• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    An attribute-based encryption method comprising executing a CP-ABE type encryption algorithm associated with an access policy described by an access structure organized in the form of a tree, the encryption of a message M by said algorithm requiring, for each non-leaf node (a) of the tree, the random generation of a main polynomial (qa (x)) and at least one product computation between the main polynomial (qa (x) )) taken at least one point (qa (i)) and at least one element of a cyclic group (Q, P, H (j)), said method comprising: - in a previous step, the pre-calculation of the generated between a plurality of randomly generated integers (ri) and at least one element of a cyclic group (Q, P, H (j)) and saving the pre-calculation results in a memory (L), - for encrypting the message M, accessing the pre-calculation results stored in the memory (L) and using them to perform at least one calculation (204,205, 209,210) between the main polynomial taken at at least one point (qa (i)) and at least one element of a cyclic group (Q, P, H (j)).
    公开号:FR3043292A1
    申请号:FR1560508
    申请日:2015-11-03
    公开日:2017-05-05
    发明作者:Nouha Oualha；Christophe Janneteau
    申请人:Commissariat a lEnergie Atomique CEA；Commissariat a lEnergie Atomique et aux Energies Alternatives CEA；
    IPC主号:
    专利说明:

    The invention relates to the field of data protection, and in particular the field of security in computer networks or telecommunications networks with low resources. Low-resource networks consist of devices with low computing, memory, and power capabilities. Examples of low-resource networks are emerging networks with machine-to-machine communications, the Internet of Things, wireless sensor networks, and vehicular networks. The invention can also be applied to other devices constrained in resources such as for example smart cards. The invention relates more specifically to the problem of securing the exchange of data within a network and relates to an attribute-based encryption method comprising a pre-calculation phase making it possible to accelerate the execution of the an encryption algorithm which is, in most cases, highly consuming computing resources.
    One of the key points to ensure the security of computer applications is the protection of sensitive data. The data can be protected using cryptographic data encryption algorithms, requiring cryptographic keys to decrypt the data. Keys must be distributed to authorized users to decrypt the data. To selectively manage different types of users who perform different tasks on the data, a fine and flexible data access control is required. A recent and promising approach, called attribute-based encryption (ABE), provides both data confidentiality and data access control by cryptographically combining decryption keys to data access permissions. The data thus encrypted do not need to be transmitted on a secure channel or to be stored in a trusted server. To decrypt encrypted data, users must now satisfy an access policy that is set to attributes that can be associated with data users, data elements, and the environment. For example, an attribute may relate to the role of a user, for example his profession, or the user's personal characteristics, for example his function or a priority level assigned to him for data access. sensitive.
    The publication by Bethencourt et al. [1] describes a particular attribute-based encryption method, referred to as the Ciphertext-Policy Attribute-Based Encryption CP-ABE.
    This method is a construction of an attribute-based encryption method that has the access policy embedded in the encrypted data and attributes owned by the data users. In this way, if the access policy changes regularly, access control is more flexible than the basic ABE schema, since it is only necessary to change the access policy that will be incorporated into the encrypted data, rather than to distribute new keys to users. The attribute-based approach to encryption has matured and can be used as a functional module to build an application system. In addition to the Bethencourt et al. Schema, several ABE based cryptographic constructs have recently been proposed. While these constructs provide a secure way to link privacy and data access control, they are not designed to be energy efficient. They use costly group and bilinear mapping operations as well as multiplication operations on very large numbers, especially during data encryption, the computational complexity of which increases with the number of attributes considered in the access policy. The cost of calculation is one of the main obstacles to the adoption of this encryption technique in some applications using devices that are highly limited in terms of computing resources and energy.
    There is thus a technical problem to find solutions allowing the execution of attribute-based encryption algorithms, in particular algorithms of the CP-ABE type or derived from this algorithm, on devices with limited resources.
    To overcome this problem, some work has been undertaken to adapt the ABE-based data encryption algorithm to resource-constrained devices, particularly in research works. A solution presented in [2] proposes to delegate the expensive operations of the encryption algorithm to a set of trusted servers available to make the necessary calculations on behalf of a constrained device. The proposed solution requires the presence and availability of a significant number of trusted servers to perform calculations, online, interactive, and synchronous exchanges with its servers, as well as additional data allowing the sharing of calculation and management of data. servers, which limits the gain in terms of performance.
    In general, the solutions that have been proposed to reduce the cost of expensive cryptographic calculations rely, for the most part, on the collaboration between several parties to share the burden and the cost of the calculations. Approaches requiring the availability of a sufficient number of computing servers to limit the risks of collusion between "curious" servers (insecure servers), have been applied to several security protocols and cryptosystems, for example , the D-HIP key establishment protocol described in European Patent Application Publication No. EP2832034A1, and the attribute-based encryption algorithm described in [2]. Furthermore, the French patent application filed under No. 1556679 describes a method in which a single server is requested to perform the delegated calculation in a secure manner. The approach involves, however, an interactive exchange with the server in question.
    Ateniese and others, in [3], opted for a different approach. Without resorting to third parties, the computationally constrained device stores in memory pre-computed value pairs that are subsequently used in the cryptographic system. In exchange for a little more memory space (about 10 KB more), Ateniese and others have shown that the performance of the Ellipses Curve Digital Signature Algorithm (ECDSA) based digital signature algorithm ) increases by approximately 50% compared to the base signature that does not use pre-calculation. The work of Ateniese and others was based on pre-calculation techniques described by Boyko et al. In [4]. These techniques make it possible to reduce the number of computations to be performed in order to calculate a random pair of values in the form (x , gx mod p) or (x, xe mod N) generated from pairs of pre-calculated values, using random paths on Cayley graphs with an expansion rate ε> 0 in abelian groups. These techniques have been extended to work on elliptic curves in [5].
    The solution proposed by Ateniese et al. Can not, however, be used for an encryption algorithm based on CP-ABE type attributes since the latter uses not only random values but mainly polynomials defined by a fixed point. other randomly chosen points.
    Bianchi et al. [6] proposes to cache keys that will be used in attribute-based encryption for previously known data access policies. Their approach exploits solar energy capture technologies to perform expensive computing operations. By using real-world simulation and implementation results on sensors, Bianchi et al. Demonstrates that caching computational algorithm calculations can yield significant performance gains (ie. less energy consumed and time of execution). However, data access control is less flexible than the original attribute-based encryption algorithm, since their approach requires that the access policy be predefined in advance to perform the pre-calculations.
    None of the above teachings proposes a solution that makes it possible to accelerate the execution of an encryption method based on attributes of the CP-ABE type. The invention responds to this problem by proposing a solution based on a pre-calculation phase that does not require exchanges with trusted servers and that significantly reduces the cost of calculating CP-based data encryption. -ABE. The invention utilizes a prephase stage in which values are pre-computed to expedite the execution of an attribute-based encryption algorithm. The preparation phase can be carried out offline either by a trusted third party and subsequently installed in the device constrained in resources when it is put into service, or online by the device itself (for example when a surplus of energy resources). The second phase of the invention makes it possible to generate the terms of the encrypted data using only modular multiplications and additions in a group of points of an elliptic curve, whose number is a function of a parameter k. The invention can be used in attribute-based data encryption by a CP-ABE type algorithm. Calculation operations requiring modular exponentiations and scalar multiplications in a group of points are replaced by operations of calculating modular multiplications and additions in a group of points, which considerably reduces the cost and complexity of the data encryption algorithm, as well as the execution time of the algorithm compared to a traditional implementation. The invention thus relates to a method, implemented by computer, of encryption based on the attributes comprising the execution of an encryption algorithm of the CP-ABE or CP-ABE derived type, associated with an access policy described. by an access structure organized in the form of a tree, the encryption of a message M by said algorithm requiring, for each non-leaf node a of the tree, the random generation of a main polynomial qa (x ) and at least one product calculation between the main polynomial qa (x) taken at at least one point qa (i) and at least one element of a cyclic group, said method comprising: - in a previous step, the calculating the product between a plurality of randomly generated integers n and at least one element of a cyclic group and saving the pre-calculation results in a memory, - for encrypting the message M, accessing the pre-calculation results calculated saved in the memory and their use for performing at least one product calculation between the main polynomial taken in at least one point qa (i) and at least one element of a cyclic group.
    According to a particular aspect, the method according to the invention comprises in the preceding step, the random generation of a first number n of integers η and the pre-calculation of the products between each integer number η and at least one element of a cyclic group and, for encrypting the message M, using a second number k, less than n, of randomly selected pre-calculation results to perform at least one product calculation between the main polynomial qa (x ) taken at least one point qa (i) and at least one element of a cyclic group.
    According to a particular aspect, the method according to the invention comprises for encrypting the message M, for the root node of the tree, calculating the sum of pre-calculation results to determine the product between a random integer value and said at least one element of a cyclic group.
    According to a particular aspect, the method according to the invention comprises for encrypting the message M, for each non-leaf node, for each coefficient of a secondary polynomial r (x) connected to the main polynomial by a dependency relation of the type qa (x ) = r (x) .x + qa (0), calculating the sum of pre-calculation results to determine an intermediate result equal to the product between said coefficient and said at least one element of a cyclic group.
    According to a particular aspect, the method according to the invention comprises for encrypting the message M, for each non-leaf node, for each child node of said non-leaf node indexed by an index i, an intermediate evaluation of the product between on the one hand the product r (i) .i and on the other hand said at least one element of a cyclic group from a weighted sum of said intermediate results calculated on the set of coefficients of the secondary polynomial r (x).
    According to a particular aspect, the method according to the invention comprises for encrypting the message M, for each non-leaf node, for each child node of said non-leaf node, evaluating the product between the main polynomial qa (x) taken in at least a point qa (i) varying on the indices of the child nodes of the non-leaf node and the said at least one element of a cyclic group from the intermediate evaluation and the prior evaluation of the product between the main polynomial qparent (x ) associated with the parent node of said non-leaf node taken at the point corresponding to the index of said non-leaf node within the children of said parent node, and said at least one element of a cyclic group.
    According to one particular aspect of the invention, the evaluation of the product between the main polynomial qa (x) taken in at least one point qa (i) varying on the indices of the child nodes of the non-leaf node and the said at least one element of a cyclic group is performed recursively by traversing the tree from its root node to its leaf nodes.
    According to a particular aspect, the method according to the invention comprises in the preceding step, the generation of a third number n 'of integers r', and the pre-calculation of n 'products and, to encrypt the message M, the use, in addition, of an additional pre-calculation result among the n 'products.
    According to a particular aspect of the invention, the randomly generated integers correspond to the values qa (i) of said main polynomial taken in a plurality of points i and the pre-calculation performed in the prior step includes the product between on the one hand the product qa (i) .i and on the other hand at least one element of a cyclic group.
    According to a particular aspect, the method according to the invention comprises for encrypting the message M, for each non-leaf node, for each child node of said non-leaf node, evaluating the product between the main polynomial qa (x) taken in at least a point qa (i) varying on the indices of the child nodes of the non-leaf node and said at least one element of a cyclic group from the sum of at least a part of the pre-calculation results.
    According to a particular aspect of the invention, said at least one element of a cyclic group is chosen from a point of an elliptic curve, the product of a point of an elliptic curve with an integer, the result of the applying a hash function to a value representing an attribute associated with a leaf node of the tree. The invention also relates to an encryption device comprising means, including a processor, configured to execute the encryption method according to the invention and at least one memory in which are stored the pre-calculation results of the previous step of said method. The invention also relates to a computer program product downloadable from a communication network and / or stored on a computer readable medium comprising program code instructions for executing the encryption method according to the invention, when the program is executed by a processor. The invention also relates to a processor-readable recording medium on which is recorded a program comprising program code instructions for executing the encryption method according to the invention, when the program is executed by a processor. Other features and advantages of the present invention will appear better on reading the description which follows in relation to the appended drawings which represent: FIG. 1, a flowchart illustrating the implementation of a CP-ABE encryption algorithm according to FIG. 2 is a flowchart illustrating the implementation of a modified CP-ABE type encryption algorithm according to the invention; FIG. 3 is a flowchart detailing a preliminary phase of preparation of the method; according to the invention, - Figure 4, a flowchart detailing a first routine used by the invention, - Figure 5, a flowchart detailing a second routine used by the invention, - Figure 6, a diagram. an encryption device according to the invention.
    The invention is now described in an exemplary embodiment applied to the CP-ABE algorithm known to those skilled in the art and described in reference [1]. Without departing from the scope of the invention, it also applies to derived or extended algorithms from the basic CP-ABE algorithm. Without being exhaustive, the invention can in particular also apply to the algorithms described in references [7], [8], [9] and [10] which relate to extensions of the basic CP-ABE algorithm.
    Figure 1 illustrates a possible implementation of the known CP-ABE algorithm. The access structure of the CP-ABE algorithm is constructed for each data or encrypted message, and the set of descriptive attributes are associated with the users and their private keys. If the user has the attributes that satisfy the access structure of an encrypted data, he can decrypt it. The algorithm considers three actors: the sender, the receiver, and the authority. The role of the latter is to generate the public parameters and keys, as well as the private keys of the receivers. The algorithm comprises five algorithms. The invention applies to the data encryption algorithm, which is described in the following paragraph in its state-of-the-art version [1]. The CP-ABE algorithm comprises a configuration phase in which the authority generates several parameters of the algorithm. In particular, the authority fixes a point P of an elliptic curve which makes it possible to generate a cyclic additive group Gi of order p, it also defines a cyclic multiplicative group G2 of the same order p, a bilinear mapping function ee: Gt x Gt -> G2, and a hash function H: {0,1} * -> i ^ which makes it possible to match an attribute to an element of the group Gt. The authority chooses two random values aei β in the set lp integers modulo p and creates the public key PK = (q = β.Ρ, T =. P, g = eP, Pa which is made public, and the secret key MK = β aP which is kept secret. then comprises an encryption phase, for each message M to be encrypted, this phase being described in detail in FIG.
    In order to encrypt a message M with an access structure Γ, the access structure Γ is represented in the form of a tree whose internal nodes correspond to threshold gates or "threshold gate" in English and the leaf nodes of the 'tree are associated with attributes. A threshold gate has for parameters (ka, na) and performs a conditional function of the form "k conditions performed on na conditions in total". An internal non-leaf node associated with a parameter threshold gate (ka, na) is thus connected to na child nodes. The attributes relate to the role of the user (the recipient of the encrypted data), the characteristics of the user, the content of the encrypted data, and the environment. By the tree structure, the access policy of the encryption algorithm defines conditions to respect on the attributes associated with leaf nodes of the tree. Conditions are defined by non-leaf nodes as threshold gates. In particular, two functions are defined in the tree: the parent function (a) which designates the parent node of the node a, and the index function (a) which designates the index associated with the node a with respect to the other nodes of the same parent node .
    Each node in the tree (even the leaf nodes) is associated with a polynomial qra (.), Of order (ka- 1), such that qra (0) = qparenm (index (a), ka being a parameter of the threshold gate of node A. The other points of the polynomial are randomly selected For the root node R, the polynomial qR () is defined such that qR (0) = s, where s is a random value of Ίν selected by the cipherer / sender, and the other points of the polynomial are randomly selected.The computation of the polynomials is done according to a descending approach in the tree (from the root node to the leaf nodes).
    FIG. 1 details the path of the tree starting from the root node R. In a first step 101, one fixes qR (0) = s, then one calculates 102 the first terms of the encrypted message C = M.gs, C = sQ The other random points of the polynomial qR () of degree kR-1 are then generated. The tree is then traversed in the downward direction starting with fixing the current node equal to the root node R. If the tree is not completely traversed, the current node a is fixed at a new node and then determined Qra (0) = qpa.rent (a) (index (a)) from the polynomial qparentO generated at the previous recursion. The other random points of the polynomial qa () of degree ka-1 are generated. If a is a leaf node of the tree then we calculate 108 the following elements of the encrypted message Ca = qa (0) .P, C'a = qa (0) .H (att (a)), otherwise we continue the traversing the tree recursively to a new node. At the end of the processing of the tree, the sender generates the encrypted data as: CT = (r, C = M.gs, C = sQ, Vy e Y · Cy = qyO.P, C'y = qyO.Hatty, with att (a) a function that returns the value of the attribute that is associated with the leaf node a in the access tree and Y is the set of leaf nodes of the tree. CP-ABE Encryption Enables Flexible Data Access Control, but Its Computational Cost and Complexity Make it Difficult to Implement in Resource-Constrained Devices The Most Expensive Computing Operations concern in particular the calculation of the terms Cy and C'y which depend on the access policy associated with the data, the number of which increases with the number of attributes in the access tree, in particular the multiplications between a data element a cyclic group such as P, Q or H (att (y)) with the zero value of a polynomial qy (0) is pa particularly expensive because the values involved can be very high. Typically the polynomials used are generated in the group 1p with p an integer which can take a value dimensioned, for example, over 512 bits.
    The solution provided by the invention makes it possible to reduce the cost of calculating these terms by using pre-calculated values and less expensive calculation operations, while retaining the same flexibility of access control with respect to the algorithm of original encryption.
    FIG. 2 illustrates, on a flowchart, the implementation of a modified CP-ABE encryption method according to the invention in order to speed up its execution and to make it compatible with a device with limited resources.
    The principle of CP-ABE encryption described in [1] is to define an encrypted message access policy which is described as a set of logical expressions on one or more attributes. The access policy defines the attributes needed to decrypt a message. The owner of the data to be encrypted can decide on the access policy associated with the encrypted data. The access policy is modeled as a tree structure (also called a tree) that has a root node denoted R, non-leaf nodes that represent threshold doors of the access structure, and leaf nodes. which are associated with the attributes. Thus, the logical expressions on several attributes can be modeled by such a structure. For example, a non-leaf node representing a parameter threshold gate (3,5) can be connected to five leaf nodes representing five different attributes to model the logical expression according to which three of the five attributes must be satisfied. More generally, a non-leaf node may also be connected to child nodes that are themselves non-leaf nodes. In this way, it is possible to model logical expressions nested on several attributes.
    In order to simplify the interpretation of the access structure, we consider the following functions: • parent (a) returns the parent node of node a in the access tree, • child (a) returns the set child nodes of the node a in the tree, • num (a) returns the number of child nodes of the node a in the tree, • degree (a) returns the threshold value of the gate associated with the non-leaf node a of the tree, • att (a) returns the value of the attribute associated with the leaf node a in the tree, • atts (a) returns the set of attributes associated with leaf nodes of the subtree derived from the tree access, formed by the root node a (if a is the root node of the access tree, then atts (a) is the set of all the attributes associated with the access structure), and • index (a) returns the index associated with node a in the tree that corresponds to the order defined in the tree between the child nodes of the same node .
    Subsequently, the modifications brought about by the invention are identified with respect to the CP-ABE algorithm described in [1] and explained in FIG. 1, which will be referred to as referring to the basic CP-ABE algorithm.
    The configuration phase of the CP-ABE algorithm (not represented in FIG. 2) is kept identical with respect to the conventional version described in FIG. 1. This configuration phase is always executed by a third party entity that plays the role of authority and consists in defining the cryptographic parameters and functions subsequently used in the encryption phase of a message M.
    During this phase, an elliptic curve with a point P which generates the cyclic additive group G1 of order p are fixed. Also, a cyclic multiplicative group G2 of the same order p, and a bilinear mapping e: G1 x G1 G2 are also defined. A hash function H: {0,1} * G1 makes it possible to match an attribute to an element of the group G ^ The configuration phase is carried out with the same parameters and cryptographic functions as the encryption algorithm based on the attributes CP -ABE of Bethencourt and others. In particular, the public parameters of the algorithm PK = (q = β.Ρ, T = Q) -P <g = e (P, P) a) are considered, as well as the space of the attributes Ω.
    The modified encryption method according to the invention then comprises a first phase of preparation and then an encryption phase.
    The preparation phase may be executed by the encryption device itself or by a trusted third party entity at one time or opportunistically (eg when energy resources are available). This phase consists of pre-calculating values that are subsequently saved in tables. These values are then used during the second encryption phase that is executed for each new message M to be encrypted. The preparation phase aims to perform complex calculations that are executed beforehand only once to allow, in the encryption phase, a lightening of the calculations to be executed for each message to be encrypted.
    The preparation phase consists of a step prior to the encryption phase and is independent of the message to be encrypted.
    This preparation phase is illustrated by the flowchart of FIG. 3 which comprises a first step 301 of random generation of n integers r1, r2,..., Rn e 1V. These integers are generated to replace the random variables used in the CP-ABE algorithm, in particular the polynomial coefficients of the access structure. The number n is a parameter of the invention and has an influence on the performance, in terms of security, of the algorithm. The larger the number n, the more difficult the encryption is to attack.
    In a second step 302, the following calculations are executed Vi e [l, n], calculate gr '.
    Vi e [l, n], calculate rj.Q.
    Vi e [1, n], calculate η.P.
    Vi e [l, n], Vj e Ω, calculate η.H (j).
    The first calculation is a modular exponentiation and the next three calculations are all in the form of a product between a randomly generated integer and an element of a cyclic group. All these operations are complex to execute and require significant resources in particular because the integers η are taken in zp with p a very large integer, whose dynamics typically varies on at least 512 bits.
    The tuple ^ Γί, Γΐ.0, Γΐ.Ρ, {η.Η (0}] 6Ω) for i varying from 1 to n is then saved in a table L for later use in the encryption phase.
    We now describe the encryption phase of the invention in support of Figure 2.
    In a first step 201, we consider the root node R of the access tree and execute a subroutine P1 which returns a tuple of the form (c = gs, C = sQ, CR = sP, {C ' R, j = sH (j)} jatts (R)), s is a random value belonging to TLV.
    The routine P1 is shown as a flowchart in Figure 4 and includes the following steps.
    According to a first step 401 of the routine P1, a subset S of the set [1, n] is randomly generated such that the subset S comprises k elements, n is the first parameter of the invention corresponding to the number of integers η generated randomly during the preparation phase and k is a second parameter of the invention. From the pre-calculated results stored in the memory L, a second step 402 consists of calculating the term Πϊs gn which aims to replace the term gs normally used in the basic algorithm CP-ABE. The operation performed in step 402 corresponds to a product of k pre-calculated elements and is less complex to perform than the direct operation gs with s a very large integer.
    If the result of the calculation of step 402 is equal to 1, the routine P1 is stopped and restarted at the first step 401. This test step is necessary to avoid obtaining a result equivalent to having gs = 1, and which would correspond to a value of s equal to 0.
    In a third step 403, the following terms are calculated: Σί es n. Q which equals s. Q in the basic CP-ABE algorithm, Σί es η-P which equals s. P in the basic CP-ABE algorithm, vj e attsÇR), Σί esri · H (j), which is equivalent to s.H (j) in the basic CP-ABE algorithm.
    These operations correspond to sums of k precomputed terms and are, there too, much less complex to execute than the operation of multiplication of s with an element of a cyclic group which is performed in the basic CP-ABE algorithm.
    In a fourth step 404, the routine P1 returns the tuple (C = gs, C = s .a CR = s .P, {C'RJ = s, H (j)} jeatts (R) from calculated equivalents.
    The routine P1 is executed only once, for the root node R, and allows the calculation of the first two terms of the encrypted message and the starting calculation of the last two terms of the encrypted message.
    Returning now to the description of the encryption algorithm according to the invention described in FIG. 2. From the message M to be encrypted, 202 is calculated, the term C = M.C which corresponds to the first term of the encrypted message. M. gs.
    Then, in a step 203, a routine P2 for the root node R is executed.
    The routine P2 is shown as a flowchart in Figure 5. It is executed for each node of the tree, including the root node, and includes the following steps.
    In a first step 501 of the subroutine P2, a parameter dmax = degree (a) - 2 is first fixed. In other words, this parameter dmax is equal to the threshold value of the gate associated with the node a.
    Then, 502 is randomly generated a subset Sdmax of the set [1, n] such that the subset Sdmax has k elements. The parameter k may take here a value that is identical to or different from the value of the parameter k used for the same purposes by the routine P1 to define the subset S.
    Then, from the results saved in the memory L, the term Ziesd is calculated which corresponds to the term cdmax.P with cdmax * e dominant coefficient of a random polynomial r (x) of degree dmax, this polynomial being associated with the node a of the access tree, according to the principle of the CP-ABE algorithm described above (FIG. 1).
    If the result of the previous calculation is the identity element of the cyclic group Gi, the routine P2 is stopped and restarted at the second step 502. This step is important to ensure that the dominant coefficient cdmax of the polynomial is not zero.
    In the opposite case, the following two steps are performed 504,505 for each value of d in the interval [0, dmax-1] and step 506 for each value of d in the interval [0, dmax].
    According to step 504, a subset Sd of the set [1, n] is randomly generated such that the subset Sd comprises k elements. The parameter k can take here a value that is identical to or different from the value of the parameter k used for the same purposes by the subprogram P2 to define the subset Sdmax or by the subprogram P1 to define the subset S.
    Then, 505, from the values saved in the memory L, are computed the terms εdri-P which are equivalent to the terms cd.P in the basic CP-ABE algorithm. The coefficients Cd are the coefficients of the random polynomial r (x) of degree dmax associated with the node a in the access structure.
    Then, 506, again from the values saved in the memory L, the terms sies-H (j) equivalent to the terms cd.H (j) in the basic CP-ABE algorithm are calculated.
    Finally, in a last step 507, the routine P2 returns the tuple
    for the current node a of the access tree.
    The subroutine P2 makes it possible to calculate, from simple additions operations of the pre-calculated terms during the preparation phase, products between a coefficient of a random polynomial (which is not directly generated) and an element a cyclic group (P, H (j)). Instead of randomly generating the coefficients of the polynomials in Zp and performing multiplication operations between these coefficients and the elements of a cyclic group, the results of pre-calculations are used to accelerate the encryption operation.
    Returning now to the description of the algorithm of FIG. 2. According to step 203, the routine P2 is thus executed for the root node R. From the results returned by the sub-program P2, namely the tuples
    the algorithm is able to define completely, without calculating it, the random polynomial qR () associated with the node R as being: qR (x) = r (x) .x + s
    We introduce here the secondary polynomial r (x) linked to the main polynomial qR (x) by the preceding relation and whose coefficients are the coefficients Cd introduced previously. Here we find the value s = qR (0) defined in the first step 101 of the unmodified CP-ABE algorithm.
    Using the tuple returned to step 203, 204 is then calculated, for all the indices i varying in the range [1, num (R)], the terms:
    The calculation carried out at step 204 makes it possible to obtain the intermediate results r (i) i. P which are then used to determine the final result sought:
    Thus, the term qR (i) .P is obtained without performing direct multiplication between a random number of Zp and a member (P) of a cyclic group but by simply adding between the terms r (i) .iP and CR.
    Similarly, in step 205, for all indices i varying in the range [l, num (R)] and for Vj E atts (b) where be child (x) and index (b) = are calculated. i, the intermediate results:
    Then we calculate the final results: V i E [l, num (R)], VjE atts (b), where b E child (x) and index (b) = i, the sum:
    The final result is thus obtained by performing a simple addition between the intermediate result and the term C'Rj calculated by the routine P1.
    The terms qR (i) -P and qR (i) .HQ) calculated in steps 204,205 correspond to the products between the random polynomial taken at the points of indices corresponding to the child nodes and an element of a cyclic group (P, H (j)).
    These terms are used to compute recursively, by traversing the access tree from the root node to the leaf nodes, all the products
    between the points qa (i) where qa () is the random polynomial associated with the node a, and the element P or H (j).
    These terms are calculated from the results saved in memory L during the preparation phase. The calculations necessary to determine these terms are thus greatly reduced and the execution time of these steps is reduced compared to a conventional implementation of the basic CP-ABE algorithm which consists of directly calculating the products qR (i) .P and qR (i) .H (j) which would imply multiplications on very large numbers.
    Thus, the algorithm continues by setting 206 the current node a starting with the root node R. If the tree is not completely traversed, we fix 207 the current node a to a new node then we execute 208 again the subroutine P2 for the node a.
    If a is not a leaf node, the same calculation steps 209, 210 are carried out making it possible to arrive at the terms qa (i) -P and qa (ï) .H (j).
    For any node a of the access tree, if degree (a) = 1, then the polynomial qa () is defined as qa (x) = qParent (a) 0ndex (a)) · If degree (a) > 1, the encryption algorithm executes 208 the subroutine P2 which returns the tuple
    The algorithm is able to completely define (without calculating) the polynomial qa () as being: qa (x) = r (x) .x + qParent (a) (index (a)).
    Using the tuple obtained at the end of step 208, the algorithm calculates 209.210, V i e [l, num (a)],
    It also calculates Vi e [l, num (a)], Vj e atts (b) where y e child (a) and index (b) = i,
    The algorithm then calculates, V i e [l, num (a)], the sum: qa (i) .P = r (i) .i. P + qparent (a) (index (a)). P.
    He also calculates, Vi e [l, num (a)], Vj e atts (b), where b is a child of a of index i, the sum: qa (i). H (j) = r (i) i. H (j) + qparent (a) (index (a)). H (j). The algorithm stops when the whole tree is traversed and all the nodes have been traversed. The algorithm recursively calculates for each leaf node y, the terms qy (0) .P and qy (0) .H (att (y)). The encrypted message is returned in an ultimate step 211, where Y is the set of leaf nodes of the access tree:
    The exemplary implementation of the invention described in Figure 2 should not be interpreted as limiting the invention to this particular implementation. Indeed, any variant of implementation, particularly in the structure of the steps of implementation, may be considered by the skilled person. For example, subroutine P1, subroutine P2 or both subroutines P1 and P2 can be directly implemented as steps of a main program and not in the form of subroutines. The order and arrangement of the steps described may also be modified insofar as the CT encryption result is obtained identically.
    The invention also extends to any application of the precalculation principle described in the prior preparation phase of the invention, for algorithms derived from the CP-ABE algorithm. By derivative algorithms, we mean here algorithms based on the same principle of tree access structure in which random polynomials must be generated, recursively, for each node of the structure and which involve multiplications between points of these structures. polynomials and elements of a cyclic group.
    According to a first embodiment of the invention, in order to improve the hazards used during the encryption phase, the preparation phase of the invention is modified as follows.
    The steps of random generation of integers n and the associated precalculation steps, in other words all the steps of the preparation phase described in FIG. 4, are duplicated to generate a second table L 'of pre-calculated values from a second set of n 'integers generated randomly.
    Then, in the encryption phase, at each step requiring the selection of k pre-calculated values from the n pre-calculated values in the first table L, an additional pre-calculated value selected in the second table L 'is added. In other words, a subset S of pre-calculated values is selected in the first table L and an additional pre-calculated value in the second table L '.
    This variant has the advantage of reinforcing the security of encryption in the face of third party attacks.
    According to another embodiment of the invention, the encryption phase of the invention can be further accelerated by pre-calculating more operations.
    Indeed, the calculation operations in the subprogram P1 proposed in the present invention require only operations of modular multiplication and addition of points. In the subroutine P2, the calculation operations further comprise scalar multiplication operations in the group of points with the scalar being small indices. For access trees with non-leaf nodes having a large number of children, the invention can be modified so that, during the preparation phase, random polynomials of various degrees are generated and pre-calculated. in addition, the terms r (i) iP and r (i) iH (j). The routine P2 can be modified accordingly, and thus the number of calculation operations can be reduced in consideration of a larger storage requirement. This variant of the invention is described below.
    In this variant, the modified subprogram P2 takes the values (n, k) as input and produces, for a node a in the tree, a tuple in the form
    where r () is a random polynomial of degree (degree (a) - 2)> 0, defined using precalculation. It also sets the maximum number of child nodes per node in a tree structure access to (dmax + 2).
    The preparation phase of the invention is modified as follows. • v d e [0, dmax], generate n random polynomials of degree d, with coefficients belonging to TLV.
    • V d e [0, dmax , vl e [1, n], set cd> i as the non-zero coefficient of the highest degree term of the polynomial rdd (). • Vd £ [0, dmax , vl e [Ι, η], Vi g [l, dmax + 2], calculate rdi (i) .i.P. • V d e [0, dmax , VI E [l, n], V i G [1, dmax + 2], Vj E Ω, compute rdil (i) .i.H (j). • v d e [0, dmax], Vl e [l, n], save the tuple
    in a table Ld.
    Thus, in this modified preparation phase, the random polynomials are directly generated, which makes it possible to pre-calculate the terms rdl (i) .i.P and rdl (i) .i.H (j).
    The routine P2 is then modified as follows.
    Steps 501 and 502 kept identical.
    Then, using the tabulated values of the memory Ld, one computes C = Σι es cd, i mod p.
    If a = 0, the routine is stopped and restarted at step 502.
    Otherwise, the following calculations are made.
    Vi G [l, num (a)], Vj G atts (y) where y G child (a) and index (y) = i, calculate r (0 · i-H (j). = Σι eS rd; i (i) H (j).
    Return
    The invention provides many advantages, particularly in terms of performance. The invention makes it possible to reduce the cost in terms of calculations of a data encryption based on the Bethencourt et al. CP-ABE scheme. The invention also reduces the execution time of data encryption. The invention does not require the deployment of a new dedicated infrastructure. Data encryption is complete without the use of trusted third parties to speed up encryption. The invention is carried out at the level of the data encryptor. It does not require modification of the data decryption algorithm. Encrypted data can be stored and accessed by data users in the same way as the original schema.
    FIG. 6 schematically illustrates an exemplary encryption device 600 according to the invention. Such a device 600 comprises one or more memories L, a first module or calculation unit PREP configured to implement the preparation phase of the invention to achieve
    a set of pre-calculations which are then transmitted to the memory L or memories. The device 600 also comprises a second module C1 PH or calculation unit configured to implement the encryption phase of the invention in order to encrypt a message M from the results of pre-calculations saved in the memory or memories L.
    The first module PREP is advantageously executed during a phase during which the device 600 has additional computing resources. Alternatively, the module PREP is executed at the initialization of the device 600.
    According to an alternative embodiment, the PREP module can be deported to be executed by a trusted third-party machine (not shown in FIG. 6) which has more computing resources than the device 600. In such a case, the results of pre-calculation are transmitted from the third-party machine to the memory or memories L of the encryption device through a secure link.
    The memory or memories L may be included in the encryption device 600 but may also be deported, for example in a backup server which includes larger backup capabilities than the device 600. In the latter case, the device 600 includes means of communication and secure data exchange with the backup server. The architecture example of FIG. 6 is given for illustrative and nonlimiting purposes. Any other arrangement for obtaining the same functionalities claimed by the invention is within the scope of the invention.
    The present invention can be implemented from hardware and / or software elements. It may be available as a computer program product on a computer readable medium. The support can be electronic, magnetic, optical or electromagnetic. The invention may also be implemented in an encryption device which may comprise one or more dedicated electronic circuits or a general purpose circuit. The technique of the invention can be realized on a reprogrammable calculation machine (a processor or a microcontroller for example) executing a program comprising a sequence of instructions, or on a dedicated calculation machine (for example a set of logic gates). as an FPGA or an ASIC, or any other hardware module). The encryption device also includes one or more memories for the purpose of saving the pre-calculations made during the preparation phase.
    According to one embodiment, the invention may comprise at least one computer-readable storage medium (RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, DVD or other optical disk medium, cassette magnetic tape, magnetic storage disk or other storage device, or other computer-readable non-transitory storage medium) encoded with a computer program (i.e., multiple executable instructions) which, when it is executed on a processor or several processors, performs the functions of the previously described embodiments. As an example of hardware architecture adapted to implement the invention, a device according to the invention may comprise a communication bus which is connected to a central processing unit or microprocessor (CPU, acronym for "Central Processing Unit" in English), which processor can be "muiti-core" or "many-coreune read-only memory (ROM, acronym for" Read Only Memory "in English) that can include the programs necessary for the implementation of the invention; a RAM or Random Access Memory (RAM) with registers adapted to record variables and parameters created and modified during the execution of the aforementioned programs, and a communication interface or I / O ( I / O acronym for "Input / ouput" in English) adapted to transmit and receive data.
    In the case where the invention is implanted on a reprogrammable calculation machine, the corresponding program (that is to say the sequence of instructions) can be stored in or on a removable storage medium (for example an SD card , a DVD or Bluray, a mass storage means such as a hard disk eg SSD) or non-removable, volatile or non-volatile, this storage medium is readable partially or completely by a computer or a processor. The computer readable medium may be transportable or communicable or mobile or transmissible (i.e. by a 2G, 3G, 4G, Wifi, BLE, fiber optic or other telecommunication network). The invention can also be implemented as a computer program product.
    The reference to a computer program that, when executed, performs any of the functions described above, is not limited to an application program running on a single host computer. On the contrary, the terms computer program and software are used herein in a general sense to refer to any type of computer code (for example, application software, firmware, microcode, or any other form of computer code). computer instruction) that can be used to program one or more processors to implement aspects of the techniques described herein. The means or computer resources can be distributed ("cloud computing"), possibly using peer-to-peer technologies. The software code can be executed on any appropriate processor (for example, a microprocessor) or processor core or set of processors, whether provided in a single computing device or distributed among a plurality of computing devices (eg example as possibly accessible in the environment of the device). The executable code of each program enabling the programmable device to implement the processes according to the invention can be stored, for example, in the hard disk or in read-only memory. In general, the program or programs may be loaded into one of the storage means of the device before being executed. The central unit can control and direct the execution of instructions or portions of software code of the program or programs according to the invention, instructions that are stored in the hard disk or in the ROM or in the other storage elements mentioned above. Executable code can also be downloaded from a remote server.
    The computer program may include source code, object code, intermediate source code, or partially compiled object code or any other form of program code instructions adapted to implement the invention in the form of a computer code. computer program.
    Such a program can present various functional architectures. For example, a computer program according to the invention can be broken down into one or more routines that can be adapted to perform one or more functions of the invention as described above. The routines can be stored together in a single executable file but can also be saved in one or more external files in the form of libraries that are associated with a main program statically or dynamically. Routines can be called from the main program but may also include calls to other routines or subroutines.
    All processes or process steps, programs, or subroutines described as flowcharts shall be interpreted as corresponding to modules, segments, or portions of program code that include one or more code instructions to implement the logical and the steps of the invention described. The invention applies to the general context of low-resource networks in which a resource-constrained device wishes to encrypt data using attribute-based encryption. The invention makes it possible to reduce the calculation cost and the associated energy consumption, and to speed up the encryption.
    The solution proposed by the invention makes it possible to use attribute-based encryption algorithms (ABE) directly at the levels of sensors or actuators constrained in resources (little power of calculation and energy), when today This type of encryption can only be implemented at the level of more resource-rich platforms (eg gateways). This solution helps to enhance the security of wireless sensor networks, including end-to-end encryption, while providing several benefits in terms of simplifying and accelerating security management. ABE encryption is particularly interesting when a particular piece of data is likely to be used by several different users. With the CP-ABE scheme of Bethencourt and others, the data access control policy is directly associated with the data during the encryption process. Thus the encrypted data can be saved on any type of server (eg cloud service), without compromising the security of the data and without the need to set up specific access control mechanisms on this server. This technology therefore finds natural applications in areas such as freight transport, health, the smart city, the factory of the future, this list is not exhaustive.
    Several applications can benefit from the advantages provided by the invention, or even emerge thanks to the invention. Two examples to illustrate the applications of the invention are described below:
    A first example concerns container control systems. During the transport and storage of goods, some containers or pallets of containers may be equipped with sensors. The sensors are used to monitor the condition of the container and transmit the measured data on temperature, humidity, gas content or other parameters during the transportation of the goods. The sensors can be connected to the Internet by using an on-board gateway on the means of transport (eg a vehicle such as a truck), which allows sensors to transmit measurements over the Internet using standard communication protocols. Measured data can be encrypted by sensors before they are sent over the Internet, especially if adjacent containers may contain goods from other customers. When shipping to their destination, containers can cross several stops and be transshipped on other modes of transport (eg air, sea, rail, road). Freight transhipment staff, carriers and customers can access some sensor-measured data with different levels of authorization and validity. End customers can access logs that provide information on multiple measured parameters throughout the transport chain. Remote monitoring of containers reduces product losses, especially for perishable goods. If a problem arises that can lead to a loss of quality, or a sprout infestation, sellers of the products may make the decision to change the destination of certain goods to be used quickly, or to destroy certain products before they occur. arrive at their destination. In this context, the invention can be installed at the sensor level to protect the data of the sensors in confidentiality, and allow access control to data of different levels. The security policy associated with sensor data can be remotely updated by vendors. The latter can thus select the level of security for new customers, ferries, or carriers.
    A second example of possible application of the invention relates to remote monitoring of patients in the medical field. Patient telemonitoring is a means of remotely monitoring the state of health of patients in a hospital setting, which improves the quality of care and reduces the cost of providing health care. Most remote monitoring technologies use sensors to measure physiological parameters, eg. ex. temperature, blood pressure (or pulse), or other parameters. The sensors generally run on batteries, and they are worn by patients. They can communicate using wireless technologies, and be connected to the Internet using the patients' Internet access boxes. The measured data is stored locally in the patient's home, or transmitted to centralized servers on the Internet or a private network that allows patients and health care providers to access data remotely. Since medical data is always considered very sensitive, it is very important to protect the data by means of encryption algorithms. The measured data can be reported to the patient himself, his family, his friends, or to the medical staff in charge of the patient. The patient can also, selectively, allow individuals or groups to access the data. The invention can be used in this context to enable sensors to encrypt data using attribute-based encryption methods, and also allow the patient to define a fine security policy to protect his or her personal data.
    The examples of application of the invention described above are given by way of illustration in order to demonstrate the broad scope of the possible industrial applications for the invention as well as the possibility of implementing the method according to the invention in many types. sensors that can integrate a data encryption device. References [1] J. Bethencourt, A. Sahai, and B. Waters. Ciphertext-Policy Attribute-Based Encryption. In Proceedings of the 2007 IEEE Symposium on Security and Privacy (SP Ό7). 2007.
    [2] L. Touati, Y. Challal, and A. Bouabdallah, "C-CP-ABE: Cooperative Ciphertext Policy Attribute-Based Encryption for the Internet of Things," Advanced Networking Distributed Systems and Applications (INDS), 2014 [3] ] Ateniese and others, "Low Cost Standard Signature in Wireless Network Sensor: A Case for Reviving Pre-computation Techniques ", NDSS, 2013 [4] Boyko et al.," Discrete speeding up logging and factoring based schemes via precomputations, "EUROCRYPT '98, 1998 [5] J.-S. Coron, D. M'Rahi, and C. Tymen , "Fast Generation of Pairs (k, [k] P) for Koblitz Elliptic Curves," The 8th Annual International Workshop on Selected Areas in Cryptography (SAC Ό1), 2001.
    [6] G. Bianchi, A. T. Capossele, C. Petrioli, and D. Spenza, "AGREE: exploiting energy harvesting to support data-centric access control in WSNs", Ad Hoc Netw. 11.8 (November 2013), 2625-2636.
    [7] S. Jahid, N. Borisov, "PIRATTE: Immediate Proxy-based Revocation of ATTribute-based Encryption", University of Illinois at Urbana-Champaign [8] Yi-Mu Ji, Tan J., Liu H, Y Sun, J. Kang, Z. Kuang, C. Zhao, "A privacy protection method based on CP-ABE and KP-ABE for cloud computing," Journal of Software, Vol 9, No. 6, June 2014, [9]. L. Touati, Y. Challal, "Batch-based CP-ABE with Attribute Revocation Mechanism for the Internet of Things", International Conference on Computing, Networking and Communications (ICNC 2015), Feb 2015, Anaheim, France, pp 1044- 1049.
    [10] S. Roy, M. Chuah, "Secure Data Retrieval Based on Ciphertext Policy Attribution-Based Encryption (CP-ABE) System for the DTNs".
    权利要求:
    Claims (14)
    [1" id="c-fr-0001]
    A computer-implemented method of attribute-based encryption comprising the execution of a CP-ABE or CP-ABE-based encryption algorithm associated with an access policy described by an access structure organized in the form of a tree, the encryption of a message M by said algorithm requiring, for each non-leaf node (a) of the tree, the random generation of a main polynomial (qa (x)) and at least one product calculation between the main polynomial (qa (x)) taken at least one point (qa (i)) and at least one element of a cyclic group (Q, P, H (j)), said method being characterized in that it comprises: - in a preceding step, the pre-calculation (302) of the product between a plurality of randomly generated integers (n) (301) and at least one element of a cyclic group ( Q, P, H (j)) and the saving of the pre-calculation results in a memory (L), - to encrypt the message M, the access the pre-calculation results stored in the memory (L) and their use for performing at least one calculation (204,205,209,210,403) of product between the main polynomial taken in at least one point (qa (i)) and at least one element of a cyclic group (Q, P, H (j)).
    [2" id="c-fr-0002]
    2. An encryption method according to claim 1 comprising, in the preceding step, the random generation (301) of a first number n of integers (n) and the pre-calculation (302) of the products between each integer ( n) and at least one element of a cyclic group (Q, P, H (j)) and, for encrypting the message M, the use of a second number k, less than n, of pre-calculation results , randomly selected, to perform at least one product calculation (204,205,209,210,403) between the main polynomial (qa (x)) taken at least one point (qa (i)) and at least one element of a cyclic group (Q, P, H (j)).
    [3" id="c-fr-0003]
    An encryption method according to claim 2 comprising, for encrypting the message M, for the root node (R) of the tree, calculating (403) the sum of pre-calculation results to determine the product between a value integer (s) random and said at least one element of a cyclic group (Q, P, H (j)).
    [4" id="c-fr-0004]
    4. Encryption method according to one of claims 2 or 3, for encrypting the message M, for each non-leaf node, for each coefficient (Cd) of a secondary polynomial (r (x)) connected to the main polynomial by a dependency relation of the type qa (x) = r (x) x + qa (0), the calculation (503, 505, 506) of the sum of pre-calculation results to determine an intermediate result equal to the product between said coefficient (Cd ) and said at least one element of a cyclic group (P, H (j)).
    [5" id="c-fr-0005]
    5. An encryption method according to claim 4 comprising, for encrypting the message M, for each non-leaf node, for each child node of said non-leaf node indexed by an index i, an intermediate evaluation of the product between firstly the product r (i) .i and on the other hand said at least one element of a cyclic group (P, H (j)) from a weighted sum of said intermediate results calculated on the set of coefficients (Cd) of the polynomial secondary r (x).
    [6" id="c-fr-0006]
    An encryption method according to claim 5 comprising, for encrypting the message M, for each non-leaf node, for each child node of said non-leaf node, evaluating the product between the main polynomial (qa (x)) taken at at least one point (qa (i)) varying on the indices of the child nodes of the non-leaf node and said at least one element of a cyclic group (P, H (j)) from the intermediate evaluation and the prior evaluation of the product between the main polynomial (qparent (x)) associated with the parent node of said leafless node taken at the point (index (a)) corresponding to the index of said non-leaf node within the children of said parent node, and said at least one element of a cyclic group (P, H (j)).
    [7" id="c-fr-0007]
    An encryption method according to claim 6 wherein the evaluation of the product between the main polynomial (qa (x)) taken at at least one point (qa (i)) varying on the indices of the child nodes of the non-leaf node and said at least one element of a cyclic group (P, H (j)) is performed recursively by traversing the tree from its root node to its leaf nodes.
    [8" id="c-fr-0008]
    8. Method of encryption according to one of claims 2 to 7 comprising, in the prior step, the generation of a third number n 'of integers (r'i) and the pre-calculation of n' products and, to encrypt the message M, the use, in addition, of an additional pre-calculation result among the n 'products.
    [9" id="c-fr-0009]
    The encryption method according to claim 1, wherein the randomly generated integers correspond to the values (qa (i)) of said main polynomial taken in a plurality of points (i) and the pre-calculation performed in the prior step includes the produced between on the one hand the product qa (i) .i and on the other hand at least one element of a cyclic group (Q, P, H (j)).
    [10" id="c-fr-0010]
    An encryption method according to claim 9 comprising, for encrypting the message M, for each non-leaf node, for each child node of said non-leaf node, evaluating the product between the main polynomial (qa (x)) taken at at least one point (qa (i)) varying on the indices of the child nodes of the non-leaf node and said at least one element of a cyclic group (Q, P, H (j)) from the sum of at least some of the pre-calculation results.
    [11" id="c-fr-0011]
    11. Encryption method according to one of the preceding claims wherein said at least one element of a cyclic group is selected from a point (P) of an elliptic curve, the product (Q) of a point (P) an elliptic curve with an integer (β), the result (H (j)) of the application of a hash function to a value (j) representing an attribute associated with a leaf node of the tree.
    [12" id="c-fr-0012]
    12. An encryption device comprising means (PREP, CIPH), including a processor, configured to execute the encryption method according to any one of claims 1 to 11 and at least one memory (L) in which the results of pre-calculation of the prior step of said method.
    [13" id="c-fr-0013]
    13. Computer program product downloadable from a communication network and / or stored on a computer readable medium having program code instructions for executing the encryption method according to any one of claims 1 to 11, when the program is executed by a processor.
    [14" id="c-fr-0014]
    A processor-readable recording medium on which is recorded a program comprising program code instructions for executing the encryption method according to any one of claims 1 to 11, when the program is executed by a processor. processor.
    类似技术:
    公开号 | 公开日 | 专利标题
    EP3371929B1|2020-03-18|Method of encryption based on the attributes comprising a pre-calculation phase
    US9252942B2|2016-02-02|Method and system for secure multiparty cloud computation
    Fernández-Caramés2019|From pre-quantum to post-quantum IoT security: A survey on quantum-resistant cryptosystems for the Internet of Things
    FR2992509A1|2013-12-27|DEVICE AND METHOD FOR GENERATING A SESSION KEY
    EP3506556B1|2020-08-05|Method of authenticated key exchange via blockchain
    EP3174241B1|2018-01-03|Method for establishing secure end-to-end communication between a user terminal and a connected object
    FR3021777A1|2015-12-04|SECURE DISTRIBUTED STORAGE BY MULTIPARTITE CALCULATION
    Becker et al.2018|Revisiting Private Stream Aggregation: Lattice-Based PSA.
    Buccafurri et al.2018|Integrating digital identity and blockchain
    US20200014534A1|2020-01-09|Elliptic curve isogeny based key agreement protocol
    Pinheiro et al.2018|Security architecture and protocol for trust verifications regarding the integrity of files stored in cloud services
    WO2020061593A1|2020-03-26|Decentralized key generation and distribution over a blockchain-based network
    Vasić et al.2017|Adaptable secure communication for the Cloud of Things
    EP3211826B1|2019-06-12|Method for handling implicit certificates using a distributed public key infrastructure
    Esiner et al.2019|Two-factor authentication for trusted third party free dispersed storage
    Zhang et al.2016|Cost-efficient and multi-functional secure aggregation in large scale distributed application
    CA2895189C|2021-01-26|Group signature using a pseudonym
    WO2017009067A1|2017-01-19|Method of secure delegation of expensive calculations for public key encryption algorithms
    Pereira et al.2021|Impact of receiver imbalances on the security of continuous variables quantum key distribution
    EP3785403B1|2022-01-12|Method for formulating usage data in respect of relays used in the course of a communication between two devices, for searching said data, and associated devices
    Naresh et al.2021|Lightweight secure communication system based on Message Queuing Transport Telemetry protocol for e‐healthcare environments
    FR3110311A1|2021-11-19|cryptographic evaluation of real-valued functions on encrypted data
    EP3008851B1|2018-04-04|System and method for delegating bilinear pairing computations to a server
    WO2007096566A1|2007-08-30|Cryptographic hashing device and method
    EP3063898B1|2017-04-12|Signature with pseudonym for chip card
    同族专利:
    公开号 | 公开日
    EP3371929A1|2018-09-12|
    FR3043292B1|2017-10-27|
    WO2017076705A1|2017-05-11|
    EP3371929B1|2020-03-18|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    CN108632030B|2018-03-22|2020-11-27|中山大学|CP-ABE-based fine-grained access control method|
    CN108512662A|2018-04-12|2018-09-07|上海海事大学|The hiding multimachine structure encryption method of support policy on a kind of lattice|
    CN109246096B|2018-08-30|2021-05-18|西安电子科技大学|Multifunctional fine-grained access control method suitable for cloud storage|
    CN109981643A|2019-03-26|2019-07-05|长沙学院|A kind of inquiry authorization of fine granularity can search for encryption method and system|
    CN110098926B|2019-05-06|2021-08-13|西安交通大学|Attribute revocation method|
    CN111447192A|2020-03-23|2020-07-24|齐鲁工业大学|Lightweight attribute base signcryption method for cloud and mist assisted Internet of things|
    法律状态:
    2016-11-30| PLFP| Fee payment|Year of fee payment: 2 |
    2017-05-05| PLSC| Search report ready|Effective date: 20170505 |
    2017-11-30| PLFP| Fee payment|Year of fee payment: 3 |
    2019-11-29| PLFP| Fee payment|Year of fee payment: 5 |
    2021-08-06| ST| Notification of lapse|Effective date: 20210705 |
    优先权:
    申请号 | 申请日 | 专利标题
    FR1560508A|FR3043292B1|2015-11-03|2015-11-03|ATTRIBUTE-BASED ENCRYPTION METHOD COMPRISING A PRE-CALCULATION PHASE|FR1560508A| FR3043292B1|2015-11-03|2015-11-03|ATTRIBUTE-BASED ENCRYPTION METHOD COMPRISING A PRE-CALCULATION PHASE|
    PCT/EP2016/075717| WO2017076705A1|2015-11-03|2016-10-26|Method of encryption based on the attributes comprising a pre-calculation phase|
    EP16788489.9A| EP3371929B1|2015-11-03|2016-10-26|Method of encryption based on the attributes comprising a pre-calculation phase|
    [返回顶部]