Patent ID: 12206767

DETAILED DESCRIPTION

Embodiments of the invention provide devices and methods for secured, confidential, and authenticated exchange of messages between a pair of users, comprising a sender (also referred to herein as a ‘transmitter’, ‘sender device’, or ‘transmitter device’) and a recipient (also referred to hereinafter as a ‘receiver’, a ‘recipient device’, or a ‘receiver device’), in an identity-based encryption cryptosystem (also referred to as a ‘cryptographic system’).

Referring toFIG.1, there is shown a cryptosystem100in which the embodiments of the invention may be applied. The cryptosystem100may comprise a sender103and a recipient105connected via a link107, a sender trusted center101(also referred to hereinafter as a ‘transmitter trusted center’) connected to the sender103, and a recipient trusted center102(also referred to hereinafter as a ‘receiver trusted center’) connected to the recipient105. The sender trusted center101and the recipient trusted center102are different entities such that the sender103cannot connect the recipient trusted center102and the recipient105cannot connect the sender trusted center101. The following description of some embodiments of the invention will be made hereinafter with reference to two trusted centers (a sender trusted center and a recipient trusted center), for illustration purposes only. However, the skilled person will readily understand that the embodiments of the invention may be applied to cryptosystems involving three or more trusted centers.

The sender103and the recipient105may be any user, user device, equipment, object, entity, configured to operate in the cryptosystem100. More specifically, the sender103may be any user device, user equipment, user object, or user apparatus configured or configurable to determine an encrypted message from original data and to transmit the encrypted message to the recipient105. The recipient105may be any user device, user equipment, user object or user apparatus configured or configurable to receive the encrypted message transmitted over the link107and to decrypt the encrypted message to recover original data. It should be noted that in the figures, the sender103and the recipient105are labeled according to the direction of transmission and reception of encrypted messages. However, in practice, the sender103and the recipient105may be any transceivers devices capable of transmitting and receiving data in any cryptosystem100.

In some embodiments, the sender103and the recipient105may be any cryptographic device that implement hardware and/or software cryptographic functions for ensuring data and/or signals security, encryption, authentication, protection, and privacy. As used herein, a ‘cryptographic device’ encompass any device, computer, computing machine, or embedded system, programmed and/or programmable to perform cryptographic functions for the generation and the use of cryptographic keys. Exemplary cryptographic devices include, without limitation:smartcards, tokens to store keys such as wallets, smartcards readers such as Automated Teller Machines (ATM) used for example in financial transactions, restricted access, telecommunications, military applications, secure communication equipments, and TV set-top boxes;electrical and digital electronic devices such as RFID tags and electronic keys;embedded secure elements (e.g. smart-cards, Trusted Platform Module (TPM) chip);computers (e.g. desktop computers and laptops), tablets;routers, switches, printers;mobile phones such as smartphones, base stations, relay stations, satellites;Internet of Thing (IoT) devices (used for example in smart-cities, smart-cars applications), robots, drones; andrecorders, multimedia players, mobile storage devices (e.g. memory cards and hard discs) with logon access monitored by cryptographic mechanisms.

The embodiments of the invention may be implemented in a cryptosystem100, which may be used in various applications such as in storage, information processing, or communication systems.

For example, in an application of the invention to storage systems, the cryptosystem100may represent a storage system, infrastructure or network, the sender103and/or the recipient105being part of such cryptosystem and comprising one or more storage devices configured to store or use encrypted data (e.g. memory cards or hard discs).

In an application of the invention to information processing, the cryptosystem100may be for example a computer system (e.g. a small or large area wired or wireless access network), a database, an online sale system or a financial system comprising a sender103and a recipient105configured to secure the data used and/or stored in the system (such as personal financial or medical data).

In an application of the invention to communication systems, the cryptosystem100may be wired/wireless/optical/radio communication network in which at least one sender103is configured to transmit, over a medium107that can be unsecure, encrypted data to at least one recipient105.

Original data may correspond to text files, video, audio, or any other media data.

The sender103and/or the recipient105may be fixed, such as a computer operating in a wired communication system, or mobile, such as a user terminal operating in a radio or wireless network.

The link107may correspond to a network (e.g. Internet-based network, computer network) or to any communication medium (wired, wireless, or optical).

The sender103may be configured to select the sender trusted center101in the cryptosystem100and to identify the sender and recipient trusted centers by their identity information. The sender103may be further configured to select the recipient105among the users of the cryptosystem100. The recipient105may be configured to select the recipient trusted center102in the cryptosystem100and to identify the sender and recipient trusted centers by their identity information.

The sender trusted center101may be connected to the sender103and the recipient trusted center102may be connected to the recipient105. The sender trusted center101and/or the recipient trusted center102may be a device, an entity, or a system such as an organization (e.g. a social public organization, headquarters of a corporation, smart-cities regional authorities, smart-cars national authorities) configured or configurable to generate private keys associated with the identity information of the users when they join the cryptosystem100.

According to some embodiments, the sender trusted center101and/or the recipient trusted center102may be a system administrator, a dedicated server, or a server that is part of a distributed network. The sender trusted center101and the recipient trusted center102according to the invention may collaborate to exchange data to be used by the sender103and the recipient105for exchange of trust.

Each user in the cryptosystem100may be associated with an identity information, also referred to as ‘an identifier’, that uniquely identifies the user in the cryptosystem100. In some embodiments, an identifier may be one or a combination of two or more identifiers chosen in a group comprising an identity sequence, a name, a username, a network address, a social security number, a street address, an office number, a telephone number, an electronic mail address associated with a user, a date, an Internet Protocol address belonging to a network host. An identifier associated with each user may be any public, cryptographically unconstrained string that is used in conjunction with public data of the trusted center101to perform data encryption or signing.

In the following description of some embodiments, the identity information associated with the sender103will be also referred to as the ‘sender identifier’ or ‘transmitter identifier’, the identity information associated with the recipient105will be referred to as the ‘recipient identifier’ or ‘receiver identifier’, the identity information associated with the sender trusted center101will be also referred to as the ‘sender trusted center identifier’, and the identity information associated with the recipient trusted center102will be also referred to as the ‘recipient trusted center identifier’.

Each of the sender identifier, the recipient identifier, the sender trusted center identifier, and the recipient trusted center identifier may be strings that belong to the set {0,1}*.

In order to facilitate the understanding of the various embodiments of the invention, the following definitions are provided:n∈designates a non-zero natural number;λs∈+is a positive value integer number designating a sender trusted center security parameter (also referred to as a ‘transmitter trusted center security parameter’);λr∈+is a positive value integer number designating a recipient trusted center security parameter (also referred to as a ‘receiver trusted center security parameter’);p∈designates a prime number;2=/2designates a Euclidean domain (also called a Euclidean ring) and2[x] designates the ring of polynomials having coefficients that belong to the Euclidean ring2;G and GTdesignate two groups of order p;e: G×G→GTdesignates a bilinear map;H1: {0,1}n→G designates a first cryptographic hash function;H2: GT→{0,1}ndesignates a second cryptographic hash function;H2: {0,1}n×{0,1}n→pndesignates a third cryptographic hash function;={0,1}nrepresents a finite message space, i.e. the space to which belongs each message (also referred to as an ‘original message’ or a ‘plaintext message’, or a ‘plaintext’);M∈designates a plaintext message;=G*x{0,1}nrepresents a finite ciphertext space, i.e. the space to which belongs each encrypted message (also referred to as a ‘ciphertext’ or a ‘ciphertext message’);C(M)∈designates a ciphertext message computed by encrypting the plaintext message M;IDTCsrefers to the sender trusted center identifier (also referred to as ‘transmitter trusted center identifier’);IDTCrrefers to the recipient trusted center identifier (also referred to as a ‘receiver trusted center identifier’);IDsendrefers to the sender identifier;IDrecirefers to the recipient identifier;gpubsrefers to a sender trusted center public key (also referred to as a ‘transmitter trusted center public key’);gpubrrefers to a recipient trusted center public key (also referred to as a ‘receiver trusted center public key’);

gI⁢⁢DT⁢⁢Cs
refers to an intermediate sender trusted center public key (also referred to as ‘an intermediate transmitter trusted center public key’);

gI⁢⁢DT⁢Cr
refers to an intermediate recipient trusted center public key (also referred to as an ‘intermediate receiver trusted center public key’);gsendrefers to a sender public key (also referred to as a ‘transmitter public key’);grecirefers to a recipient public key (also referred to as a ‘receiver public key’);Prvsendrefers to a sender private key (also referred to as a ‘transmitter private key’) associated with the sender public key gsendand sender identifier IDsend;Prvrecirefers to a recipient private key (also referred to as a ‘receiver private key’) associated with the recipient public key greciand recipient identifier IDreci;

Pr⁢vIDT⁢Cs
refers to a sender trusted center private key associated with the sender trusted center identifier IDTCs;PKsrefer to sender system parameters (also referred to as ‘transmitter system parameters’) determined by the sender trusted center101;PKrrefer to recipient system parameters (also referred to as ‘receiver system parameters’) determined by the recipient trusted center102;ssrefers to a sender trusted center master key (also referred to as a ‘transmitter trusted center master key’);srrefers to a recipient trusted center master key (also referred to as a ‘receiver trusted center master key’);etauthsrefers to a sender authentication key (also referred to as a ‘transmitter authentication key’);etauthrrefers to a recipient authentication key (also referred to as a ‘receiver authentication key’);Eσ(·) designates a cipher (also referred to as a ‘ciphertext algorithm’) that uses a cryptographic key σ as encryption key and Dσ(·) designates the decipher associated with the cipher Eσ(·) such that a message encrypted using the cipher Eσ(·) is successfully recovered only if it is decrypted with the decipher Dσ(·) that uses the cryptographic key σ as a decryption key. The cipher is symmetric.

The embodiments of the invention provide a sender103operable to transmit an encrypted message C(M) to a recipient105in an identity-based cryptosystem100that comprises a sender trusted center101connected to the sender103and a recipient trusted center102connected to the recipient105, the sender103and the recipient105being configured to communicate over the link107securely, independently, and without accessing the sender trusted center101and the recipient trusted center102. Accordingly, the transmission of encrypted messages from the sender103to the recipient105may be completed without contacting the sender trusted center101and the recipient trusted center102. In the identity-based cryptosystem100, the sender103is associated with a sender identifier IDsend, the recipient is associated with a recipient identifier IDreci, the sender trusted center is associated with a sender trusted center identifier IDTCs, and the recipient trusted center is associated with a recipient trusted center identifier IDTCr. The different identifiers may be publically known, i.e. known to the sender103, the recipient105, the sender trusted center101, and the recipient trusted center102.

The sender trusted center101may be configured to manage the generation and distribution of the sender private key. Accordingly, the sender trusted center101may be configured to receive the sender identifier IDsendfrom the sender103and to determine a sender private key Prvsendfrom the sender identifier IDsend.

Similarly, the recipient trusted center102may be configured to manage the generation and distribution of the recipient private key. Accordingly, the recipient trusted center102may be configured to receive the recipient identifier IDrecifrom the recipient105and to determine a recipient partial private key Prvrecifrom the recipient identifier IDreci.

The sender trusted center101may be further configured to send the sender private key to the sender103. The recipient trusted center102may be configured to send the recipient private key to the recipient105. Once the sender trusted center101and the recipient trusted center102delivered the private keys to the sender103and the recipient105, the sender private key and the recipient private key may not need to be updated, for example if new users join the cryptosystem100.

According to the embodiments of the invention, the sender103is configured to send the encrypted message to the recipient105securely using an authentication of the sender trusted center through the use of two authentication keys.

Accordingly, the sender103may be configured to receive, from the sender trusted center101, two public authentication keys etauthsand etauthr. The sender trusted center101may be configured to determine at least one of the two public authentication keys from a sender trusted center private key

P⁢r⁢vIDT⁢Cs
previously determined at the recipient trusted center102from the sender trusted center identifier IDTCsassociated with the sender trusted center101.

The two public authentication keys comprise a sender authentication key etauthsand a recipient authentication key etauthr. The sender authentication key may be used for the exchange of trust, i.e. for the sender authentication and the verification of a recipient trusted center public key. The recipient authentication key may be used at the recipient for the authentication of the sender authentication key. Key verification enables matching the key to a person/entity.

Upon reception of the two public authentication keys, the sender103may be configured to verify a sender trusted center public key gpubs, a recipient trusted center public key gpubr, and the sender authentication key etauths.

If the sender103succeeds the verifications of the sender trusted center public key, the recipient trusted center public key, and the sender authentication key, the sender103may be configured to determine a ciphertext set C1comprising an encrypted message C(M).

The sender103may then send the ciphertext set to the recipient105, the recipient105being configured to receive the ciphertext set and to recover an original message by decrypting the encrypted message.

The sender trusted center101has secret information that enables it to compute the sender private key of the sender103. More specifically, the sender trusted center101may be configured to hold a sender trusted center security parameter denoted by λs∈+and a sender trusted center identifier IDTCsand to generate sender system parameters PKsand a sender trusted center master key ssfrom the sender security parameter λsand the sender trusted center identifier IDTCs. The sender system parameters denoted by PKs={p, G, GT, e, H1, H2, H3, gpubs} comprise a prime number p, two algebraic groups G and GTof order equal to the prime number p, an admissible bilinear map e, a first cryptographic hash function H1, a second cryptographic hash function H2, a third cryptographic hash function H3, and a sender trusted center public key gpubsassociated with the sender trusted center identifier IDTCs.

When computed, the sender trusted center101makes the sender system parameters known publicly, i.e. to all the users in the cryptosystem including the sender103, the recipient105, and the recipient trusted center102. The sender trusted center101keeps, however, the sender trusted center master key ssprivate and known only to the sender trusted center101.

The sender trusted center security parameter λsis used to determine the sender system parameters and the sender trusted center master key. In particular, the sender trusted center security parameter may allow to determine the size, in bits, of the sender trusted center master key such that ss∈pn, with n being a non-zero natural number. The sender trusted center security parameter may be also used to determine the size of the prime number in bits. For example, the prime number may be selected to be a random λs-bits prime number.

According to some embodiments, the bilinear map e may be based on a Weil pairing or a Tate pairing defined on a subgroup of an elliptic curve. In such embodiments, the elements of the algebraic group G may be points on an elliptic curve.

According to some embodiments, the sender trusted center101may be configured to determine the sender system parameters PKsand the sender trusted center master key by applying a setup algorithm that takes as input the sender trusted center security parameter λsand the sender trusted center identifier IDTCsand returns as outputs the sender system parameters PKsand a sender trusted center master key ss. According to the setup algorithm, the sender trusted center101may be configured to generate a prime number p, the two algebraic groups G and GTand an admissible bilinear map e by running a Bilinear Diffie-Hellman parameter generator that takes as input the sender trusted center security parameter λsand outputs a prime number p, the description of two groups G and GTand the description of an admissible bilinear map e: G×G→GT.

Given the sender trusted center security parameter, the sender trusted center101may be configured to select, among a predefined set of cryptographic hash functions, a first cryptographic hash function H1: {0,1}n→G, a second cryptographic hash function H2: GT→{0,1}n, and a third cryptographic hash function H3: {0,1}n×{0,1}n→np. The cryptographic hash function H1, H2and H3may be random oracles.

The sender trusted center101may be then configured to determine a first value denoted by g by applying the first cryptographic hash function H1to the sender trusted center identifier IDTCssuch that g=H1(IDTCs).

The sender trusted center101may be further configured to randomly select a sender trusted center master secret key ss∈p+; and to determine a sender trusted center public key gpubsby applying an exponentiation function defined by a base and an exponent, the base being equal to the first value g1=H1(IDTCs), and the exponent being equal to the sender trusted center master key sssuch that gpubs=g1ss. The exponentiation function may be replaced with a scalar multiplication function according to which gpubs=[ss]g1 if the first value corresponds to a point of an elliptic curve.

The recipient trusted center102has secret information that enables it to compute the recipient private key of the recipient103and the sender trusted center private key. More specifically, the recipient trusted center102may be configured to hold a recipient trusted center security parameter denoted by λr∈+, a recipient trusted center identifier IDTCr, to generate recipient system parameters PKr, a recipient trusted center master key srfrom the recipient trusted center security parameter A, and the recipient trusted center identifier IDTCr. The recipient system parameters denoted by PKr={p, G, GT, e, H1, H2, H3, gpubr} comprise a prime number p, two algebraic groups G and GTof order equal to the prime number p, an admissible bilinear map e, a first cryptographic hash function H1, a second cryptographic hash function H2, a third cryptographic hash function H3, and a recipient trusted center public key gpubrassociated with the recipient trusted center identifier IDTCr.

When computed, the recipient trusted center102makes the recipient system parameters known publicly, i.e. to all the users in the cryptosystem including the sender103, the recipient105, and the sender trusted center101. The recipient trusted center102keeps, however, the recipient trusted center master key srprivate and known only to the recipient trusted center102.

The recipient trusted center security parameter A, is used to determine the recipient system parameters and the recipient trusted center master key. In particular, the recipient trusted center security parameter may allow to determine the size, in bits, of the recipient trusted center master key such that sr∈pn, with n being a non-zero natural number. The recipient trusted center security parameter may be also used to determine the size of the prime number in bits. For example, the prime number may be selected to be a random λr-bit prime number.

According to some embodiments, the recipient trusted center102may be configured to determine the recipient system parameters PKrand the recipient trusted center master key by applying a setup algorithm that takes as input the recipient trusted center security parameter λr, and the recipient trusted center identifier IDTCrand returns as outputs the recipient system parameters PKrand a recipient trusted center master key sr. According to the setup algorithm, the recipient trusted center102may be configured to generate a prime number p, the two algebraic groups G and GTand an admissible bilinear map e by running a Bilinear Diffie-Hellman parameter generator that takes as input the recipient trusted center security parameter λrand outputs a prime number p, the description of two groups G and GTand the description of an admissible bilinear map e: G×G→GT.

Given the recipient trusted center security parameter, the recipient trusted center102may be configured to select, among a predefined set of cryptographic hash functions, a first cryptographic hash function H1: {0,1}n→G, a second cryptographic hash function H2: GT→{0,1}n, and a third cryptographic hash function H3: {0,1}n×{0,1}n→pn. The cryptographic hash function H1, H2and H3may be random oracles.

The recipient trusted center102may be then configured to determine a value denoted by g by applying the first cryptographic hash function H1to the recipient trusted center identifier IDTCrsuch that g=H1(IDTCr).

The recipient trusted center102may be further configured to randomly select a recipient trusted center master secret key sr∈p+and to determine a recipient trusted center public key gpubrby applying an exponentiation function defined by a base and an exponent, the base being equal to the value g=H1(IDTCr), and the exponent being equal to the recipient trusted center master key srsuch that gpubr=gsr. The exponentiation function may be replaced by a scalar multiplication function according to which gpubr=[sr]g if the value g corresponds to a point of an elliptic curve.

A large part of the system parameters comprised in the sender system parameters and the recipient system parameters may coincide. In particular, according to some embodiments, the sender system parameters and the recipient system parameters may satisfy PKs\{gpubs}={p, G, GT, e, H1, H2, H3}=PKr\{gpubr}-{p, G, GT, e, H1, H2, H3}.

According to some embodiments, the sender103may send the sender identifier IDsendto the sender trusted center101and ask it to receive the sender private key Prvsend.

Upon reception of the request sent by the sender103, the sender trusted center101may be configured to determine the sender private key from the sender trusted center master key ss, the sender system parameters PKs, and the sender identifier IDsendby applying a KeyGen algorithm that takes as input the sender trusted center master secret key, the sender identifier, and the sender system parameters, and outputs the sender private key.

Accordingly, the sender trusted center101may be configured to determine a sender public key gsendby applying the first hash function H1to the sender identifier IDsendsuch that gsend=H1(IDsend) and to determine the sender private key Prvsendby applying an exponentiation function defined by a base and an exponent, the base being equal to the sender public key gsendand the exponent being equal to the inverse of the sender trusted center master secret key

1ss
such that

P⁢r⁢vsend=gsend1ss.
The exponentiation function may be replaced by a scalar multiplication function such that

P⁢r⁢vsend=[1ss]⁢gsend
if the sender public key corresponds to a point of an elliptic curve.

According to some embodiments, the recipient105may send the recipient identifier IDrecito the recipient trusted center102and ask it to receive the recipient private key Prvreci.

Upon reception of the request sent by the recipient105, the recipient trusted center102may be configured to determine the recipient private key from the recipient trusted center master key sr, the recipient system parameters PKr, and the recipient identifier IDreciby applying a KeyGen algorithm that takes as input the recipient trusted center master secret key, the recipient identifier, and the recipient system parameters, and outputs the recipient private key.

Accordingly, the recipient trusted center102may configured to determine a recipient public key greciby applying the first hash function H1to the recipient identifier IDrecisuch that greci=H1(IDreci) and to determine the recipient private key Prvreciby applying an exponentiation function defined by a base and an exponent, the base being equal to the recipient public key greci, and the exponent being equal to the inverse of the recipient trusted center master secret key

1sr
such that

P⁢r⁢vr⁢e⁢c⁢i=greci1sr.
The exponentiation function may be replaced with a scalar multiplication function according to which

P⁢r⁢vr⁢e⁢c⁢i=[1sr]⁢gr⁢e⁢c⁢i
if the recipient public key corresponds to a point of an elliptic curve.

According to some embodiments, the sender trusted center101may send the sender trusted center identifier IDTCsto the recipient trusted center102and ask it to receive the its sender trusted center private key

PrvTCs.

Upon reception of the request sent by the sender trusted center101, the recipient trusted center102may be configured to determine the sender trusted center private key from the recipient trusted center master key sr, the recipient system parameters PKr, and the sender trusted center identifier IDTCsby applying a KeyGen algorithm that takes as input the recipient trusted center master secret key, the sender trusted center identifier, and the recipient system parameters, and outputs the sender trusted center private key.

Accordingly, the recipient trusted center102may configured to determine an intermediate sender trusted center public key

gIDTCs
by applying the first hash function H1to the sender trusted center identifier IDTCssuch that

gI⁢⁢DT⁢⁢Cs=H1⁡(I⁢⁢DT⁢⁢Cs)
and to determine the sender trusted center private key

PrvTCs
by applying an exponentiation function defined by a base and an exponent, the base being equal to the intermediate sender trusted center public key

gIDTCs,
and the exponent being equal to the inverse of the recipient trusted center master secret key

1sr
such that

P⁢r⁢vT⁢Cs=gIDT⁢Cs1sr.
The exponentiation function may be replaced with a scalar multiplication function according to which

Pr⁢vT⁢Cs=[1sr]⁢gIDT⁢Cs
if the sender trusted center public key corresponds to a point of an elliptic curve.

According to some embodiments, the sender trusted center101may be configured to determine the two public authentication keys from the sender trusted center master key ss, the sender trusted center private key

PrvTCs,
and the recipient trusted center public key gpubr. More specifically, the sender trusted center101may be configured to:determine the sender authentication key etauthsby applying an exponentiation function of a base equal to the recipient trusted center public key gpubrand an exponent equal to the inverse of the sender trusted center master key sssuch that

e⁢ta⁢u⁢t⁢h⁢s=gpubr1ss,
anddetermine the recipient authentication key etauthrby applying an exponentiation function of a base equal to the sender trusted center private key

PrvTCs
and an exponent equal to the sender trusted center master key sssuch that

etauthr=PrvTCsss.

In embodiments in which the recipient trusted center public key corresponds to a point of an elliptic curve, the exponentiation function performed to determine the sender authentication key may be replaced with a scalar multiplication such that

e⁢ta⁢u⁢t⁢h⁢s=[1ss]⁢gp⁢u⁢br.

In embodiments in which the sender trusted center private key corresponds to a point of an elliptic curve, the exponentiation function performed to determine the recipient authentication key may be replaced with a scalar multiplication such that

etauthr=[ss]⁢PrvTCs.

The sender trusted center101may be further configured to send the two public authentication keys to the sender103and the recipient105.

According to some embodiments, the sender103may be configured to verify a sender trusted center public key by comparing a first value

e⁡(Prvsend,gpubs)
to a second value

e⁡(gsend,gIDTCs),
the first value

e⁡(Prvsend,gpubs)
being determined by applying the bilinear map e to the sender private key Prvsendand the sender trusted center public key gpubscomprised in the sender system parameters. The second value

e⁡(gsend,gIDTCs)
is determined by the sender103by applying the bilinear map e to the sender public key gsendand the intermediate sender trusted center public key

gIDTCs.
The sender103verifies the sender trusted center public key if the sender103determines that

e⁡(Prvsend,gpubs)=e⁡(gsend,gIDTCs).

According to some embodiments, the sender103may be configured to verify the sender authentication key etauthsby comparing a third value e(gpubs,etauths) to a fourth value

e⁡(gIDTCs,gpubr),
the third value e(gpubs, etauths) being determined by applying the bilinear map e to the sender trusted center public key gpubsand the sender authentication key etauths, the fourth value

e⁡(gIDYCs,gpubr)
being determined by applying the bilinear map e to the intermediate sender trusted center public key

gIDTCs
and the recipient trusted center public key gpubrcomprised in the recipient system parameters. The sender103verifies the sender authentication key if the sender103determines that

e⁡(gpubs,etauths)=e⁡(gIDTCs,gpubr).

If the sender103succeeds the verification of the sender trusted center public (i.e. if the sender103gets

e⁡(Prvsend,gpubs)=e⁡(gsend,gIDTCs))
and the verification of the sender authentication key (i.e. of the sender103gets

e⁡(gpubs,etauths)=e⁡(gIDTCs,gpubr)),
then the sender103may be configured to determine the ciphertext set C1={V, U, C(M), Y} that comprises, in addition to the encrypted message C(M), a first component denoted by V, a second component denoted by U, and a third component denoted by Y. More specifically, the sender103may be configured to:determine a random secret key σ;determine a recipient public grecikey by applying the first cryptographic hash function H1to the recipient identifier IDrecisuch that greci=H(IDreci);determine an auxiliary value r by applying the third cryptographic hash function H3to the random secret value σ and a given message M such that r=H3(σ,M);determine the first component V by applying an exponentiation function of a basis equal to the recipient trusted center public key gpubrcomprised in the recipient system parameters and an exponent equal to the auxiliary value, such that V=gpubrrr. The exponentiation function may be replaced with a scalar multiplication function such that V=[r]gpubrin embodiments in which the recipient trusted center public key corresponds to a point of an elliptic curve;determine the second component U by applying an addition operation to the random secret key σ and the output H2(e(grecir,H1(IDTCr))) of the application of the second cryptographic hash function H2to the output e(grecir,H1(IDTCr)) of the application of the bilinear map e to a first input grecirand a second input H1(IDTCr), the first input grecirbeing given by the recipient public key grecito the power the auxiliary value r, the second input H1(IDTCr) being given by the output of the application of the first cryptographic hash function H1to the recipient trusted center identifier IDTCr. The second component is accordingly given by U=σ+H2(e(grecir,H1(IDTCr))). The addition operation may be performed over2[x] in which case, the addition operation is an XOR operation;determine the encrypted message C(M) by applying a cipher Eσto the given message M, the cipher Eσusing the random secret key σ as encryption key, anddetermine the third component Y by applying the second cryptographic hash function H2to the output

e⁡(Prvsend,gIDTCs)×e⁡(gIDTCr,greci)
of the product between a first input

e⁡(Prvsend,gIDTCs)
and a second input

e⁡(gIDTCr,greci)
to the power the auxiliary value r, the first input

e⁡(Prvsend,gIDTCs)
being the output of the application of the bilinear map e to the sender private key Prvsendand the intermediate sender trusted center public key

gIDTCs.
The second input

e⁡(gIDTCr,greci)
is the output of the application of the bilinear map e to an intermediate recipient trusted center public key

gIDTCr
and the recipient public key greci. The third component is accordingly given by

Y=H2⁡((e⁡(Prvsend,gIDTCs)×e⁡(gIDTCr,greci))r).

If the sender103fails to verify one or both of the sender trusted center public (i.e. if the sender103gets

e⁡(Prvsend,gpubs)≠e⁡(gsend,gIDTCs))
and the verification of the sender authentication key (i.e. if the sender103gets

e⁡(gpubs,etauths)≠e⁡(gIDTCs,gpubr)),
then the sender103aborts.

Upon reception of the ciphertext set, the recipient105may be configured to:verify a recipient trusted center public key by comparing the output e(Prvreci, gpubr) of the application of the bilinear map e to the recipient private key Prvreciand the recipient trusted center public key gpubrto the output

e⁡(greci,gIDTCr)
of the application of the bilinear map e to the recipient public key greciand the intermediate recipient trusted center public key

gIDTCr.
The recipient trusted center public key is verified if the recipient105determines that

e⁡(Prvreci,gpubr)=e⁡(greci,gIDTCr);verify the recipient authentication key etauthrand the sender trusted center public key gpubsby comparing the output e(gpubr, etauthr) of the application of the bilinear map e to the recipient trusted center public key gpubrcomprised in the recipient system parameters and the recipient authentication key etauthr, to the output

e⁡(gITTCr,gpubs)
of the application of the bilinear map e to the intermediate recipient trusted center public key

gIDTCr
and the sender trusted center public key gpubs. The sender trusted center public key is verified if the recipient105determines that

e⁡(gpubr,etauthr)=e⁡(gIDTCr,gpubs);
andverify the sender authentication key etauthsby comparing the output e(gpubs,etauths) of the application of the bilinear map e to the sender trusted center public key gpubsand the sender authentication key etauths, to the output

e⁡(gIDTCs,gpubr)
of the application of the bilinear map e to the intermediate sender trusted center public key

gIDTCs
and the recipient trusted center public key gpubr. The sender authentication key is verified if the recipient105determines that

e⁡(gpubs,etauths)=e⁡(gIDTCs,gpubr).

In embodiments in which the verifications of the recipient trusted center public key, the recipient authentication key, the sender trusted center public key, and the sender authentication key succeed (i.e. when

e⁡(Prvreci,gpubr)=e⁡(greci,gIDTCr)⁢⁢and⁢⁢e⁡(gpubr,etcuthr)=e⁡(gIDTCr,gpubs)⁢⁢and⁢⁢e⁡(gpubs,etauths)=e⁡(gIDTCs,gpubr)),
the recipient105may be configured to:determine a sender public key gsendby applying the first cryptographic hash function H1to the sender identifier IDsendsuch that gsend=H1(IDsend);determine a secret key σ by applying a subtraction operation between the second component U comprised in the received ciphertext set and the output H2(e(Prvreci, V)) of the application of the second cryptographic hash function H2to the result of the application of the bilinear map e to the recipient private key Prvreciand the first component V comprised in the ciphertext set. The secret key is accordingly expressed as σ=U−H2(e(Prvreci, V)). The subtraction operation may be performed over2[x] in which case, the subtraction operation is an XOR operation;determine/recover an original message M by decrypting the encoded message C(M) comprised in the received ciphertext set using a decipher Dσthat uses the secret key σ as a decryption key;determine an auxiliary value r by applying the third cryptographic hash function to the secret key and the original message such that r=H3(σ, M);verify the sender identify IDsendby comparing the third component Y comprised in the ciphertext set to the output

H2⁡((e⁡(gsend,gIDTCs)×e⁡(etauths,Prvreci))r)
of the application of the second cryptographic hash function H2to a value

e⁡(gsend,gIDTCs)×e⁡(etauths,Prvreci)
to the power the auxiliary value r, the value being given by the product between:the output

e⁡(gsend,gIDTCs)
of the application of the bilinear map e to the sender public key gsendand the intermediate sender trusted center public key

gIDTCs;
andthe output e(etauths,Prvreci) of the application of the bilinear map e to the sender authentication key etauthsand the recipient private key Prvreci.

The recipient105verifies the sender identity if the recipient105determines that

Y=H2⁡((e⁡(gsend,gIDTCs)×e⁡(etauths,Prvreci))r).

According to some embodiments, the cipher/decipher Eσ/Dσmay be any symmetric encryption/decryption algorithm/protocol/function such as the AES, the Triple Data Encryption algorithm, the DES (Data Encryption Standard), the Triple DES (3DES), or the RC4 (Rivest Cipher 4). The cipher/decipher Eσ/Dσmay be configured to perform encryption/decryption using non-tweakable or tweakable modes of operation. Exemplary non-tweakable modes of operations comprise the Electronic Codebook mode (ECB), the Cipher Block Chaining mode (CBC), the Propagating Cipher Block Chaining mode (PCBC), the Cipher Feedback mode (CFB), the Output Feedback mode (OFB), and the Counter mode (CTR). Exemplary tweakable modes of operation comprise the XOR-Encrypt-XOR (XEX) mode and the tweakable with ciphertext stealing mode (XTS).

According to some embodiments, the sender103and/or the recipient105may be configured to generate the secret key used in the cipher algorithm and the decipher algorithm using a random number generator and/or Physically Unclonable Functions. In some embodiments, a random number generator may be chosen in a group comprising a pseudo-random number generator and a true random number generator.

There is also provided a method for sending an encrypted message M(C) from a sender103to a recipient105in an identity-based cryptosystem100. The cryptosystem comprises a sender trusted center101connected to the sender103and a recipient trusted center102connected to the recipient105. In the identity-based cryptosystem100, the sender103is associated with a sender identifier IDsend, the recipient is associated with a recipient identifier IDreci, the sender trusted center is associated with a sender trusted center identifier IDTCs, and the recipient trusted center is associated with a recipient trusted center identifier IDTCr. The method comprises making the different identifiers publically known to all the users and trusted centers in the cryptosystem100.

FIG.2is a flowchart depicting a method for sending the encrypted message from the sender103to the recipient105according to some embodiments of the invention.

At step201, sender system parameters PKsand a sender trusted center master key ssmay be determined at the sender trusted center101from a sender trusted center security parameter λsand a sender trusted center identifier IDTCsassociated with the sender trusted center101, according to a setup algorithm that takes as inputs the sender trusted center security parameter λsand the sender trusted center identifier IDTCsand outputs sender system parameters PKsand a sender trusted center master key ss.

At step202, recipient system parameters PKrand a recipient trusted center master key srmay be determined at the recipient trusted center102from a recipient trusted center security parameter λrand a recipient trusted center identifier IDTCrassociated with the recipient trusted center102, according to a setup algorithm that takes as inputs the recipient trusted center security parameter λrand the recipient trusted center identifier IDTCrand outputs recipient system parameters PKrand a recipient trusted center master key sr.

At step203, a sender private key Prvsendmay be determined at the sender trusted center101from the sender trusted center master key ss, the sender system parameters PKs, and the sender identifier IDsend, by applying a KeyGen algorithm that takes as inputs the sender trusted center master secret key ss, the sender identifier IDsend, and the sender system parameters PKs, and outputs the sender private key Prvsend.

At step204, a recipient private key Prvrecimay be determined at the recipient trusted center102from the recipient trusted center master key ss, the recipient system parameters PKr, and the recipient identifier IDreci, by applying a KeyGen algorithm that takes as inputs the recipient trusted center master secret key sr, the recipient identifier IDreci, and the recipient system parameters PKr, and outputs the recipient private key Prvreci.

At step205, sender trusted center private key PrvTCsmay be determined at the recipient trusted center102from the recipient trusted center master key ss, the recipient system parameters PKr, and the sender trusted center identifier IDTCs, by applying a KeyGen algorithm that takes as inputs the recipient trusted center master secret key sr, the sender trusted center identifier IDTCs, and the recipient system parameters PKr, and outputs the sender trusted center private key

PrvTCs.

At step206, two public authentication keys comprising a sender authentication key etauthsand a recipient authentication key etauthrmay be determined at the sender trusted center101from the sender trusted center master key ss, the sender trusted center private key

P⁢r⁢vT⁢Cs,
and the recipient trusted center public key gpubr, according to a PubKeyGen algorithm that takes as inputs the sender trusted center master key ss, the sender trusted center private key

P⁢r⁢vT⁢Cs,
and the recipient system parameters and outputs the two public encryption keys.

The sender authentication key may be used for the exchange of trust, i.e. for the sender authentication and the verification of a recipient trusted center public key. The recipient authentication key may be used at the recipient for the authentication of the sender authentication key.

At step207, the two public authentication keys may be sent by the sender trusted center101to the sender103and the recipient105and received at the sender103and the recipient105.

At step208, a ciphertext set C1comprising an encrypted message C(M) may be determined at the sender103if the verifications of the sender trusted center public key gpubr, the recipient trusted center public key gpubr, and the sender authentication key etauthssucceeds, according to the EncryptET algorithm that takes as inputs the recipient identifier, the sender private key, the sender identifier, a given message M∈and the sender and recipient system parameters, and outputs the ciphertext set C1.

At step209, the ciphertext set C1may be sent to the recipient105.

At step210, the ciphertext set C1may be received at the recipient105, the sender103may be authenticated, and the original message recovered, according to a DecryptET algorithm that takes as inputs the recipient identifier, the recipient private key, the sender identifier, the ciphertext set, the sender and recipient system parameters, the sender trusted center public key and the two public authentication keys, and outputs a recovered original message M.

FIG.3Ais a flowchart depicting a method of determining the sender system parameters PKs={p, G, GT, e, H1, H2, H3, gpubs} and a sender trusted center master key ssaccording to a setup algorithm, the sender system parameters comprising a prime number p, two algebraic groups G and GTof order equal to the prime number p, an admissible bilinear map e, a first cryptographic hash function H1, a second cryptographic hash function H2, a third cryptographic hash function H3, and a sender trusted center public key gpubsassociated with the sender trusted center identifier IDTCs.

At step301, input parameters of the setup algorithm may be received, including a sender trusted center security parameter denoted by λs∈+and a sender trusted center identifier IDTCs.

At step302, a prime number p, two algebraic groups G and GTand an admissible bilinear map e may be determined by running a Bilinear Diffie-Hellman parameter generator that takes as input the sender trusted center security parameter λsand outputs a prime number p, the description of two groups G and GTand the description of an admissible bilinear map e: G×G→GT.

At step303, a first cryptographic hash function H1: {0,1}n→G, a second cryptographic hash function H2: GT→{0,1}n, and a third cryptographic hash function H3: {0,1}n×{0,1}n→pn, may be selected, for example among a predefined set of cryptographic hash functions. The cryptographic hash function H1,H2and H3may be random oracles.

At step304, a first value g1 may be determined by applying the first cryptographic hash function H1to the sender trusted center identifier IDTCssuch that g1=H1(IDTCs).

At step305, a sender trusted center master key ss∈p+may be selected randomly.

At step306, a sender trusted center public key gpubsmay be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the first value g1, and the exponent being equal to the sender trusted center master key sssuch that gpubs=g1ss. In embodiments in which the first value corresponds to a point of an elliptic curve, the exponentiation function may be replaced with a scalar multiplication function according to which the sender trusted center master key is given by the product gpubs=[ss]g1.

At step307, the sender system parameters PKs={p, G, GT, e, H1, H2, H3, gpubs} and the sender trusted center master key ssmay be output. The sender system parameters may be disseminated to the sender103, the recipient105, and the recipient trusted center102, while the sender trusted center master key may be kept secret at the sender trusted center101.

FIG.3Bis a flowchart depicting a method of determining the recipient system parameters PKr={p, G, GT, e, H1, H2, H3, gpubr} and a recipient trusted center master key sraccording to a setup algorithm, the recipient system parameters comprising a prime number p, two algebraic groups G and GTof order equal to the prime number p, an admissible bilinear map e, a first cryptographic hash function H1, a second cryptographic hash function H2, a third cryptographic hash function H3, and a recipient trusted center public key gpubrassociated with the recipient trusted center identifier IDTCr.

At step311, input parameters of the setup algorithm may be received, including a recipient trusted center security parameter denoted by λr∈+and a recipient trusted center identifier IDTCr.

At step312, a prime number p, two algebraic groups G and GTand an admissible bilinear map e may be determined by running a Bilinear Diffie-Hellman parameter generator that takes as input the recipient trusted center security parameter λrand outputs a prime number p, the description of two groups G and GTand the description of an admissible bilinear map e: G×G→GT.

At step313, a first cryptographic hash function H1: {0,1}n→G, a second cryptographic hash function H2: GT→{0,1}n, and a third cryptographic hash function H3: {0,1}n×{0,1}n→pnmay be selected, for example among a predefined set of cryptographic hash functions. The cryptographic hash function H1,H2and H3may be random oracles.

At step314, a first value g2 may be determined by applying the first cryptographic hash function H1to the recipient trusted center identifier IDTCrsuch that g2=H1(IDTCr).

At step315, a sender trusted center master key sr∈p+may be selected randomly.

At step316, a recipient trusted center public key gpubrmay be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the first value g2, and the exponent being equal to the recipient trusted center master key srsuch that gpubr=g2sr. In embodiments in which the first value g2 corresponds to a point of an elliptic curve, the exponentiation function may be reduced to performing a scalar multiplication function according to which gpubr=[sr]g2.

At step317, the recipient system parameters PKr={p, G, GT, e, H1, H2, H3, gpubr} and the recipient trusted center master key srmay be output. The recipient system parameters may be disseminated to the sender103, the recipient105, and the sender trusted center101, while the recipient trusted center master key may be kept secret at the recipient trusted center102.

According to some embodiments, the sender system parameters and the recipient system parameters may satisfy:
PKs={p,G,GT,e,H1,H2,H3,gpubs}=PKr={p,G,GT,e,H1,H2,H3,gpubr}.

FIG.4Ais a flowchart depicting a method for determining a sender private key Prvsendaccording to the KeyGen algorithm.

At step401, the inputs of the KeyGen algorithm may be received, including the sender trusted center master secret key ss, the sender system parameters PKs, and the sender identifier IDsend.

At step402, a sender public key gsendmay be determined by applying the first hash function H1to the sender identifier IDsendsuch that gsend=H1(IDsend).

At step403, a sender private key Prvsendmay be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the sender public key gsend, and the exponent being equal to the inverse of the sender trusted center master secret key

1ss
such that

P⁢r⁢vsend=gsend1ss.
The exponentiation function may be replaced by a scalar multiplication function such that

P⁢r⁢vsend=[1ss]⁢gs⁢e⁢n⁢d
if the sender public key corresponds to a point of an elliptic curve.

At step404, the sender private key Prvsendmay be output.

FIG.4Bis a flowchart depicting a method for determining a recipient private key Prvreciaccording to the KeyGen algorithm.

At step411, the inputs of the KeyGen algorithm may be received, including the recipient trusted center master secret key sr, the recipient system parameters PKr, and the recipient identifier IDreci.

At step412, a recipient public key grecimay be determined by applying the first hash function H1to the recipient identifier IDrecisuch that greci=H1(IDreci).

At step413, a recipient private key Prvrecimay be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the recipient public key greci, and the exponent being equal to the inverse of the recipient trusted center master key

1sr
such that

P⁢r⁢vr⁢e⁢c⁢i=greci1sr.
The exponentiation function may be replaced with a scalar multiplication function according to which

P⁢r⁢vr⁢e⁢c⁢i=[1sr]⁢gr⁢e⁢c⁢i
if the recipient public key corresponds to a point of an elliptic curve.

At step404, the sender private key Prvrecimay be output.

FIG.4Cis a flowchart depicting a method for determining a sender trusted center private key PrvTCsaccording to the KeyGen algorithm.

At step421, the inputs of the KeyGen algorithm may be received, including the recipient trusted center master secret key sr, the recipient system parameters PKr, and the sender trusted center identifier IDTCs.

At step422, a sender trusted center public key

gIDTCs
may be determined by applying the first hash function H1to the sender trusted center identifier IDTCssuch that

gIDT⁢Cs=H1⁡(IDT⁢Cs).

At step423, a sender trusted center private key

Pr⁢vT⁢Cs
may be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the intermediate sender trusted center public key

gIDT⁢Cs,
and the exponent being equal to the inverse of the recipient trusted center master secret key

1sr
such that

P⁢r⁢vT⁢Cs=gIDTCs1sr.
The exponentiation function may be replaced with a scalar multiplication function according to which

P⁢r⁢vT⁢Cs=[1sr]⁢gIDT⁢Cs
if the sender trusted center public key corresponds to a point of an elliptic curve.

At step424, the sender trusted center private key Prvrecimay be output.

FIG.5is a flowchart depicting a method for determining two authentication keys at the sender trusted center103according to the PubKeyGenET algorithm.

At step501, the inputs of the PubKeyGenET algorithm may be received, including the sender trusted center master key ss, the sender trusted center private key

P⁢r⁢vT⁢Cs,
and the recipient trusted center public key gpubr.

At step502, a sender authentication key etauthsmay be determined by applying an exponentiation function of a base equal to the recipient trusted center public key gpubrand an exponent equal to the inverse of the sender trusted center master key sssuch that

e⁢ta⁢u⁢t⁢h⁢s=gp⁢u⁢br1ss.
In embodiments in which the recipient trusted center public key corresponds to a point of an elliptic curve, the exponentiation function performed to determine the sender authentication key may be replaced with a scalar multiplication such that

e⁢ta⁢u⁢t⁢h⁢s=[1ss]⁢gp⁢u⁢br.

At step503, a recipient authentication key etauthrmay be determined by applying an exponentiation function of a base equal to the sender trusted center private key

P⁢r⁢vT⁢Cs
and an exponent equal to the sender trusted center master key sssuch that

e⁢ta⁢u⁢t⁢h⁢r=P⁢r⁢vT⁢Csss.
In some embodiments in which the sender trusted center private key corresponds to a point of an elliptic curve, the exponentiation function may be replaced with a scalar multiplication according to which

e⁢ta⁢u⁢t⁢h⁢r=[ss]⁢P⁢r⁢vT⁢Cs.

The sender and recipient authentication keys may be disseminated to the sender103and the recipient105.

FIG.6is a flowchart depicting a method for determining, at the sender103, a ciphertext set comprising an encrypted message, according to the EncryptET algorithm, the ciphertext set C1={V, U, C(M), Y} comprises, in addition to the encrypted message C(M), the a first component V, a second component U, and a third component Y.

At step601, the inputs of the EncryptET algorithm may be received, including the recipient identifier IDreci, a sender private key Prvsend, a given message M, the sender and recipient system parameters PKsand PKr, and sender authentication key etauths.

At step602, the sender trusted center public key may be verified by comparing a first value e(Prvsend,gpubs) to a second value

e⁡(gsend,gIDT⁢Cs).

If it is determined at step602that the sender trusted center public key is not verified, i.e. if it is determined at step602that

e⁡(P⁢r⁢vsend,gpubs)≠e⁡(gsend,⁢gIDT⁢Cs),
then the processing may end at step603.

If it is determined at step602that the sender trusted center public key is verified, i.e. if it is determined at step602that

e⁡(P⁢r⁢vsend,⁢gpubs)=e⁡(gsend,⁢gIDT⁢Cs),
then the sender authentication key may be verified at step604by comparing a third value e(gpubs,etauths) to a fourth value

e⁡(gIDTCs,gp⁢u⁢br).

If it is determined at step604that the sender authentication key is not verified, i.e. if it is determined at step604that

e⁡(gp⁢u⁢bs,eta⁢u⁢t⁢h⁢s)≠e⁡(gIDTCs,gp⁢u⁢br),
then the processing may be interrupted at step605.

If it is determined at step604that the sender authentication key is verified, i.e. if it is determined at step604that

e⁡(gpubs,etauths)=e⁡(gIDTCs,gpubr),
then steps606to612may be performed to determine the ciphertext set.

At step606, a random secret key σ may be generated.

At step607, a recipient public key grecimay be determined by applying the first cryptographic hash function H1to the recipient identifier IDrecisuch that greci=H1(IDreci).

At step608, an auxiliary value r may be determined by applying the third cryptographic hash function H3to the random secret value σ and the given message M such that r=H3(σ,M).

At step609, the first component V may be determined by applying an exponentiation function of a basis equal to the recipient trusted center public key gpubrcomprised in the recipient system parameters and an exponent equal to the auxiliary value, such that V=gpubrr. The exponentiation function may be replaced with a scalar multiplication according to which V=[r]gpubrif the recipient trusted center public key corresponds to a point of an elliptic curve.

At step610, the second component U may be determined by applying an addition operation to the random secret key σ and the output H2(e(grecir,H1(IDTCr))) of the application of the second cryptographic hash function H2to the output e(grecir, H1(IDTCr)) of the application of the bilinear map e to a first input grecirand a second input H1(IDTCr), the first input grecirbeing given by the recipient public key grecito the power the auxiliary value r, the second input H1(IDTCr) being given by the output of the application of the first cryptographic hash function H1to the recipient trusted center identifier IDTCr. The second component is accordingly given by U=σ+H2(e(grecir, H1(IDTCr). The addition operation may be performed over2[x] in which case, the addition operation is an XOR operation.

At step611, an encrypted message C(M) may be determined by applying a cipher Eσto the given message M, the cipher Eσusing the random secret key σ as encryption key.

At step612, the third component Y may be determined by applying the second cryptographic hash function H2to the output

e⁡(P⁢r⁢vsend,gIDT⁢Cs)×e⁡(gIDT⁢Cr,⁢gr⁢e⁢c⁢i)
of the product between a first input

e⁡(P⁢r⁢vsend,gIDT⁢Cs)
and a second input

e⁡(gIDT⁢Cr,⁢gr⁢e⁢c⁢i)
to the power the auxiliary value r, the first input

e⁡(P⁢r⁢vsend,gIDT⁢Cs)
being the output of the application of the bilinear map e to the sender private key Prvsendand the intermediate sender trusted center public key

gIDT⁢Cs.
The second input

e⁡(gIDT⁢Cr,⁢gr⁢e⁢c⁢i)
is the output of the application of the bilinear map e to an intermediate recipient trusted center public key

gIDT⁢Cr
and the recipient public key greci. The third component is accordingly given by

Y=H2⁡((e⁡(P⁢r⁢vsend,gIDT⁢Cs)×e⁡(gIDT⁢Cr,gr⁢e⁢c⁢i))r).

At step613, the ciphertext set C1={V, U, C(M), Y} may be output.

FIG.7is a flowchart depicting a method for determining a recovered original message at the recipient105, according to a DecryptET algorithm.

At step701, the inputs of the DecryptET algorithm may be received, including the recipient identifier IDreci, the recipient private key Prvreci, the sender identifier IDsend, the ciphertext set C1={V, U, C(M), Y}, the sender and recipient system parameters PKsand PKr, the two public authentication keys etauthsand etauthr, and the sender trusted center public key gpubs.

At step702, the recipient trusted center public key may be verified by comparing the output e(Prvreci,gpubr) of the application of the bilinear map e to the recipient private key Prvreciand the recipient trusted center public key gpubrto the output

e⁡(gr⁢e⁢c⁢i,gIDT⁢Cr)
of the application of the bilinear map e to the recipient public key greciand the intermediate trusted center public key

gIDT⁢Cr.

If it is determined at step702that the recipient trusted center public key is not verified, i.e. if it is determined at step702that

e⁡(P⁢r⁢vr⁢eci,gp⁢u⁢br)≠e⁡(gr⁢eci,gIDT⁢Cr),
then the processing may be interrupted at step703.

If it is determined at step702that the recipient trusted center public key is verified, i.e. if it is determined at step702that

e⁡(Pr⁢vr⁢eci,gp⁢u⁢br)=e⁡(gr⁢eci,gIDT⁢Cr),
then the recipient authentication key etauthrand the sender trusted center public key gpubsmay be verified at step704by comparing the output e(gpubr, etauthr) of the application of the bilinear map e to the recipient trusted center public key gpubrcomprised in the recipient system parameters and the recipient authentication key etauthr, to the output

e⁡(gIDT⁢Cr,⁢gp⁢u⁢bs)
of the application of the bilinear map e to the intermediate recipient trusted center public key

gIDT⁢Cr
and the sender trusted center public key gpubs.

If it is determined at step704that the recipient authentication key and the sender trusted center public key are not verified, i.e. if it is determined at step704that

e⁡(gp⁢u⁢br,⁢e⁢ta⁢u⁢t⁢h⁢r)≠e⁡(gIDT⁢Cr,⁢gp⁢u⁢bs),
then the processing may be stopped at step705.

If it is determined at step704that the recipient authentication key and the sender trusted center public key are verified, i.e. if it is determined at step704that

e⁡(gp⁢u⁢br,eta⁢u⁢t⁢h⁢r)=e⁡(gIDT⁢Cr,gp⁢u⁢bs),
then the sender authentication key etauthsmay be verified at step706by comparing the output e(gpubs,etauths) of the application of the bilinear map e to the sender trusted center public key gpubsand the sender authentication key etauths, to the output

e⁡(gIDTCs,gp⁢u⁢br)
of the application of the bilinear map e to the intermediate sender trusted center public key

gIDT⁢Cs
and the recipient trusted center public key gpubr.

If it is determined at step706that the sender authentication key is not verified, i.e. if it is determined at step706that

e⁡(gp⁢u⁢bs,eta⁢u⁢t⁢h⁢s)≠e⁡(gIDTCs,gp⁢u⁢br),
then the processing may be ended at step707.

If it is determined at step706that the sender authentication key is verified, i.e. if it is determined at step706that

e⁡(gpubs,etauths)=e⁡(gIDTCs,gpubr),
then steps708to710may be performed to determine a recovered original message.

At step708, a sender public key gsendmay be determined by applying the first cryptographic hash function H1to the sender identifier IDsendsuch that gsend=H1(IDsend).

At step709, a secret key σ=U−H2(e(Prvreci,V)) may be determined by applying a subtraction operation between the second component U comprised in the received ciphertext set and the output H2(e(Prvreci, V)) of the application of the second cryptographic hash function H2to the result of the application of the bilinear map e to the recipient private key Prvreciand the first component V comprised in the ciphertext set. The subtraction operation may be performed over[x] in which case, the subtraction operation is an XOR operation.

At step710, an original message M may be recovered/determined by decrypting the encoded message C(M) comprised in the received ciphertext set using a decipher Dσthat uses the secret key σ as a decryption key.

At step711, an auxiliary value r may be determined by applying the third cryptographic hash function to the secret key and the recovered original message such that r=H3(σ, M).

At step712, the sender identify IDsendmay be verified by comparing the third component Y comprised in the ciphertext set to the output

H2⁡((e⁡(gsend,gIDT⁢Cs)×e⁡(e⁢ta⁢u⁢t⁢h⁢s,P⁢r⁢vr⁢e⁢c⁢i))r)
of the application of the second cryptographic hash function H2to a value

e⁡(gsend,gIDT⁢Cs)×e⁡(e⁢ta⁢u⁢t⁢h⁢s,P⁢r⁢vr⁢e⁢c⁢i)
to the power the auxiliary value r, the value being given by the product between:the output

e⁡(gsend,gIDT⁢Cs)
of the application of the bilinear map e to the sender public key gsendand the intermediate sender trusted center public key

gIDT⁢Cs,
andthe output e(etauths,Prvreci) of the application of the bilinear map e to the sender authentication key etauthsand the recipient private key Prvreci.

If it is determined at step712that the sender identity is not verified, i.e. if it is determined at step712that

Y≠H2⁡((e⁡(gsend,gIDT⁢Cs)×e⁡(e⁢ta⁢u⁢t⁢h⁢s,P⁢r⁢vr⁢e⁢c⁢i))r),
then the processing may be interrupted at step713.

If it is determined at step712that the sender identity is verified, i.e. if it is determined at step712that

Y=H2⁡((e⁡(gsend,gIDT⁢Cs)×e⁡(e⁢ta⁢u⁢t⁢h⁢s,P⁢r⁢vr⁢e⁢c⁢i))r),
then the recovered original message may be output at step714.

A proof of exchange is presented hereinafter according to the various embodiments of the invention and the algorithms PubKeyGenET, EncryptET, and DecryptET.

The algorithm EncryptET exploits the following variables:

gp⁢u⁢bs=gIdTCsss;e⁢ta⁢u⁢t⁢h⁢s=gIdTCrsrss,and⁢⁢gp⁢u⁢br=gIdTCrsr.

The verification of the validity of etauthssucceeds if the following equality is satisfied:

e⁡(gp⁢u⁢bs,eta⁢u⁢t⁢h⁢s)=e⁡(gIDTCsss,gIDTCrsrss)=e⁡(gIDTCs,gIDTCrsr)=e⁡(gIDTCr,gpubr)

The steps702,704, and706of the algorithm DecryptET allow to verify the identity of the sender. The DecryptET exploits the following variables:

Pr⁢vrecipient=greci1sr;gpubr=gIdTCrsr;e⁢ta⁢u⁢t⁢h⁢r=gIdTCssssr;gp⁢u⁢bs=gIdTCsss,e⁢ta⁢u⁢t⁢h⁢s=gIdTCrsrss;V=gp⁢u⁢brr=gIdTCrsrr,where⁢⁢r=H3⁡[σ,M];U=σ⊕H2⁡[e⁡(gr⁢e⁢c⁢ir,H1⁡[IdT⁢Cr])];⁢W=Eσ⁡(M),and⁢⁢Y=H2⁡[e⁡(P⁢r⁢vsend,gIdTCs)×e⁡(gIdTCr,gr⁢e⁢c⁢i)r].

The verification of the sender trusted center public key is successful if the following equality is satisfied:

e⁡(P⁢r⁢vr⁢e⁢c⁢i,gp⁢u⁢br)=e⁡(greci1sr,gIdTCrsr)=e⁡(gr⁢e⁢c⁢i⁢p⁢i⁢e⁢n⁢t,gIdT⁢Cr).

Similarly, the verification of etauthris successful of the following equation is satisfied:

e⁡(gp⁢u⁢bs,eta⁢u⁢t⁢h⁢r)=e⁡(gIdTCrsr,gIdTCssssr)=e⁡(gIdTCr,gIdTCsss)=e⁡(gIdTCr,gpubs).

Additionally, this verification allows to verify the public key gpubsof the sender trusted center. This validation is necessary to the validation of the sender authentication key etauths.

The final verification of the DecryptET algorithm is successful if the following equality is satisfied:

e⁡(gp⁢u⁢bs,eta⁢u⁢t⁢h⁢s)=e⁡(gIdTCsss,gIdTCrsrss)=e⁡(gIdTCs,gIdTCrsr)=e⁡(gIdTCs,gpubr).

The original message can be recovered using the decrypting process.

Thus, the secret key σ=U−H2(e(V, sk)) allows deciphering W=Eσ(M) by computing Dσ(W)=Dσ(Eσ(M))=M.

The authentication of the sender is checked at step712.

There is also provided a program stored in a computer-readable non-transitory medium for sending an encrypted message M(C) from a sender103to a recipient105in an identity-based cryptosystem100. The cryptosystem comprises a sender trusted center101connected to the sender103and a recipient trusted center102connected to the recipient105. In the identity-based cryptosystem100, the sender103is associated with a sender identifier IDsend, the recipient is associated with a recipient identifier IDreci, the sender trusted center is associated with a sender trusted center identifier IDTCs, and the recipient trusted center is associated with a recipient trusted center identifier IDTCr. The program comprises instructions stored on the computer-readable storage medium, that, when executed by a processor, cause the processor to:determine sender system parameters PKsand a sender trusted center master key ssat the sender trusted center101from a sender trusted center security parameter λsand a sender trusted center identifier IDTCsassociated with the sender trusted center101, according to a setup algorithm that takes as inputs the sender trusted center security parameter λsand the sender trusted center identifier IDTCsand outputs sender system parameters PKsand a sender trusted center master key ss;determine recipient system parameters PKrand a recipient trusted center master key srat the recipient trusted center102from a recipient trusted center security parameter λrand a recipient trusted center identifier IDTCrassociated with the recipient trusted center102, according to a setup algorithm that takes as inputs the recipient trusted center security parameter λrand the recipient trusted center identifier IDTCrand outputs recipient system parameters PKrand a recipient trusted center master key sr;determine a sender private key Prvsendat the sender trusted center101from the sender trusted center master key ss, the sender system parameters PKs, and the sender identifier IDsend, by applying a KeyGen algorithm that takes as inputs the sender trusted center master secret key ss, the sender identifier IDsend, and the sender system parameters PKs, and outputs the sender private key Prvsend;determine a recipient private key Prvreciat the recipient trusted center102from the recipient trusted center master key sr, the recipient system parameters PKr, and the recipient identifier IDreci, by applying a KeyGen algorithm that takes as inputs the recipient trusted center master secret key sr, the recipient identifier IDreci, and the recipient system parameters PKr, and outputs the recipient private key Prvreci;determine a sender trusted center private key

Pr⁢vT⁢Cs
at the recipient trusted center102from the recipient trusted center master key sr, the recipient system parameters PKr, and the sender trusted center identifier IDTCs, by applying a KeyGen algorithm that takes as inputs the recipient trusted center master secret key sr, the sender trusted center identifier IDTCs, and the recipient system parameters PKr, and outputs the sender trusted center private

P⁢r⁢vT⁢Cs;determine, at the sender trusted center101, two public authentication keys comprising a sender authentication key etauthsand a recipient authentication key etauthrfrom the sender trusted center master key ss, the sender trusted center private key

P⁢r⁢vT⁢Cs,
and the recipient trusted center public key gpubr, according to a PubKeyGen algorithm that takes as inputs the sender trusted center master key ss, the sender trusted center private key

P⁢r⁢vT⁢Cs,
and the recipient system parameters and outputs the two public authentication keys;send the two public authentication keys by the sender trusted center101to the sender103and received at the sender103;determine, at the sender103, a ciphertext set C1comprising an encrypted message C(M) if the verifications of the sender trusted center public key gpubs, the recipient trusted center public key gpubr, and the sender authentication key etauthssucceeds, according to the EncryptET algorithm that takes as inputs the recipient identifier, the sender private key, the sender identifier, a given message M∈and the sender and recipient system parameters, and outputs the ciphertext set C1;send the ciphertext set C1from the sender103to the recipient105;receive, at the recipient105, the ciphertext set C1, authenticate the sender103, and recover the original message, according to a DecryptET algorithm that takes as inputs the recipient identifier, the recipient private key, the sender identifier, the ciphertext set, the sender and recipient system parameters, the sender trusted center public key and the two public authentication keys, and outputs a recovered original message M.

The methods and devices described herein may be implemented by various means. For example, these techniques may be implemented in hardware, software, or a combination thereof. For a hardware implementation, the processing elements of the different devices operating in the system100can be implemented for example according to a hardware-only configuration (for example in one or more FPGA, ASIC, or VLSI integrated circuits with the corresponding memory) or according to a configuration using both VLSI and Digital Signal Processor (DSP).

FIG.8is a block diagram representing an exemplary hardware/software architecture of a device80operating in the cryptosystem100such as the sender103, the recipient105, the sender trusted center101, or the recipient trusted center102, according to some embodiments of the invention.

As illustrated, the architecture may include various computing, processing, storage, communication, sensing, and displaying units comprising:communication circuitry comprising a transceiver82and a transmit/receive element81(e.g. one or more antennas) configured to connect the device to corresponding links in the cryptosystem100(e.g. connecting the sender103to the sender trusted center101or connecting the recipient105to the recipient trusted center102or connecting the recipient105to the sender103or connecting the sender trusted center101to the recipient trusted center102), and to ensure transmission/reception of exchanged data (e.g. the sender identifier sent from the sender103to the sender trusted center101, or the recipient identifier sent from the recipient105to the recipient trusted center102, or the sender private key sent from the sender trusted center101to the sender103, or the recipient private key sent from the recipient trusted center102to the recipient105, or sender trusted center identifier sent from the sender trusted center101to the recipient trusted center102, or the sender trusted center private key sent from the recipient trusted center102to the sender trusted center101, or the sender authentication key and the recipient authentication key sent from the sender trusted center101to the sender103and to the recipient105). The communication circuitry may support various network and air interface such as wired and wireless networks (e.g. wireless local area networks and cellular networks);a processing unit84configured to execute the computer-executable instructions to run the methods and algorithms according to the various embodiments of the invention for to perform the various required functions of the device such as data computation, encryption/decryption operations, generation and processing of random keys and values, and any functionalities required to enable the device to operate in the cryptosystem100according to the embodiments of the invention. The processing unit84may be a general purpose processor, a special purpose processor, a DSP, a plurality of microprocessors, a controller, a microcontroller, an ASIC, an FPGA circuit, any type of integrated circuit, and the like;a power source83that may be any suitable device providing power to the device80such as dry cell batteries, solar cells, and fuel cells;a storage unit85possibly comprising a random access memory (RAM) or a read-only memory used to store processed data (e.g. the sender identifier, the recipient identifier, the sender trusted center identifier, the recipient trusted center identifier, the sender system parameters, the recipient system parameters, the sender public key, the recipient public key, the sender private key, the recipient private key, the sender trusted center master key, the recipient trusted center master key, the sender authentication key, the recipient authentication key, etc.) and any data required to perform the functionalities of the device80according to the embodiments of the invention;Input peripherals86;Output peripherals87comprising communication means such as displays enabling for example man-to-machine interaction with the device80for example for configuration and/or maintenance purposes.

The architecture of the device80may further comprise one or more software and/or hardware units configured to provide additional features, functionalities and/or network connectivity.

Furthermore, the method described herein can be implemented by computer program instructions supplied to the processor of any type of computer to produce a machine with a processor that executes the instructions to implement the functions/acts specified herein. These computer program instructions may also be stored in a computer-readable medium that can direct a computer to function in a particular manner. To that end, the computer program instructions may be loaded onto a computer to cause the performance of a series of operational steps and thereby produce a computer implemented process such that the executed instructions provide processes for implementing the functions specified herein.

It will be understood that the configurations and/or approaches described herein are exemplary in nature, and that these specific embodiments or examples are not to be considered in a limiting sense, because numerous variations are possible. The specific routines or methods described herein may represent one or more of any number of processing strategies. As such, various acts illustrated and/or described may be performed in the sequence illustrated and/or described, in other sequences, in parallel, or omitted. Likewise, the order of the above-described processes may be changed.

The subject matter of the present disclosure includes all novel and non-obvious combinations and sub-combinations of the various processes, systems and configurations, and other features, functions, acts, and/or properties disclosed herein, as well as any and all equivalents thereof.