shared information part can be canceled, to achieve the purpose of reducing the reputation of noncooperative participants.In the process of reputation adjustment, after a secret restoration, the shared deposit information held by participants will be insecure. Therefore, the shared deposits in the scheme are mostly one-time, and the new identity of the participant is calculated after the information, the sharing information held by all participants needs to be updated.When the reputation of the participant increases, a new identity is activated for the participant, and a new shared information value is assigned to it. The specific plan is as follows:(1) Freeze noncooperative participants. If the weight of an existing participant is one, the participant’s weight is frozen to exit the secret-sharing system. At this point, according to the adjustment of the social trust function mentioned in section 2, a polynomial with a constant term of zero should be generated again to update the storage of all participants so that frozen participants only hold the old storage, and the secret cannot be recovered in the new polynomial.If the weight of an existing participant is greater than one, its weight value is reduced by one. At this point, a polynomial with a constant term of zero is generated to update the storage of all participants, making it no longer applicable to freeze the old points in the new polynomial.(2) Activate partner. If it is a new participant, a new identity matrix is assigned to it, the new shared information part is assigned to it, and its weight is one. If an existing participant is assigned a new deposit, its weight value is increased by one.ParticipantPi The new identity information of the participant can be calculated by using the formula vij=im−m+j, and each participant Pi can be calculated by using the shared information part formula:(5)wi=∑j=1mifvij∏l=1,l≠invij−li−lmodp,where wi is calculated by each participant and sent to the Pi address of the participant. The Pi address of the participant calculates the information according to the received information and obtains the information ϕij, as shown in formula (6), then ϕij is the newly allocated shared information part of the Pi address of the participant:(6)ϕij=fvij=∑i=1nwimodp.


#### 3.1.4. Update Storage Phase

After recovering the secret information once, the stored information held by each participant will be disclosed. In this case, the shared information part held by all participants needs to be updated again to ensure the security of secret information. All participants use the stored information as the secret value to reconstruct the polynomial, each participant distributes the constructed polynomial using the resharing algorithm, and each participant updates the stored information held by the participant using formula (6). The specific scheme is as follows:(1)
Each participantPi randomly selects a polynomial gijx with the highest degree of t−1, which satisfies gij0=fvij, and then sends gijx to the participant Pl1≤l≤n, that is, the constant of the polynomial constructed by each participant is the score held by the participant store information, and each participant constructs a corresponding number of polynomial values based on the reputation value he holds and distributes them.(2)
Each participant calculates the new substorage value by using the shared information part received from other participants, as shown in formula (7):(7)gkl=∑i=1n∑jmigijvkl∏j∈Δ,j≠i0−vklvij−vkl,here1≤k,l≤n, vkl represents the identity of the participant, mi is the corresponding reputation value of the participant, and the corresponding identity gkl1≤k≤n is calculated to represent the new subshare value of the participant Pkl.(3)
Each participant calculates the secret value using the new submemory value.


### 3.2. Design of the Proposed Scheme

In this section, an asynchronous multisecret reputation adjustment sharing scheme is proposed by using binary asymmetric polynomials to distribute multiple secret values and realize the asynchronous reconstruction of secret values. In the process of secret reconstruction, the reputation weight value of participants is dynamically adjusted according to their behaviors so that the next secret recovery process is independent of the last secret recovery process, and the related information of the unrecovered secret value will not be disclosed.In the reputation adjustment, when the reputation value in the plan increases, each participant allocates the new to share information for the increased reputation value. There are the following situations: first, after performing a secret recovery process, the reputation of the participants is adjusted according to the behavior of the participants, but because they share information held by each participant has been leaked when the secret was restored last time, it is necessary to update the points held by each participant. Second, in this scheme, only one secret information can be shared in one secret distribution. When multiple secrets are recovered, multiple secret distribution processes are required. This paper studies the above problems and proposes a multisecret reputation adjustment scheme using binary asymmetric polynomials.


#### 3.2.1. Security Model

Thet,n social secret sharing model proposed in this paper consists of n participants P1,P2,⋯,Pn and a distributor (visible only in the initialization phase), and the threshold is t. It is assumed that there is a private channel between each pair of participants (used in the reputation adjustment process), and the distributor can communicate securely with each participant when distributing the shared information. At the same time make the following assumptions:(1)
The maximum value of reputation weight held by each participant should be less than the threshold value to ensure that a single participant cannot recover the secret value; during the secret reconstruction, the sum of the weights of the number of participants should be greater than or equal to the threshold value to ensure that the participants can recover the secret value. In secret refactoring, each participant must honestly present all stored information values.(2)
Participants’ reputation value and identification information of each round are made public, and the public information is guaranteed to be safe and reliable.(3)
When the participant’s reputation value decreases, the participant can honestly freeze the reduced participant id and destroy the stored information held.(4)
All participants are rational participants, that is, there is no cheating.


#### 3.2.2. Phases of the Scheme

This scheme can distribute multiple secret values at once while ensuring that the recovered secret values andt−1 collusive attackers cannot obtain information about other unrecovered secret values. Afterward, for the proposed scheme, the correctness of the reconstructed secret and the security of the secret value and shared information are analyzed and proved. The existing schemes are analyzed and compared in terms of reputation adjustment and the distribution of multisecret values. The proposed t,n multisecret reputation adjustment scheme includes four phases: initialization, secret distribution, secret reconstruction, and reputation adjustment. The specific scheme is as follows:(1) Initialization Phase. In the initialization phase, the corresponding parameters are introduced. In the scheme, p is a large prime number. Zp is a finite field. S1,S2,⋯,St are distributed multisecret values, where S1,S2,⋯,St∈Zp. t is the threshold, and n is the number of participants. P=P1,P2⋯,Pn represent the set of participants. The identification information of each participant is vii=1,2,⋯,n. kt≤k≤n is the number of participants in the reconstruction of the secret.(2) Secret Distribution Phase(1)
Assuming that participantPi represents the i-th 1≤i≤n participant, the distributor assigns an initial reputation value to each participant, and each participant Pi holds a reputation value of mi.(2)
The multisecret values areS1,S2,⋯,St, and the distributor randomly constructs a binary asymmetric polynomial fx,y∈Zp, the highest degree of x, y is t−1, and p represents a large prime number, where the multisecret value satisfies the conditions S1=f1,0, S2=f2,0, ⋯, St=ft,0, as shown in formula (8):(8)fx,y=a0,0+a1,0x+a0,1y+a1,1xy+a2,0x2+a0,2y2+a1,2xy2+a2,1x2y+a2,2x2y2+⋯+at−1,t−1xt−1yt−1modp.whereaiji=0,1,2,⋯,t−1j=0,1,2,⋯,t−1 is an integer value other than zero, where aij∈Zp.(3)
The reputation value of the participantPi1≤i≤n is mi, and the distributor calculates the corresponding identity vij=im−m+j for the participant according to the reputation value mi, where m is the largest weight among all participants, and m≤t. vij represents the j-th identity information of the i-th participant, and it is sent to the corresponding participant Pi, and the identity of each participant Pi is vij.(4)
The distributor uses the participant’s identity to calculate the sharing informationϕij=fx,vij,1≤j≤mi, where ϕij represents the j-th sharing information of the i-th participant, and sends the sharing information to the corresponding participant Pi, then each participant holds a univariate polynomial containing x, and the highest power is t−1.(3) Secret Refactoring Phase(1)
Suppose that whenk participants want to reconstruct the secret value Sr1≤r≤t, at this time, it is only necessary to satisfy that the sum of the weights of the reconstructed participants is not less than the threshold to reconstruct the secret, as shown in formula (9):(9)∑Pkm≥ti.(2)
Each participantPi uses a univariate polynomial to share the information to calculate fijr=fr,vij, and then uses formula (10) to calculate the sub-secret value:(10)wi=∑j=1mifr,vij∏l=1,vkl≠vijmk0−vklvij−vklmodp.(3)
After each participant calculateswi, and sends wi to the reconstructed participant, the secret value can be obtained by using formula (11) for calculation:(11)Sr=fr,0=∑i=1kwi.(4) Reputation Adjustment Phase(1)
On the Internet of Vehicles, after the secret reconstruction according to the above scheme is completed, the reputation is dynamically adjusted according to the interactive behavior between the participants. As shown in Figure1, when the reputation value of a participant decreases, the participant freezes a corresponding amount of identification information value according to the reputation value and cancels the corresponding shared information to achieve the purpose of reducing the reputation of noncooperative participants.(2)
When the reputation value of a participant increases, the scheme in this section can be used to activate a new identity for the participant and assign a new shared information value to it, and there is no need to reupdate the shared information of all participants, and the security of unrecovered secret information can still be guaranteed.(3)
The distributor judges whether it meets1<j≤m according to the request for activating the new identity sent by the participant Pi. If so, the distributor uses vij=im−m+j to calculate the new identity information vij of the participant Pi and uses the participant’s identity to calculate the new share information ϕij=fx,vij, ϕij represents the j-th share information of the i-th participant, and the share information is sent to the corresponding participant Pi. At this time, the sharing information of other participants remains unchanged.(4)
After each participant updates his reputation value and the shared information part he holds, suppose that whenk participants want to reconstruct the secret value S, each participant calculates w and sends w to the reconstructed participant, using formula (11) to calculate, you can get the secret value.Figure 1
Schematic diagram of reputation tuning.Here is a simple example:(1)
Encryption process: Suppose there is a secretS, take random numbers a1,⋯,ak−1. Let a0=S, construct the following polynomial: fx=a0+a1x+a2x2+⋯+ak−1xk−1, in which all operations are performed in the finite field F. Take any n numbers x1,⋯,xn, substitute them into the polynomial to obtain fx1,⋯,fxn, and store x1,fx1,⋯,xn,fxn on n nodes, respectively.(2)
Decryption process: Take any data onk nodes, assume a, b, and c, substitute them into the formula and solve polynomial coefficients:(12)a0+a1x1+⋯+aK−1xk−11=y1,a0+a1x2+⋯+aK−1xk−12=y2,⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯,a0+a1xk+⋯+aK−1xkk−1=yk.It is represented by matrix multiplication as follows:(13)1x1…x1k−11x2⋯x2k−1⋮⋮⋱⋮1xK⋯xkk−1a0a2⋮ak−1=y1y1⋮yk−1⟶a0a2⋮ak−1=1x1…x1k−11x2⋯x2k−1⋮⋮⋱⋮1xk⋯xkk−1−1y1y2⋮yk−1.After obtaininga0,a1,⋯,ak−1, the polynomial fx=a0+a1x+a2x2+…+ak−1xk−1 can be constructed, and the original secret S=a0 can be obtained by substituting x=0 into the polynomial.


### 3.3. Scheme Analysis

In the last section, this paper introduced the concrete implementation of the multisecret reputation adjustment scheme. The following subsection will mainly analyze and discuss the correctness and security of secret reconstruction in the process of secret reconstruction and prove the correctness and feasibility of the scheme. It also analyzes and compares the existing schemes in terms of reputation adjustment and distribution of multisecret value.


#### 3.3.1. Proof of the Correctness of Reconstruction

Theorem 1.
When the number of reconstructed participants meets formula (9), that is, when the sum of weights of reconstructed participants is not less than the threshold value, the correct secret value can be reconstructed.Assuming thatk participants meet formula (9) to reconstruct the secret value Sr1≤r≤t, each participant Pi calculates fijr=fr,vij, and the formula is used to calculate the secret value in the scheme. The proof is as follows.(1)
k participants reconstruct the secret, and the reputation weight of each participant is mi. Therefore, according to the Lagrange interpolation polynomial, it can be known that when the sum of the reputation weights of the k participants is greater than or equal to t, the participant can reconstruct the secret value. The number of participants shown in the following table is n, the reputation weight of each participant Pi is mi, and P1,P2,⋯Pk is the secret reconstruction of k participants. The specific conditions of the participants are shown in Table 1.(2)
The sharing information of each participantPi is ϕij=fx,vij, which is a univariate polynomial containing x, and the highest power is t−1. By calculating fijr=fr,vij, a specific value can be calculated. At this time, according to formula (3)‒(11):(14)∑i=1kwi=∑i=1k∑j=1mifr,vij∏l=1,vkl≠vijmk0−vklvij−vklmodp.The two-variable polynomial is transformed into a traditional one-variable polynomial. At this time, the Lagrange formula is used to calculate the secret valueSr. The proof is as follows:(15)∑i=1kwi=∑i=1tfr,vi∏l=1,vl≠vit−10−vlvi−vlmodp=∑i=1tfr,vi∏l=1,vl≠vit−10−vlvi−vlmodp=Sr.Table 1
The situation of the reconstruction participants.
ParticipantP1P2P3⋯Pk⋯PnWeightsm1m2m3⋯mk⋯mnk-refactorings√√√√√——


#### 3.3.2. Proof of Secret Security

Theorem 2.
The reconstruction process between the secretSr1≤r≤t is independent of each other, that is, it can realize the asynchronous reconstruction of the secret, after reconstructing a secret value, the recovered secret value and other k participants satisfying formulas (3)–(8) cannot obtain the relevant information about the unrecovered secret value.If secret information has been reconstructed at this time,k participants who satisfy formulas (3)–(8) conduct a collision attack (plus the secret value Sr that has just been recovered) to obtain other unrecovered secret values Si1≤i≤t,i≠r.When k participants hold the shared storage ϕij=fx,vij and the secret value Sr=fr,0 for a conspiracy attack, due to Si=fi,0,1≤i≤t,i≠r, and the binary asymmetric polynomial has a total of tt+1/2 coefficients, when a secret value is restored, the k participants hold the shared information of the unary polynomial with the unknown coefficient t, and only the t−1 points of the polynomial fi=fi,y,1≤i≤t can be obtained. Therefore, the relevant information of the unrecovered secret value Si=fi,0 cannot be obtained. Therefore, the relevant information of the unrecovered secret value Si=fi,0 cannot be obtained.The proof is as follows:(16)∑i=1kwi=∑i=1k∑j=1mifi,vij∏l=1,vkl≠vijmk0−vklvij−vkl+fr,0modp=∑i=1t−1fi,vi∏l=1,vl≠vit−10−vlvi−vlmodp≠Si,where 1≤i≤t,i≠r.


### 3.4. Scheme Comparison

By constructing a binary asymmetric polynomial with the highest degree ofx and y being t−1, the article ensures that the secrets are independent of each other. The distributor only needs to perform the distribution process once, which can realize the asynchronous reconstruction of multiple secrets. After the secret information is reconstructed once, the stored information of each participant will not be disclosed, and the unrecovered secret information can still be reconstructed. Article [33] discusses the sharing of single-secret value. After a secret reconstruction is completed, all shared information parts must be updated, otherwise, the secret value will be leaked. The specific comparison is shown in Table 2.Table 2
The literature comparison.
LiteraturePolynomial distributionSecret valueReputation adjustmentUpdate shareDistributor in reputation adjustmentNojoumian scheme [33]Unary polynomialSingle secretCan dynamically increase and decrease reputation valueUpdate all participant depositsUnnecessaryHarn scheme [34]Bivariate symmetric polynomialMultisecret synchronization———This articleBivariate asymmetric polynomialMultisecret asynchronousCan dynamically increase and decrease reputation valueNo need to update the share depositNeededIn the process of reputation adjustment, if the reputation value of the participants’ increases, the distributor can improve the reputation value by calculating the identity information and storing information for the participants. It does not require the participants of the distributor but needs to re-update the sharing information of all participants by self-selection. In the article [34], a bivariate symmetric polynomial is used to realize the multisecret asynchronous reconstruction process. However, after completing a secret reconstruction, other unrecovered secret values will be illegally stolen by participants, so the security of asynchronous reconstruction of secrets cannot be guaranteed.It can be found from the above table that this article has realized asynchronous multisecret reputation adjustment, which can reconstruct specific secret values asynchronously, and the recovery of each secret value is independent of each other, and the reputation value can be dynamically increased and decreased. And when the reputation is dynamically adjusted, there is no need to update the sharing information held by the participants, but the participation of the distributor is required in the process of adjusting the reputation.


## 3.1. Overview of the Secret-Sharing in the IoV

In the secret sharing of the Internet of Vehicles, the credibility of the distributor and the security of the interaction channel between distributors and participants should be ensured during distribution. The distributor determines the initial reputation value for each participant, and each participant receives the same amount of stored information as to its reputation value at initialization. Many times in secret reconstruction according to each of the participants in the process of reconstruction in the process of the interaction between the behavior and dynamic adjustment of the popularity of the participants’ weight value, to improve the popularity of the cooperative participant values, to make its increase in the number of points to save information, to reduce the reputation of the not cooperative participant, to reduce its holdings of points to save information, namely make the cooperation of participants higher than not-cooperative participant’s reputation, more storage values are received. The specific scheme is described as follows:


### 3.1.1. Secret-Sharing Phase

(1)
In the secret sharing scheme of the Internet of Vehicles oft,n, the participant Pi represents the i-th 1≤i≤n participant, and each participant Pi holds a reputation value of mi. Suppose the distributor randomly constructs a polynomial of order fx=a0+a1x+a2x2+⋯+at−1xt−1modp, fx∈Zp (The constant value is the secret information, that is, f0=S); according to the reputation value mi of participant Pi1≤i≤n, the distributor calculates the shared information part and sends the corresponding parts to the participant Pi, after which the distributor leaves the scheme. Generate shared information part values and send them to participants according to the following formula:(1)ϕij=fvij,1≤j≤mi,wherevij=im−m+j, m is the maximum weight of all participants, m<t, ϕij represents the j-th shared information part of the i-th participant. After the secret value is reconstructed once each time, the reputation of the participants is dynamically adjusted and updated according to their behaviors in the last reconstruction process.(2)
LetVn×m represent the identity matrix of participants, where n is the number of participants, m is the maximum weight value of all participants, elements in Vn×m are different nonzero elements on Zp, and Zp represents a finite field. For example, in the case of V2×2, where the elements v11 and v12 are identifiers for participant P1, and v21 and v22 are identifiers for participant P2. The distributor assigns each participant a corresponding amount of stored information based on their reputation value:(2)Vn×m=V2×2=v11v21v12v22.


### 3.1.2. Secret Refactoring Phase

(1)
When the sum of weights of reconstructed participants is greater than or equal to the threshold value, the secret value can be reconstructed, and the subsecret value of each participantPi can be obtained by using the shared information part calculation formula (3):(3)wi=∑j=1mifvij∏l=1,vnl≠vijmn0−vnlvij−vnlmodp.(2)
After calculatingwi for each participant, the secret value can be obtained by calculating wi using fformula (4):(4)S=f0=∑i=1nwimodp.


### 3.1.3. Reputation Adjustment Phase

In the secret sharing of the Internet of Vehicles, the weight information of participants’ reputation is open, so the secret distributor can dynamically adjust the stored information held by participants according to the reputation value of participants in each round. In the whole process of social adjustment, when the participant’s reputation value increases, it can activate the new identity of the participant and assign it the new shared information part value. When the reputation value of participants decreases, the corresponding identity information value can be frozen according to the reputation value, and the corresponding shared information part can be canceled, to achieve the purpose of reducing the reputation of noncooperative participants.In the process of reputation adjustment, after a secret restoration, the shared deposit information held by participants will be insecure. Therefore, the shared deposits in the scheme are mostly one-time, and the new identity of the participant is calculated after the information, the sharing information held by all participants needs to be updated.When the reputation of the participant increases, a new identity is activated for the participant, and a new shared information value is assigned to it. The specific plan is as follows:(1) Freeze noncooperative participants. If the weight of an existing participant is one, the participant’s weight is frozen to exit the secret-sharing system. At this point, according to the adjustment of the social trust function mentioned in section 2, a polynomial with a constant term of zero should be generated again to update the storage of all participants so that frozen participants only hold the old storage, and the secret cannot be recovered in the new polynomial.If the weight of an existing participant is greater than one, its weight value is reduced by one. At this point, a polynomial with a constant term of zero is generated to update the storage of all participants, making it no longer applicable to freeze the old points in the new polynomial.(2) Activate partner. If it is a new participant, a new identity matrix is assigned to it, the new shared information part is assigned to it, and its weight is one. If an existing participant is assigned a new deposit, its weight value is increased by one.ParticipantPi The new identity information of the participant can be calculated by using the formula vij=im−m+j, and each participant Pi can be calculated by using the shared information part formula:(5)wi=∑j=1mifvij∏l=1,l≠invij−li−lmodp,where wi is calculated by each participant and sent to the Pi address of the participant. The Pi address of the participant calculates the information according to the received information and obtains the information ϕij, as shown in formula (6), then ϕij is the newly allocated shared information part of the Pi address of the participant:(6)ϕij=fvij=∑i=1nwimodp.


### 3.1.4. Update Storage Phase

After recovering the secret information once, the stored information held by each participant will be disclosed. In this case, the shared information part held by all participants needs to be updated again to ensure the security of secret information. All participants use the stored information as the secret value to reconstruct the polynomial, each participant distributes the constructed polynomial using the resharing algorithm, and each participant updates the stored information held by the participant using formula (6). The specific scheme is as follows:(1)
Each participantPi randomly selects a polynomial gijx with the highest degree of t−1, which satisfies gij0=fvij, and then sends gijx to the participant Pl1≤l≤n, that is, the constant of the polynomial constructed by each participant is the score held by the participant store information, and each participant constructs a corresponding number of polynomial values based on the reputation value he holds and distributes them.(2)
Each participant calculates the new substorage value by using the shared information part received from other participants, as shown in formula (7):(7)gkl=∑i=1n∑jmigijvkl∏j∈Δ,j≠i0−vklvij−vkl,here1≤k,l≤n, vkl represents the identity of the participant, mi is the corresponding reputation value of the participant, and the corresponding identity gkl1≤k≤n is calculated to represent the new subshare value of the participant Pkl.(3)
Each participant calculates the secret value using the new submemory value.


## 3.1.1. Secret-Sharing Phase

(1)
In the secret sharing scheme of the Internet of Vehicles oft,n, the participant Pi represents the i-th 1≤i≤n participant, and each participant Pi holds a reputation value of mi. Suppose the distributor randomly constructs a polynomial of order fx=a0+a1x+a2x2+⋯+at−1xt−1modp, fx∈Zp (The constant value is the secret information, that is, f0=S); according to the reputation value mi of participant Pi1≤i≤n, the distributor calculates the shared information part and sends the corresponding parts to the participant Pi, after which the distributor leaves the scheme. Generate shared information part values and send them to participants according to the following formula:(1)ϕij=fvij,1≤j≤mi,wherevij=im−m+j, m is the maximum weight of all participants, m<t, ϕij represents the j-th shared information part of the i-th participant. After the secret value is reconstructed once each time, the reputation of the participants is dynamically adjusted and updated according to their behaviors in the last reconstruction process.(2)
LetVn×m represent the identity matrix of participants, where n is the number of participants, m is the maximum weight value of all participants, elements in Vn×m are different nonzero elements on Zp, and Zp represents a finite field. For example, in the case of V2×2, where the elements v11 and v12 are identifiers for participant P1, and v21 and v22 are identifiers for participant P2. The distributor assigns each participant a corresponding amount of stored information based on their reputation value:(2)Vn×m=V2×2=v11v21v12v22.


## 3.1.2. Secret Refactoring Phase

(1)
When the sum of weights of reconstructed participants is greater than or equal to the threshold value, the secret value can be reconstructed, and the subsecret value of each participantPi can be obtained by using the shared information part calculation formula (3):(3)wi=∑j=1mifvij∏l=1,vnl≠vijmn0−vnlvij−vnlmodp.(2)
After calculatingwi for each participant, the secret value can be obtained by calculating wi using fformula (4):(4)S=f0=∑i=1nwimodp.


## 3.1.3. Reputation Adjustment Phase

In the secret sharing of the Internet of Vehicles, the weight information of participants’ reputation is open, so the secret distributor can dynamically adjust the stored information held by participants according to the reputation value of participants in each round. In the whole process of social adjustment, when the participant’s reputation value increases, it can activate the new identity of the participant and assign it the new shared information part value. When the reputation value of participants decreases, the corresponding identity information value can be frozen according to the reputation value, and the corresponding shared information part can be canceled, to achieve the purpose of reducing the reputation of noncooperative participants.In the process of reputation adjustment, after a secret restoration, the shared deposit information held by participants will be insecure. Therefore, the shared deposits in the scheme are mostly one-time, and the new identity of the participant is calculated after the information, the sharing information held by all participants needs to be updated.When the reputation of the participant increases, a new identity is activated for the participant, and a new shared information value is assigned to it. The specific plan is as follows:(1) Freeze noncooperative participants. If the weight of an existing participant is one, the participant’s weight is frozen to exit the secret-sharing system. At this point, according to the adjustment of the social trust function mentioned in section 2, a polynomial with a constant term of zero should be generated again to update the storage of all participants so that frozen participants only hold the old storage, and the secret cannot be recovered in the new polynomial.If the weight of an existing participant is greater than one, its weight value is reduced by one. At this point, a polynomial with a constant term of zero is generated to update the storage of all participants, making it no longer applicable to freeze the old points in the new polynomial.(2) Activate partner. If it is a new participant, a new identity matrix is assigned to it, the new shared information part is assigned to it, and its weight is one. If an existing participant is assigned a new deposit, its weight value is increased by one.ParticipantPi The new identity information of the participant can be calculated by using the formula vij=im−m+j, and each participant Pi can be calculated by using the shared information part formula:(5)wi=∑j=1mifvij∏l=1,l≠invij−li−lmodp,where wi is calculated by each participant and sent to the Pi address of the participant. The Pi address of the participant calculates the information according to the received information and obtains the information ϕij, as shown in formula (6), then ϕij is the newly allocated shared information part of the Pi address of the participant:(6)ϕij=fvij=∑i=1nwimodp.


## 3.1.4. Update Storage Phase

After recovering the secret information once, the stored information held by each participant will be disclosed. In this case, the shared information part held by all participants needs to be updated again to ensure the security of secret information. All participants use the stored information as the secret value to reconstruct the polynomial, each participant distributes the constructed polynomial using the resharing algorithm, and each participant updates the stored information held by the participant using formula (6). The specific scheme is as follows:(1)
Each participantPi randomly selects a polynomial gijx with the highest degree of t−1, which satisfies gij0=fvij, and then sends gijx to the participant Pl1≤l≤n, that is, the constant of the polynomial constructed by each participant is the score held by the participant store information, and each participant constructs a corresponding number of polynomial values based on the reputation value he holds and distributes them.(2)
Each participant calculates the new substorage value by using the shared information part received from other participants, as shown in formula (7):(7)gkl=∑i=1n∑jmigijvkl∏j∈Δ,j≠i0−vklvij−vkl,here1≤k,l≤n, vkl represents the identity of the participant, mi is the corresponding reputation value of the participant, and the corresponding identity gkl1≤k≤n is calculated to represent the new subshare value of the participant Pkl.(3)
Each participant calculates the secret value using the new submemory value.


## 3.2. Design of the Proposed Scheme

In this section, an asynchronous multisecret reputation adjustment sharing scheme is proposed by using binary asymmetric polynomials to distribute multiple secret values and realize the asynchronous reconstruction of secret values. In the process of secret reconstruction, the reputation weight value of participants is dynamically adjusted according to their behaviors so that the next secret recovery process is independent of the last secret recovery process, and the related information of the unrecovered secret value will not be disclosed.In the reputation adjustment, when the reputation value in the plan increases, each participant allocates the new to share information for the increased reputation value. There are the following situations: first, after performing a secret recovery process, the reputation of the participants is adjusted according to the behavior of the participants, but because they share information held by each participant has been leaked when the secret was restored last time, it is necessary to update the points held by each participant. Second, in this scheme, only one secret information can be shared in one secret distribution. When multiple secrets are recovered, multiple secret distribution processes are required. This paper studies the above problems and proposes a multisecret reputation adjustment scheme using binary asymmetric polynomials.


### 3.2.1. Security Model

Thet,n social secret sharing model proposed in this paper consists of n participants P1,P2,⋯,Pn and a distributor (visible only in the initialization phase), and the threshold is t. It is assumed that there is a private channel between each pair of participants (used in the reputation adjustment process), and the distributor can communicate securely with each participant when distributing the shared information. At the same time make the following assumptions:(1)
The maximum value of reputation weight held by each participant should be less than the threshold value to ensure that a single participant cannot recover the secret value; during the secret reconstruction, the sum of the weights of the number of participants should be greater than or equal to the threshold value to ensure that the participants can recover the secret value. In secret refactoring, each participant must honestly present all stored information values.(2)
Participants’ reputation value and identification information of each round are made public, and the public information is guaranteed to be safe and reliable.(3)
When the participant’s reputation value decreases, the participant can honestly freeze the reduced participant id and destroy the stored information held.(4)
All participants are rational participants, that is, there is no cheating.


### 3.2.2. Phases of the Scheme

This scheme can distribute multiple secret values at once while ensuring that the recovered secret values andt−1 collusive attackers cannot obtain information about other unrecovered secret values. Afterward, for the proposed scheme, the correctness of the reconstructed secret and the security of the secret value and shared information are analyzed and proved. The existing schemes are analyzed and compared in terms of reputation adjustment and the distribution of multisecret values. The proposed t,n multisecret reputation adjustment scheme includes four phases: initialization, secret distribution, secret reconstruction, and reputation adjustment. The specific scheme is as follows:(1) Initialization Phase. In the initialization phase, the corresponding parameters are introduced. In the scheme, p is a large prime number. Zp is a finite field. S1,S2,⋯,St are distributed multisecret values, where S1,S2,⋯,St∈Zp. t is the threshold, and n is the number of participants. P=P1,P2⋯,Pn represent the set of participants. The identification information of each participant is vii=1,2,⋯,n. kt≤k≤n is the number of participants in the reconstruction of the secret.(2) Secret Distribution Phase(1)
Assuming that participantPi represents the i-th 1≤i≤n participant, the distributor assigns an initial reputation value to each participant, and each participant Pi holds a reputation value of mi.(2)
The multisecret values areS1,S2,⋯,St, and the distributor randomly constructs a binary asymmetric polynomial fx,y∈Zp, the highest degree of x, y is t−1, and p represents a large prime number, where the multisecret value satisfies the conditions S1=f1,0, S2=f2,0, ⋯, St=ft,0, as shown in formula (8):(8)fx,y=a0,0+a1,0x+a0,1y+a1,1xy+a2,0x2+a0,2y2+a1,2xy2+a2,1x2y+a2,2x2y2+⋯+at−1,t−1xt−1yt−1modp.whereaiji=0,1,2,⋯,t−1j=0,1,2,⋯,t−1 is an integer value other than zero, where aij∈Zp.(3)
The reputation value of the participantPi1≤i≤n is mi, and the distributor calculates the corresponding identity vij=im−m+j for the participant according to the reputation value mi, where m is the largest weight among all participants, and m≤t. vij represents the j-th identity information of the i-th participant, and it is sent to the corresponding participant Pi, and the identity of each participant Pi is vij.(4)
The distributor uses the participant’s identity to calculate the sharing informationϕij=fx,vij,1≤j≤mi, where ϕij represents the j-th sharing information of the i-th participant, and sends the sharing information to the corresponding participant Pi, then each participant holds a univariate polynomial containing x, and the highest power is t−1.(3) Secret Refactoring Phase(1)
Suppose that whenk participants want to reconstruct the secret value Sr1≤r≤t, at this time, it is only necessary to satisfy that the sum of the weights of the reconstructed participants is not less than the threshold to reconstruct the secret, as shown in formula (9):(9)∑Pkm≥ti.(2)
Each participantPi uses a univariate polynomial to share the information to calculate fijr=fr,vij, and then uses formula (10) to calculate the sub-secret value:(10)wi=∑j=1mifr,vij∏l=1,vkl≠vijmk0−vklvij−vklmodp.(3)
After each participant calculateswi, and sends wi to the reconstructed participant, the secret value can be obtained by using formula (11) for calculation:(11)Sr=fr,0=∑i=1kwi.(4) Reputation Adjustment Phase(1)
On the Internet of Vehicles, after the secret reconstruction according to the above scheme is completed, the reputation is dynamically adjusted according to the interactive behavior between the participants. As shown in Figure1, when the reputation value of a participant decreases, the participant freezes a corresponding amount of identification information value according to the reputation value and cancels the corresponding shared information to achieve the purpose of reducing the reputation of noncooperative participants.(2)
When the reputation value of a participant increases, the scheme in this section can be used to activate a new identity for the participant and assign a new shared information value to it, and there is no need to reupdate the shared information of all participants, and the security of unrecovered secret information can still be guaranteed.(3)
The distributor judges whether it meets1<j≤m according to the request for activating the new identity sent by the participant Pi. If so, the distributor uses vij=im−m+j to calculate the new identity information vij of the participant Pi and uses the participant’s identity to calculate the new share information ϕij=fx,vij, ϕij represents the j-th share information of the i-th participant, and the share information is sent to the corresponding participant Pi. At this time, the sharing information of other participants remains unchanged.(4)
After each participant updates his reputation value and the shared information part he holds, suppose that whenk participants want to reconstruct the secret value S, each participant calculates w and sends w to the reconstructed participant, using formula (11) to calculate, you can get the secret value.Figure 1
Schematic diagram of reputation tuning.Here is a simple example:(1)
Encryption process: Suppose there is a secretS, take random numbers a1,⋯,ak−1. Let a0=S, construct the following polynomial: fx=a0+a1x+a2x2+⋯+ak−1xk−1, in which all operations are performed in the finite field F. Take any n numbers x1,⋯,xn, substitute them into the polynomial to obtain fx1,⋯,fxn, and store x1,fx1,⋯,xn,fxn on n nodes, respectively.(2)
Decryption process: Take any data onk nodes, assume a, b, and c, substitute them into the formula and solve polynomial coefficients:(12)a0+a1x1+⋯+aK−1xk−11=y1,a0+a1x2+⋯+aK−1xk−12=y2,⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯,a0+a1xk+⋯+aK−1xkk−1=yk.It is represented by matrix multiplication as follows:(13)1x1…x1k−11x2⋯x2k−1⋮⋮⋱⋮1xK⋯xkk−1a0a2⋮ak−1=y1y1⋮yk−1⟶a0a2⋮ak−1=1x1…x1k−11x2⋯x2k−1⋮⋮⋱⋮1xk⋯xkk−1−1y1y2⋮yk−1.After obtaininga0,a1,⋯,ak−1, the polynomial fx=a0+a1x+a2x2+…+ak−1xk−1 can be constructed, and the original secret S=a0 can be obtained by substituting x=0 into the polynomial.


## 3.2.1. Security Model

Thet,n social secret sharing model proposed in this paper consists of n participants P1,P2,⋯,Pn and a distributor (visible only in the initialization phase), and the threshold is t. It is assumed that there is a private channel between each pair of participants (used in the reputation adjustment process), and the distributor can communicate securely with each participant when distributing the shared information. At the same time make the following assumptions:(1)
The maximum value of reputation weight held by each participant should be less than the threshold value to ensure that a single participant cannot recover the secret value; during the secret reconstruction, the sum of the weights of the number of participants should be greater than or equal to the threshold value to ensure that the participants can recover the secret value. In secret refactoring, each participant must honestly present all stored information values.(2)
Participants’ reputation value and identification information of each round are made public, and the public information is guaranteed to be safe and reliable.(3)
When the participant’s reputation value decreases, the participant can honestly freeze the reduced participant id and destroy the stored information held.(4)
All participants are rational participants, that is, there is no cheating.


## 3.2.2. Phases of the Scheme

This scheme can distribute multiple secret values at once while ensuring that the recovered secret values andt−1 collusive attackers cannot obtain information about other unrecovered secret values. Afterward, for the proposed scheme, the correctness of the reconstructed secret and the security of the secret value and shared information are analyzed and proved. The existing schemes are analyzed and compared in terms of reputation adjustment and the distribution of multisecret values. The proposed t,n multisecret reputation adjustment scheme includes four phases: initialization, secret distribution, secret reconstruction, and reputation adjustment. The specific scheme is as follows:(1) Initialization Phase. In the initialization phase, the corresponding parameters are introduced. In the scheme, p is a large prime number. Zp is a finite field. S1,S2,⋯,St are distributed multisecret values, where S1,S2,⋯,St∈Zp. t is the threshold, and n is the number of participants. P=P1,P2⋯,Pn represent the set of participants. The identification information of each participant is vii=1,2,⋯,n. kt≤k≤n is the number of participants in the reconstruction of the secret.(2) Secret Distribution Phase(1)
Assuming that participantPi represents the i-th 1≤i≤n participant, the distributor assigns an initial reputation value to each participant, and each participant Pi holds a reputation value of mi.(2)
The multisecret values areS1,S2,⋯,St, and the distributor randomly constructs a binary asymmetric polynomial fx,y∈Zp, the highest degree of x, y is t−1, and p represents a large prime number, where the multisecret value satisfies the conditions S1=f1,0, S2=f2,0, ⋯, St=ft,0, as shown in formula (8):(8)fx,y=a0,0+a1,0x+a0,1y+a1,1xy+a2,0x2+a0,2y2+a1,2xy2+a2,1x2y+a2,2x2y2+⋯+at−1,t−1xt−1yt−1modp.whereaiji=0,1,2,⋯,t−1j=0,1,2,⋯,t−1 is an integer value other than zero, where aij∈Zp.(3)
The reputation value of the participantPi1≤i≤n is mi, and the distributor calculates the corresponding identity vij=im−m+j for the participant according to the reputation value mi, where m is the largest weight among all participants, and m≤t. vij represents the j-th identity information of the i-th participant, and it is sent to the corresponding participant Pi, and the identity of each participant Pi is vij.(4)
The distributor uses the participant’s identity to calculate the sharing informationϕij=fx,vij,1≤j≤mi, where ϕij represents the j-th sharing information of the i-th participant, and sends the sharing information to the corresponding participant Pi, then each participant holds a univariate polynomial containing x, and the highest power is t−1.(3) Secret Refactoring Phase(1)
Suppose that whenk participants want to reconstruct the secret value Sr1≤r≤t, at this time, it is only necessary to satisfy that the sum of the weights of the reconstructed participants is not less than the threshold to reconstruct the secret, as shown in formula (9):(9)∑Pkm≥ti.(2)
Each participantPi uses a univariate polynomial to share the information to calculate fijr=fr,vij, and then uses formula (10) to calculate the sub-secret value:(10)wi=∑j=1mifr,vij∏l=1,vkl≠vijmk0−vklvij−vklmodp.(3)
After each participant calculateswi, and sends wi to the reconstructed participant, the secret value can be obtained by using formula (11) for calculation:(11)Sr=fr,0=∑i=1kwi.(4) Reputation Adjustment Phase(1)
On the Internet of Vehicles, after the secret reconstruction according to the above scheme is completed, the reputation is dynamically adjusted according to the interactive behavior between the participants. As shown in Figure1, when the reputation value of a participant decreases, the participant freezes a corresponding amount of identification information value according to the reputation value and cancels the corresponding shared information to achieve the purpose of reducing the reputation of noncooperative participants.(2)
When the reputation value of a participant increases, the scheme in this section can be used to activate a new identity for the participant and assign a new shared information value to it, and there is no need to reupdate the shared information of all participants, and the security of unrecovered secret information can still be guaranteed.(3)
The distributor judges whether it meets1<j≤m according to the request for activating the new identity sent by the participant Pi. If so, the distributor uses vij=im−m+j to calculate the new identity information vij of the participant Pi and uses the participant’s identity to calculate the new share information ϕij=fx,vij, ϕij represents the j-th share information of the i-th participant, and the share information is sent to the corresponding participant Pi. At this time, the sharing information of other participants remains unchanged.(4)
After each participant updates his reputation value and the shared information part he holds, suppose that whenk participants want to reconstruct the secret value S, each participant calculates w and sends w to the reconstructed participant, using formula (11) to calculate, you can get the secret value.Figure 1
Schematic diagram of reputation tuning.Here is a simple example:(1)
Encryption process: Suppose there is a secretS, take random numbers a1,⋯,ak−1. Let a0=S, construct the following polynomial: fx=a0+a1x+a2x2+⋯+ak−1xk−1, in which all operations are performed in the finite field F. Take any n numbers x1,⋯,xn, substitute them into the polynomial to obtain fx1,⋯,fxn, and store x1,fx1,⋯,xn,fxn on n nodes, respectively.(2)
Decryption process: Take any data onk nodes, assume a, b, and c, substitute them into the formula and solve polynomial coefficients:(12)a0+a1x1+⋯+aK−1xk−11=y1,a0+a1x2+⋯+aK−1xk−12=y2,⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯⋯,a0+a1xk+⋯+aK−1xkk−1=yk.It is represented by matrix multiplication as follows:(13)1x1…x1k−11x2⋯x2k−1⋮⋮⋱⋮1xK⋯xkk−1a0a2⋮ak−1=y1y1⋮yk−1⟶a0a2⋮ak−1=1x1…x1k−11x2⋯x2k−1⋮⋮⋱⋮1xk⋯xkk−1−1y1y2⋮yk−1.After obtaininga0,a1,⋯,ak−1, the polynomial fx=a0+a1x+a2x2+…+ak−1xk−1 can be constructed, and the original secret S=a0 can be obtained by substituting x=0 into the polynomial.


## 3.3. Scheme Analysis

In the last section, this paper introduced the concrete implementation of the multisecret reputation adjustment scheme. The following subsection will mainly analyze and discuss the correctness and security of secret reconstruction in the process of secret reconstruction and prove the correctness and feasibility of the scheme. It also analyzes and compares the existing schemes in terms of reputation adjustment and distribution of multisecret value.


### 3.3.1. Proof of the Correctness of Reconstruction

Theorem 1.
When the number of reconstructed participants meets formula (9), that is, when the sum of weights of reconstructed participants is not less than the threshold value, the correct secret value can be reconstructed.Assuming thatk participants meet formula (9) to reconstruct the secret value Sr1≤r≤t, each participant Pi calculates fijr=fr,vij, and the formula is used to calculate the secret value in the scheme. The proof is as follows.(1)
k participants reconstruct the secret, and the reputation weight of each participant is mi. Therefore, according to the Lagrange interpolation polynomial, it can be known that when the sum of the reputation weights of the k participants is greater than or equal to t, the participant can reconstruct the secret value. The number of participants shown in the following table is n, the reputation weight of each participant Pi is mi, and P1,P2,⋯Pk is the secret reconstruction of k participants. The specific conditions of the participants are shown in Table 1.(2)
The sharing information of each participantPi is ϕij=fx,vij, which is a univariate polynomial containing x, and the highest power is t−1. By calculating fijr=fr,vij, a specific value can be calculated. At this time, according to formula (3)‒(11):(14)∑i=1kwi=∑i=1k∑j=1mifr,vij∏l=1,vkl≠vijmk0−vklvij−vklmodp.The two-variable polynomial is transformed into a traditional one-variable polynomial. At this time, the Lagrange formula is used to calculate the secret valueSr. The proof is as follows:(15)∑i=1kwi=∑i=1tfr,vi∏l=1,vl≠vit−10−vlvi−vlmodp=∑i=1tfr,vi∏l=1,vl≠vit−10−vlvi−vlmodp=Sr.Table 1
The situation of the reconstruction participants.
ParticipantP1P2P3⋯Pk⋯PnWeightsm1m2m3⋯mk⋯mnk-refactorings√√√√√——


### 3.3.2. Proof of Secret Security

Theorem 2.
The reconstruction process between the secretSr1≤r≤t is independent of each other, that is, it can realize the asynchronous reconstruction of the secret, after reconstructing a secret value, the recovered secret value and other k participants satisfying formulas (3)–(8) cannot obtain the relevant information about the unrecovered secret value.If secret information has been reconstructed at this time,k participants who satisfy formulas (3)–(8) conduct a collision attack (plus the secret value Sr that has just been recovered) to obtain other unrecovered secret values Si1≤i≤t,i≠r.When k participants hold the shared storage ϕij=fx,vij and the secret value Sr=fr,0 for a conspiracy attack, due to Si=fi,0,1≤i≤t,i≠r, and the binary asymmetric polynomial has a total of tt+1/2 coefficients, when a secret value is restored, the k participants hold the shared information of the unary polynomial with the unknown coefficient t, and only the t−1 points of the polynomial fi=fi,y,1≤i≤t can be obtained. Therefore, the relevant information of the unrecovered secret value Si=fi,0 cannot be obtained. Therefore, the relevant information of the unrecovered secret value Si=fi,0 cannot be obtained.The proof is as follows:(16)∑i=1kwi=∑i=1k∑j=1mifi,vij∏l=1,vkl≠vijmk0−vklvij−vkl+fr,0modp=∑i=1t−1fi,vi∏l=1,vl≠vit−10−vlvi−vlmodp≠Si,where 1≤i≤t,i≠r.


## 3.3.1. Proof of the Correctness of Reconstruction

Theorem 1.
When the number of reconstructed participants meets formula (9), that is, when the sum of weights of reconstructed participants is not less than the threshold value, the correct secret value can be reconstructed.Assuming thatk participants meet formula (9) to reconstruct the secret value Sr1≤r≤t, each participant Pi calculates fijr=fr,vij, and the formula is used to calculate the secret value in the scheme. The proof is as follows.(1)
k participants reconstruct the secret, and the reputation weight of each participant is mi. Therefore, according to the Lagrange interpolation polynomial, it can be known that when the sum of the reputation weights of the k participants is greater than or equal to t, the participant can reconstruct the secret value. The number of participants shown in the following table is n, the reputation weight of each participant Pi is mi, and P1,P2,⋯Pk is the secret reconstruction of k participants. The specific conditions of the participants are shown in Table 1.(2)
The sharing information of each participantPi is ϕij=fx,vij, which is a univariate polynomial containing x, and the highest power is t−1. By calculating fijr=fr,vij, a specific value can be calculated. At this time, according to formula (3)‒(11):(14)∑i=1kwi=∑i=1k∑j=1mifr,vij∏l=1,vkl≠vijmk0−vklvij−vklmodp.The two-variable polynomial is transformed into a traditional one-variable polynomial. At this time, the Lagrange formula is used to calculate the secret valueSr. The proof is as follows:(15)∑i=1kwi=∑i=1tfr,vi∏l=1,vl≠vit−10−vlvi−vlmodp=∑i=1tfr,vi∏l=1,vl≠vit−10−vlvi−vlmodp=Sr.Table 1
The situation of the reconstruction participants.
ParticipantP1P2P3⋯Pk⋯PnWeightsm1m2m3⋯mk⋯mnk-refactorings√√√√√——


## 3.3.2. Proof of Secret Security

Theorem 2.
The reconstruction process between the secretSr1≤r≤t is independent of each other, that is, it can realize the asynchronous reconstruction of the secret, after reconstructing a secret value, the recovered secret value and other k participants satisfying formulas (3)–(8) cannot obtain the relevant information about the unrecovered secret value.If secret information has been reconstructed at this time,k participants who satisfy formulas (3)–(8) conduct a collision attack (plus the secret value Sr that has just been recovered) to obtain other unrecovered secret values Si1≤i≤t,i≠r.When k participants hold the shared storage ϕij=fx,vij and the secret value Sr=fr,0 for a conspiracy attack, due to Si=fi,0,1≤i≤t,i≠r, and the binary asymmetric polynomial has a total of tt+1/2 coefficients, when a secret value is restored, the k participants hold the shared information of the unary polynomial with the unknown coefficient t, and only the t−1 points of the polynomial fi=fi,y,1≤i≤t can be obtained. Therefore, the relevant information of the unrecovered secret value Si=fi,0 cannot be obtained. Therefore, the relevant information of the unrecovered secret value Si=fi,0 cannot be obtained.The proof is as follows:(16)∑i=1kwi=∑i=1k∑j=1mifi,vij∏l=1,vkl≠vijmk0−vklvij−vkl+fr,0modp=∑i=1t−1fi,vi∏l=1,vl≠vit−10−vlvi−vlmodp≠Si,where 1≤i≤t,i≠r.


## 3.4. Scheme Comparison

By constructing a binary asymmetric polynomial with the highest degree ofx and y being t−1, the article ensures that the secrets are independent of each other. The distributor only needs to perform the distribution process once, which can realize the asynchronous reconstruction of multiple secrets. After the secret information is reconstructed once, the stored information of each participant will not be disclosed, and the unrecovered secret information can still be reconstructed. Article [33] discusses the sharing of single-secret value. After a secret reconstruction is completed, all shared information parts must be updated, otherwise, the secret value will be leaked. The specific comparison is shown in Table 2.Table 2
The literature comparison.
LiteraturePolynomial distributionSecret valueReputation adjustmentUpdate shareDistributor in reputation adjustmentNojoumian scheme [33]Unary polynomialSingle secretCan dynamically increase and decrease reputation valueUpdate all participant depositsUnnecessaryHarn scheme [34]Bivariate symmetric polynomialMultisecret synchronization———This articleBivariate asymmetric polynomialMultisecret asynchronousCan dynamically increase and decrease reputation valueNo need to update the share depositNeededIn the process of reputation adjustment, if the reputation value of the participants’ increases, the distributor can improve the reputation value by calculating the identity information and storing information for the participants. It does not require the participants of the distributor but needs to re-update the sharing information of all participants by self-selection. In the article [34], a bivariate symmetric polynomial is used to realize the multisecret asynchronous reconstruction process. However, after completing a secret reconstruction, other unrecovered secret values will be illegally stolen by participants, so the security of asynchronous reconstruction of secrets cannot be guaranteed.It can be found from the above table that this article has realized asynchronous multisecret reputation adjustment, which can reconstruct specific secret values asynchronously, and the recovery of each secret value is independent of each other, and the reputation value can be dynamically increased and decreased. And when the reputation is dynamically adjusted, there is no need to update the sharing information held by the participants, but the participation of the distributor is required in the process of adjusting the reputation.


## 4. Modified Threshold Scheme Based on Vandermonde Matrix

### 4.1. Conditions for Common Nonzero Solutions ofn-Element Homogeneous Linear Systems

LetAi be the mi×n matrix, and the basic solution system of the homogeneous linear equations AiX=0 of rAi=n−ri<n is ηi1,ηi1,⋯,ηiri,1≤i≤s.Theorem 3.
The necessary conditions for n-variable homogeneous linear equationsA1X=0,A2X=0,⋯,AsX=0 to have nonzero common solutions are the following:
A1ηi1+A2ηi1+⋯+Asηi1, A1ηi2+A2ηi2+⋯+Asηi2,…, A1ηiri+A2ηiri+⋯+Asηiri (i≠j) are Linearly related.Proof.
Supposeηi1,ηi1,⋯,ηiri, which is the basic solution system of AiX=0,i=1,2,⋯,s, and X0 is the nonzero common solution of A1X=0,A2X=0,⋯,AsX=0. Then X0 can be expressed linearly by ηi1,ηi1,⋯,ηiri and set to X0=ki1ηi1+ki2ηi2+⋯+kiriηiri, where ki1,ki2,⋯kiri are not all zero. From AjX=0i≠j, we can get(17)0=A1X0+A2X0+⋯+AjX0+⋯+AsX0=A1ki1ηi1+ki2ηi2+⋯+kiriηiri+A2ki1ηi1+ki2ηi2+⋯+kiriηiri+⋯+Ajki1ηi1+ki2ηi2+⋯+kiriηiri+⋯+Aski1ηi1+ki2ηi2+⋯+kiriηiri=ki1A1ηi1+A2ηi1+⋯+Ajηi1+⋯+Asηi1+ki2A1ηi2+A2ηi2+⋯+Ajηi2+⋯+Asηi2+⋯+kiriA1ηiri+A2ηiri+⋯+Ajηiri+⋯+Asηiri
Sinceki1,ki2,⋯kiri are not all zero, A1ηi1+A2ηi1+⋯+Ajηi1+⋯+Asηi1, A1ηi2+A2ηi2+⋯+Ajηi2+⋯+Asηi2,…, A1ηiri+A2ηiri+⋯+Ajηiri+⋯+Asηiri are linearly related.
Inference For two n-variable homogeneous linear equations A1X=0,A2X=0, assuming that η1,η2,⋯,ηr are the basic solution system of a2, the necessary and sufficient conditions for A1X=0 and A2X=0 to have a nonzero common solution are the following: A1η1,A1η2,⋯,A1ηr are linear related.Proof.
(necessity). SupposeX0 is a nonzero common solution with A1X=0,A2X=0, then X0 can be expressed linearly by η1,η2,⋯,ηr, set X0=k1η1+k2η2+⋯+krηr, where k1,k2⋯,kr are not all zero.
FromA1X=0, we can get(18)0=A1X=A1k1η1+k2η2+⋯+krηr,=k1A1η1+k2A1η2+⋯+krA1ηr.
Therefore,A1η1,A1η2,⋯,A1ηr are linearly related.
(Sufficiency) Since A1η1,A1η2,⋯,A1ηr are linearly related, there are numbers k1,k2⋯,kr that are not all zeros, so that(19)0=k1A1η1+k2A1η2+⋯+krA1ηr,=A1k1η1+k2η2+⋯+krηr.
LetX0=k1η1+k2η2+⋯+krηr, then X0 is the solution of A2X=0, and satisfies A1X=0, then X0 is the common solution of A1X=0,A2X=0.Theorem 4.
The necessary and sufficient conditions for then-variable homogeneous linear equations A1X=0,A2X=0,⋯,AsX=0 to have nonzero common solutions are(20)rA1A2⋮As<n.Proof.
(necessity). Suppose the nonzero common solution of then-variable homogeneous linear equations A1X=0,A2X=0,⋯,AsX=0 is X0, that is, A1X=0,A2X=0,⋯,AsX=0, so that(21)A1A2⋮AsX=0,has a nonzero common solution, so(22)rA1A2⋮As<n.
(Sufficiency) Since rA1A2⋮As<n, the linear equations A1A2⋮AsX0=0 , has a nonzero solution, set to X0, that is, A1A2⋮AsX0=0.Thus, A1X=0,A2X=0,⋯,AsX=0, that is, X0 is a nonzero common solution of A1X=0,A2X=0,⋯,AsX=0.Theorem 5.
The necessary and sufficient conditions for then-variable homogeneous linear equations A1X=0,A2X=0,⋯,AsX=0 to have nonzero common solutions are the following:(23)rA1A2⋮As=rAi,i=1,2,⋯,s.
Proof (necessity). Since the solutions ofA1X=0 are all solutions of A2X=0,⋯,AsX=0, then A1X=0 and A1X=0A2X=0⋮AsX=0 have the same solution, then rA1A2⋮As=rA1, similarly, we can prove that. rA1A2⋮As=rA2=rA3=⋯=rAs.
(Sufficiency) Since the solution of A1X=0A2X=0⋮AsX=0 must is the solution of A1X=0. Therefore, the basic solution system of A1X=0A2X=0⋮AsX=0 is the solution of A1X=0. And from rA1A2⋮As=rA1, it can be known that the number of basic solution systems of A1X=0A2X=0⋮AsX=0 and A1X=0 are the same, so their basic solution systems are equivalent, so A1X=0A2X=0⋮AsX=0 and A1X=0 have the same solution. Similarly, we can prove that A1X=0A2X=0⋮AsX=0 and AiX=0i=2,3,⋯,s have the same solution.


### 4.2. The Conditions for Multiple Nonsublinear Equations to Have Nonzero Common Solutions

Theorem 6.
Then-variable nonhomogeneous linear equations A1X=b1,A2X=b2,⋯,AsX=bs all have solutions, so the necessary and sufficient condition for them to have nonzero common solutions is that their derived groups A1X=0,A2X=0,⋯,AsX=0 have nonzero common solutions.Proof (necessity).
Letx be the meaning of any x of the derived group x1, x2, and x3, then a is the solution of b and also the solution of ab, which proves that x1, x2, and x3 have nonzero common solutions.
(Sufficiency) According to the condition and Theorem 6, we know that rAi,bi=rAi=rA1A2⋮As, and then rAi=rA1A2⋮As≤A1b1A2b2⋮⋮Asbs≤rAi,bi=rAi, so rA1b1A2b2⋮⋮Asbs=rAi,bi. And because the solution of AiX=bii=1,2,⋯,s is obviously the solution of A1X=b1,A2X=b2,⋯,AsX=bs, so A1X=b1,A2X=b2,⋯,AsX=bs and AiX=bii=1,2,⋯,s have the same solution.Theorem 7.
Then-variable nonhomogeneous linear equations A1X=b1,A2X=b2,⋯,AsX=bs all have solutions, so the necessary and sufficient condition for them to have a nonzero common solution is rA1A2⋮As=rAi,bi=rAi.


### 4.3. Scheme Structure

We will not discuss the details of the agreement. The main thing we want to point out is that this method is equivalent to the agreement in the Lagrangian section (this equivalent is quite obvious, but it is not clearly stated in the existing literature). The only major difference is the issue of expression, that is, the Lagrangian method uses an arbitrary set of at leastt participants to update their share, while the Vandermonde method uses the share of all n participants.


#### 4.3.1. Threshold Modification

(1)
Share again the first step in Figure1. Each participant Pi randomly selects a polynomial gix with the highest degree of t′−1, which satisfies gi0=fi, and then sends gij to the participant Pj1≤j≤n, that is, shares the initial share again with the additional share. The shared storage exchange matrix is εn×n. Each participant produces one row of the matrix and receives one column at the same time, as shown below:(24)εn×n=g11g12⋯g1ng21g21⋯g2n⋮⋮⋱⋮gn1gn2⋯gnn,where,gi0=fi.(2)
Participants calculate the first row of a public matrixυn×n−1modq to adjust the threshold, where υn×n is a Vandermonde matrix, that is, υi,j=ij−11≤i,j≤n.. Suppose the vector is υ1×n−1=υ1υ2⋯υn.(3)
Finally, each participantPj uses his share vector and is multiplied to calculate the final share:(25)ϕj=υ1υ2⋯υng1jg2j⋮gnj=∑i=1nυigij.


#### 4.3.2. Secret Reconstruction

To reconstruct the secret,t′ participants Pj must cooperate to construct a polynomial of degree t′−1:(26)ϕx=∑j=1t′∏1≤i≤t′,i≠jx−ij−i×ϕj.The participant then calculatesϕ0, or does not calculate ϕx, but directly uses the Lagrangian interpolation formula to calculate ϕ0.Consider a polynomialfx=3+2x+x2∈Ζ19 with the same four participants as in Section 4.2. The first step is the same as the Lagrangian method. We start directly from the second step.(1)
Participants calculate the first row of a public matrixx to adjust the threshold, where x is a Vandermonde matrix:(27)υn×n=11111248139814167,υn×n−1=4134182012511151318310916.(2)
Finally, each participantPj uses his exchange share vector and υ1×n−1 to is multiplied to calculate the final share:(28)ϕ1=4134181017514=1,ϕ2=41341895217=16.(29)ϕ3=41341815121510=0,ϕ4=413418218125=0.The secretα can be reconstructed with a new threshold t′=4:(30)α=0−20−30−41−21−31−41+0−10−30−42−12−32−416,+0−10−20−43−13−23−40+0−10−20−34−14−24−30,≡212mod19,=3.


## 4.1. Conditions for Common Nonzero Solutions ofn-Element Homogeneous Linear Systems

LetAi be the mi×n matrix, and the basic solution system of the homogeneous linear equations AiX=0 of rAi=n−ri<n is ηi1,ηi1,⋯,ηiri,1≤i≤s.Theorem 3.
The necessary conditions for n-variable homogeneous linear equationsA1X=0,A2X=0,⋯,AsX=0 to have nonzero common solutions are the following:
A1ηi1+A2ηi1+⋯+Asηi1, A1ηi2+A2ηi2+⋯+Asηi2,…, A1ηiri+A2ηiri+⋯+Asηiri (i≠j) are Linearly related.Proof.
Supposeηi1,ηi1,⋯,ηiri, which is the basic solution system of AiX=0,i=1,2,⋯,s, and X0 is the nonzero common solution of A1X=0,A2X=0,⋯,AsX=0. Then X0 can be expressed linearly by ηi1,ηi1,⋯,ηiri and set to X0=ki1ηi1+ki2ηi2+⋯+kiriηiri, where ki1,ki2,⋯kiri are not all zero. From AjX=0i≠j, we can get(17)0=A1X0+A2X0+⋯+AjX0+⋯+AsX0=A1ki1ηi1+ki2ηi2+⋯+kiriηiri+A2ki1ηi1+ki2ηi2+⋯+kiriηiri+⋯+Ajki1ηi1+ki2ηi2+⋯+kiriηiri+⋯+Aski1ηi1+ki2ηi2+⋯+kiriηiri=ki1A1ηi1+A2ηi1+⋯+Ajηi1+⋯+Asηi1+ki2A1ηi2+A2ηi2+⋯+Ajηi2+⋯+Asηi2+⋯+kiriA1ηiri+A2ηiri+⋯+Ajηiri+⋯+Asηiri
Sinceki1,ki2,⋯kiri are not all zero, A1ηi1+A2ηi1+⋯+Ajηi1+⋯+Asηi1, A1ηi2+A2ηi2+⋯+Ajηi2+⋯+Asηi2,…, A1ηiri+A2ηiri+⋯+Ajηiri+⋯+Asηiri are linearly related.
Inference For two n-variable homogeneous linear equations A1X=0,A2X=0, assuming that η1,η2,⋯,ηr are the basic solution system of a2, the necessary and sufficient conditions for A1X=0 and A2X=0 to have a nonzero common solution are the following: A1η1,A1η2,⋯,A1ηr are linear related.Proof.
(necessity). SupposeX0 is a nonzero common solution with A1X=0,A2X=0, then X0 can be expressed linearly by η1,η2,⋯,ηr, set X0=k1η1+k2η2+⋯+krηr, where k1,k2⋯,kr are not all zero.
FromA1X=0, we can get(18)0=A1X=A1k1η1+k2η2+⋯+krηr,=k1A1η1+k2A1η2+⋯+krA1ηr.
Therefore,A1η1,A1η2,⋯,A1ηr are linearly related.
(Sufficiency) Since A1η1,A1η2,⋯,A1ηr are linearly related, there are numbers k1,k2⋯,kr that are not all zeros, so that(19)0=k1A1η1+k2A1η2+⋯+krA1ηr,=A1k1η1+k2η2+⋯+krηr.
LetX0=k1η1+k2η2+⋯+krηr, then X0 is the solution of A2X=0, and satisfies A1X=0, then X0 is the common solution of A1X=0,A2X=0.Theorem 4.
The necessary and sufficient conditions for then-variable homogeneous linear equations A1X=0,A2X=0,⋯,AsX=0 to have nonzero common solutions are(20)rA1A2⋮As<n.Proof.
(necessity). Suppose the nonzero common solution of then-variable homogeneous linear equations A1X=0,A2X=0,⋯,AsX=0 is X0, that is, A1X=0,A2X=0,⋯,AsX=0, so that(21)A1A2⋮AsX=0,has a nonzero common solution, so(22)rA1A2⋮As<n.
(Sufficiency) Since rA1A2⋮As<n, the linear equations A1A2⋮AsX0=0 , has a nonzero solution, set to X0, that is, A1A2⋮AsX0=0.Thus, A1X=0,A2X=0,⋯,AsX=0, that is, X0 is a nonzero common solution of A1X=0,A2X=0,⋯,AsX=0.Theorem 5.
The necessary and sufficient conditions for then-variable homogeneous linear equations A1X=0,A2X=0,⋯,AsX=0 to have nonzero common solutions are the following:(23)rA1A2⋮As=rAi,i=1,2,⋯,s.
Proof (necessity). Since the solutions ofA1X=0 are all solutions of A2X=0,⋯,AsX=0, then A1X=0 and A1X=0A2X=0⋮AsX=0 have the same solution, then rA1A2⋮As=rA1, similarly, we can prove that. rA1A2⋮As=rA2=rA3=⋯=rAs.
(Sufficiency) Since the solution of A1X=0A2X=0⋮AsX=0 must is the solution of A1X=0. Therefore, the basic solution system of A1X=0A2X=0⋮AsX=0 is the solution of A1X=0. And from rA1A2⋮As=rA1, it can be known that the number of basic solution systems of A1X=0A2X=0⋮AsX=0 and A1X=0 are the same, so their basic solution systems are equivalent, so A1X=0A2X=0⋮AsX=0 and A1X=0 have the same solution. Similarly, we can prove that A1X=0A2X=0⋮AsX=0 and AiX=0i=2,3,⋯,s have the same solution.


## 4.2. The Conditions for Multiple Nonsublinear Equations to Have Nonzero Common Solutions

Theorem 6.
Then-variable nonhomogeneous linear equations A1X=b1,A2X=b2,⋯,AsX=bs all have solutions, so the necessary and sufficient condition for them to have nonzero common solutions is that their derived groups A1X=0,A2X=0,⋯,AsX=0 have nonzero common solutions.Proof (necessity).
Letx be the meaning of any x of the derived group x1, x2, and x3, then a is the solution of b and also the solution of ab, which proves that x1, x2, and x3 have nonzero common solutions.
(Sufficiency) According to the condition and Theorem 6, we know that rAi,bi=rAi=rA1A2⋮As, and then rAi=rA1A2⋮As≤A1b1A2b2⋮⋮Asbs≤rAi,bi=rAi, so rA1b1A2b2⋮⋮Asbs=rAi,bi. And because the solution of AiX=bii=1,2,⋯,s is obviously the solution of A1X=b1,A2X=b2,⋯,AsX=bs, so A1X=b1,A2X=b2,⋯,AsX=bs and AiX=bii=1,2,⋯,s have the same solution.Theorem 7.
Then-variable nonhomogeneous linear equations A1X=b1,A2X=b2,⋯,AsX=bs all have solutions, so the necessary and sufficient condition for them to have a nonzero common solution is rA1A2⋮As=rAi,bi=rAi.


## 4.3. Scheme Structure

We will not discuss the details of the agreement. The main thing we want to point out is that this method is equivalent to the agreement in the Lagrangian section (this equivalent is quite obvious, but it is not clearly stated in the existing literature). The only major difference is the issue of expression, that is, the Lagrangian method uses an arbitrary set of at leastt participants to update their share, while the Vandermonde method uses the share of all n participants.


### 4.3.1. Threshold Modification

(1)
Share again the first step in Figure1. Each participant Pi randomly selects a polynomial gix with the highest degree of t′−1, which satisfies gi0=fi, and then sends gij to the participant Pj1≤j≤n, that is, shares the initial share again with the additional share. The shared storage exchange matrix is εn×n. Each participant produces one row of the matrix and receives one column at the same time, as shown below:(24)εn×n=g11g12⋯g1ng21g21⋯g2n⋮⋮⋱⋮gn1gn2⋯gnn,where,gi0=fi.(2)
Participants calculate the first row of a public matrixυn×n−1modq to adjust the threshold, where υn×n is a Vandermonde matrix, that is, υi,j=ij−11≤i,j≤n.. Suppose the vector is υ1×n−1=υ1υ2⋯υn.(3)
Finally, each participantPj uses his share vector and is multiplied to calculate the final share:(25)ϕj=υ1υ2⋯υng1jg2j⋮gnj=∑i=1nυigij.


### 4.3.2. Secret Reconstruction

To reconstruct the secret,t′ participants Pj must cooperate to construct a polynomial of degree t′−1:(26)ϕx=∑j=1t′∏1≤i≤t′,i≠jx−ij−i×ϕj.The participant then calculatesϕ0, or does not calculate ϕx, but directly uses the Lagrangian interpolation formula to calculate ϕ0.Consider a polynomialfx=3+2x+x2∈Ζ19 with the same four participants as in Section 4.2. The first step is the same as the Lagrangian method. We start directly from the second step.(1)
Participants calculate the first row of a public matrixx to adjust the threshold, where x is a Vandermonde matrix:(27)υn×n=11111248139814167,υn×n−1=4134182012511151318310916.(2)
Finally, each participantPj uses his exchange share vector and υ1×n−1 to is multiplied to calculate the final share:(28)ϕ1=4134181017514=1,ϕ2=41341895217=16.(29)ϕ3=41341815121510=0,ϕ4=413418218125=0.The secretα can be reconstructed with a new threshold t′=4:(30)α=0−20−30−41−21−31−41+0−10−30−42−12−32−416,+0−10−20−43−13−23−40+0−10−20−34−14−24−30,≡212mod19,=3.


## 4.3.1. Threshold Modification

(1)
Share again the first step in Figure1. Each participant Pi randomly selects a polynomial gix with the highest degree of t′−1, which satisfies gi0=fi, and then sends gij to the participant Pj1≤j≤n, that is, shares the initial share again with the additional share. The shared storage exchange matrix is εn×n. Each participant produces one row of the matrix and receives one column at the same time, as shown below:(24)εn×n=g11g12⋯g1ng21g21⋯g2n⋮⋮⋱⋮gn1gn2⋯gnn,where,gi0=fi.(2)
Participants calculate the first row of a public matrixυn×n−1modq to adjust the threshold, where υn×n is a Vandermonde matrix, that is, υi,j=ij−11≤i,j≤n.. Suppose the vector is υ1×n−1=υ1υ2⋯υn.(3)
Finally, each participantPj uses his share vector and is multiplied to calculate the final share:(25)ϕj=υ1υ2⋯υng1jg2j⋮gnj=∑i=1nυigij.


## 4.3.2. Secret Reconstruction

To reconstruct the secret,t′ participants Pj must cooperate to construct a polynomial of degree t′−1:(26)ϕx=∑j=1t′∏1≤i≤t′,i≠jx−ij−i×ϕj.The participant then calculatesϕ0, or does not calculate ϕx, but directly uses the Lagrangian interpolation formula to calculate ϕ0.Consider a polynomialfx=3+2x+x2∈Ζ19 with the same four participants as in Section 4.2. The first step is the same as the Lagrangian method. We start directly from the second step.(1)
Participants calculate the first row of a public matrixx to adjust the threshold, where x is a Vandermonde matrix:(27)υn×n=11111248139814167,υn×n−1=4134182012511151318310916.(2)
Finally, each participantPj uses his exchange share vector and υ1×n−1 to is multiplied to calculate the final share:(28)ϕ1=4134181017514=1,ϕ2=41341895217=16.(29)ϕ3=41341815121510=0,ϕ4=413418218125=0.The secretα can be reconstructed with a new threshold t′=4:(30)α=0−20−30−41−21−31−41+0−10−30−42−12−32−416,+0−10−20−43−13−23−40+0−10−20−34−14−24−30,≡212mod19,=3.


## 5. Conclusion

Under the conditions of the security model, this paper proposes a multisecret reputation adjustment scheme for the Internet of Vehicles, and introduces in detail the specific implementation of the dynamic adjustment of the reputation weight value when the scheme distributes multiple secret values on the Internet of Vehicles at a time. The solution can realize the situation of distributing multiple secret values at once, which proves the asynchronous and independent reconstruction of multiple secrets, and when the secret is reconstructed, the security of the shared information is guaranteed by showing the subsecret value instead of directly showing the shared information; after the reconstruction is completed, the program can dynamically adjust the reputation value according to the interaction between the participants. At the same time, it is proved that whent−1 participants conduct a collusion attack, the attacker cannot steal other unrecovered secrets value-related information, ensuring the security of the unrecovered secret. Furthermore, we provide another way to keep the secret unchanged and modify the secret threshold. The idea is to share the existing shares of the participants again, and then use the Vandermonde matrix to modify the threshold from t to t′.



---

*Source: 1413976-2022-05-13.xml*