  In this paper, we study a security problem of protecting secrets in
distributed systems. Specifically, we employ discrete-event systems to describe
the structure and behaviour of distributed systems, in which global secret
information is separated into pieces and stored in local component agents. The
goal is to prevent such secrets from being exposed to intruders by imposing
appropriate protection measures. This problem is formulated as to ensure that
at least one piece of every distributed global secret is secured by a required
number of protections, while the overall cost to apply protections is minimum.
We first characterize the solvability of this security problem by providing a
necessary and sufficient condition, and then develop an algorithm to compute a
solution based on the supervisory control theory of discrete-event systems.
Finally, we illustrate the effectiveness of our solution with an example system
comprising distributed databases.
