Computerized system and method of secret key management

A computer implemented method of authorizing execution of a restricted operation, wherein the restricted operation is authorized only if a secret key is available;

• the computer comprising at least one computer processor operatively connected to a computer data storage;
• the method comprising operating the computer processor for reconstructing the secret key, comprising:
• receiving at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective entity;
• retrieving from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs;
• wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a0 of the polynomial is the secret key;
• reconstructing the polynomial based on the K (identifiers, derived value) pairs;
• and
• rendering the secret key available for enabling execution of the restricted operation by the computer or by another device.

A data-storage system comprising:

• a control layer comprising one or more control devices operatively connected to N data-storage devices, the data-storage devices constituting a physical storage space of the data-storage system;
• wherein at least one of the control devices is configured for managing at least one secret key required for enabling execution of one or more restricted operations at the N storage devices;
• the at least one control device comprising at least one computer processor operatively connected to a computer data storage;
• the computer processor is configured for reconstructing the secret key to:
• receive at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective data-storage device;
• retrieve from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs;
• wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a0 of the polynomial is the secret key;
• and
• reconstruct the polynomial based on the K (identifiers, derived value) pairs and render the secret key available for enabling execution of the restricted operation.

In a data-storage system a method of managing at least one secret key required for enabling execution of one or more restricted operations at N storage devices;

• the data-storage system comprising at least one control device operatively connected to the N data-storage devices, the N data-storage devices constituting a physical storage space of the data-storage system;
• the method comprising operating the at least one control device for reconstructing the secret key, comprising:
• receiving at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective entity;
• retrieving from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs;
• wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a0 of the polynomial is the secret key;
• reconstructing the polynomial based on the K (identifiers, derived value) pairs;
• and
• rendering the secret key available for enabling execution of the restricted operation by the computer or by another device.

A non-transitory program storage device readable by a computer, tangibly embodying computer readable instructions executable by the computer to perform a method of authorizing execution of a restricted operation, wherein the restricted operation is authorized only if a secret key is available;

• the computer comprising at least one computer processor operatively connected to a computer data storage;
• the method comprising operating the computer processor for reconstructing the secret key, comprising:
• receiving at least K identifiers out of a group of N identifiers, each identifier uniquely identifying a respective entity;
• retrieving from the computer data storage for each of the at least K identifiers a respective derived value to obtain K (identifiers, derived value) pairs;
• wherein the derived values are the product of applying a polynomial of a degree K−1 to the identifiers, where the constant term a0 of the polynomial is the secret key;
• reconstructing the polynomial based on the K (identifiers, derived value) pairs;
• and
• rendering the secret key available for enabling execution of the restricted operation by the computer or by another device.