# Binary Symmetric Polynomial-Based Protected Fair Secret Sharing and Secure Communication over Satellite Networks

Authors: Chao Guo; Chenglei Pan; Guangyu Hu; Dingbang Xie; Peiliang Zuo; Yanyan Han
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The rapid establishment of the low Earth orbit (LEO) satellite network in orbit has promoted the development of satellite communication technology. However, with the reduction of access conditions of satellite networks, the problems of data protection and secure communication have attracted extensive attention. A secret sharing scheme is a cryptographic technology that can disperse risks and tolerate intrusion by dividing and storing secrets. Using secret sharing technology in satellite communication can realize information security and data confidentiality. However, if there are cheaters among the participants, existing secret sharing schemes cannot prevent cheaters from sharing secrets exclusively, even if they can detect attacks. For this reason, this paper proposes a satellite based on binary symmetric polynomials protected fair secret sharing and secure communication scheme. In satellite secret refactoring, this scheme can produce a shared session key between two participants, no other key agreement processes, and reduce the scheme in the shared secret and the actual communication satellite application complexity. Users use the session key to encrypt communication to improve security and resist external attacks. The safety and fairness of the scheme are proved against the four attack models. Compared with the existing schemes, the scheme has a lower cost of deception identification on the premise of satisfying security and fairness. This scheme does not require any cryptographic assumptions and is unconditionally secure.


---

## Body

## 1. Introduction

A satellite network is a unified, organic system composed of various types of satellites in different orbits by maximizing the utilization efficiency of space information resources. It has the characteristics of comprehensive coverage, flexible networking, good transmission effect, and functional diversity, so it is often used in meteorology, scientific research, military, and environmental fields. However, the satellite network has a tremendous negative impact due to satellite node exposure, open channel, complex space environment, highly dynamic network topology, and high link error rate. Limited space-borne resources affect computing power, which will pose a significant threat to the security of satellite networks. Although Vaseghi et al. proposed a chaotic satellite image encryption algorithm in 2021, there are security proof problems [1]. Therefore, it is necessary to design an unconditional security-protected fair secret sharing scheme in the satellite network.In 1979, Shamir and Blakley proposed a secret sharing scheme based on Lagrange interpolation polynomials and mapping geometry, respectively [2, 3]. The traditional t,n secret sharing scheme consists of secret distribution and secret reconstruction: (1) The distributor divides the shared secret into multiple secret shares by calculation and distributes them to participants, respectively. (2) Any participant set greater than or equal to the threshold can present the secret share to reconstruct the shared secret. The proposal of secret sharing provides a new idea for key management, but the traditional secret sharing scheme also has some security problems. In the process of reconstruction, the reconstructors are not completely honest. If the insider attacker shows the false child secret, then the honest participant restores the false secret, and the insider attacker can enjoy the secret to maximize the benefits. If the external attacker collects the subsecrets presented by the honest participants, it can also forge its identity and obtain the same attack effect as the internal attacker. The above spoofing attack raises the fairness issue of secret refactoring: (1) when there are internal or external attackers, all honest reconstructors can recover shared secrets, but attackers cannot reconstruct true shared secrets. (2) When there is no attacker, all refactorers can reconstruct true shared secrets.One of the most common attacks on the satellite network is the information forgery attack. The attacker forges the illegally stolen data and sends it back to the uplink. The ground cannot distinguish whether the data is from the legitimate node, resulting in the error of the whole data communication. The problem of honest refactorers recovering false secrets arises in secret refactorings. Similarly, satellite communication is broadcast chiefly over a wide range, so if encryption protection technology is not adopted, it can easily lead to data leakage.Because of the above cheating problems, Rabin and Ben introduced the validation vector to check the correctness of participants’ secret shares and detect and identify cheaters [4]. In 1995, Carpentieri proposed a scheme based on the characteristics of reference [4] that reduced the additional verification vectors required by participants [5]. In 2009, Harn and Lin constructed a subsecret consistency deceiver detection and recognition algorithm and proved the scheme’s feasibility under three attack models [6]. In 2011, Ghodosi pointed out that the deception detection and recognition algorithm in reference [6] was invalid under its limitations; after he improved the scheme conditions, the scheme with a medium or above the number of participants had high computational complexity for deception recognition [7]. In 2018, Liu et al. constructed two deception detection and recognition algorithms based on binary polynomials and proposed a scheme for nonreconstructors to participate in detection and recognition [8]. The spoofing detection and identification scheme will terminate the protocol immediately when spoofing is detected, which does not apply to the general situation. Secondly, although the cheater is detected and identified, it cannot be prevented from enjoying the shared secret exclusively, which does not meet the fairness of secret reconstruction. Tompa and Woll first proposed the fair secret sharing scheme in 1988 and hid the shared secret in a secret reconstruction sequence, and all participants did not know the location of the real secrets. In the synchronous reconstruction environment, the attacker can successfully attack only when the probability is 1/k, and the attacker correctly guesses the shared secret reconstruction location [9]. Therefore, this scheme is fair in a synchronous environment. In an asynchronous environment, an attacker can launch an attack and share the secret as long as the child’s secret is presented last. In 1995, Lin and Harn used the scheme in reference [4] to verify subsecrets. In addition, the secret reconstruction sequence s1,⋯,sj,sj+1,⋯,sk is constructed, in which sj=s,sj+1=s′, s′, participants restore the secret to sj+1=s′, the correct secret sharing is the previous sj, and the scheme meets the fairness in the asynchronous environment [10]. In 2013, Tian et al. used secret consistency and secret reconstruction sequences to construct a fair secret sharing scheme and proved the fairness of the scheme under noncollusive attacks, asynchronous and synchronous collusive attacks [11]. In 2014, Harn pointed out that reference [11] was neither safe nor fair in an asynchronous environment [12]. In 2015, Harn et al. constructed the secret reconstruction sequence and adopted the algorithm in reference [13] to share and reconstruct each secret sequence bit [14]. The scheme was fair and safe in an asynchronous environment. In 2016, Gu et al. proposed a fair secret sharing scheme based on binary symmetric polynomials to provide secure channels between participants. Still, discrete logarithms and hash functions are required to ensure security [15]. In 2017, Zhang et al. constructed a fair secret sharing scheme with absolute security by combining the deception detection and recognition algorithm and secret reconstruction in reference [6] and proved the fairness and security of the scheme under four attack models [16]. In 2019, Yang and Xing constructed a fair secret sharing scheme based on binary asymmetric polynomials and proved the fairness and security of the scheme under four standard attack models [17]. In 2019, Li et al. proposed an unconditional secret sharing scheme [18]. In 2020, Sun improved the recognition algorithm of reference [6] and proposed a fair secret sharing scheme with absolute security [19]. According to the research in reference [7], the security restriction conditions under the three attack models in references [16, 19] are all wrong. Liu et al. proposed a blockchain-based anonymous authentication scheme for air-ground integrated networks, which increased the consumption of satellite resources [20].Therefore, according to the above research progress, in order to adapt to the characteristics of limited satellite resources and narrow bandwidth, combined with the characteristics of low orbit satellite network with wide coverage, low propagation delay, and small transmission loss, this paper proposes an unconditionally secure protected fair secret sharing scheme based on binary symmetric polynomials. Combined with the IoT architecture of low orbit satellites proposed by Ding et al. [21], this scheme can effectively solve the problems of secret distribution and mutual communication in satellite networks [6, 7]. The interplanetary link is formed by multiple low-orbit satellites, and the ground control center or mid-orbit satellites serve as the key distribution center. The users are all kinds of network users who need to provide services in the satellite network. The scheme has a low cost of deception detection and identification. It satisfies fairness and security under four standard attack models, which solves a series of security problems in a satellite network, such as intercepting data transmission by attackers, data leakage, and data tampering.


## 2. Related Work

### 2.1. Harn Spoofing Detection Algorithm

Harn and Lin proposed a deception detection algorithm compatible with Shamir’s secret sharing [2, 6]. The algorithm is briefly described as follows.t represents share, n represents the total number, s stands for secret share, and J represents the number of interpolation points.Input:t,n,J=i1,⋯,ij,si1,si2,⋯,sij,where j interpolation points i1,si1,⋯,ij,sij are used to calculate the interpolation polynomial fx, denoting the order of fx as d. If d=t−1, then secret s=f0.Output: no cheater, and the secret iss. There are cheaters.If the participant set isJ and the attacker set is GFp, reference [6] points out that deception detection will always succeed when J−C>t−1.


### 2.2. Carpentieri Deception Recognition Algorithm

The scheme in this paper adopts the deceiver recognition algorithm proposed by Carpentieri, which is briefly described as follows [5].q is a large prime number, q>n, and GFq are finite fields, and the secret s is selected on GFq.


#### 2.2.1. Secret Distribution

The distributor selects akk≤n-dimensional vector di≡di,0,⋯,di,k−1 on GFq for each participant Pii=1,⋯,n as its secret share, the distributor randomly selects a nonnull different value α1,⋯,αn on GFq, ai is the coefficient of the unknown x, fx=s+a1x+a2x2+⋯+ak−1xk−1, di,0=fαi, for i=1,⋯,n, the different participant di,1,⋯,di,k−1 randomly selects on GFq. For any participant Pj, the distributor randomly selects different nonnull values gj,i,i=1,⋯,n on GFq, calculates bj,i=gj,idi,0+αjdi,1+⋯+αjk−1di,k−1, and distributes numerical pairs gj,i,bj,i,i=1,⋯,n,i≠j to each participant Pj.


#### 2.2.2. Deception Identification

After participantsPi show their secret share di, any participants Pj can authenticate di through an equation gj,iy0+αjy1+⋯+αjk−1yk−1=bj,i. If di is the solution vector of the equation, then Pi is the honest participant, otherwise Pi is identified as a cheater.


## 2.1. Harn Spoofing Detection Algorithm

Harn and Lin proposed a deception detection algorithm compatible with Shamir’s secret sharing [2, 6]. The algorithm is briefly described as follows.t represents share, n represents the total number, s stands for secret share, and J represents the number of interpolation points.Input:t,n,J=i1,⋯,ij,si1,si2,⋯,sij,where j interpolation points i1,si1,⋯,ij,sij are used to calculate the interpolation polynomial fx, denoting the order of fx as d. If d=t−1, then secret s=f0.Output: no cheater, and the secret iss. There are cheaters.If the participant set isJ and the attacker set is GFp, reference [6] points out that deception detection will always succeed when J−C>t−1.


## 2.2. Carpentieri Deception Recognition Algorithm

The scheme in this paper adopts the deceiver recognition algorithm proposed by Carpentieri, which is briefly described as follows [5].q is a large prime number, q>n, and GFq are finite fields, and the secret s is selected on GFq.


### 2.2.1. Secret Distribution

The distributor selects akk≤n-dimensional vector di≡di,0,⋯,di,k−1 on GFq for each participant Pii=1,⋯,n as its secret share, the distributor randomly selects a nonnull different value α1,⋯,αn on GFq, ai is the coefficient of the unknown x, fx=s+a1x+a2x2+⋯+ak−1xk−1, di,0=fαi, for i=1,⋯,n, the different participant di,1,⋯,di,k−1 randomly selects on GFq. For any participant Pj, the distributor randomly selects different nonnull values gj,i,i=1,⋯,n on GFq, calculates bj,i=gj,idi,0+αjdi,1+⋯+αjk−1di,k−1, and distributes numerical pairs gj,i,bj,i,i=1,⋯,n,i≠j to each participant Pj.


### 2.2.2. Deception Identification

After participantsPi show their secret share di, any participants Pj can authenticate di through an equation gj,iy0+αjy1+⋯+αjk−1yk−1=bj,i. If di is the solution vector of the equation, then Pi is the honest participant, otherwise Pi is identified as a cheater.


## 2.2.1. Secret Distribution

The distributor selects akk≤n-dimensional vector di≡di,0,⋯,di,k−1 on GFq for each participant Pii=1,⋯,n as its secret share, the distributor randomly selects a nonnull different value α1,⋯,αn on GFq, ai is the coefficient of the unknown x, fx=s+a1x+a2x2+⋯+ak−1xk−1, di,0=fαi, for i=1,⋯,n, the different participant di,1,⋯,di,k−1 randomly selects on GFq. For any participant Pj, the distributor randomly selects different nonnull values gj,i,i=1,⋯,n on GFq, calculates bj,i=gj,idi,0+αjdi,1+⋯+αjk−1di,k−1, and distributes numerical pairs gj,i,bj,i,i=1,⋯,n,i≠j to each participant Pj.


## 2.2.2. Deception Identification

After participantsPi show their secret share di, any participants Pj can authenticate di through an equation gj,iy0+αjy1+⋯+αjk−1yk−1=bj,i. If di is the solution vector of the equation, then Pi is the honest participant, otherwise Pi is identified as a cheater.


## 3. Solution Overview

As shown in Figure1, this scheme is divided into two scenarios. Solid lines represent communication between users, while dotted lines represent sharing secrets between users. When two users communicate with each other, they cannot communicate with each other directly due to the complex and changeable environment, such as desert, gobi, and sea. First, the ground control center will randomly send the secret share of the unique IN for the participants to the middle Earth orbit (MEO), and then, the MEO will transmit it to the LEO through the intersatellite link. Because the low orbit satellite has the characteristics of wide coverage and good transmission effect, the LEO will send the secret share to two users. Under the condition of ensuring the reliability of each other, the users can generate the session key between each other according to the above scheme. Therefore, when users communicate, they can encrypt and decrypt through the session key; when particular users have a secret to share with ordinary users, a particular user sends a request to the ground control center, the ground control center will randomly to send the secret share of the unique IN for the participants to the MEO, and then, the MEO will transmit it to the LEO through the intersatellite link, and the LEO will send the secret share to ordinary users. After that, secret reconstruction can be started between users. When all cheaters are excluded, the ground control center responds to the special user. The particular user can achieve the purpose of secret sharing, which significantly improves the security of the session and reduces the time of generating the session key.Figure 1
Overview of secret sharing scheme for satellite networks.


## 4. The Project Design

### 4.1. Scheme Description

The scheme in this section adopts the deceiver recognition algorithm proposed by Carpentieri, which is briefly described as follows [5]. The subground control center D and the set of participants P1,⋯,Pn are defined, and the finite domain of order p is constructed, where pp>n is a large prime number, and the secret s is selected on GFp.


#### 4.1.1. Secret Distribution

D constructs k−1 degree polynomial fx=s+a1x+a2x2+⋯+ak−1xk−1modp, where the unknown coefficient a1,a2,⋯,ak is uniformly randomly selected on GFp, different values α1,α2,⋯,αn are randomly selected on GFp\0 and disclosed, and the kk≤n-dimensional vector di≡di,0,⋯,di,k−1 is generated for each participant Pii=1,2,⋯,n as it is secret share and distributed, where di,0=fαimodp, di,1,⋯,di,k−1 is uniformly randomly selected on GFp. Participants Pjj=1,2,⋯,n, D randomly select different values gj,ii=1,2,⋯,n,i≠j on GFp\0, form n−1 pairs of values gj,i,bj,i, and distribute them to Pj, calculating bj,i=gj,idi,0+αjdi,1+⋯+αjk−1di,k−1modp.


#### 4.1.2. Deception Identification

After the participantPi receives and presents his secret share di via the satellite network, any participant Pjj=1,2,⋯,n,i≠j can verify di through bj,i=gj,iy0+αjy1+⋯+αjk−1yk−1modp, where y0,y1,⋯,yk−1 is unknown. If di is the solution vector of the equation, Pi is identified as an honest participant, otherwise as a cheater. The scheme in this section includes two parts: secret satellite distribution and secret satellite reconstruction. The detailed process is given below.


### 4.2. Secret Distribution

Assume that the ground control center isD, the threshold value of the scheme is t, and there are n participants P1,P2,⋯,Pn. D constructs the finite domain GFp of order p, and pp>n is a large prime number. The select secret s on GFp sets the security parameter v and executes the following algorithm:
(i)
Step 1: select random integersl1≤l≤v, aii=1,2,⋯,v,i≠l is the sequence bit value, and randomly generate a set of sequences:(1)a1>a2>⋯>al−1>al<al+1⋯<av(i)
Step2: takeaii=1,2,⋯,v,i≠l as a constant term to generate a univariate polynomial:(2)fix=ai+ai,1x+⋯+ai,t−1xt−1modpFor the sequencel position, al is used as a constant term to generate a bivariate symmetric polynomial of degree t−1:
(3)Fx,y=al+c1,0x+c0,1y+c1,1xy+⋯+ct−1,t−1xt−1yt−1modp,where the unknown coefficientci,j=cj,i∀i,j∈0,t−1, F0,0=al(i)
Step 3: calculate whatd satisfies s=al⊕d.(ii)
Step 4: selectIDi1≤i≤n,IDi∈GFp\0 as the identification information of each participant Pi1≤i≤n and make it public to ensure that any two participants meet IDi≠IDji≠j. Compute Fiy=FIDi,ymodp and distribute it to the actor Pi over a secure channel(iii)
Step 5: generate the secret share of the participantPi: vector si,k≡si,k,0,si,k,1,⋯,si,k,t−1,1≤k≤v is t-dimensional:(i)
Whenk=l,si,l≡si,l,0=FIDi,0modp,⋯,si,l,t−1(ii)
Whenk≠l,si,k≡si,k,0=fkIDimodp,⋯,si,k,t−1The remainingnkt−1 elements si,k,1,⋯,si,k,t−11≤i≤n,1≤k≤v are randomly selected on GFp, and v vectors are distributed to participant Pi through the secure channel.
(i)
Step 6: for sequence bitk=1,2,⋯,v, select a non-zero value gj,i,ki,j=1,2,⋯,n,i≠j on a finite field GFp randomly for each participant Pi, bj,i,k=gj,i,ksi,k,0+IDjsi,k,1+⋯+IDjt−1si,k,t−1modp and distribute gj,i,k,bj,i,k,i=1,⋯,n,i≠j to each participant Pj over a secure channel.


### 4.3. Secret Refactoring

Assuming the set of reconstructorsR=P1,⋯,Pmm≥t, the reconstruction algorithm performs at most v rounds, denoted by P−i=R\Pi. Participants Pi and Pj calculate, respectively FIDi,IDjmodp through Fiymodp and Fjymodp, which serves as the session key between ground users. After that, information exchange is carried out in symmetric encryption.Case 1.
Send roundk secret quota. All refactorers Pi perform the following algorithms:
Step 1: if the algorithm takesk=1 rounds, Pi send a secret share si,1 to P‐i.
Step 2: the algorithm execution cycle is roundk. If Pi receives m−1 secret shares of round k−1 sent by P‐i, the algorithm perform step 3. Otherwise, the attacker set C is output, and the algorithm is terminated.
Step3:Pi calculates interpolation polynomial fk−1′x through the collected subsecret share s1,k−1,1,⋯,sm,k−1,1. If the polynomial fk−1′x is t−1, the secret share of the wheel k is sent; otherwise, a spoofing attack exists. Pi verifies the m−1 subsecret share received by gi,j,k−1,bi,j,k−1, if the verification is passed, Pi will vote for Pj; otherwise, no vote will be given. If Pj gets votes T<2/m and Pj is marked as a cheater, Pj is removed from the secret reconstruction, and the cheater set C is entered. Those who voted for Pj also enter the cheater set C. If R\C≥t, Pi sends the k wheel secret share; otherwise, the protocol terminates and outputs the deceiver set C.Case 2.
Receive roundk secret share. All refactorers Pi perform the following algorithms:
Step 1: ifPi receives all m−1 secret shares of round k sent by P‐i, the algorithm calculates interpolation polynomial fk′x through s1,k,1,s2,k,1,⋯,sm,k,1. If the polynomial fk′x is of order t−1, perform step 2. Otherwise, Pi verifies m−1 subsecret shares received by gi,j,k,bi,j,k, and Pi votes for Pj. Otherwise, Pi does not vote. If Pj gets the votes that satisfy T<2/m, Pj is marked as a cheater, Pj is removed from the secret reconstruction, and the cheater set C is entered. Those who voted for Pj are also entered into the cheater set C. If R\C≥t, perform step 2, otherwise, the protocol terminates, and the spoofer set C is output.
Step 2: all the reconstructors inR\C calculating the sequence bits, ak=fk′0, if ak−1<ak is satisfied, the reconstructors in R\C send a request to the ground control center D, and D sends d to the reconstructors in R\C. After any reconstructor in R\C receives d, he reconstructs the secret through the equation s=ak−1⊕d, and the agreement is terminated; otherwise, the secret share of the round k+1 is sent.


## 4.1. Scheme Description

The scheme in this section adopts the deceiver recognition algorithm proposed by Carpentieri, which is briefly described as follows [5]. The subground control center D and the set of participants P1,⋯,Pn are defined, and the finite domain of order p is constructed, where pp>n is a large prime number, and the secret s is selected on GFp.


### 4.1.1. Secret Distribution

D constructs k−1 degree polynomial fx=s+a1x+a2x2+⋯+ak−1xk−1modp, where the unknown coefficient a1,a2,⋯,ak is uniformly randomly selected on GFp, different values α1,α2,⋯,αn are randomly selected on GFp\0 and disclosed, and the kk≤n-dimensional vector di≡di,0,⋯,di,k−1 is generated for each participant Pii=1,2,⋯,n as it is secret share and distributed, where di,0=fαimodp, di,1,⋯,di,k−1 is uniformly randomly selected on GFp. Participants Pjj=1,2,⋯,n, D randomly select different values gj,ii=1,2,⋯,n,i≠j on GFp\0, form n−1 pairs of values gj,i,bj,i, and distribute them to Pj, calculating bj,i=gj,idi,0+αjdi,1+⋯+αjk−1di,k−1modp.


### 4.1.2. Deception Identification

After the participantPi receives and presents his secret share di via the satellite network, any participant Pjj=1,2,⋯,n,i≠j can verify di through bj,i=gj,iy0+αjy1+⋯+αjk−1yk−1modp, where y0,y1,⋯,yk−1 is unknown. If di is the solution vector of the equation, Pi is identified as an honest participant, otherwise as a cheater. The scheme in this section includes two parts: secret satellite distribution and secret satellite reconstruction. The detailed process is given below.


## 4.1.1. Secret Distribution

D constructs k−1 degree polynomial fx=s+a1x+a2x2+⋯+ak−1xk−1modp, where the unknown coefficient a1,a2,⋯,ak is uniformly randomly selected on GFp, different values α1,α2,⋯,αn are randomly selected on GFp\0 and disclosed, and the kk≤n-dimensional vector di≡di,0,⋯,di,k−1 is generated for each participant Pii=1,2,⋯,n as it is secret share and distributed, where di,0=fαimodp, di,1,⋯,di,k−1 is uniformly randomly selected on GFp. Participants Pjj=1,2,⋯,n, D randomly select different values gj,ii=1,2,⋯,n,i≠j on GFp\0, form n−1 pairs of values gj,i,bj,i, and distribute them to Pj, calculating bj,i=gj,idi,0+αjdi,1+⋯+αjk−1di,k−1modp.


## 4.1.2. Deception Identification

After the participantPi receives and presents his secret share di via the satellite network, any participant Pjj=1,2,⋯,n,i≠j can verify di through bj,i=gj,iy0+αjy1+⋯+αjk−1yk−1modp, where y0,y1,⋯,yk−1 is unknown. If di is the solution vector of the equation, Pi is identified as an honest participant, otherwise as a cheater. The scheme in this section includes two parts: secret satellite distribution and secret satellite reconstruction. The detailed process is given below.


## 4.2. Secret Distribution

Assume that the ground control center isD, the threshold value of the scheme is t, and there are n participants P1,P2,⋯,Pn. D constructs the finite domain GFp of order p, and pp>n is a large prime number. The select secret s on GFp sets the security parameter v and executes the following algorithm:
(i)
Step 1: select random integersl1≤l≤v, aii=1,2,⋯,v,i≠l is the sequence bit value, and randomly generate a set of sequences:(1)a1>a2>⋯>al−1>al<al+1⋯<av(i)
Step2: takeaii=1,2,⋯,v,i≠l as a constant term to generate a univariate polynomial:(2)fix=ai+ai,1x+⋯+ai,t−1xt−1modpFor the sequencel position, al is used as a constant term to generate a bivariate symmetric polynomial of degree t−1:
(3)Fx,y=al+c1,0x+c0,1y+c1,1xy+⋯+ct−1,t−1xt−1yt−1modp,where the unknown coefficientci,j=cj,i∀i,j∈0,t−1, F0,0=al(i)
Step 3: calculate whatd satisfies s=al⊕d.(ii)
Step 4: selectIDi1≤i≤n,IDi∈GFp\0 as the identification information of each participant Pi1≤i≤n and make it public to ensure that any two participants meet IDi≠IDji≠j. Compute Fiy=FIDi,ymodp and distribute it to the actor Pi over a secure channel(iii)
Step 5: generate the secret share of the participantPi: vector si,k≡si,k,0,si,k,1,⋯,si,k,t−1,1≤k≤v is t-dimensional:(i)
Whenk=l,si,l≡si,l,0=FIDi,0modp,⋯,si,l,t−1(ii)
Whenk≠l,si,k≡si,k,0=fkIDimodp,⋯,si,k,t−1The remainingnkt−1 elements si,k,1,⋯,si,k,t−11≤i≤n,1≤k≤v are randomly selected on GFp, and v vectors are distributed to participant Pi through the secure channel.
(i)
Step 6: for sequence bitk=1,2,⋯,v, select a non-zero value gj,i,ki,j=1,2,⋯,n,i≠j on a finite field GFp randomly for each participant Pi, bj,i,k=gj,i,ksi,k,0+IDjsi,k,1+⋯+IDjt−1si,k,t−1modp and distribute gj,i,k,bj,i,k,i=1,⋯,n,i≠j to each participant Pj over a secure channel.


## 4.3. Secret Refactoring

Assuming the set of reconstructorsR=P1,⋯,Pmm≥t, the reconstruction algorithm performs at most v rounds, denoted by P−i=R\Pi. Participants Pi and Pj calculate, respectively FIDi,IDjmodp through Fiymodp and Fjymodp, which serves as the session key between ground users. After that, information exchange is carried out in symmetric encryption.Case 1.
Send roundk secret quota. All refactorers Pi perform the following algorithms:
Step 1: if the algorithm takesk=1 rounds, Pi send a secret share si,1 to P‐i.
Step 2: the algorithm execution cycle is roundk. If Pi receives m−1 secret shares of round k−1 sent by P‐i, the algorithm perform step 3. Otherwise, the attacker set C is output, and the algorithm is terminated.
Step3:Pi calculates interpolation polynomial fk−1′x through the collected subsecret share s1,k−1,1,⋯,sm,k−1,1. If the polynomial fk−1′x is t−1, the secret share of the wheel k is sent; otherwise, a spoofing attack exists. Pi verifies the m−1 subsecret share received by gi,j,k−1,bi,j,k−1, if the verification is passed, Pi will vote for Pj; otherwise, no vote will be given. If Pj gets votes T<2/m and Pj is marked as a cheater, Pj is removed from the secret reconstruction, and the cheater set C is entered. Those who voted for Pj also enter the cheater set C. If R\C≥t, Pi sends the k wheel secret share; otherwise, the protocol terminates and outputs the deceiver set C.Case 2.
Receive roundk secret share. All refactorers Pi perform the following algorithms:
Step 1: ifPi receives all m−1 secret shares of round k sent by P‐i, the algorithm calculates interpolation polynomial fk′x through s1,k,1,s2,k,1,⋯,sm,k,1. If the polynomial fk′x is of order t−1, perform step 2. Otherwise, Pi verifies m−1 subsecret shares received by gi,j,k,bi,j,k, and Pi votes for Pj. Otherwise, Pi does not vote. If Pj gets the votes that satisfy T<2/m, Pj is marked as a cheater, Pj is removed from the secret reconstruction, and the cheater set C is entered. Those who voted for Pj are also entered into the cheater set C. If R\C≥t, perform step 2, otherwise, the protocol terminates, and the spoofer set C is output.
Step 2: all the reconstructors inR\C calculating the sequence bits, ak=fk′0, if ak−1<ak is satisfied, the reconstructors in R\C send a request to the ground control center D, and D sends d to the reconstructors in R\C. After any reconstructor in R\C receives d, he reconstructs the secret through the equation s=ak−1⊕d, and the agreement is terminated; otherwise, the secret share of the round k+1 is sent.


## 5. Scheme Analysis

### 5.1. Security Model

Because the satellite fair secret sharing and secure communication scheme proposed in this section have protected characteristics, it is not necessary to consider any attack from external hostile users or satellites. The scheme is the same as the previous satellite’s fair secret sharing and communication scheme. It is assumed that there is a secure channel between the ground control center and participants, so only security in secret reconstruction is considered. To better analyze the safety and fairness of the scheme, the scheme classifies internal hostile user or satellite attacks into the following four types of attacks.Case 1.
Noncooperative attack with synchronization (NCAS). When all refactorers participate in secret reconstruction, the secret share is synchronous. There is no collusion between internal hostile users or satellites, which means that the false secret share presented by the internal enemy can only be a random number from a finite field. And the false secret share is entirely independent of the secret share provided by other real refactorers.Case 2.
Noncooperative attack with as synchronization (NCAAS). When participating in secret reconstruction, all reconstructors show that the secret share is asynchronous, and there is no collusion between internal hostile users or satellites. The best attack idea for internal hostile users or satellites is to finally show the false secret share and collect as many real secret shares as possible.Case 3.
Collusion attack with synchronization (CAS). When all refactorers participate in secret reconstruction, the secret shares they show are synchronous, and there is collusion between internal hostile users or satellites. Internal hostile users or satellites can conspire to generate and produce false secret shares. When the number of false secrets constructed is greater than or equal to the threshold, the other honest reconstructors reconstruct the false secrets constructed by their internal enemies.Case 4.
Collusion attack with asynchronization (CAAS). When all refactorings participate in secret refactoring, the secret share is asynchronous, and there is collusion between internal hostile users or satellites. Same as NCAAS, the best attack idea for internal hostile users or satellites is to choose to show the false secret share finally and collect as many real secret shares as possible before that. The false secret share of conspiracy presented will have a greater chance of attack success.


### 5.2. Safety Analysis

This section gives a detailed security analysis of the scheme in this section. To clearly represent the security proof process of the scheme, the following assumptions and symbolic definitions are given: suppose the refactorer set isR=P1,P2,⋯,Pnn≥t, where Pi and Pji≠j are arbitrary honest refactorers. A is defined as any internal deceiver. α is the number of internal fraudsters. m is the number of all refactorers. C is the set of identified internal fraudsters.Theorem 1.
A correctly guesses that the probability that round k can reconstruct the shared secret is 1/v.Proof.
The real shared secret is hidden in the reconstruction sequence by the ground control center.A does not know the correct location and can only iterate the reconstruction in turn according to the reconstruction sequence. The probability of successfully guessing the real secret location is 1/v.Theorem 2.
In this section’s scheme reconstruction process, any cheater will be identified by the honest refactorer, and the fraud identification probability is1−1/q−1.Proof.
Suppose the secret is reconstructed in thek round, and the share of the subsecret shown by the reconstructor Pi to Pj is si,k′, where si,k,0′≠si,k,0, i≠j. Pj verifies si,k′ through the gj,i∈GFq−0 sent by the distributor, Pj has q−1 validation equations, considering two equations:
(4)gj,i,ky0+IDjy1+⋯+IDjt−1yk−1=bj,i,kmodp,gj,i,k′y0+IDjy1+⋯+IDjt−1yk−1=bj,i,k′modp,
wheregj,i,k≠gj,i,k′, if si,k′ and si,k are the solutions of these two equations; the two equations are subtracted to obtain gj,i,k−gj,i,k′si,k,0=bj,i,k−bj,i,k′,gj,i,k−gj,i,k′si,k,0′=bj,i,k−bj,i,k′. Because inequalities gj,i,k≠gj,i,k′ and sj,i,k≠sj,i,k′ are contradictory, there is only one case of the equation satisfying the subsecret share of Pj verifiable Pi. Then, the probability that Pi successfully deceives Pj is at most 1/q−1, and the probability of being recognized by Pj is not less than 1−1/q−1.Theorem 3.
Whenm−α≥t, the Harn subsecret consistency detection scheme can always detect deception [6].Proof.
In 2011, Ghodosi pointed out that the spoofing detection scheme of reference [6] cannot successfully detect spoofing, regardless of whether the secret reconstruction protocol is asynchronous or synchronous [7]. Suppose that there are qq≥1 deceivers Pi1,⋯,Piq and t−1 honest reconstructors in the secret reconstruction process. The deceivers conspire to generate a random t−1 degree polynomial gx. For any honest participant, Pi meets the requirements of gi=0. The deceiver calculates the false secret share gi1,⋯,giq for himself, and he shows false secret shares to all honest people and the sum of true secrets hi1,⋯,hiq. When honest reconstructors receive false secret shares, their reconstructed polynomial is hx=fx+gx. The deceiver can easily calculate the true shared secret f0=h0−g0, while the honest reconstructor reconstructs the wrong secret h0. The highest degree of the false polynomial hx is t−1, so consistency spoofing detection can be bypassed. If there are at least t honest reconstructors in the scheme, no matter how the deceiver constructs, the highest degree of the polynomial gx is at least t, which does not meet the consistency detection. To sum up, when m−α≥t, secret consistency can always successfully detect deception.Theorem 4.
Whenm−α≥t the scheme in this chapter is safe and fair under NCAS.Proof.
In the case of NCAS, it is assumed that there is only a single deceiverA in the secret reconstruction process. According to the attack method in the proof of Theorem 3, the scheme in this section cannot detect deception because the highest degree of the false polynomial hx is t−1, so the condition m−α≥t must be satisfied. Due to the lack of cooperation between attackers, arbitrary deceiver A assumes that the other reconstructors are honest and cannot obtain adequate information through collusion. Suppose that the false subsecret share constructed by A in round k is si,k′≡si,k,0+si,k,0′,si,k,1⋯,si,k,t−1, according to Theorem 1, the probability that the false subsecret share presented by A is verified by the honest reconstructor is less than that of 1/q−1. So it cannot pass the verification and obtain the votes of other reconstructors, and the k rounds are not necessarily the location of the real secret in the reconstructed sequence. The probability of A successfully guessing the reconstruction location is 1/v. When the security parameter is large enough, the probability of A successfully cheating is negligible. To sum up, when m−α≥t, the scheme in this section is safe and fair under NCAS.Theorem 5.
Whenm−α≥t, the scheme in this section is safe and fair under NCAAS.Proof.
In the case of NCAAS, it is assumed that there is only a single deceiverA in the secret reconstruction process. When m−α≥t, the number of honest reconstructors in H is not less than t. Because it is an asynchronous environment, the best attack strategy of A is to let the honest reconstructor show the real subsecret share first and then A reconstruct the secret polynomial fix through t−1 real subsecret shares. Therefore, in the first l rounds of secret reconstruction, A chooses to show the real subsecret share. In the round l+1, A found that the real secret reconstruction position was in the previous round, condition m−α≥t limits that A cannot attack in the way shown in the proof of Theorem 3. A can only randomly select random numbers on GFq to construct false subsecret share si,k′≡si,k,0′,si,k,1⋯,si,k,t−1. At this time, the false subsecret share constructed by A cannot pass the consistency detection. The secret reconstruction enters the identification algorithm. A obtains the number of votes T<m/2 and is identified as a deceiver. It is removed from the reconstruction process and added to the attacker set C. Honest refactorers in R\C continue to execute the reconstruction protocol, requests d from D, and then reconstructs the real secret s=al⊕d. To sum up, when m−α≥t, the scheme is safe and fair under NCAAS.Theorem 6.
Whenm−α≥t∪m>2α−1, the scheme in this section is safe under CAS.Proof.
In the case of CAS, whenα≥t, the deceiver set α can calculate the secret polynomial fix in advance. As described in Theorem 3-(1) of reference [15], the attack mode passes consistency detection (for example, when α=t, m−α=t−1, m=2t−1. α attackers can precalculate sequence bits to show legal secret shares in the first l rounds. In the round l, the subsecret shares of other real reconstructors are calculated by using the reconstructed correct sequence bit polynomial fl+1x. Assuming s1,l+1,1,s2,l+1,1,⋯,st−1,l+1,1, the false polynomial f′x is constructed by using t−1 real subsecret shares and a random number sl+1′. Use f′x to generate the subsecret share st,l+1,1′,st+1,l+1,1′,⋯,s2t−2,l+1,1′ of the remaining t−1 deceivers. At this time, the subsecret share shown by all the reconstructors is s1,l+1,1,s2,l+1,1,⋯,st−1,l+1,1,st,l+1,1′,st+1,l+1,1′,⋯,s2t−2,l+1,1′,sl+1′. The polynomial obtained by all honest reconstructors is f′x, so it can pass the consistency detection). Perhaps as shown in Theorem 3, conspiring to calculate the false subsecret share passes the consistency detection, so m−α≥t is required. The false subsecret share constructed by A cannot pass the consistency detection, and the secret reconstruction enters the identification algorithm. The honest reconstructor will not vote for any A after identification, and the internal cheater set can vote for each other. Therefore, the scheme needs to meet m>2α−1. At this time, the attacker is eliminated, and the honest reconstructor reconstructs the real shared secret according to the protocol. When α<t, the deceiver set can only pass the consistency detection through the attack shown in Theorem 3 when the condition m−α≥t∪m>2α−1 is satisfied, the protocol is executed normally, or t−1 conspirators guess the share of the tth subsecret, and the guessing probability is negligible. The attacker can only show α random numbers and cannot pass the consistency detection. To sum up, when m−α≥t∪m>2α−1, the scheme in this section is safe and fair under CAS.Theorem 7.
Whenm−α≥t∪m>2α−1, the scheme in this section is safe under CAAS.Proof.
In the case of CAAS, no matter whether the number of fraudstersα is greater than or equal to the threshold value t, due to the asynchronous environment, any A can always collect t−1 real subsecret shares and calculate whether the previous round is a real satellite secret reconstruction location. Therefore, in the first round l, A shows the real subsecret share. Until round l+1, A reconstructs the secret polynomial fl+1x through the collected real subsecret share and finds that the real secret reconstruction position is in the previous round. It selects the two attack methods described in Theorem 6 to pass the consistency detection; when the condition m−α≥t∪m>2α−1 is satisfied, the honest refactor can execute the protocol normally. To sum up, when m−α≥t∪m>2α−1, the scheme is safe and fair under CAAS.


## 5.1. Security Model

Because the satellite fair secret sharing and secure communication scheme proposed in this section have protected characteristics, it is not necessary to consider any attack from external hostile users or satellites. The scheme is the same as the previous satellite’s fair secret sharing and communication scheme. It is assumed that there is a secure channel between the ground control center and participants, so only security in secret reconstruction is considered. To better analyze the safety and fairness of the scheme, the scheme classifies internal hostile user or satellite attacks into the following four types of attacks.Case 1.
Noncooperative attack with synchronization (NCAS). When all refactorers participate in secret reconstruction, the secret share is synchronous. There is no collusion between internal hostile users or satellites, which means that the false secret share presented by the internal enemy can only be a random number from a finite field. And the false secret share is entirely independent of the secret share provided by other real refactorers.Case 2.
Noncooperative attack with as synchronization (NCAAS). When participating in secret reconstruction, all reconstructors show that the secret share is asynchronous, and there is no collusion between internal hostile users or satellites. The best attack idea for internal hostile users or satellites is to finally show the false secret share and collect as many real secret shares as possible.Case 3.
Collusion attack with synchronization (CAS). When all refactorers participate in secret reconstruction, the secret shares they show are synchronous, and there is collusion between internal hostile users or satellites. Internal hostile users or satellites can conspire to generate and produce false secret shares. When the number of false secrets constructed is greater than or equal to the threshold, the other honest reconstructors reconstruct the false secrets constructed by their internal enemies.Case 4.
Collusion attack with asynchronization (CAAS). When all refactorings participate in secret refactoring, the secret share is asynchronous, and there is collusion between internal hostile users or satellites. Same as NCAAS, the best attack idea for internal hostile users or satellites is to choose to show the false secret share finally and collect as many real secret shares as possible before that. The false secret share of conspiracy presented will have a greater chance of attack success.


## 5.2. Safety Analysis

This section gives a detailed security analysis of the scheme in this section. To clearly represent the security proof process of the scheme, the following assumptions and symbolic definitions are given: suppose the refactorer set isR=P1,P2,⋯,Pnn≥t, where Pi and Pji≠j are arbitrary honest refactorers. A is defined as any internal deceiver. α is the number of internal fraudsters. m is the number of all refactorers. C is the set of identified internal fraudsters.Theorem 1.
A correctly guesses that the probability that round k can reconstruct the shared secret is 1/v.Proof.
The real shared secret is hidden in the reconstruction sequence by the ground control center.A does not know the correct location and can only iterate the reconstruction in turn according to the reconstruction sequence. The probability of successfully guessing the real secret location is 1/v.Theorem 2.
In this section’s scheme reconstruction process, any cheater will be identified by the honest refactorer, and the fraud identification probability is1−1/q−1.Proof.
Suppose the secret is reconstructed in thek round, and the share of the subsecret shown by the reconstructor Pi to Pj is si,k′, where si,k,0′≠si,k,0, i≠j. Pj verifies si,k′ through the gj,i∈GFq−0 sent by the distributor, Pj has q−1 validation equations, considering two equations:
(4)gj,i,ky0+IDjy1+⋯+IDjt−1yk−1=bj,i,kmodp,gj,i,k′y0+IDjy1+⋯+IDjt−1yk−1=bj,i,k′modp,
wheregj,i,k≠gj,i,k′, if si,k′ and si,k are the solutions of these two equations; the two equations are subtracted to obtain gj,i,k−gj,i,k′si,k,0=bj,i,k−bj,i,k′,gj,i,k−gj,i,k′si,k,0′=bj,i,k−bj,i,k′. Because inequalities gj,i,k≠gj,i,k′ and sj,i,k≠sj,i,k′ are contradictory, there is only one case of the equation satisfying the subsecret share of Pj verifiable Pi. Then, the probability that Pi successfully deceives Pj is at most 1/q−1, and the probability of being recognized by Pj is not less than 1−1/q−1.Theorem 3.
Whenm−α≥t, the Harn subsecret consistency detection scheme can always detect deception [6].Proof.
In 2011, Ghodosi pointed out that the spoofing detection scheme of reference [6] cannot successfully detect spoofing, regardless of whether the secret reconstruction protocol is asynchronous or synchronous [7]. Suppose that there are qq≥1 deceivers Pi1,⋯,Piq and t−1 honest reconstructors in the secret reconstruction process. The deceivers conspire to generate a random t−1 degree polynomial gx. For any honest participant, Pi meets the requirements of gi=0. The deceiver calculates the false secret share gi1,⋯,giq for himself, and he shows false secret shares to all honest people and the sum of true secrets hi1,⋯,hiq. When honest reconstructors receive false secret shares, their reconstructed polynomial is hx=fx+gx. The deceiver can easily calculate the true shared secret f0=h0−g0, while the honest reconstructor reconstructs the wrong secret h0. The highest degree of the false polynomial hx is t−1, so consistency spoofing detection can be bypassed. If there are at least t honest reconstructors in the scheme, no matter how the deceiver constructs, the highest degree of the polynomial gx is at least t, which does not meet the consistency detection. To sum up, when m−α≥t, secret consistency can always successfully detect deception.Theorem 4.
Whenm−α≥t the scheme in this chapter is safe and fair under NCAS.Proof.
In the case of NCAS, it is assumed that there is only a single deceiverA in the secret reconstruction process. According to the attack method in the proof of Theorem 3, the scheme in this section cannot detect deception because the highest degree of the false polynomial hx is t−1, so the condition m−α≥t must be satisfied. Due to the lack of cooperation between attackers, arbitrary deceiver A assumes that the other reconstructors are honest and cannot obtain adequate information through collusion. Suppose that the false subsecret share constructed by A in round k is si,k′≡si,k,0+si,k,0′,si,k,1⋯,si,k,t−1, according to Theorem 1, the probability that the false subsecret share presented by A is verified by the honest reconstructor is less than that of 1/q−1. So it cannot pass the verification and obtain the votes of other reconstructors, and the k rounds are not necessarily the location of the real secret in the reconstructed sequence. The probability of A successfully guessing the reconstruction location is 1/v. When the security parameter is large enough, the probability of A successfully cheating is negligible. To sum up, when m−α≥t, the scheme in this section is safe and fair under NCAS.Theorem 5.
Whenm−α≥t, the scheme in this section is safe and fair under NCAAS.Proof.
In the case of NCAAS, it is assumed that there is only a single deceiverA in the secret reconstruction process. When m−α≥t, the number of honest reconstructors in H is not less than t. Because it is an asynchronous environment, the best attack strategy of A is to let the honest reconstructor show the real subsecret share first and then A reconstruct the secret polynomial fix through t−1 real subsecret shares. Therefore, in the first l rounds of secret reconstruction, A chooses to show the real subsecret share. In the round l+1, A found that the real secret reconstruction position was in the previous round, condition m−α≥t limits that A cannot attack in the way shown in the proof of Theorem 3. A can only randomly select random numbers on GFq to construct false subsecret share si,k′≡si,k,0′,si,k,1⋯,si,k,t−1. At this time, the false subsecret share constructed by A cannot pass the consistency detection. The secret reconstruction enters the identification algorithm. A obtains the number of votes T<m/2 and is identified as a deceiver. It is removed from the reconstruction process and added to the attacker set C. Honest refactorers in R\C continue to execute the reconstruction protocol, requests d from D, and then reconstructs the real secret s=al⊕d. To sum up, when m−α≥t, the scheme is safe and fair under NCAAS.Theorem 6.
Whenm−α≥t∪m>2α−1, the scheme in this section is safe under CAS.Proof.
In the case of CAS, whenα≥t, the deceiver set α can calculate the secret polynomial fix in advance. As described in Theorem 3-(1) of reference [15], the attack mode passes consistency detection (for example, when α=t, m−α=t−1, m=2t−1. α attackers can precalculate sequence bits to show legal secret shares in the first l rounds. In the round l, the subsecret shares of other real reconstructors are calculated by using the reconstructed correct sequence bit polynomial fl+1x. Assuming s1,l+1,1,s2,l+1,1,⋯,st−1,l+1,1, the false polynomial f′x is constructed by using t−1 real subsecret shares and a random number sl+1′. Use f′x to generate the subsecret share st,l+1,1′,st+1,l+1,1′,⋯,s2t−2,l+1,1′ of the remaining t−1 deceivers. At this time, the subsecret share shown by all the reconstructors is s1,l+1,1,s2,l+1,1,⋯,st−1,l+1,1,st,l+1,1′,st+1,l+1,1′,⋯,s2t−2,l+1,1′,sl+1′. The polynomial obtained by all honest reconstructors is f′x, so it can pass the consistency detection). Perhaps as shown in Theorem 3, conspiring to calculate the false subsecret share passes the consistency detection, so m−α≥t is required. The false subsecret share constructed by A cannot pass the consistency detection, and the secret reconstruction enters the identification algorithm. The honest reconstructor will not vote for any A after identification, and the internal cheater set can vote for each other. Therefore, the scheme needs to meet m>2α−1. At this time, the attacker is eliminated, and the honest reconstructor reconstructs the real shared secret according to the protocol. When α<t, the deceiver set can only pass the consistency detection through the attack shown in Theorem 3 when the condition m−α≥t∪m>2α−1 is satisfied, the protocol is executed normally, or t−1 conspirators guess the share of the tth subsecret, and the guessing probability is negligible. The attacker can only show α random numbers and cannot pass the consistency detection. To sum up, when m−α≥t∪m>2α−1, the scheme in this section is safe and fair under CAS.Theorem 7.
Whenm−α≥t∪m>2α−1, the scheme in this section is safe under CAAS.Proof.
In the case of CAAS, no matter whether the number of fraudstersα is greater than or equal to the threshold value t, due to the asynchronous environment, any A can always collect t−1 real subsecret shares and calculate whether the previous round is a real satellite secret reconstruction location. Therefore, in the first round l, A shows the real subsecret share. Until round l+1, A reconstructs the secret polynomial fl+1x through the collected real subsecret share and finds that the real secret reconstruction position is in the previous round. It selects the two attack methods described in Theorem 6 to pass the consistency detection; when the condition m−α≥t∪m>2α−1 is satisfied, the honest refactor can execute the protocol normally. To sum up, when m−α≥t∪m>2α−1, the scheme is safe and fair under CAAS.


## 6. Scheme Comparison and Performance Analysis

From the perspective of security fairness, reference [7] points out that Harn deception detection and identification has security problems [5]. But references [16, 19] are not perfect based on Harn deception detection [6]. Under NCAS m>t, NCAAS m−α<t−1∩m>t, and CAS α<t∩m>t, the deceiver can successfully bypass the subsecret consistency detection algorithm through the attack method shown in Theorem 3. And the deceiver cannot be recognized by the honest reconstructor. Therefore, the restrictions listed in the above different scenarios should be changed m−α≥t. Only in this way can the scheme be safe and fair. Under CAS and CAAS, when the number of honest reconstructors is close to that of deceivers, the scheme in this paper needs fewer participants than references [16, 19]. The scheme in reference [11] cannot completely resist asynchronous attacks and synchronous collusion attacks. The schemes in references [14, 15] only consider the fairness of secret reconstruction in an asynchronous environment but do not consider CAS and NCAS. And the schemes do not meet complete fairness, and both need a hash function to ensure security. When deception is detected, the scheme stops immediately, which is not applicable in the actual environment. Compared with the above scheme, the protocol will not terminate immediately when deception is detected, to ensure that honest participants can reconstruct satellite secrets. Secondly, the scheme does not need the protection of a similar hash function, meets unconditional security, and ensures secure communication.From the perspective of scheme complexity, the scheme reconfiguration protocol in this section requiresθv a round of secret reconfiguration protocols to achieve fairness, which is the same as the fair secret sharing scheme proposed in references [11, 14–16, 19]. From the perspective of each round of reconfiguration protocol, each participant in this scheme receives k elements on GFp from D, and additional 2n−1 elements, FIDi,ymodp containing t elements for generating the session key, there are k+t+2n−1 in total. In the fair secret sharing scheme constructed for binary polynomials in reference [17], the additional verification elements aj,i,l and bj,i,l distributed to participants are nk. Each round D has to construct x binary asymmetric polynomials of order nk and distribute many additional elements. Compared with this, this scheme has a key free negotiation process between participants, fewer additional elements, and better communication and computational efficiency. Sun proposed an efficient deception recognition algorithm. The method of logic or operation between correctly labeled vectors is used to replace the m−t sub-Lagrange interpolation in reference [6], reducing the fraud identification overhead [19]. The scheme in this secret uses subsecret consistency for deception detection, which is the same as references [16, 19], only Ο1. The computational complexity of the deception identification algorithm of Harn and Lin is Οm! [6]. Similarly, the computational complexity of the deception identification algorithm in the scheme of Zhang et al. is also Οm! [16]. Although the deception identification algorithm in the Sun scheme reduces the overhead, the computational complexity is also Οm! [19]. The scheme deception identification algorithm in this paper only needs m−1 times of solution verification operation of secret share polynomial, and the computational complexity is Οm. According to the discussion in reference [8], in the deception identification algorithm in reference [7], assuming threshold t=6, the number of participants is required to be m≥16, and the identification algorithm requires 264 times of the Shamir secret reconstruction operation. Therefore, the scheme of references [16, 19] is not practical. To more intuitively represent the fraud detection and identification overhead between different schemes, suppose Tp is the modular exponentiation operation time, TLm is the interpolation operation time of m points, TH is the hash operation time, and Tv is the polynomial solution verification operation time. As shown in Table 1, the scheme in this section is compared with other fair secret sharing schemes in detail.Table 1
Comparison of fair secret sharing schemes.
SchemeSafe passage between participantsCompletely fairSecurity assumptionsSpoofing detection overheadCheater identification overheadReference [11]NoNoNoTLt+m−tTvmTvReference [16]NoNoNoTLmCmtTLt+m−tTLmReference [19]NoNoNoTLmCmtTLtReference [15]YesNoDLPmTp+THNoReference [22]YesNoYesNoNoOur schemeYesYesNoTLmTvm−1


## 7. Parameter Analysis

In Sections4.1 and 4.2 of this paper, it can be seen that the threshold value is an important parameter affecting satellite secret distribution and satellite secret reconstruction. Furthermore, it has a crucial impact on the generation of binary symmetric polynomials and the order of interpolation polynomials. It can be seen from reference [23] that the security and reliability of the n,k tthreshold secret sharing scheme are closely related to the key update cycle and the threshold value. Therefore, choosing the appropriate key update cycle and threshold is of great significance in improving the security of this scheme.


### 7.1. Key Update Cycle and Key Share Leakage Rate

When an attacker intercepts the shared secret share between satellite nodes, it is called key share leakage andPt is used to represent the distribution function of the key share leakage rate with time t:
(5)Pt=1−e−λt.Figure2 shows the probability distribution of key share leakage with the key update cycle T, x is λ, as can be seen from the figure, λ at the same time, the larger the key update cycle, the higher the key share leakage rate. In Figure 2, λ takes 0.02, 0.04, and 0.06, respectively, which are the corresponding values of Pt.Figure 2
Key share leakage rate graph.


### 7.2. Influence of Threshold on Network Security

Each node of the satellite network has different key shares. In a key update cycle, the probability of the key share being intercepted by the attacker is as follows:(6)P=∑i=0k−1CnipTi1−pTn−i=∑i=0k−1Cni1−e−λTie−λTn−i,whereP stands for network security, n=40,λ=0.015, the variation curve of P concerning k is given in Figure 3, and the values of T=20,30,40,50. As can be seen from the figure, when the key update period T remains unchanged, P will gradually increase with the increase of the threshold value k. when k increases to a certain extent, P approaches 1. When t is different, P corresponding to the same k value is also different. Therefore, it is necessary to increase the threshold value while increasing the key update cycle to improve network security. To improve the security and reliability of the n,k threshold secret sharing scheme, it is necessary to set the key update cycle and threshold reasonably.Figure 3
P versus k under different T.


## 7.1. Key Update Cycle and Key Share Leakage Rate

When an attacker intercepts the shared secret share between satellite nodes, it is called key share leakage andPt is used to represent the distribution function of the key share leakage rate with time t:
(5)Pt=1−e−λt.Figure2 shows the probability distribution of key share leakage with the key update cycle T, x is λ, as can be seen from the figure, λ at the same time, the larger the key update cycle, the higher the key share leakage rate. In Figure 2, λ takes 0.02, 0.04, and 0.06, respectively, which are the corresponding values of Pt.Figure 2
Key share leakage rate graph.


## 7.2. Influence of Threshold on Network Security

Each node of the satellite network has different key shares. In a key update cycle, the probability of the key share being intercepted by the attacker is as follows:(6)P=∑i=0k−1CnipTi1−pTn−i=∑i=0k−1Cni1−e−λTie−λTn−i,whereP stands for network security, n=40,λ=0.015, the variation curve of P concerning k is given in Figure 3, and the values of T=20,30,40,50. As can be seen from the figure, when the key update period T remains unchanged, P will gradually increase with the increase of the threshold value k. when k increases to a certain extent, P approaches 1. When t is different, P corresponding to the same k value is also different. Therefore, it is necessary to increase the threshold value while increasing the key update cycle to improve network security. To improve the security and reliability of the n,k threshold secret sharing scheme, it is necessary to set the key update cycle and threshold reasonably.Figure 3
P versus k under different T.


## 8. Conclusion

This paper proposes a protected secret sharing scheme for satellite networks based on binary symmetric polynomials, points out the conditional errors in references [15, 17], and proves the complete security fairness under four attack models. Compared with the existing fair secret sharing schemes, this scheme has two characteristics: The first is verifiable multisecret sharing. This scheme can effectively ensure participants’ effectiveness with secret shares before secret transmission. Secondly, suppose participants want to communicate with each other, after ensuring participants’ effectiveness. In that case, participants can communicate through the key distributed by the distribution center to form a session key to resist the external attack of satellite communication node attackers. There is no need for additional key negotiation processes between participants to reduce the number of interactions to improve the performance of the satellite network. Thus, it can reduce the bit error rate of the link and ensure safe communication between users. At the same time, the scheme does not rely on any security assumptions, is unconditionally secure, and has low fraud detection and identification overhead, which reduces the cost of remote maintenance and management of satellite networks and improves reliability and security.



---

*Source: 8606589-2022-08-09.xml*