Abstract:
A system and method concerns a secure transmission of a file fragmentable into a plurality of fragments, and comprises (a) initially fixing a global encryption key; (b) encrypting the fragmentable file based on said global key to form a first encrypted file; (c) encrypting the global key by means of an asymmetric encryption algorithm using a public key to obtain a global encrypted key; (d) inserting values representing the global encrypted key among the fragments of said encrypted file to form a second encrypted file; and (e) transmitting the second encrypted file.

Description:
FIELD OF THE INVENTION 
     The invention relates to methods for secure transmission of data and to devices implementing this type of method, in particular adapted for transmitting fragmentable data files of significant size. 
     BACKGROUND OF THE INVENTION 
     In order to transmit files of significant size, such as images, in a secure manner, it is possible to use symmetric encipherment systems. However, this type of encipherment necessitates the dispatching of a secret key used to decrypt and encrypt the file transmitted. Consequently, such a method of transmitting secure data comprises the risk of the interception of the key which may make it possible to decrypt the data file. Moreover, the receiver will then know the key used by the sender, this therefore necessitating regular, indeed systematic, changing of the secret key to be used. 
     Additionally, it is very unwieldy to use an asymmetric encryption system which therefore implements a private key to encrypt each file fragment by the sender and a public key transferred to the receiver to decrypt this fragment. Specifically, on account of the receiver&#39;s partial knowledge of the key, asymmetric systems necessitate the use of large prime integers, of significant size, in particular greater than 1024 bits (in particular in the RSA algorithm) to encrypt each file fragment. Consequently, the resources and time required to implement such a method of encrypted transmission are significant. 
     An aim of the present invention is to alleviate these drawbacks. 
     The present invention proposes a method for secure transmission of data allowing the dispatching of data of significant size, in particular of images, and which is fast and effective. 
     Additionally, the aim of the present invention is to provide a method for secure data transmission that is robust to noise or to the loss of data, in particular by fraudulent interception of data packets. 
     SUMMARY OF THE INVENTION 
     For this purpose, the invention proposes a method for secure transmission of a file fragmentable into a plurality of fragments in which, 
     (a) a global encipherment key is fixed initially, 
     (b) the fragmentable file is enciphered as a function of said global key to form a first encrypted file; 
     (c) the global key is enciphered by means of an asymmetric encipherment algorithm to obtain an enciphered global key, 
     (d) values representative of the enciphered global key are inserted among the fragments of said encrypted file to form a second encrypted file, and; 
     (e) said second encrypted file is transmitted. 
     By thus inserting in an encrypted manner the global key into the file to be transferred, the receiver can thus decrypt the global key advantageously by means of a public key of an asymmetric algorithm. The global key being of reduced size, the decryption of this global key is easily achievable. Thereafter, the encryption of the file can use an encipherment algorithm that is less unwieldy to implement, and using this global key which will be enciphered and then inserted into the file, thereby ensuring a shorter encryption/decryption time. 
     A substantially similar chain of steps is known from the document WO04/012378. However, the present invention goes further and proposes a particularly advantageous characteristic according to which, in step (b), for a succession of fragments: 
     (b1) each current fragment is assigned a dynamic encryption key determined on the basis of a combination involving a group of previously encrypted fragments, and 
     (b2) the value of the current fragment is allocated a value which is dependent on its initial value and on said dynamic key. 
     This type of encipherment allows fast encryption of the data of the fragmentable file and makes it possible to solve all the integrity problems. Specifically, if a data packet is lost, the whole of the encrypted file will be modified thereby. Additionally, this type of encryption makes it possible to begin decryption, on receipt, before having received the entirety of the encrypted file. This type of encryption is therefore particularly adapted for transmitting big files across a network such as the Internet. 
     In an embodiment of the invention, a value representative of a signature of the fragmentable file is inserted, in addition to the values representative of the global key enciphered in the encrypted file. This signature makes it possible to verify, on receipt, that the transmitted image has been correctly decrypted, and in particular to verify the integrity of this image. Specifically, interception of data during transmission would generate a shift such that the image once decrypted, would no longer correspond to the signature inserted into the image. 
     In an advantageous realization also, a linear combination of the values of the previously encrypted fragments is used by implementing coefficients α j , dependent on the global key, and in which the coefficients α j  are expressed by the relation: 
             {                 α   j     =       β   j     -     2     l   -   1       -   1                 if   ⁢           ⁢     β   j       ∈     {     0   ,   …   ⁢           ,       2   l     -   2       }       ,                 a   j     =     ±     2     l   -   1                     if   ⁢           ⁢     β   j       =       2   l     -   1       ,           ⁢     
     ⁢   with   ⁢     
     ⁢     β   j       =       ∑     n   =   1     l     ⁢       2     l   -   n       ⁢       b     lj   -   l   +   n       .                 
where b lj−l+n  are 1 successive values of the global key.
 
     This relation makes it possible to choose the α j  so that the sum of these coefficients is very close to zero. Thus, as the insertion of data is performed in the file, noise (vagaries) is also inserted. The fact of choosing the α j  so that their sum is about equal to zero makes it possible to attenuate the noise during the decryption phase. The α j  are therefore chosen so that the probability density of appearance of each value is nearly uniform. 
     Thereafter, the invention proposes a method for secure reception of an encrypted file fragmentable into a plurality of fragments, in which: 
     a′) the encrypted file is received, 
     b′) values representative of an enciphered global key are extracted from among the fragments of said encrypted file, 
     c′) the enciphered global key is deciphered using a public key to obtain a deciphered global key, 
     d′) the encrypted fragmentable file is deciphered as a function of said deciphered global key. 
     According to an advantageous general characteristic of the invention, on receipt, and more particularly in step b′), a dynamic encryption key specific to each current fragment is determined on the basis of a combination involving a group of previously decrypted fragments. 
     Additionally, the invention proposes a send/receive system implementing a method for the secure transmission of a fragmentable file in accordance with the invention. 
     Moreover, the invention also proposes a computer program product whose installation on a computer allows the execution of the method for secure transmission in accordance with the invention and/or the method of reception in accordance with the invention. 
     Other features and advantages of the present invention will appear in the description hereinafter of a nonlimiting exemplary embodiment, with reference to the appended drawings, in which: 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  represents a network in which the method of the invention is implemented; 
         FIG. 2  is a flowchart representing a method for secure transmission in accordance with the invention; 
         FIG. 3  is a flowchart representing a method of reception in accordance with the invention. 
     
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       FIG. 1  represents a first terminal  1  linked to a computer-based network  2 , for example the Internet. The first terminal  1  is adapted for transmitting data via the network  2  to a second terminal  3 . 
     In order to securely transmit a data file of significant size, such as for example an image, across the computer-based network  2 , the invention proposes a method illustrated in particular by the example of  FIG. 2 . In step S 101 , and according to the method in accordance with the invention, a global encryption key K glob  is determined. This key is formed for example of kbits divided into Twords 
     where T=k/l, l being the length of each of the points. 
     This global key can be used so as to perform flow-based encryption, as described hereinafter. However, this global key can be a secret key for a symmetric block encryption algorithm, or any other type of encryption algorithm. 
     This key can be stored in the encryption system which will perform the encryption and the transmission of the encrypted file, or can also be generated by an encryption keys generator. 
     In step S 102 , it is possible to calculate a signature S of the image which can also be transmitted with the encrypted file. This signature makes it possible in particular to verify the integrity of the file upon receipt so as to check that no interception or loss of packet has been caused by the transmission. Consequently, this signature S makes it possible to strengthen the security of the image. Specifically, within the framework of the application to the transfer of medical images for example between a medical imaging laboratory and the doctor who must analyze the images obtained, it is important to ensure that no datum has been added or modified in the transferred image. The signature makes it possible to perform a comparison between the image received and the image transmitted. 
     Thereafter, the method can implement a flow-based encryption algorithm which is in particular suited to file transmission across a network as in the example represented. Specifically, this type of encryption makes it possible in particular to begin the decipherment of the encrypted data even before the file is fully received. However, another encryption method could be used, for example a secret-key block encryption, where the secret key would be the global key K glob . Nevertheless, the flow-based encipherment algorithm presents various advantages with respect to the block algorithm. First of all, in contradistinction to the block algorithm, the flow-based algorithm is less sensitive to noise. Thereafter, the integrity of the images is improved. Furthermore, the flow-based algorithm does not cause textured zones to appear when the unencrypted image exhibits homogeneous zones. In accordance with step S 103 , for each fragment of the file to be encrypted, for example for each pixel or group of pixels, p i  of the image, a dynamic key k dyn  is calculated, within the framework of the flow-based encipherment algorithm. This flow-based encipherment can be termed synchronous or asynchronous. In the case of synchronous flow-based encipherment, the dynamic key k dyn  does not depend on the data to be encrypted or on the data that has been encrypted. Conversely, in the case of asynchronous encipherment, the dynamic key which is established as a function of the previously encrypted pixels. This dynamic key can for example be obtained by means of various key generating functions and, as in the preferred embodiment of the invention, by means of a linear combination, as indicated by the following formula: 
     
       
         
           
               
             
               { 
               
                 
                   
                     
                       
                         z 
                         i 
                       
                       = 
                       
                         
                           ( 
                           
                             
                               ∑ 
                               
                                 j 
                                 = 
                                 1 
                               
                               n 
                             
                             ⁢ 
                             
                               
                                 α 
                                 j 
                               
                               ⁢ 
                               
                                 p 
                                 
                                   i 
                                   - 
                                   j 
                                 
                                 ′ 
                               
                             
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           mod 
                         
                         ⁢ 
                         X 
                       
                     
                   
                 
                 
                   
                     
                       
                         p 
                         i 
                         ′ 
                       
                       = 
                       
                         
                           ( 
                           
                             
                               z 
                               i 
                             
                             + 
                             
                               p 
                               i 
                             
                           
                           ) 
                         
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           mod 
                         
                         ⁢ 
                         X 
                       
                     
                   
                 
               
             
           
         
       
     
     where:
         z i  is the dynamic key value assigned to the current pixel or fragment of value p i , i varying between 1 and n, where n is the number of pixels or fragments,   α j  with j lying between 1 and n is a set of coefficients for implementing the linear combination applied to the current pixel or fragment,   p′ I-j  with i-j lying between i-n and i−1 is a set of values of n previously encrypted pixels,   p′ j  is the value of the encrypted current pixel, and   mod X corresponds to a congruence specific to a sampling of said fragments.       

     In this example, X depends on the size of the memory allocated to the calculation of the encrypted values of the current pixel. In general, X equals 256 points. Each pixel p i  is therefore encrypted into pixel p i ′ in step S 104 . Additionally the coefficients α j  of the linear combination are obtained on the basis of the global key K glob . An exemplary embodiment is illustrated by the following formula: 
             {                 α   j     =       β   j     -     2     l   -   1       -   1                 if   ⁢           ⁢     β   j       ∈     {     0   ,   …   ⁢           ,       2   l     -   2       }       ,                 a   j     =     ±     2     l   -   1                     if   ⁢           ⁢     β   j       =       2   l     -   1       ,           ⁢     
     ⁢   with   ⁢     
     ⁢     β   j       =       ∑     n   =   1     l     ⁢       2     l   -   n       ⁢       b     lj   -   l   +   n       .                 
where blj−1+n are 1 successive values of the global key.
 
     In this case, the global key K glob  is formed of n words of a length of 1 bits, each bit being denoted b j . By using such a formula, it is possible to alter the coefficients α j , in particular so that the sum of all the α j  is about zero. This makes it possible in particular to decrease the influence of the noise of the decryption algorithm in accordance with the invention. 
     When the whole of the file has been encrypted, the global key K glob  is in its turn encrypted, for example by an asymmetric encipherment algorithm with a public key and a private key. It is possible to use such an encipherment algorithm for this case, since the global key is not a file of too significant a size. 
     Once enciphered in step S 105 , the enciphered global key K′ glob  is thereafter inserted into the encrypted file (S 106 ). The signature can also be encrypted in the course of this same step. The insertion of the data can be done in various ways as a function of the length of the message to be inserted and of the desired robustness. For the insertion of data filed in images, there are two principal groups of procedures: procedures which work in the spatial domain, and procedures which work in the frequency domain, in particular with the DCT (Discrete Cosine Transform). The combination in the spatial and frequency domain is also possible. It is possible to use a combination which directly embeds the data in the pixels of the image, in particular by using for example pseudo-random number generators to choose the sequence of pixels affected by the insertion. However, the procedure preferred in the invention uses an algorithm which embeds the information in the low-order bits of the image. The objective is to embed in the image an n-bits message composed of the encrypted secret key and of the signature of the original image. It is then necessary to calculate an insertion factor so as to disperse the message throughout the image. This dispersion makes it possible to attenuate the noise to the insertion of data and also makes it possible to extend the visual integrity of the image to the whole image. The image is therefore divided into n regions of equivalent size, each of these regions will be used to embed a bit of the message. The recurrence of the algorithm for the insertion will have to be at least equal to the size of these regions by insertion of hidden data. 
     Once all the data have been inserted into the file, the file thus encrypted is transmitted in step S 107  to a recipient, for example the second terminal  3  of  FIG. 1 . 
     Thereafter, the recipient can decrypt the image using an inverse decipherment method illustrated by  FIG. 3 , that is to say beginning by extracting from the image received in stage S 201 , the encrypted global key as well as the signature S EMM  (S 202 ). Next, the user can decrypt this global key by means of a public key which, for example, has been transmitted to him by the sender beforehand (S 203 ), and decrypt the whole of the image by means of this decrypted global key in a manner analogous to the encryption algorithm used, in steps S 204  and S 205 . Finally, the signature S MEC  of the decrypted received image is calculated in step S 206 , then, in step S 207 , the signature of the original image S EMM  is compared with the signature of the image received S REC , so as to verify the integrity of the image, and to determine whether the transmitted data have undergone an attack during transmission. 
     Of course, the invention is not limited to the embodiment described above by way of example; it applies to other variants. 
     Thus, according to an advantageous realization, it is furthermore possible to compress the data file in the course of encryption.