text:
\section{Introduction}
The topic of this paper is to provide several examples of secret
sharing schemes where the domain of secret, that of shares, or
the set of players
is infinite. This type of approach studying infinite objects
instead of finitary ones is not novel even in the realm of
cryptography, see, e.g., \cite{blakley-swanson, ChorKush,
Makar:1980, patarin:infinite, Vaudenay:09}. As usual, switching to
infinite means some kind of abstraction: we disregard particular and quite
frequently annoying properties of finite structures, and focus on their
general properties only. An excellent example is Probability Theory where
the law of large numbers automatically leads to continuous distributions.

The concept of secret sharing either on infinite domain or with infinitely
many players is quite straightforward. Nevertheless, the difficulty lies in
the details. Natural properties fail in the infinite case, and even exact
definitions are sometimes problematic. In this paper we describe several
natural schemes which are intuitively correct.
We also give counterexamples
showing that certain ``natural'' definitions might not achieve the
desired effects.

We mainly consider {\it probabilistic schemes}, where
correctness and completeness relies on some probability measure. Even
defining probability measures on arbitrary (product) space is not without
problems, see \cite{delarue, haezendonck, rokhlin} for a general description
of the problems and the definition for the ``standard probability space.''
While we do not rely on those works, a good working
knowledge of measure theory and probability spaces will definitely help
understanding the basic issues.

Schemes are grouped more or less arbitrarily according to several
contradictory properties: the method used in the scheme, their similarity to
each other, and the access structure they realize. Section
\ref{sec:definitions} enlists the definitions of {\em access structure},
(probabilistic) {\em secret sharing scheme}, and when a scheme {\em
realizes} a structure. Wording of definitions are sometimes vague, as we did
not want to {\em a priori} exclude schemes which otherwise would intuitively
fit into this collection. Exact definitions, as extracted from these
examples, can be found in the companion paper \cite{infinite-secret-theory}.
Section \ref{sec:uniform}--\ref{sec:statistics} contain schemes which
illustrate the diversity of tools they use. As it is proved in
\cite{infinite-secret-theory}, schemes in Sections \ref{sec:stochastic},
\ref{sec:statistics} and \ref{sec:hilbert} are the best possible: no scheme
with better security guarantee can realize the same access structure. Section
\ref{sec:hilbert} introduces the notion of {\em Hilbert space programs}
which is a generalization of span programs \cite{spanprogram} for infinitely
many participants. Section \ref{sec:esoteric} concludes the paper with a
scheme which is not a (probabilistic) scheme at all.

\section{Definitions}\label{sec:definitions}

In this section we define the basic notions of secret sharing, namely what
access structure is, and give an informal definition for
secret sharing schemes and when it realizes an access structure.
Precise definitions are postponed to the companion paper
\cite{infinite-secret-theory}.

\subsection{Access structure}

The set of {\it participants}, or agents, who will receive (secret) share
will
be denoted by $P$. We always assume that $P$ is not empty, and to avoid
certain trivialities, we assume further that is has at least two members.
We allow $P$ to be infinite as well; for the time being
the reader may assume that $P$ is finite. Certain subsets of participants
are expected to recover the secret. The collection of these subsets
is usually denoted by the letter $\mathcal A \subseteq 2^P$, and is called
{\em access structure}. Here $2^P$ denotes the collection of all subsets of
$P$.

\begin{definition}\label{def:access-structure}\rm
$\mathcal A\subseteq 2^P $ is an {\em access structure} if it satisfies the
next two properties:
\begin{enumerate}
\item {\it Monotonicity}: if $A\in\mathcal A$ and $A\subset A'\subseteq P$,
then $A'\in\mathcal A$. Intuitively, if a set is allowed to recover the
secret, then adding further members to this set should not take away this
property.
\item {\it Nontriviality}: there is at least one qualified set
(and thus $P\in \mathcal A$), furthermore no singleton set is in $\mathcal
A$ (in particular, the empty set is never qualified).
\end{enumerate}
\end{definition}
\noindent
Subsets of $P$ in the access structure $\mathcal A$ are called {\it
qualified}, and subsets not it $\mathcal A$ are {\it unqualified}. As $P$ is
always qualified (as there is at least on qualified set, which is always a
subset of $P$), and no singleton can be qualified, access structures over
$P$ exist if and only if $P$ has at least two elements.

Requiring monotonicity is quite natural: if a group of participants can
recover the secret, then adjoining any further members cannot take away this
ability. The nontriviality means that none of the participants should be
aware of the secret, and also the secret should not be a public knowledge
(which is equivalent to the condition that the empty set is qualified).

Given any collection $\mathcal B$ of subsets of $P$, the smallest monotone
family extending $\mathcal B$ is said to be {\it generated by $\mathcal
B$}. It is easy to check that this is just the collection of supersets of
the elements of $\mathcal B$:
$$
\mathop{\mathrm{gen}}(\mathcal B) \buildrel{\mbox{\footnotesize def}}\over=  \{ A\subseteq P \,:\, \mbox{
$B\subseteq A$ for some $B\in\mathcal B$}\,\}.
$$
By the monotonicity property, an access structure is determined uniquely by
any of its generators.
\begin{definition}\label{def:base}\rm
$\mathcal B \subset 2^P$ is a {\em minimal generator} if no proper subcollection of
$\mathcal B$ generates the same collection. Minimal
generators are also called {\em base}.
\end{definition}

\noindent
It is easy to see that $\mathcal B$ is a base if and only if no two elements
in $\mathcal B$ contain each other. Saying otherwise, $\mathcal B$ is a base
if and only if it is a {\em Sperner
system} \cite{sperner}. A collection $\mathcal A$ can have many generators, but
if it has a base then it has unique generator: that base. This base, if
exists, consists
of the {\it minimal elements} in $\mathcal A$ whose collection is denoted
by $\mathcal A_0$:
\begin{equation}\label{eq:minimal-qualified}
   \mathcal A_0 = \{ B\in\mathcal A\,:\, \mbox{no proper subset of $B$ is in }
       \mathcal A\}.
\end{equation}
When specifying an access structure by listing a collection of qualified
subsets, we tacitly assume that $\mathcal A$ is the collection generated
by the given subsets. It is often desirable (or illuminating) to give the
minimal qualified subsets only. From (\ref{eq:minimal-qualified}) one can see
that $\mathcal A$ has a base if and only if every qualified subset contains a
minimal qualified subset. This is the case, for example, if every qualified
subset contains a {\it finite} qualified subset, which always happens when
$P$ is finite. When $P$ is infinite the simplest example for an access
structure without base is the family consisting of all
infinite subsets of $P$. Here the union of any two -- in fact, any finitely
many -- unqualified subsets is still unqualified.

For any integer $k>1$ the {\it $k$-threshold structure} is the access
structure consisting of subsets of $P$ with at least $k$ elements.
Frequently the number of participants is also mentioned by speaking about an
$(n,k)$-threshold structure; here $n$ is the number of participants in $P$.
As we allow $P$ to be infinite, this latter notation is not always
appropriate. When we speak about a {\it $k$-threshold structure} we always
assume that $k>1$ is a natural number, that the set $P$ is known, and then
this phrase denotes the family
$$
        \{ A \subseteq P \,:\, |A| \ge k \}
$$
generated by the $k$-element subsets of $P$.

A special case of a threshold structure, which generalizes to infinite sets
as well, is the {\it all-or-nothing} structure. In this case there is only
one qualified set, namely all participants are necessary to recover the secret:
$$
      \{P\}.
$$

\subsection{Probabilistic secret sharing scheme}

A {\it secret sharing scheme} is a method to distribute some kind of
information among the participants so that qualified subsets could recover
the secret's value from their shares, while forbidden subset should have no,
or only limited, information on the secret. The following definition captures
the usual notion of secret sharing scheme without specifying exactly what
``information on the secret'' means.

\begin{definition}\label{def:sss-basic}\rm
We say that the secret sharing scheme $\mathcal S$ {\it realizes the access
structure $\mathcal A$}, if
\begin{enumerate}
\item {\it qualified subsets can recover the secret}: for any $A\in \mathcal
A$, the collective shares assigned to members of $A$ determine the secret's
value;
\item {\it unqualified subsets have no full information}: if $F\notin
\mathcal A$ then the collective shares of $F$ does not determine the
secret's value.
\end{enumerate}
\end{definition}

Several remarks are due. First, no computational issues are considered, thus
rather than requiring any qualified subset of participants be able to {\em
recover} the secret, we rather say that the collection of shares {\em
determine} the secret. This amounts to assuming infinite computational power,
which is a usual assumption in unconditional cryptography. Second, in
several cases we will only require a weaker recoverability condition. As the
secret and shares come from a probability distribution (see Definition
\ref{def:prob.secret.scheme}), we'll be quite
happy if qualified subsets determine the secret {\em with probability 1}
rather than always.

Third, in Definition \ref{def:sss-basic} we deliberately left out what
{\it ``does not determine''} means, as the exact definition might depend on
the type of the
scheme. It might mean ``no information on the secret at all,``
or ``any secret is possible with any collection of the shares'' (but perhaps
with different probabilities),  or
``the collective shares of $F$ does not determine the secret uniquely
with positive probability.'' We will see examples for each of these
possibilities.

\medskip

This paper concentrates exclusively on schemes where every subset is either
qualified or unqualified. It is quite natural to separate these properties,
and consider {\it access} and {\it forbidden} structures with the
possibility that certain subsets are in neither of them.
Some of our examples generalize to for these more general cases, others do
not. These generalizations, whenever possible, are left to the
interested reader.

\medskip

To define a secret sharing scheme, we must also define the domain
of (possible) secrets, and the domain of (possible) shares for each
participant.

\begin{definition}\label{def:sss-domain}\rm
The {\em domain of secrets} is denoted by $X_s$, and the {\em domain of
shares} for the participant $i\in P$ is denoted by $X_i$. We always assume
that none of these sets are empty, and $X_s$ has at least two elements, i.e.
there is indeed a secret to be distributed.
\end{definition}

\noindent
Sometimes, but not necessarily always, some, or all of these domains might
coincide, can be equipped with some (algebraic or geometric) structure. In
classical secret sharing all domains are finite, but we allow these domains
to be infinite sets as well.

\medskip
Secret sharing schemes are usually described by referring to a {\em dealer}
who chooses the secret's value, determines the shares, and distributes
(privately) the shares to the participants. The dealer is assumed to be
honest, following the instructions exactly, and disappearing after her task
is completed without leaking out any information.
If the dealer is {\em not} assumed to be honest, then participants,
after receiving their shares, engage in a conversation to verify that
indeed they received a consistent set of shares. These schemes go under the
name of {\em verifiable secret sharing} \cite{cramer-vss}, which is not
considered in this paper.

In our schemes both the secret and the shares are chosen randomly (but not
independently) according to a given joint probability distributions. In such
cases the scheme is determined by the joint distribution of the secret and
of the totality of shares. This approach is a direct generalization of the
traditional finite secret sharing methods. Using probabilities has also the
advantage that one can easily define what
``no information'' means: the random variable $\xi$ gives no information on
$\eta$ if and only if they are {\it independent}, that is, the probability
that $\xi$ is in $U$ and $\eta$ is in $V$ is the product of the two separate
probabilities:
$$
\mathop{\hbox{\rm Prob}}\nolimits(\xi\in U \mbox{ and } \eta\in V) = \mathop{\hbox{\rm Prob}}\nolimits(\xi\in U)\cdot\mathop{\hbox{\rm Prob}}\nolimits(\eta\in V).
$$
Or, in other words, the {\em conditional distribution} $\xi|\eta$ (if
exists) is the same as the unconditional distribution of $\xi$.

\medskip

Recall that we denoted by $X_i$ the set of the (potential) shares of
the participant $i\in P$, and by $X_s$ the set of (possible) secrets
where $s$ is a dummy element not in $P$.
\begin{definition}\label{def:prob.secret.scheme}\rm
A {\em probabilistic secret sharing scheme $\mathcal S$} is a
probability distribution on the set $X=\prod_{i\in P\cup\{s\}} X_i$.
Equivalently, it is a collection of random variables $\langle \xi_i: i\in
P\cup\{s\}\rangle$ with some joint distribution so that $\xi_i$ takes values
from $X_i$. The {\it share of
participant $p\in P$} is the value of $\xi_p$, and the secret is the value
of $\xi_s$.
\end{definition}

\noindent
Using such a scheme, the dealer simply draws the values $\langle \xi_i:i\in
P\cup\{s\}\rangle$ randomly according to
their joint distribution, and then tells the value $\xi_p$ to
participant $p\in P$, and sets the secret to $\xi_s$. Quite frequently the
same distribution can be reached first determining (or receiving) the secret
$s=\xi_s$ according to its {\em marginal} distribution, and then drawing the
shares from the conditional distribution $\langle \xi_p: p\in P \rangle| \xi_s
= s$. To do so we need this marginal distribution to exist.

\medskip

According to Definition \ref{def:sss-basic},
the secret sharing scheme $\mathcal S$ {\em realizes the access structure
$\mathcal A$} if members of any qualified set $A\in\mathcal A$ can recover
the secret's value from their
joint shares (at least with probability 1), while unqualified
subsets have, in some sense, limited information only about the value of the
secret. The examples will illustrate this vague definition.

\section{Schemes using uniform distribution}\label{sec:uniform}

The first group of examples use uniform distribution. The simplest one is
the uniform distribution on the interval $[0,1)$, where the measurable
subsets (events) are those $X\subseteq[0,1)$ which have Lebesgue measure.
The {\em probability} that a uniformly distributed random variable $\xi$
is an element of $X\subseteq[0,1)$ is the Lebesgue measure of $X$.

In the sequel we will use $x\pmod 1$ to denote the fractional part of
the real number $x$.

\subsection{Chor-Kushilevitz scheme}

Let us start with a scheme of Chor and Kushilevitz from \cite{ChorKush},
where
both the secret and the shares are uniform random reals from the unit
interval.

\begin{scheme}\label{scheme:ChorKush}{\rm(Chor, Kushilevitz,
\cite{ChorKush})}
Suppose there are $n$ participants, namely $P=\{1,2,\dots,n\}$ where $n$ is a
fixed (finite) natural number. The dealer chooses
$n$ uniform random real numbers $h_1,\dots,h_n$ from $[0,1)$ independently,
and then she sets the secret to be $(h_1+\cdots+h_n)\pmod 1$,
i.e., the fractional part of the sum.
The {\rm share} of participant $p\in P$ is the number $h_p$.
\end{scheme}

\noindent
It is clear that all participants together can determine the secret using
the same formula what the dealer did. It is also clear that the secret is
uniformly distributed in the unit interval, moreover it is independent of
any $n-1$ of the shares. Thus scheme \ref{scheme:ChorKush} is {\it perfect},
namely unqualified subsets have no information of the secret: the collection
of their shares is {\em independent} of the secret. The scheme
and realizes the all-or-nothing structure $\mathcal A = \{P\}$.

\medskip

The same joint distribution of the secret and the shares can be achieved by
a slightly different procedure. Namely, the dealer could choose the secret and
$n-1$ out of the $n$ shares independently as uniform random reals from
$[0,1)$. Finally she can set the last share from $[0,1)$ so that secret be
equal to the fractional part of the sum of the shares.

\subsection{A perfect scheme for finitely generated structures}

Let $P$ be arbitrary (maybe infinite), and let $\mathcal A \subset
2^P$ be any access structure {\it generated by finite sets}. That is, every
qualified set (element of $\mathcal A$) should contain a {\it finite} qualified
subset. Using a standard trick due to Ito and al.~from \cite{Ito}, Scheme
\ref{scheme:ChorKush} can be used as a building block to create a perfect
secret sharing scheme realizing $\mathcal A$ which distributes a uniform
random real from the unit interval $[0,1)$.

\begin{scheme}\label{scheme:ChorKush-general}
Suppose $\mathcal A$ is generated by $\mathcal A_0$ where each element of
$\mathcal A_0$ is finite. Let $s\in[0,1)$ be a uniformly chosen random real,
and for each $A\in \mathcal A_0$ use Scheme \ref{scheme:ChorKush} to
distribute $s$ among the members of $A$ using uniform random $[0,1)$ reals in each
such sub-scheme independently. In this sub-scheme participant $p\in A$ receives the
share $h^A_p\in[0,1)$ (labeled by the minimal qualified subset $A$) such
that $s$ is the fractional part of the sum $\sum_{p\in A} h^A_p$.
The total share of participant $p\in P$ will be the tuple $\langle h^A_p:
p\in A$ and $A\in\mathcal A_0\rangle$.
\end{scheme}
\noindent
This is indeed a prefect scheme realizing $\mathcal A$. For the easy part:
if $A\subseteq P$ is qualified, then the secret can be recovered from the
shares members of $A$ received. There is an $A_0\subseteq A$ with $A_0\in
\mathcal A_0$, and members of $A_0$, adding up their shares indexed by
$A_0$ and taking the fractional part of the sum get the secret.

For the hard part: let $F\subseteq P$ be unqualified (``independent''), we must
show that their total share is independent from the secret $s$. By standard
probability argument \cite{kallenberg} this happens if and only if every
finite subcollection of these values is independent of $s$. So let these
values be $h^{A_1}_{p_1},\dots,h^{A_k}_{p_k}$, where each $p_j\in F$, and
$p_j\in A_j\in \mathcal A_0$. Partition these sub-shares according to their
upper index. Fix $A=A_j$ and let
$h^A_{p_{j_1}},\dots,h^A_{p_{j_\ell}}$ be all the shares in this partition. As
$F$ is unqualified, there is a $p=p_A\in A$ such that the sub-share
$h^A_{p_A}$ is
{\it not} in the partition. Consequently, by the remark following the
description of Scheme \ref{scheme:ChorKush} above,
the shares
$h^A_{p_{j_1}},\dots,h^A_{p_{j_\ell}}$ {\it and the secret} are totally
independent. For different $A\in \mathcal A_0$ the dealer computed the
shares independently, thus any collection of finitely many
sub-shares is indeed independent of the secret.

\subsection{A (not so) perfect 2-threshold scheme}

Let $k\ge 2$ be a (finite) natural number. By instantiating Scheme
\ref{scheme:ChorKush-general} by the generating family $\mathcal A_0 = \{
A\subseteq P \,:\, A$ has exactly $k$ elements$\}$, we see that every
$k$-threshold structure (independently of whether $P$ is finite or infinite)
can be realized by
a perfect scheme which distributes a single real number from the unit
interval. As a share, each participant receives as many real numbers as many
minimal ($k$-element) qualified subsets he is in. When $P$ is infinite, this
means infinitely many real numbers. For finite $n$ Shamir's $k$-threshold
scheme \cite{Shamir} distributes a secret so that shares are of the same
size as the secret -- in fact, they are coming from the same algebraic
structure. Generalizing Shamir's scheme for infinitely many participants,
however, raises problematic issues.

Scheme \ref{scheme:blakley-swanson} below was proposed by Blakley and
Swanson in \cite{blakley-swanson}. It is a geometric version of Shamir's
$2$-threshold scheme \cite{Shamir} for infinitely many participants: any
pair of the participants must be able to determine the secret, but any single
share should be independent from the secret. The idea can be outlined as
follows. The dealer chooses a random line $t$ in the plane. The secret is
the value where $t$ intersects the $y$ axis. Each participant $p$ has a
publicly known non-zero value $x_p$ (the participant's ``label''), and
$p$'s share is the height where the random
line intersects the vertical line going through the point $(x_p,0)$. Two
participants can, of course, determine the line $t$, and thus the secret, while
a single participant knows only a single point on $t$, which allows the
secret to be any value whatsoever.

But this is not enough: the secret should be {\it statistically independent} of every
share. Independence can be achieved by using finite geometry, and it also
lets the secret (and all shares) be chosen uniformly. On the Euclidean plane
$\mathbb R^2$ no uniform distribution exists, thus one has to look for other
possibilities. The {\it projective plane} seems to be more promising as it can be
equipped naturally with a finite, uniform measure. Gluing together
diagonally opposite points of the surface of the 3D-sphere gives a
topological equivalent of the projective plane. ``Projective lines''
correspond to main (big) circles and ``projective points'' correspond to
diagonally opposite pairs of points. Mapping diagonally opposite points to
the main circle halfway between them gives the (projective) duality between
points and lines. The uniform distribution on projective points corresponds
to the Lebesgue-measure on measurable symmetric subsets on the surface of
the sphere. By duality, it also gives a uniform distribution on the
projective lines as well. Thus one can choose projective points and lines
``uniformly and randomly.''

\begin{scheme}\label{scheme:blakley-swanson}{\rm(Blakley and Swanson, \cite{blakley-swanson})}
Let $Q$ be a point of the projective plane, and $\ell$ be a line
passing through $Q$, see Figure \ref{fig:projective-plane}. The set of participants is $I-\{\ell\}$ where
$I$ is the set of all lines through $Q$.
\begin{figure}[htp]
\begin{center}
\begin{tikzpicture}[scale=1.0]
\draw (0,0) circle (2);
\draw[rotate=135,ultra thick](2,0) arc (0:180:2 and 0.4);
\draw[rotate=135,dashed](-2,0) arc(180:360:2 and 0.4);
\draw[ultra thick](0,2) arc(90:270: 1.6 and 2);
\draw[dashed] (0,-2) arc(-90:90:1.6 and 2);
\draw[ultra thick](0,-2) arc(-90:90:1 and 2);
\draw[dashed] (0,2) arc(90:270:1 and 2);
\draw (0,2) node[above] {$Q$};
\draw (0,1.9)--(0,2.1);
\draw (-1.8,0) node{$\ell$};
\draw (-0.2,-0.6) node {$t$};
\draw (1.2,0.3) node {$p$};
\draw[->] (-2.7,1.3) node[above] {\it secret} -- (-1.4,1.05);
\draw[->] (3.0,-0.9) node[above]{\it $p$'s share} -- (0.9,-1.2);
\end{tikzpicture}
\end{center}
\kern -10pt
\caption{$2$-threshold scheme using projective plane}\label{fig:projective-plane}
\end{figure}
The dealer chooses a line $t$ randomly with uniform distribution. With probability $1$ this line
avoids the point $Q$. The secret will be the intersection of $t$ and $\ell$,
and the share of participant $p$ is the intersection of the lines $t$ and $p$.
\end{scheme}

\noindent
Scheme \ref{scheme:blakley-swanson} is a $2$-threshold scheme,
meaning that any two participants can recover the secret, while a single
participant has limited information on the secret. Indeed, any pair of participants
can recover the secret line $t$ as the unique line passing through their
points, thus they can recover the secret (as the intersection of $t$ and
$\ell$) as well.

It is clear that the secret is distributed uniformly on $\ell$, and also
that participant $p$'s share is uniformly distributed on his line as well.
It is also clear that knowing a single share lets every secret possible. One
may be tempted to assume that the {\it conditional distribution} of the
secret given the share of participant $p$ is also {\it uniform}.
\begin{figure}[htb]
\begin{center}
\begin{tikzpicture}[scale=0.51]
\draw (-0.5,0) -- (10.5,0) ; \draw (5,-0.1) node[below] {$\scriptstyle
0$} --(5,12.1);
\draw (0,-0.1) node[below] {$\scriptstyle -\pi/2$} -- (0,12.1);
\draw (10,-0.1) node[below] {$\scriptstyle \pi/2$} -- (10,12.1);
\draw (-1.4,0.25) node {$\scriptstyle d= \pi/18$};
\draw (-1.4,0.7) node {$\scriptstyle d=\pi/9$};
\draw (-1.4,1.35) node {$\scriptstyle d=\pi/4$};
\draw (-1.4,2.05) node {$\scriptstyle d=\pi/2$};
\input gomb.dat
\end{tikzpicture}
\end{center}
\kern -10pt
\caption{Conditional distribution of the secret in Scheme
\ref{scheme:blakley-swanson} for different distances}\label{fig:projective-plane-cond}
\end{figure}
Unfortunately, this is not the case. Fixing the share of $p$ to be some
point $R$, the conditional distribution of the secret line $t$ (now it goes
through $R$) is rotationally symmetric. Thus the conditional distribution of
the secret, that is, the intersection of $t$ and $\ell$ depends (only) on
the distance $d$ between $R$ and $\ell$, and its density function is depicted on
Figure \ref{fig:projective-plane-cond} for different values of $d$.
When the distance is the maximal $d=\pi/2$, then the distribution is uniform
(straight line). The smaller the distance the larger the bump at zero (the
closest point of $\ell$ to $R$). Nevertheless, the minimum is always
positive, thus whatever $p$'s share is, thus the secret can be in any arc of
$\ell$ with positive probability.

\subsection{A perfect 2-threshold scheme}

As noted above, the lack of uniform distribution on the real line prevents a
straightforward application of Shamir's scheme \cite{Shamir} for the case
when the secret is a real number. There are, however, some clever tricks to
overcome this difficulty. Scheme \ref{scheme:uniform-real} is a perfect
$2$-threshold scheme with continuum many participants where the
secret is a uniformly chosen real number from the unit interval.
Unfortunately we were unable to generalize this construction to a
$k$-threshold scheme for any $k$ bigger than 2.

Recall that
$x\pmod 1$ denotes the fractional part of the real number $x$.

\begin{scheme}\label{scheme:uniform-real}{\rm(Csirmaz, Ligeti, Tardos,
\cite{csirmaz-tardos-ligeti})}
In this scheme the secret $s$ is a uniform real number chosen from the unit
interval $[0,1)$, and participants are indexed by positive real
numbers between $0$ and $1$. The dealer, after choosing the secret $s$ as
described, chooses a uniform random real $r$ from $[0,1)$ independently from
$s$. Participant
with index $p\in(0,1)$ will receive the share $s_p =r+s\cdot p \pmod 1$.
\end{scheme}

\noindent
First note that each participant receives a uniform random number from the
interval $[0,1)$ {\it which is independent of the secret}. This is so as the
``randomization'' value $r$ is independent from the secret (and from the
participant). Thus no participant has any information on the secret
whatsoever, i.e., the scheme is {\it perfect}. Second, if $0< p<q < 1$ are
the indices of two participants, then the fractional part of the difference
of their shares is
\begin{equation}\label{eq:scheme-uniform}
    s\cdot(q-p)~~ \pmod 1 .
\end{equation}
They also know that $s$ is between zero and one, $q-p$ is between $0$ and
$1$, thus $s\cdot(q-p)$ is between $0$ and $1$. By (\ref{eq:scheme-uniform})
they know the fractional part of this product, consequently they know the
exact value as well as it equals to its fractional part. From here
determining the secret is a simple matter of division.

In an intuitive sense this scheme is also {\it ideal}. The shares and the
secret are very much alike, and we did not squeeze extra information into
the shares using some tricky encoding.

\subsection{An ``all-or-nothing'' scheme}

All-or-nothing schemes realize the simplest possible access structure,
namely the one where the only qualified subset consists of all participants:
$\mathcal A = \{P\}$. When $P$ is finite, say has $n$ elements, then Scheme
\ref{scheme:ChorKush} of Chor and Kushilevitz is, in fact, an all-or-nothing
scheme distributing a real number. Thus all-or-nothing schemes exist for
every finite set of participants. Scheme \ref{scheme:weak-ramp}
below is an all-or-nothing one where $P$ has
countably many elements and the secret is a real number.

\begin{scheme}\label{scheme:weak-ramp}{\rm(Csirmaz, Ligeti, Tardos,
\cite{csirmaz-tardos-ligeti})} Let the set of participants be labeled by the
positive integers $\mathbb N^+=\{1,2,\dots\}$. Participant $i\in\mathbb N^+$
receives $h_i$, an independent, uniformly distributed real number from
$[0,1)$. Finally the dealer computes the secret as
$$
    s= \sum_{i=1}^{\infty} \frac{h_i}{2^i}.
$$
\end{scheme}

\noindent
The distribution of the secret is depicted on Figure \ref{fig:weak-ramp}.

We claim that Scheme \ref{scheme:weak-ramp} realizes the access structure
$\mathcal A = \{P\}$. First, it is clear that all participants together can
determine the secret: they simply use the same formula what the dealer
did.
\begin{figure}[htp]
\begin{center}
\begin{tikzpicture}[scale=1.4]
\draw (-0.1,0) -- (5.1,0) ; \draw (2.5,-0.1) node[below] {$\scriptstyle
0.5$} --(2.5,2.1);
\draw (0,-0.1) node[below] {$\scriptstyle 0$} -- (0,0.1);
\draw (5,-0.1) node[below] {$\scriptstyle 1$} -- (5,0.1);
\input distr.dat
\end{tikzpicture}
\end{center}
\caption{Distribution of the secret in Scheme \ref{scheme:weak-ramp}}\label{fig:weak-ramp}
\end{figure}

Second, suppose participant with label $i\ge 1$ is missing, i.e., only the
shares of $F=P-\{i\}$ are known. As
$i$'s contribution to the secret is a uniform value from an interval of
length $2^{-i}$, members of $F$ only know that $s$ is within a certain
interval (which interval can be computed from their shares), and the secret
has a uniform distribution within that interval. Consequently $F$ can
compute the secret {\em up to an interval of length $2^{-i}$}, and the
conditional distribution of the secret in that interval is uniform. Thus,
in some sense, unqualified subsets have limited information on the
secret. But this ``limited information'' can be quite big: an unqualified
subset can narrow down the value of the secret to a tiny interval. Scheme
\ref{scheme:ell2} realizes the same access structure (namely, $\mathcal
A=\{P\}$), and has the advantage
that unqualified subsets -- based on their shares -- cannot exclude any
secret value whatsoever.

\section{Schemes with Gaussian distribution}\label{sec:gauss}

While there is no uniform distribution on the reals, there is a natural, and
much used one: the {\it Gaussian} or {\it normal} distribution. As usual,
$N(\mu,\sigma^2)$ denotes the normal distribution with expected value $\mu$ and
variance $\sigma^2$, its density function is
$$
    \frac{1}{\sqrt{2\pi\sigma^2}} e^{-\frac{(x-\mu)^2}{2\sigma^2}} .
$$
A {\it standard normal} variable has expected value $\mu=0$ and variance
$\sigma^2=1$. If
$\xi_i$ is normal with parameters $\mu_i$ and $\sigma_i$, and $\xi_1$,
$\dots,\xi_m$ are {\it independent}, then the linear combination $\sum
\lambda_i\xi_i$ is also normally distributed
with expected
value $\big(\sum \lambda_i\mu_i\big)$ and variance $\big(\sum
\lambda_i^2\sigma_i^2\big)$.

\subsection{A $k$-threshold scheme over the reals}

\begin{scheme}\label{scheme:gauss}
Let $k\ge 2$ be a fixed positive integer. Participants are identified by
non-zero real numbers $\mathbb R - \{0\}$. The dealer sets the share of
participants $x_1=1/k$, $x_2=2/k$, $\dots, x_k=k/k=1$ to be
independent standard normal values. Next, she computes the unique
polynomial $f(x)$ of degree at most $k-1$ for which $f(x_i)$ is the share of
$x_i$ for $i=1,2,\dots,k$. Then she sets the secret as $f(0)$, and
$p\in\mathbb R-\{0\}$ receives the share $f(p)$.
\end{scheme}

\noindent
As a polynomial of degree at most $k-1$ is determined uniquely by values it
takes at $k$ different places, any $k$ participant can compute $f$, and thus
can recover the secret as well. Determining $f$ can be done, for example, by the {\it
Lagrange interpolation method} outlined below.

Suppose we are looking for a polynomial $f$ of degree at most $k-1$ which
takes the value $y_i$ at $x_i$ for $i=1,\dots,k$. Let $L_i(x)$ be the
following polynomial of degree $k-1$
$$
    L_i(x) = \frac{(x-x_1)\cdots(x-x_{i-1})(x-x_{i+1})\cdots(x-x_k)}
       {(x_i-x_1)\cdots(x_i-x_{i-1})(x_i-x_{i+1})\cdots(x_i-x_k)}
  = \prod_{\scriptstyle j=1\atop \scriptstyle j\ne i}^k \frac{x-x_j}{x_i-x_j},
$$
which takes $1$ at $x_i$ and zero at $x_j$ when $j\ne i$. The polynomial we
are seeking for is
\begin{equation}\label{eq:interpolation}
    f(x) = \sum_{i=1}^k y_i L_i(x),
\end{equation}
as it takes $y_i$ at $x_i$, and has degree at most $k-1$. Equation
(\ref{eq:interpolation}) can also be used to determine the value of $f$ at
any particular place $x$ without computing the coefficients of $f$ first.

In Scheme \ref{scheme:gauss} the dealer has chosen the values $f(1/k)$,
$f(2/k)$, $\dots,$
$f(k/k)$. Therefore she can compute the share of $p$ using Lagrange
interpolation (\ref{eq:interpolation}) as follows:
$$
    f(p) = \sum_{i=1}^k \bigg(
      \prod_{\scriptstyle j=1\atop\scriptstyle  j\ne
i}^k\frac{p-j/k}{(i-j)/k}\bigg) f(i/k) =
      \sum_{i=1}^k \lambda_{p,i} f(i/k),
$$
where the constants $\lambda_{p,i}$ depend only on $p$ (and $i$ and $k$),
but they do not
depend on the actual values of $f(i/k)$. Thus $f(p)$ is a linear combination of
independent standard normal variables, consequently it also follows a Gaussian
distribution with expected value $0$ and variance
$$
  \sigma_p^2 =  \sum_{i=1}^k \lambda_{p,i}^2 =
    \sum_{i=1}^k \prod_{j\ne i} \frac{(kp-j)^2}{(i-j)^2}.
$$
In particular, the secret, namely the value of $f$ at $0$, has expected
value $0$ and variance
\begin{equation}\label{eq:gauss-secret-variance}
  \sigma_0^2 = \sum_{i=1}^k \prod_{j\ne i} \frac{j^2}{(i-j)^2} =
   \sum_{i=1}^k {k\choose i}^2 = {2k\choose k}-1 \approx
    \frac{2^{2k}}{\sqrt{\pi k}}.
\end{equation}
The {\it joint distribution} of the shares of $k-1$ participants $p_1,
\dots,p_{k-1}$ is a $(k-1)$-dimensional Gaussian distribution; these shares,
however, are not necessarily independent. Nevertheless, the {\it conditional
distribution} of the secret, given the shares $f(p_1)=h_1, \dots,
f(p_{k-1})=h_{k-1}$ is again Gaussian. Indeed, the probability that
$f(p_j)=h_j$ and $f(0)=s$ (namely the value of the density function at this
point) can be
computed as follows. Using (\ref{eq:interpolation}) we can compute $f(1/k),
\dots,f(k/k)$ from the values $h_j$ and $s$ as
$$
    f(\ell/k) = s \big(\prod_{j=1}^{k-1} \frac{\ell/k-p_j}{0-p_j}\big) +
    \big( \sum_{i=1}^{k-1} h_{i} \frac{\ell/k-0}{p_i-0}\prod_{j\ne
    i}\frac{\ell/k-p_j}{p_i-p_j}\big)
    = s\cdot a_\ell-b_\ell,
$$
here $\ell=1,\dots,k$, and the constants $a_\ell$ and $b_\ell$ do not depend on $s$. Thus
\begin{eqnarray}
&&\hskip -20pt \mathop{\hbox{\rm Prob}}\nolimits\big(f(0)=s, f(p_1)=h_1,\dots,f(p_{k-1})=h_{k-1}\big) \,= \nonumber\\[3pt]
&=& \mathop{\hbox{\rm Prob}}\nolimits\big(f(1/k)=sa_1-b_1,\dots,f(k/k)=sa_k-b_k\big) \,=\nonumber\\
&=& \frac1{(2\pi)^{k/2}} \exp \big( {\textstyle-\frac12} ((sa_1-b_1)^2+\cdots
               + (sa_k-b_k)^2)\big) \,=\nonumber\\
&=& C\cdot\exp\big({\textstyle-\frac12} (As-B)^2\big),\label{eq:conditional}
\end{eqnarray}
where
\begin{eqnarray*}
A^2 &=& a_1^2 + \cdots a_k^2 =\sum_{\ell=1}^k  \frac{(\ell/k-p_1)^2
\cdots(\ell/k-p_{k-1})^2}
    {p_1^2 \cdots p_{k-1}^2},\\[5pt]
AB &=& a_1b_1 + \cdots a_kb_k,
\end{eqnarray*}
and $C$ is again some constant not depending on $s$. According to
(\ref{eq:conditional}), the conditional distribution of the secret is indeed
normal with expected value $B/A$ and variance $A^{-2}$. The variance depends
only on who the participants $p_1, \dots, p_{k-1}$ are, but does not depend
on the value of their shares. If one of the participants is quite close to
zero, then we expect his share to be close to the secret as well, and this
intuition
is justified by the small value of the variance $A^{-2}$. Also, if all
$p_\ell$ are really small, then in the formulas above we can replace $\ell/k-p_j$ by
$\ell/k$, and the expected value of the conditional distribution of the secret
can be approximated as
$$
\frac{B}{A} = \frac{AB}{A^2}\approx
\sum_{i=1}^{k-1}h_i\prod_{j\ne i} \frac{0-p_j}{p_i-p_j},
$$
which is the value at zero of the smallest degree polynomial going through
the shared values of these $k-1$ participants, while the variance is
$$
   A^{-2} \approx \frac{p_1^2\cdots p_{k-1}^2}{\sum_{\ell=1}^k (\ell/k)^{2k-2}}
   \approx p_1^2\cdots p_{k-1}^2.
$$
On the other hand, if all participants are well above $1$, i.e., $p_j\gg 1$,
then we can bound the conditional variance $A^{-2}$ from below. As $\ell\le k$,
$$
\frac{(\ell/k-p_j)^2}{p_j^2} = \left(1- \frac\ell{kp_j}\right)^2 < 1,
$$
therefore
\begin{equation}\label{eq:gauss-variance}
A^{-2}=\left(\sum_{\ell=1}^k  \frac{(\ell/k-p_1)^2
\cdots(\ell/k-p_{k-1})^2} {p_1^2 \cdots p_{k-1}^2} \right)^{-1}
> \frac1k.
\end{equation}
The variance is asymptotically $1/k$ as the values of $p_j$ tend to
infinity; and the expected value is
$$
\frac{AB}{A^2}\approx \sum_{i=1}^{k-1} h_i\frac{k}{2p_i}\prod_{j\ne i}
     \frac{0-p_j}{p_i-p_j},
$$
once again the value at zero of the smallest degree polynomial going through
the ``corrected'' values $\tilde h_i = h_ik/(2p_i)$. Consequently this
scheme is far away from being ``perfect,'' which would require that the
conditional distribution of the secret be the same as the unconditional one.
Nevertheless, the scheme offers quite good security guarantees, namely
any $k-1$ participants, whatever their shares are, cannot exclude any interval, or in
fact any set with positive Lebesgue measure, from $\mathbb R$ as the
possible value of the secret.

\subsection{An almost perfect threshold scheme}

Using a trick inspired by the Ajtai-Dwork cryptosystem \cite{regev}, we can
make the previous threshold Scheme \ref{scheme:gauss} ``almost perfect.'' In
designing their cryptosystem, Ajtai and Dwork used the fact
that the fractional part of a normal variable with large enough variance is
almost uniformly distributed. The density function of the distribution of
the fractional part of a normal variable with variance $\sigma^2$
can be computed using the Poisson summation formula
\begin{equation}\label{eq:Poisson}
\frac1{\sqrt{2\pi\sigma^2}}\sum_{k=-\infty}^{+\infty}
  e^{-\frac{(x-k)^2}{2\sigma^2}} =
\sum_{\ell=-\infty}^{+\infty} \cos(2\pi x \ell) e^{-2\pi^2\sigma^2\ell^2} ,
~~~ 0\le x < 1.
\end{equation}
On figure \ref{fig:ajtai-dwork} this density function is depicted for three
different values of $\sigma$.
\begin{figure}[htb]
\begin{center}
\begin{tikzpicture}[scale=1.0]
\draw (-0.25,0) -- (5.25,0) ; \draw (5,-0.1) node[below] {$1$} --(5,2.8);
\draw (0,-0.1) node[below] {$0$} -- (0,2.8);
\draw (-0.9,1.0) node {$\sigma=3$};
\draw (-0.8,1.6) node {$\sigma=1.5$};
\draw (-0.9,2.3) node {$\sigma=1$};
\input ajtai.dat
\end{tikzpicture}
\end{center}\vspace{-10pt}
\caption{Distribution of the fractional part of a normal variable}\label{fig:ajtai-dwork}
\end{figure}
For each $\sigma$ it takes the smallest value at
$1/2$, and the largest value at $0$ (and $1$). The larger the variance the
closer the distribution to the uniform one. In fact, as formula
(\ref{eq:Poisson}) indicates, the deviation from the
uniform distribution is of order $\exp(-2\pi^2\sigma^2)$, thus choosing, e.g.,
$\sigma=10$ the distribution is practically indistinguishable from
the uniform one.

The trick is that instead of using a normally distributed random
variable $\xi\in N(m,\sigma^2)$,
we will
use its fractional part $\eta = \xi\pmod 1$. The density function of
$\eta$ differs from the density function of the uniform distribution by
about $\exp(-2\pi^2\sigma^2)$.
With this trick in mind we make the following changes to Scheme
\ref{scheme:gauss}. First, the
secret will not be the value of the interpolating polynomial $f$ at zero,
rather
the fractional part of it. If $f(0)$ has large enough
variance, then its
fractional part is almost uniform in the unit interval. Second, we
restrict participants to values larger than $1$ to make sure that the
conditional distribution of the secret has variance separated from zero.
Third, to make sure that $f(0)$ has variance large enough, $f(1/k),\dots,f(k/k)$
will be chosen independently from $N(0,\sigma^2)$ with some large enough
$\sigma$.

\begin{scheme}\label{scheme:ajtai-dwork}
Let $k\ge 2$ be a fixed positive integer, $\lambda>1$ be a ``security''
parameter, and set $\sigma=\lambda\cdot\sqrt k$.  Participants are labeled by real
numbers above $1$. The dealer chooses $k$ normally distributed random reals
$\xi_i$ from $N(0,\sigma^2)$ independently, and determines the smallest degree
polynomial $f$  with $f(i/k)=\xi_i$. Then she sets the secret to be the
fractional part of $f(0)$, and gives participant $p > 1$ the share
$f(p)$.
\end{scheme}

\noindent
As with Scheme \ref{scheme:gauss} any subset of $k$ participants can recover
the polynomial $f$, thus the secret as well.
According to equation (\ref{eq:gauss-secret-variance}), $f(0)$ has variance
$$
   \sigma^2 \cdot \sum_{i=1}^k {k\choose i}^2  > \lambda^2\cdot k\cdot 2^k ,
$$
and from (\ref{eq:gauss-variance}) it follows that the variance of the {\it
conditional distribution} of $f(0)$ given $k-1$ shares is bigger than
$$
   \sigma^2 \cdot \frac1k = \lambda^2 .
$$
Consequently the density function of the fractional part of $f(0)$, i.e.,
that of the secret, differs from the uniform one by less than
$2\exp(-2\pi^2\lambda^2)$
both in the unconditional and in the conditional case. Therefore
these density functions differ from each other by less than
$4\exp(-2\pi^2\lambda^2)$ {\it everywhere}.
Choosing, e.g.,  $\lambda=10$, the two distributions are practically indistinguishable,
unqualified subsets have (uniformly) arbitrary small information on
the secret.

One could slightly twist Scheme \ref{scheme:ajtai-dwork} to realize the {\em
infinite} subsets of participants indexed by positive real numbers above 1.
Shares they receive will form a graph of a polynomial, but in this case the
degree of the polynomial has no a priori bound. As usual, the secret
is the value of the polynomial at zero (or, rather, its fractional part).
Infinitely many points determine the
polynomial -- and the secret -- unambiguously, while given finitely many
shares only, the ratio of the unconditional and conditional probability of
the secret is bounded.

\begin{scheme}\label{scheme:bounded2}
Fix the ``security parameter'' $\lambda>1$. Participants are labeled by real
numbers above $1$. The dealer chooses the integer $k\ge 2$ randomly so that
$k$ is chosen with probability $2^{-k+1}$, then she executes Scheme
\ref{scheme:ajtai-dwork} with $k$ and $\lambda$.
\end{scheme}

\noindent
Clearly both the secret and the shares are random variables with some
well-determined distribution which depends on $\lambda$. The secret is
from the unit interval with a distribution quite close to the uniform one.
Any infinite set of participants can determine the polynomial $f$ whatever
its degree is, thus they can determine the secret as well.

With probability $2^{-k+1}$ the polynomial will be of degree $k-1$, thus $k$
participants can determine the secret uniquely with probability
$1-2^{-k+1}$.  With probability $2^{-k+1}$, however, $f$ has degree at least
$k$, and the conditional distribution of the secret is quite close to the
uniform one (say bigger than $1/2$ everywhere). Consequently, no matter what
the shares of these $k$ participants are, the density function of the
conditional distribution of the secret given these shares is at least
$2^{-k}$ over the whole unit interval. Consequently they have at least that
much uncertainty about the value of the secret.

\subsection{Gaussian ``all-or-nothing'' scheme}

Scheme \ref{scheme:weak-ramp} realized an infinite ``all-or-nothing'' access
structure: all participants were necessary to recover the secret exactly.
When the $i$'th participant's share was missing, others could narrow down the
secret to an interval of length $2^{-i}$ only. Here we present an alternate
scheme realizing the same structure, based on a Gaussian probability
distribution on $\ell_2$ in which unqualified subsets cannot exclude any
positive set as the possible value of the secret.

Suppose $\langle\xi_i\in N(0,\sigma_i^2)\,:\, i\in\mathbb N^+\rangle$ is
a sequence of independent normal variables. This defines a (Gaussian)
probability measure on the infinite sequences: to choose such a sequence
``randomly,'' simply take a realization of the sequence
$\langle \xi_i: i\in\mathbb N^+\rangle$.
If, in addition, $\sigma^2 =\sum_i \sigma_i^2 < \infty$, then, with
probability 1, the sum $\sum \xi_i$ converges, and has normal
distribution $N(0,\sigma^2)$. Fix such $\sigma_i$ values. Shares will be
generated according to the above measure, and the secret will be the sum
of the distributed vector.
\begin{scheme}\label{scheme:ell2}
Fix the values $\sigma_i$ such that $\sum\sigma_i^2<\infty$.
Participants are labeled by the set $\mathbb N^+$ of positive integers.
The share $h_i$ of $i\in\mathbb N^+$ is a normally distributed real number
from $N(0,\sigma_i^2)$ where shares are chosen
independently. Finally the dealer computes the secret as $s=\sum_i h_i$.
\end{scheme}

\noindent
As remarked above, with this choice of the variances, the sum $\sum_i h_i$ is
convergent with probability $1$, thus this is a correct scheme.
Evidently, all participants together can determine the secret by
adding up their shares. On the other hand, participant $i$ contributes a
normally distributed value to the secret {\em which is independent of all
other shares}, thus leaving him out the others
cannot exclude any set of reals with positive measure as the secret's value.
Indeed: given the shares of a maximal unqualified set
$F=\mathbb N^+-\{i\}$, the {\em conditional distribution} of $s$ given all these
shares is $N(m,\sigma_i^2)$, where $m=\sum_{j\ne i} h_j$, the sum of the
shares of the members of $F$.

\medskip

Using the Ajtai-Dwork trick, namely taking the secret to be the fractional
part of the value to be recovered, this scheme can also be turned
into a scheme with stronger ``hiding'' property. Namely, given the shares of
an unqualified set $F$, the density function of the conditional distribution
of the secret is not only positive wherever the unconditional secret
distribution has positive density, but the two distributions are only a
``constant apart:''
\begin{equation}\label{eq:up-to-constant}
  c\cdot(\mbox{unconditional density}) \le
    (\mbox{conditional density}) \le \frac1c\cdot(\mbox{unconditional
density})
\end{equation}
for some positive constant $c=c_F$ depending on the unqualified set $F$.

\medskip

We remark that in \cite{infinite-secret-theory} it is shown that infinite
``all-or-nothing'' structures cannot be realized by perfect schemes, thus
this improved scheme provides the strongest possible security guarantee for
this particular access structure.

\section{Stochastic processes}\label{sec:stochastic}

Schemes in this section are based on the heavy weight champion of
probability theory, the {\it Wiener process}. A Wiener process $W(t)$ is a
randomly generated function defined on the interval $[0,1]$ which is the
limiting process of the scaled sum of infinitely many independent
identically distributed random variables. Among its several properties, we
will use the following ones.
\begin{enumerate}
\item $W(0)=0$ and for $0<t\le 1$, $W(t)$ is normally distributed with
expected value $0$ and variation $t$;
\item $W(t)-W(s)$ is normal with expected value $0$ and variance $|t-s|$;
\item $W(t)$ has {\it independent increments}, that is when
$t_1<t_2<s_1<s_2$ then $W(t_2)-W(t_1)$ and $W(s_2)-W(s_1)$ are independent;
\item the expected value of $W(t)W(s)$ is $\min(t,s)$;
\item $W(t)$ is continuous, and has unlimited variance (with
probability $1$);
\item the integral $\int_0^t W(s)\,ds$ is normally distributed with expected
value $0$ and variation $t^3/3$.
\end{enumerate}
All but the last properties are standard ones, see, e.g., \cite{kallenberg}.
To see why the last property holds, we first remark that $W(s)$ has expected value $0$, thus
by Fubini's theorem the integral has expected value zero as well. The
variance can be computed as follows:
$$\begin{array}{l}
\displaystyle E \big[\big(\!\!\int_0^t W(s)\,ds\big)^2\big] =
E \big[\int_0^t\!\! \int_0^t W(s)W(s')\,ds\,ds'\big] = {}\\[10pt]
\displaystyle{}=\int_0^t\!\!\int_0^t E\big[W(s)W(s')\big]\,ds\,ds' =
\int_0^t\!\!\int_0^t \min(s,s')\,ds\,ds' = t^3/3,
\end{array}
$$
as was claimed.

\subsection{Dense subsets}

\begin{scheme}\label{scheme:dense}
The participants are labeled by real numbers from the unit interval
$[0,1]$. The dealer chooses a Wiener process $W(t)$, and tells participant
$p\in[0,1]$ the share $W(p)$. Finally, she sets the secret to be
$\int_0^1W(t)\,dt$.
\end{scheme}
\noindent
This scheme realizes the {\it dense subsets of the unit interval}. Indeed,
$W(t)$ is continuous (with probability 1), thus knowing its value on a dense subset determines
the function everywhere, and then the participants can integrate the
function to determine the secret. If $F\subseteq[0,1]$ is {\it not} dense,
then there is a subinterval $[a,b]$ disjoint from $F$, we may assume that
$F$ is just the complement of this interval. Now the secret can be written
as the sum
$$
   \int_I W(t)\,dt = \int_{[a,b]} W(t)\,dt + \int_{I-[a,b]} W(t)\,dt
$$
Both integrals on the right hand side are normally distributed with variance
$(b-a)^3/3$ and $1/3-(b-a)^3/3$ respectively. The independent increments
property of the Wiener process tells us that these summands are independent,
thus members of $F$ know the secret only up to a normally distributed value
with positive variance which is independent of their shares.

\smallskip

Scheme \ref{scheme:dense} can be restricted to any dense subset of $[0,1]$,
in particular to the set of dyadic rationals in $(0,1)$, which, in turn, can
be identified with the nodes of the infinite binary tree $T$. A set $D$ of
the nodes is {\it dense in $T$} if every node has an extension in $D$, or
said otherwise, no spanned subtree of $T$ avoids $D$.

\begin{scheme}\label{scheme:countable-dense}
Participants are nodes of the infinite binary tree $T$ labeled by finite
$\{-1,+1\}$ sequences, including the empty sequence for the root. This
scheme realizes the dense subsets of $T$. The dealer chooses a Wiener
process $W(t)$, and sets the secret to be $\int_0^1 W(t)\,dt$. Participant
with label $\langle \varepsilon_1,\varepsilon_2,\dots,\varepsilon_k\rangle$ where $\varepsilon_i=\pm1$
receives the value of $W(t)$ at
$$
t=\frac12 + \frac12 \sum_{i=1}^k \frac{\varepsilon_i}{2^i} .
$$
\end{scheme}

\noindent
Both the secret and all shares are normally distributed values. Dense
subsets of the participants can recover the process $W(t)$, thus its
integral as well. Subsets missing a whole subtree miss a whole interval from
$[0,1]$, thus have limited information on the secret.

\subsection{Convergent sequences}

Rather than setting the secret to be the integral of the Wiener process, we
could set the secret to be simply $W(1)$. If participants receive $W(t)$
for other values of $t$, then a subset $A\subseteq[0,1)$ can recover the
secret if and only if $1$ is
in the closure of $A$. Indeed, $W(t)$ is continuous at $a$. Furthermore,
if $A$ is separated from $1$,
i.e., there is a whole interval between $A$ and $1$, then by the independent
increments property, $W(1)$ has an increment (a normally distributed value)
with variance equal to the length of that interval, which is {\it
independent} of the values known to members of $A$. Consequently $A$ has
only a limited information on the secret, and secret's value can be in any
interval with positive probability. Thus Scheme \ref{scheme:limit} below
realizes those subsets of $P$ which have $1$ in their closure:

\begin{scheme}\label{scheme:limit}
The set of participants is $P\subseteq [0,1)$ such that $1$ is in the
closure of $P$. The dealer chooses a Wiener process $W(t)$, sets the secret
to be $W(1)$ and tells participant $p\in P$ the value $W(p)$.
\end{scheme}
\noindent
If we choose $P=\{ 1-1/i: i\in\mathbb N^+\}$ then qualified subsets are
exactly the infinite subsets of $P$. Thus we got a scheme realizing
all infinite subsets of a countable set, see also \ref{scheme:stat1}.

\medskip

Schemes
in this section
can also be turned into a stronger scheme with ``up to a constant hiding''
property (\ref{eq:up-to-constant}) by setting the secret to be its
fractional part.

\section{Statistical methods}\label{sec:statistics}
Recovering the secret can be considered a statistical problem: participants
have values which are ``measurements'' and the are interested in an estimate
on the ``unknown parameter'' $s$. The simplest case is when shares are
``measurements'' of the secret up to an error term with standard normal
distribution.

\begin{scheme}\label{scheme:stat1}
The dealer chooses the secret $s\in N(0,1)$. The share of participant $i\in
P$ is
$s+\xi_i$ where the hiding value $\xi_i\in N(0,1)$ is chosen independently
from all other values.
\end{scheme}

\noindent
When $n$ participants put together their values, they have $n$ independent
measurements of the secret. In this case the best statistics, namely the
best estimate of the unknown value $s$ is the average of their values, see
\cite{kholevo:2001}. The {\em conditional distribution} of the secret
assuming their shares $h_i$ is normal with expected value $\bar h$ (sample
mean), and variance $1/n$. Thus finite subsets are unqualified: they have
limited information on the secret.

Infinite subsets, however, can determine $s$ with probability $1$: their
sample mean has expected value equal to the secret, and has variance zero,
thus is must be equal (with probability 1) to the secret.

Consequently, Scheme \ref{scheme:stat1} realizes all infinite subsets of any
(infinite) set $P$ of participants, with the same security guarantees as
did Scheme \ref{scheme:bounded2} or Scheme \ref{scheme:limit}. Those
schemes, however, worked only when $P$ was countably infinite.

\bigskip
In our second scheme each participant $i\in P$ has a publicly known {\em
obfuscating value $1\le r_i < 10$}.

\begin{scheme}\label{scheme:stat2}
The dealer chooses the secret $s\in N(0,1)$, and the obfuscating value
$\eta\in N(0,1)$. The share of participant $i\in P$ is $(s+r_i\cdot\eta +
\xi_i)$ with $\xi_i\in N(0,1)$, where all random variables ($s$, $\eta$, and
$\xi_i$) are chosen independently.
\end{scheme}

\noindent
Suppose $A\subseteq P$ is an infinite subset of participants whose
obfuscating values have the only limit point $r$. Then the sample mean of
their shares will be $s+r\cdot\eta$ (as the sample mean is normally
distributed with this expected value and zero variance). Consequently a
subset $A\subseteq P$ can determine the secret if the set of their
obfuscating values has at least two different limit points $r$ and $t$: they
can find out the numbers $r$, $t$, $a=(s+r\cdot\eta)$ and $b=(s+t\cdot\eta)$,
and then compute the secret as $(t\cdot a - r\cdot b)/(t-r)$.

It is also clear that if $A\subseteq P$ is {\em finite}, then the
conditional distribution of the secret, given the shares of $A$ is normal
with positive variance (in fact, the variance is at least $1/n$ when $A$ has
$n$ elements), thus finite subsets are {\em unqualified}.

The question is when $A\subseteq P$ is infinite and their obfuscating numbers
have a single limit value, when will $A$ be qualified? To answer this
question, let us look at the conditional distribution of the secret given
$n$ shares $h_1, \dots, h_n$ with obfuscating values $r_1,\dots,r_n$. As
$\eta$ and $\xi_i$ are independent standard normal,
$$
  \mathop{\hbox{\rm Prob}}\nolimits(s=x,\, \eta=y,\, s+r_i\eta+\xi_i=h_i) =
   \frac1{(\sqrt{2\pi})^{n+2}}\, e^{-x^2/2}\,e^{-y^2/2}\,\prod_{i=1}^n
        e^{-(h_i-x-r_i\cdot y)^2/2} .
$$
Thus the conditional density function of $s$ given the shares
$h_1,\dots,h_n$ is the integral of this function by $y$. Concentrating on
the exponent only,
\begin{eqnarray*}
 &&  x^2+y^2+\sum_{i=1}^n(h_i-x-r_i\cdot y)^2 = {}\\
 &=& x^2+(1+\tsum r_i^2)y^2 + 2y\tsum r_i(h_i-x) + \tsum(h_i-x)^2 =
 {}\\[5pt]
 &=& (1+\tsum r_i^2)(y+A)^2 - (1+\tsum r_i^2)A^2 + x^2 + \tsum(h_i-x)^2,
\end{eqnarray*}
where
$$
  A = \frac{\strut\tsum r_i(h_i-x)}{\rule{0pt}{3ex} 1+\tsum r_i^2}.
$$
When integrating, the value of the first term becomes a constant (its value
does not depend on $A$, thus on $x$), therefore the exponent of the density
function of the conditional distribution is
\begin{eqnarray*}
&& - (1+\tsum r_i^2)A^2 + x^2 + \tsum(h_i-x)^2 = {}\\[5pt]
&=& x^2\left(n+1-\frac{\strut \big(\sum r_i\big)^2}{\rule{0pt}{3ex} 1+\sum r_i^2}\right) + Bx + C
={}\\
&=& x^2\left(1+\frac{\strut 1+\sum(r_i-\bar r)^2}{\rule{0pt}{3ex}
  \bar r^2 + \frac1n\big(1+\sum(r_i-\bar r)^2\big) }\right) + Bx + C,
\end{eqnarray*}
where $\bar r$ is the average (mean) of the $r_i$'s, and $B$, $C$ are
expressions which do not depend on $x$. Consequently, the conditional
distribution of the secret, given the shares $h_i$, is normally distributed
with variance $\sigma^2$, where
\begin{equation}\label{eq:stat2}
\frac1{\sigma^2} = 1+\frac{\strut 1+\sum(r_i-\bar r)^2}{\rule{0pt}{3ex}
  \bar r^2 + \frac1n\big(1+\sum(r_i-\bar r)^2\big) }.
\end{equation}
If $A\subseteq P$ is infinite and the obfuscating numbers of $A$ has the single
limit $r$, then, again, the conditional distribution of the secret is
normally distributed, and the variance can be computed from equation
(\ref{eq:stat2}), but in this case the average $\bar r$ coincides with the
limit $r$. The subset $A$ can determine the secret if and only if the
variance $\sigma^2$ is zero. And this happens, if and only if
$$
    \sum_i (r_i-r)^2 = \infty .
$$
(Note that, by assumption, $r\ge 1$.) Thus $A\subseteq P$ with a single
limit $r$ is a) unqualified if $\sum (r_i-r)^2 < \infty$, and in this case the
conditional distribution of the secret is normal with a positive variance;
and b) $A$ is qualified if the sum $\sum (r_i-r)^2$ diverges.

\smallskip
\hfill$*$\hfill
\smallskip

Let $P$ be the set of lattice points in the positive quadrant, that is the
set of point with positive integer coordinates. A {\em ray} is a
half line starting from the origin. We consider only those rays which are in
the positive quadrant. The {\em angle} or {\em argument} of the lattice point
$p\in P$ is the angle between the ray going through $p$ and the
positive $x$ axis. All these angles are between $0$ and $\pi/2$.
A {\em strip of width $d$} is a subset
$S\subseteq P$ for which there is a ray lying in the first quadrant -- the
{\em direction} of the strip -- so that a lattice point is in $S$ if and
only if it is at distance at most $d/2$ from the ray. Strips with different
directions have only finitely many lattice points in common. Considering all
strips of width, say, 10, is the standard way to construct continuum many
infinite subsets of a countable set ($P$ in this case) so that any two of
them has finite intersection, see \cite{kunen1983set}.

\begin{scheme}\label{scheme:almost-disjoint}
The set $P$ of participants in this scheme is the set of lattice points of
the positive quadrant. The dealer chooses the secret $s\in N(0,1)$, and the
obfuscating value $\eta\in N(0,1)$. The share of participant $p$  with
angle $\varphi$ is $(s+(1+\varphi)\eta+\xi_p)$, where
$\xi_p\in N(0,1)$, and, as before, all random variables are chosen
independently.
\end{scheme}

\noindent
We claim first that every strip is unqualified. Indeed, let $\varphi$ be the
the angle of the direction of the strip $S$, and let $d>5$ be its width. For each
natural number $j>0$, there are at most $100d$ lattice points within the strip
with distance between $j$ and $j+1$ from the origin. Each of these lattice
points have angles between $\varphi-d/j$ and $\varphi+d/j$. Consequently the
obfuscating numbers of the lattice points in this strip have a single
limit value, namely $r=(1+\varphi)$, and
$$
   \sum_{p\in S} (r_p-r)^2 < \sum_{j>0} (100d)\cdot(d/j)^2 =
      100d^3 \sum_{j>0} \frac1{j^2} < +\infty.
$$
As has been shown previously, this means that $S$ is unqualified.

On the other hand, the union of any two strips with different directions is
qualified. Indeed, in this case the obfuscating numbers of the subset have
two different limit points, which is a sufficient condition for a subset to
be qualified.

Thus Scheme \ref{scheme:almost-disjoint} realizes an access structure over a
countable set of participants in which
there are continuum many unqualified
subsets such that the union of any two of them is qualified.

\section{Hilbert space program}\label{sec:hilbert}

Span programs, introduced by Karchmer and Wigderson in
\cite{spanprogram}, provide a general framework for defining and
investigating (finite) linear secret sharing schemes. Instead of random
variables span programs are defined on (finite dimensional) vector spaces.
Let $\mathbb V$ be such a vector space, and fix $u\in\mathbb V$ t as the
{\em goal vector}.
Every participant $p\in P$ is assigned a linear subspace $L_p\subseteq
\mathbb V$. A
collection of participants is qualified, if the linear span of their
subspaces contain the goal vector, and unqualified otherwise.

If $\mathbb V$ is finite, that is the underlying field $\mathbb F$ is finite,
then there is a
natural way to convert a span program into a secret sharing scheme. Choose
$r\in\mathbb V$ randomly with uniform distribution. The secret will be the
inner product $r\cdot u$. If $L_p$ is $k$-dimensional and is
spanned by $x_1,\dots,x_k$, then $p$'s share is the $k$-tuple
$\langle r\cdot x_1$, $\dots,$ $r\cdot x_k\rangle$. In this way qualified
subsets can recover the secret, and the shares of an unqualified subset give
no information on the secret: the $r\cdot u$ inner product can be any
element of $\mathbb F$ with the same probability.

A generalization of this notion to infinitely many participants is the {\em
Hilbert space program}

\begin{definition}\label{def:hilbert-space-program}
Let $H$ be a (real) Hilbert space, and fix $u\in H$ as the goal. In a {\em
Hilbert space program} each participant $p\in P$ is assigned a subspace
$L_p\subseteq H$. A collection of participants is qualified, if the goal
vector is in the closure of the linear span of their subspaces, and
unqualified otherwise.
\end{definition}

Just as in the case of span programs, every Hilbert space program can be
turned into a secret sharing scheme. The idea is that make $H$ a
Gaussian space \cite{janson1997gaussian}. Let $B$ be an orthonormal basis of
the Hilbert space $H$,
and choose the standard normal variables $\xi_e\in N(0,1)$ for each $e\in B$
independently. Every element $x\in H$ can be written uniquely as
$x =\sum\{\lambda_e(x) e \,:\,e\in B\}$, where $\lambda_e(x)$ is just the
inner product of $x$ and $e$. To the element $x$ associate the
random variable $\xi_x = \sum\{\lambda_e(x)\xi_e\}$. This will be a
centered Gaussian random variable with variance $\|x\|^2$.

Set the secret to be the value of $\xi_u$, the random variable assigned
to the goal $u\in H$. If
participant $p$ got the subspace $L_p$, then let $B_p\subseteq L_p$ a base
in it, and $p$'s share will be the values of $\xi_b$ for $b\in B_p$.
It is clear that qualified subsets can determine the secret. Indeed, they
can use the linear combination which produces the goal from their
vectors.
Next suppose $A\subseteq P$ is
unqualified. Let $L\subseteq H$ be the closure of the subspace spanned by
the family $\{L_p \,:\,p\in A\}$. Let $v$ be the orthogonal projection of $u$
into
$L$, and let $w=u-v$. As the goal is not in $L$, $w\not=0$.
Then $v$ and $w$ are orthogonal, and $u=v+w$. This
means that the secret $\xi_u$ is the sum of $\xi_v$ and $\xi_w$, and that $\xi_v$ and
$\xi_w$ are uncorrelated, thus independent. But $w$ is also orthogonal
to the whole
subspace $L$, thus $\xi_w$ is independent of all shares in $A$.
Consequently the conditional distribution of the secret, given all shares of
$A$, is normal with variance $\|w\|^2$, that is $A$ has that much uncertainty
about the secret's value.

\bigskip
Schemes \ref{scheme:gauss}, \ref{scheme:ell2}, \ref{scheme:dense},
\ref{scheme:countable-dense}, \ref{scheme:limit}, \ref{scheme:stat1}, and
\ref{scheme:stat2} are all instances of this general construction. For
example, in Scheme \ref{scheme:stat2} the Hilbert space is separable, i.e.,
it has a countable orthonormal base.
Each participant gets a
one-dimensional subspace. The coordinates of the goal and the vectors which
span these subspaces are
$$
\begin{array}{ccccccccc}
\mbox{goal:}~~ & 1 & 0   & 0 & 0 & 0 & 0 & 0 & \dots \\[3pt]
\hline
\mbox{shares:\rule{0pt}{3ex}}  & 1 & r_1 & 1 & 0 & 0 & 0 & 0 & \dots \\
            & 1 & r_2 & 0 & 1 & 0 & 0 & 0 & \dots \\
            & 1 & r_3 & 0 & 0 & 1 & 0 & 0 & \dots \\
            & 1 & r_4 & 0 & 0 & 0 & 1 & 0 & \dots \\
            & \hbox to 0pt{\dots\hss} &
\end{array}
$$
In formula (\ref{eq:stat2}) we actually computed the orthogonal
component of the goal to the subspace spanned by $n$ share
vectors.

\section{An esoteric scheme}\label{sec:esoteric}

In this section we present a scheme which can be best described
as one which defies our intuition what a probabilistic scheme should be.

As the full set of participants is always qualified, one might be tempted to
define the secret as a function of the collective set of shares assigned to
the participants. Everyone together should be able to determine the secret,
so why the dealer bothers with determining the secret separately rather than
computing it from the shares she assigned to the participants? Scheme
\ref{scheme:non-measurable-secret} shows that this approach might lead to
problems.

\begin{scheme}\label{scheme:non-measurable-secret}
Let us split the unit interval $[0,1)$ into countably many subsets $X_i$
indexed by the set of integers $\mathbb Z$ such that all $X_i$ has outer
measure $1$ and inner measure zero. Let moreover fix the positive
probabilities $p_j$ for $j\in\mathbb Z$ with $\sum_{j\in\mathbb Z} p_j=1$.
In this scheme there are two participants: $P=\{a,b\}$. Participant $a$
receives a uniform random real $r$ from the unit interval, and participant
$b$ receives the integer $j\in\mathbb Z$ with probability $p_j$. Finally the
dealer computes the secret $s\in\mathbb Z$ as follows: she finds the index
$i\in\mathbb Z$ for which $r\in X_i$, and then sets $s=i+j$.
\end{scheme}

\noindent
From the scheme it is clear that recovering the secret participant $a$ uses
only the index $i$ for which his number is in the set $X_i$. So why don't we
give him this index rather than the uniform random real $r$? The answer is
that this index $i$ {\it has no probability distribution}. In fact, in this
scheme the secret is {\it not a random variable}, thus the scheme is
not a probabilistic scheme at all!

\medskip
It is worth to remark that in examples \ref{scheme:ChorKush},
\ref{scheme:uniform-real}, \ref{scheme:weak-ramp}, and in others, the dealer
determined first some (or all) of the shares, and then using those values
computed the secret. What distinguishes those schemes from scheme
\ref{scheme:non-measurable-secret} is that the function determining the
secret from the shares is {\em measurable} is the former cases, and is {\em
not measurable} in the latter one.

\bibliographystyle{plain}

redpajama_set_name: RedPajamaArXiv


myViewBoard™, your digital whiteboard in the cloud - Duration: 2 minutes, 1 second.
Get started with myViewBoard™ - Duration: 2 minutes, 21 seconds.
myViewBoard AHA Moment - Writing & Drawing - Duration: 29 seconds.
myViewBoard AHA Moment - Undo/Redo - Duration: 29 seconds.
myViewBoard™ AHA Moment - Cleaning - Duration: 29 seconds.
myViewBoard™ AHA Moment - PC/Multimedia Display - Duration: 29 seconds.
myViewBoard™ AHA Moment - Recording - Duration: 32 seconds.
myViewBoard™ AHA Moment - Content Sharing from Mobile Devices - Duration: 29 seconds.
myViewBoard™ Meet - Duration: 2 minutes, 24 seconds.
myViewBoard™ Throw - Duration: 100 seconds.
Dynamic Lessons with Office 365 - Duration: 3 minutes, 41 seconds.
Dynamic Lessons with Browser Import - Duration: 3 minutes, 31 seconds.
PREPARE A GREAT LESSON - Duration: 5 minutes, 57 seconds.
Present the Lesson - Duration: 4 minutes, 2 seconds.
Participate in the Lesson - Duration: 3 minutes, 53 seconds.
Digital whiteboarding with enterprise-grade security: ViewBoard® IFP60 Series - Duration: 94 seconds.
Transform Learning with a Switch - ViewSonic ViewBoard S - Duration: 91 seconds.
ViewSonic ViewBoard® Cast (Android and Windows Versions) - Duration: 3 minutes, 11 seconds.
ViewBoard®_Air Class - Duration: 3 minutes, 42 seconds.
ViewSonic ViewBoard® Cast_Polish - Duration: 2 minutes, 40 seconds.
ViewSonic ViewBoard® Cast_Vietnamese - Duration: 2 minutes, 40 seconds.
ViewSonic ViewBoard® Cast_Turkish - Duration: 2 minutes, 40 seconds.
ViewSonic ViewBoard® Cast_Spanish - Duration: 2 minutes, 40 seconds.
ViewSonic ViewBoard® Cast_Russian - Duration: 2 minutes, 40 seconds.
Professional monitors for photo editing, video editing, and photography that help with color management via excellent color accuracy and color calibration functionality.
Color Breeds Creation, Create with ViewSonic VP Series Professional Monitors - Duration: 75 seconds.
What is HDR10? HDR Enhanced Image Quality on the ViewSonic VP3268-4K - Duration: 93 seconds.
What is USB Type-C? USB Type-C on ViewSonic VP2785-4K - Duration: 102 seconds.
ViewSonic VP2771 - Dual Color Engine - Duration: 94 seconds.
ViewSonic VP2771 - KVM Switch with USB Type-C's dual system control - Duration: 100 seconds.
ViewSonic VP2771 - Auto Eco Control - Duration: 74 seconds.
ViewSonic VP2468 - Auto Pivot Demo Video - Duration: 47 seconds.
The Best Thing About the ViewSonic VP3268-4K is the Color Calibration - Gemma Peanut's Review - Duration: 2 minutes, 34 seconds.
Why I Switched to ViewSonic Monitors for Editing - Jeremy Cowart - Duration: 79 seconds.
See how celebrity photographer Jeremy Cowart thinks of our VP monitors! - Duration: 5 minutes, 40 seconds.
I Absolutely Love the ViewSonic VP2785-4K - Mykii Liu's Review - Duration: 75 seconds.
What wedding photographer Fujiwara look for in wedding photography? Find out here! - Duration: 2 minutes, 45 seconds.
Introducing Lamp Free Smart Theater - ViewSonic X10-4K Short Throw LED Projector - Duration: 63 seconds.
Introducing Lamp Free Smart Theater- ViewSonic X10-4K Short Throw LED Projector - Duration: 63 seconds.
ViewSonic X10-4K Teaser - Lamp Free Smart Theater - Duration: 22 seconds.
M1 Portable Projector Teaser - iF Design Award 2018 - Duration: 19 seconds.
Express Yourself Anywhere You Go with M1 Portable Cinema - Duration: 59 seconds.
ViewSonic LS700HD Unboxing Video - Duration: 2 minutes, 19 seconds.
ViewSonic PX701HD Unboxing Video - Duration: 2 minutes, 22 seconds.
ViewSonic LS800 Series Laser Projectors: Flexibility Adapted to Your Vision - Duration: 92 seconds.
Product Video - ViewSonic M1 Portable Cinema - Duration: 64 seconds.
ViewSonic PX Beamer Serie - Duration: 31 seconds.
4K Ultra HD Projector ViewSonic PX747-4K - Upgrade Your Home Theater - Duration: 85 seconds.
ViewSonic vDisplay Manager: Screen Split - Duration: 100 seconds.
ViewSonic vDisplay Manager: Smart Backlight - Duration: 72 seconds.
ViewSonic vDisplay Manager: Auto Launch - Duration: 67 seconds.
ViewSonic VG Collection Dual Monitor Arm - Duration: 80 seconds.
ViewSonic unboxed: VG2448 Advanced Ergonomic Monitor - Duration: 3 minutes.
VG Collection Business Monitor: Adapted to Every Angle of Your Work - Duration: 106 seconds.
ViewSonic VG Collection Design Story - Duration: 89 seconds.
ViewSonic VG Collection: Your One Cable Solution With VG55 Series - Duration: 76 seconds.
ViewSonic Elite XG240R 144Hz RGB Gaming Monitor – Compete in Color - Duration: 32 seconds.
ViewSonic Elite XG240R – Cooler Master Teaser - Duration: 35 seconds.
Overwatch: How to Carry with DVa - ViewSonic Gaming x Lassiz - Duration: 17 minutes.
ViewSonic XG2402 144Hz Gaming Monitor - Your Turn to Shine - Duration: 11 seconds.
[Part 2] Epsilon CS:GO Challenge: Andrè 'Barbarr' Möller vs Owen 'Smooya' Butterfield - Duration: 110 seconds.
[Part 1] Epsilon CS:GO Challenge : Andrè 'Barbarr' Möller vs Owen 'Smooya' Butterfield - Duration: 90 seconds.
My Gaming adventure with ViewSonic : Owen 'Smooya' Butterfield - Duration: 2 minutes, 7 seconds.
Lassiz's Setup & How to Set Up 240Hz for Overwatch - Duration: 4 minutes, 37 seconds.
240Hz/144Hz/60Hz What's the Difference? - ViewSonic XG2530 - Duration: 2 minutes, 2 seconds.
RZR Infiltration's Guide to Street Fighter V - Advanced - Duration: 28 minutes.
XG2530 240Hz Esports Monitor Product Features - Duration: 76 seconds.
ViewSonic X MeTec 2016 – Chatting with a Taiwanese TV producer about VP monitors - Duration: 116 seconds.
ViewSonic X MeTec 2016 - Duration: 61 seconds.
A Modern Work of Art - ViewSonic VX76 Series - Duration: 2 minutes, 8 seconds.
XG01系列Full HD超高解析大尺寸遊戲顯示器,成為你的絕佳戰友 - Duration: 117 seconds.
The XG01 Series Gaming Monitors Have Arrived! - Duration: 118 seconds.
4K Ultra HD Gaming Monitor XG2700-4K by ViewSonic - Duration: 91 seconds.
ViewSonic VX57 Series Product Review TRADITIONAL CHINESE - Duration: 60 seconds.
ViewSonic VX57 Series Product Introduction - Duration: 60 seconds.
VP2780-4K Color Perfection Product Video - Duration: 2 minutes, 36 seconds.
Product Video_VX2475SMHL-4K (Traditional Chinese) - Duration: 91 seconds.
ViewSonic VX52 Series Product Review (Traditional Chinese) - Duration: 112 seconds.
ViewSonic Wants You! 我們在美商優派工作的日子 - Duration: 4 minutes, 43 seconds.
Meet the Talents at ViewSonic SSI Team 美商優派軟體整合事業處招募中! - Duration: 2 minutes, 12 seconds.
Learn about color management and color accuracy with Dr. Hue and ViewSonic VP Professional Monitors for photo editing, video editing, and photography.
How to Replicate the iPhone Display on Your Monitor - Color Pro Sessions Ep.1 - Duration: 9 minutes, 12 seconds.
5 Tips for Choosing the Perfect Monitor - Color Pro Sessions Ep.2 - Duration: 6 minutes, 40 seconds.


Dustin Johnson is surely going through a fantastic state lately – he has been the longest of hitters on PGA Tour with an average of 315.1 yards, owns 2nd best average & it seems that he is on his way to make big at Zurich Classic.
The # 7 golfer has so had a super successful 2015. He finished at 6th or better at 5 of 7 tours this year, including a triumph at Doral hosted WGC Championship last month. He must be looking ahead to keep up his heightened form alive in the upcoming Zurich Classic as well- which would be played at New Orleans.
Dustin took an off from PGA Tour in 2014 that led to rumors that the golfer had tested positive in drug test. But both the golfer & Tour denied such an allegation. He clarified that the break was needed for him to seek some professional help to help him in dealing with some personal challenges.
His layoff continued till February 2015 as he got back to compete at Farmers Insurance Open, having spent the winter out at sea on a Greek Yacht Charter.
Dustin missed out on the cut at the tournament yet apart from Honda Classic, he has been all charged up for the rest of tournaments so far. Initially, the golfer credited hard work & strong gym sessions for his turnaround. But later on he added that the reason might lie somewhere else.
The good news is that the golfer had his first child with fiancée Paulina in January this year which has naturally brought great joy & motivation in his life. The little one is called Tatum & Dustin is just captivated by the little bundle of joy in his house.


text:
PA Biol-58x BiologyTextbook
Histocompatibility Molecules
Index to this page
Class I Histocompatibility Molecules
Class II Histocompatibility Molecules
The CD8+ T Cell/Class I Interaction
The CD4+ T Cell/Class II Interaction
Histocompatibility molecules are glycoproteins expressed at the surface of almost all vertebrate cells. They get their name because they are responsible for the compatibility — or rather the lack of it — of the tissues of genetically different individuals. Monozygotic ("identical") human twins have the same histocompatibility molecules on their cells, and they can accept transplants of tissue from each other. The rest of us have a set of histocompatibility molecules that is probably unique to us. A graft of our tissue into another human will provoke an immune response which, if left unchecked, will end in the rejection of the transplant. So the histocompatibility molecules of one individual act as antigens when introduced into a different individual. In fact, the histocompatibility molecules are often called histocompatibility antigens or transplantation antigens.
Link to discussion of transplant rejection.
The most rapid and severe rejection of foreign tissue occurs when there is a failure to properly match the donor and recipient for the major histocompatibility molecules. There are two categories: class I and class II.
Class I molecules consist of two polypeptide chains, a long one (on the left) of 346 amino acids — it is called the heavy chain — and a short one (on the right) of 99 amino acids.
The heavy chain consists of 5 main regions or domains:
three extracellular domains, designated here as N (includes the N terminal), C1, and C2;
a transmembrane domain where the polypeptide chain passes through the plasma membrane of the cell;
a cytoplasmic domain (with the C terminal) within the cytoplasm of the cell.
To the right is the protein molecule called beta-2 microglobulin ("β2M"). It is not attached to the heavy chain by any covalent bonds, but rather by a number of noncovalent interactions.
The dark bars represent disulfide (S-S) bridges linking portions of each domain (except the N domain). However, the bonds in S-S bridges are no longer than any other covalent bond, so if this molecule could be viewed in its actual tertiary (3D) configuration, we would find that the portions of the polypeptide chains containing the linked Cys are actually close together.
The outermost domains ("N" and "C1") contain two segments of alpha helix that form two ridges with a groove between them. A small molecule (e.g., a short peptide) is attached noncovalently in the groove between the two alpha helices, rather like a hot dog in a bun (not shown here, but look below).
You can also link to a color model (92K) showing these features. But note that the terminology for the domains is different in this model: N = α1, C1 = α2, C2 = α 3
The two objects on the left of the image that look like candelabra represent the short, branched chains of sugars in this glycoprotein.
The regions marked "Papain" represent the places on the heavy chain that are attacked by the proteinase papain (and made it possible to release the extracellular domains from the plasma membrane for easier analysis).
This image (courtesy of T.J. Kindt and J. E. Coligan) represents the structure of a class I histocompatibility molecule, called H-2K. Almost all the cells of an animal's body (in this case, a mouse) have thousands of these molecules present in their plasma membrane. These molecules provide tissue identity and serve as major targets in the rejection of transplanted tissue and organs. But tissue rejection is not their natural function. Class I molecules serve to display antigens on the surface of the cell so that they can be "recognized" by T cells.
Humans synthesize three different types of class I molecules designated HLA-A, HLA-B, and HLA-C. (HLA stands for human leukocyte antigen; because the molecules were first studied on leukocytes). These differ only in their heavy chain, all sharing the same type of beta-2 microglobulin. The genes encoding the different heavy chains are clustered on chromosome 6 in the major histocompatibility complex (MHC).
Link to a discussion of the MHC of humans.
We inherit a gene for each of the three types of heavy chain from each parent so it is possible, in fact common, to express two allelic versions of each type. Thus a person heterozygous for HLA-A, HLA-B, and HLA-C expresses six different class I proteins. These are synthesized and displayed by most of the cells of the body (except those of the central nervous system).
Histocompatibility molecules present antigens to T cells
Although histocompatibility molecules were discovered because of the crucial role they play in graft rejection, clearly evolution did not give vertebrates these molecules for that function. So what is their normal function? The answer: to display antigens so that they can be "seen" by T lymphocytes.
The antigen receptor on T lymphocytes (or T cells, as they are commonly called) "sees" an epitope that is a mosaic of the small molecule in the groove and portions of the alpha helices flanking it.
Discussion of antigen presentation to T cells.
The small molecules ("hot dogs") are enormously diverse. They probably represent fragments derived from all the proteins present within the cell. These would include:
fragments of normal cell constituents (These do not normally elicit an immune response.)
fragments of proteins encoded by intracellular parasites (like viruses);
fragments of proteins encoded by mutated genes in cancer cells. [Example]
Human class II molecules are designated HLA-D, and the genes encoding them are also located in the major histocompatibility complex (MHC). Class II molecules consist of two transmembrane polypeptides. These interact to form a groove at their outer end which, like class I molecules, always contains a fragment of antigen. But the fragments bound to class II molecules are derived from antigens that the cell has taken in from its surroundings. Extracellular molecules are engulfed by endocytosis. The endosomes fuse with lysosomes and their contents are partially digested. The resulting fragments are placed in class II molecules and returned to the cell surface.
See Antigen Presentation for more details
Class II molecules, in contrast to class I, are normally expressed on only certain types of cells. These are cells like macrophages and B lymphocytes that specialize in processing and presenting extracellular antigens to T lymphocytes. Thus antigen presentation by class II molecules differs from that by class I in two important ways:
All cells can present antigens with class I molecules, whereas only certain cells can do so with class II.
The antigen fragments (hot dogs) displayed in class I molecules are generated from macromolecules synthesized within the cell, whereas those displayed in class II molecules have usually been acquired from outside the cell.
Class I and class II molecules present antigen fragments to different subsets of T cells.
Most of the T cells of the body belong to one of two distinct subsets: CD4+ or CD8+. CD4 and CD8 are surface glycoproteins. Both CD4+ and CD8+ T cells have an antigen receptor (TCR) that "sees" a complex hot-dog-in-bun epitope.
The CD8 molecules on CD8+ T cells bind to a site found only on class I histocompatibility molecules (shown here as a gray hemisphere).
The CD4 molecules on CD4+ T cells bind to a site found only on class II histocompatibility molecules (shown below as a yellow triangle).
(However, neither type can be activated by simply binding its complementary epitope. Additional molecular interactions must take place. [Link])
Because of the need for CD8 to bind to a receptor site found only on class I histocompatibility molecules, CD8+ T cells are only able to respond to antigens presented by class I molecules. Most CD8+ T cells are cytotoxic T cells (CTLs). They contain the machinery for destroying cells whose class I epitope they recognize.
Every time you get a viral infection, say influenza (flu), the virus invades certain cells of your body. Once inside, the virus subverts the metabolism of the cell to make more virus. This involves synthesizing molecules encoded by the viral genome. In due course, these are assembled into a fresh crop of virus particles that leave the cell (often killing it in the process) and spread to new cells.
Except while in transit from their old home to their new, the virus works inside cells safe from any antibodies. But early in their intracellular life, infected cells display fragments of the viral proteins being synthesized in the cytoplasm in their surface class I molecules.
Any cytotoxic T cells specific for that antigen will bind to the infected cell and often will be able to destroy it before it can release a fresh crop of virus.
The bottom line: the function of the body's CD8+ T cells is to monitor all the cells of the body ready to destroy any that express foreign antigen fragments in their class I molecules.
Further details of how infected cells present viral antigens to CD8+ T cells
The CD4 molecules expressed on the surface of CD4+ T cells enable them to bind to cells presenting antigen fragments in class II molecules but not in class I. Only certain types of cells, those specialized for taking up antigen from extracellular fluids, express class II molecules. Among the most important of these are
dendritic cells
macrophages (phagocytic cells that develop from monocytes that have migrated from the blood to the tissues) and
B lymphocytes ("B cells") that take up exogenous antigen by receptor-mediated endocytosis.
Further discussion with graphic.
So CD4+ T cells see antigen derived from extracellular fluids and processed by specialized antigen-presenting cells.
To respond to an antigen, a CD4+ T cell must
have a T cell receptor (TCR) able to recognize (bind to) a complex epitope comprising an antigenic fragment displayed by a class II molecule;
bind a site on the class II molecule (shown above as a yellow triangle) with its CD4
bind to costimulatory molecules on the antigen-presenting cell. [view the Immunological Synapse]
If these conditions are met, the T cell becomes activated.
Activated T cells
enter the cell cycle leading to the growth of a clone of identical T cells
begin to secrete lymphokines
Lymphokines
activate and recruit other cells (e.g., mast cells) to the region producing inflammation (e.g., to cope with a bacterial infection);
activate B cells enabling them to develop into a clone of antibody-secreting cells. The CD4+ T cells that activate B cells are called Helper T cells [View].
Discussion of Helper T cells
Welcome&Next Search
This book is based on Kimball's Biology by John Kimball

redpajama_set_name: RedPajamaCommonCrawl


text:
FIND LOVE NOW ♥ Call 1300 292 899
Cross-Cultural Matchmakers
About Katherine Wei
Katherine's Welcome to You
Happy Stories
Katherine's Coaching
Singles News
Contact AJ International Pty Ltd
1. We respect your privacy
1.1. Contact AJ International Pty Ltd respects your right to privacy and is committed to safeguarding the privacy of our customers and website visitors. We adhere to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth). This policy sets out how we collect and treat your personal information.
1.2 "Personal information" is information we hold which is identifiable as being about you.
2.1. Contact AJ International Pty Ltd will, from time to time, receive and store personal information you enter onto our website, provided to us directly or given to us in other forms.
2.2. You may provide basic information such as your name, phone number, address and email address to enable us to send information, provide updates and process your product or service order. We may collect additional information at other times, including but not limited to, when you provide feedback, when you provide information about your personal or business affairs, change your content or email preference, respond to surveys and/or promotions, provide financial or credit card information, or communicate with our customer support.
2.3. Additionally, we may also collect any other information you provide while interacting with us.
3. How we collect your personal information
3.1. Contact AJ International Pty Ltd collects personal information from you in a variety of ways, including when you interact with us electronically or in person, when you access our website and when we provide our services to you. We may receive personal information from third parties. If we do, we will protect it as set out in this Privacy Policy.
4. Use of your personal information
4.1. Contact AJ International Pty Ltd may use personal information collected from you to provide you with information, updates and our services. We may also make you aware of new and additional products, services and opportunities available to you. We may use your personal information to improve our products and services and better understand your needs.
4.2. Contact AJ International Pty Ltd may contact you by a variety of measures including, but not limited to telephone, email, sms or mail.
5. Disclosure of your personal information
5.1. We may disclose your personal information to any of our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes set out in this Policy. Personal information is only supplied to a third party when it is required for the delivery of our services.
5.2. We may from time to time need to disclose personal information to comply with a legal requirement, such as a law, regulation, court order, subpoena, warrant, in the course of a legal proceeding or in response to a law enforcement agency request.
5.3. We may also use your personal information to protect the copyright, trademarks, legal rights, property or safety of Contact AJ International Pty Ltd, contactaj.com.au, its customers or third parties.
5.4. Information that we collect may from time to time be stored, processed in or transferred between parties located in countries outside of Australia.
5.5. If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality. We would seek to only disclose information in good faith and where required by any of the above circumstances.
5.6. By providing us with personal information, you consent to the terms of this Privacy Policy and the types of disclosure covered by this Policy. Where we disclose your personal information to third parties, we will request that the third party follow this Policy regarding handling your personal information.
6.1. Contact AJ International Pty Ltd is committed to ensuring that the information you provide to us is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.
6.2. The transmission and exchange of information is carried out at your own risk. We cannot guarantee the security of any information that you transmit to us, or receive from us. Although we take measures to safeguard against unauthorised disclosures of information, we cannot assure you that personal information that we collect will not be disclosed in a manner that is inconsistent with this Privacy Policy.
7. Access to your personal information
7.1. You may request details of personal information that we hold about you in accordance with the provisions of the Privacy Act 1988 (Cth). A small administrative fee may be payable for the provision of information. If you would like a copy of the information which we hold about you or believe that any information we hold on you is inaccurate, out of date, incomplete, irrelevant or misleading, please email us at kwei@contactaj.com.au.
7.2. We reserve the right to refuse to provide you with information that we hold about you, in certain circumstances set out in the Privacy Act.
8. Complaints about privacy
8.1. If you have any complaints about our privacy practices, please feel free to send in details of your complaints to Level 13, 276 Pitt street, Sydney, NSW 2000, Australia. We take complaints very seriously and will respond shortly after receiving written notice of your complaint.
9. Changes to Privacy Policy
9.1. Please be aware that we may change this Privacy Policy in the future. We may modify this Policy at any time, in our sole discretion and all modifications will be effective immediately upon our posting of the modifications on our website or notice board. Please check back from time to time to review our Privacy Policy.
10. Website
10.1. When you visit our website
When you come to our website (contactaj.com.au) we may collect certain information such as browser type, operating system, website visited immediately before coming to our site, etc. This information is used in an aggregated manner to analyse how people use our site, such that we can improve our service. We use Google Analytics and its cookies allow web analytics services to recognise your browser or device and, for example, identify whether you have visited our website before, what you have previously viewed or clicked on, and how you found us. The information is anonymous and only used for statistical purposes, and it helps us to analyse patterns of user activity and to develop a better user experience. For more information about Google Analytics, visit this page.
10.2. Cookies
We may from time to time use cookies on our website. Cookies are very small files which a website uses to identify you when you come back to the site and to store details about your use of the site. Cookies are not malicious programs that access or damage your computer. Most web browsers automatically accept cookies but you can choose to reject cookies by changing your browser settings. However, this may prevent you from taking full advantage of our website.
10.3. Our website may from time to time use cookies to analyses website traffic and help us provide a better website visitor experience. In addition, cookies may be used to serve relevant ads to website visitors through third party services such as Google Adwords. These ads may appear on this website or other websites you visit.
10.4. Third party sites
Our site may from time to time have links to other websites not owned or controlled by us. These links are meant for your convenience only. Links to third party websites do not constitute sponsorship or endorsement or approval of these websites. Please be aware that Contact AJ International Pty Ltd is not responsible for the privacy practises of other such websites. We encourage our users to be aware, when they leave our website, to read the privacy statements of each and every website that collects personal identifiable information.
Australia's #1 Cross-Cultural Matchmakers. Interracial dating agency, relationship coaching for Asian and Australian singles seeking love.
Join us on Wechat
Sydney Head Office
Privacy Policy | ©2018 Contact AJ International
Brisbane Enquiry
Best Time to Call You
Your Gender (required)
Your Age (required)
Your Suburb in Brisbane (required)
Marital Status (required)
Your Occupation (required)
Country of Origin (required)
Please Attach Your Photo (optional)
Types of Partner You are Looking for
If you have spoken with AJ consultant before, who was the consultant?
How did you find us?(required)
Facebook WeChat Google Search YoutTube Newspaper Friend Other
I'm a man woman
Your State (required)
NSW QLD VIC SA WA NT ACT China Asia
Self Introduction (required)
Please Attach Your Photo(optional)
Types of Partner You are Looking for (required)
Facebook WeChat Google Search YouTube Newspaper Friend Other
Melbourne Enquiry
Your Suburb in Melbourne (required)
NSW QLD VIC SA WA NT ACT