Abstract: A purchaser apparatus stores “anonymous order information including an order ID and purchaser identity verifying information” and “purchaser identity proving secret information”. A shop apparatus stores “anonymous order information including an order ID and purchaser identity verifying information”. If necessary, a purchaser sends a request including an order ID and zero knowledge proving information that a purchaser knows the purchaser identity proving secret information, from a purchaser apparatus to a shop apparatus. A shop apparatus verifies the zero knowledge proving information, based on purchaser identity verifying information retrieved from an order ID included in the request. Therefore, the unlinkability for past use is eliminated if necessary, and inconvenience caused by the unlinkability is eliminated.

Abstract: A content distribution/browsing system is disclosed. First to (m?1)th encrypted content items E(K1, C1?K2,1), . . . , E(Km?1, Cm?1?Km,1) contain second to m-th (next in order) sharing keys K2,1, . . . , Km,1, respectively. When desirous of browsing an (i+1)th content item Ci+1, the (i+1)th sharing key Ki+1,1 is acquired by browsing an immediately preceding i-th content item Ci.

Abstract: A secret sharing apparatus according to the present invention is based on a (k,n)-threshold scheme with a threshold of at least 4 but is still operational with a threshold of at least 2. The secret sharing apparatus generates a generator matrix (G) of GF(2) in which any k of n column vectors are at a full rank, divides secret information into n?1 pieces to generate divided secret data (K(1), . . . , K(n?1)), generates random data (U(0,1), . . . , U(k?2,n?1)), calculates the product of matrixes of the divided secret data, the random data, and the generator matrix (G), assigns the j×(n?1)+ith column of the calculation result to sharing partial data (D(j,i)) to calculate sharing partial data (D(j,1)), generates header information (H(j)), and individually distributes n pieces of sharing information (D(0), . . . , D(n?1)) made up of the header information (H(j)) and sharing partial data (D(j,i)) to n storage apparatuses.

Abstract: A secret sharing device of (k, n) threshold scheme creates a generator matrix G, first divided secret data, and random number data, calculates shared partial data based on the product of matrices with the random number data, the divided secret data, and the generator matrix G, and delivers the shared information formed by the shared partial data and the header information individually to the storage units. The secret sharing device calculates a recovery matrix and multiplies the shared information by the recovery matrix, hence to recover the secret information.

Abstract: A secret sharing device of (k, n) threshold scheme creates a generator matrix G, first divided secret data, and random number data, calculates shared partial data based on the product of matrices with the random number data, the divided secret data, and the generator matrix G, and delivers the shared information formed by the shared partial data and the header information individually to the storage units. The secret sharing device calculates a recovery matrix and multiplies the shared information by the recovery matrix, hence to recover the secret information.

Abstract: A content distribution/browsing system is disclosed. First to (m?1)th encrypted content items E(K1, C1?K2,1), . . . , E(Km?1, Cm?1?Km,1) contain second to m-th (next in order) sharing keys K2,1, . . . , Km,1, respectively. When desirous of browsing an (i+1)th content item Ci+1, the (i+1)th sharing key Ki+1,1 is acquired by browsing an immediately preceding i-th content item Ci.

Abstract: A secret sharing apparatus according to the present invention is based on a (k,n)-threshold scheme with a threshold of at least 4. The secret sharing apparatus generates a generator matrix (G) of GF(2) in which any k of n column vectors are at a full rank, divides secret information into n?1 pieces to generate divided secret data (K(1), . . . , K(n?1)), generates random data (U(0,1), . . . , U(k?2,n?1)), calculates the product of matrixes of the divided secret data, the random data, and the generator matrix (G), assigns the j×(n?1)+ith column of the calculation result to sharing partial data (D(j,i)) to calculate sharing partial data (D(j,1)), generates header information (H(j)), and individually distributes n pieces of sharing information (D(0), . . . , D(n?1)) made up of the header information (H(j)) and sharing partial data (D(j,i)) to n storage apparatuses.

Abstract: A purchaser apparatus stores “anonymous order information including an order ID and purchaser identity verifying information” and “purchaser identity proving secret information”. A shop apparatus stores “anonymous order information including an order ID and purchaser identity verifying information”. If necessary, a purchaser sends a request including an order ID and zero knowledge proving information that a purchaser knows the purchaser identity proving secret information, from a purchaser apparatus to a shop apparatus. A shop apparatus verifies the zero knowledge proving information, based on purchaser identity verifying information retrieved from an order ID included in the request. Therefore, the unlinkability for past use is eliminated if necessary, and inconvenience caused by the unlinkability is eliminated.