Communication of messages over networks

• US 10,250,576 B2
• Filed: 02/08/2017
• Issued: 04/02/2019
• Est. Priority Date: 02/08/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan Leonhard, Samelin, Kai
• Primary Examiner(s): Lemma, Samson B
• Application Number:
  US15/427,507
• Publication Number:
  US 20180227278A1
• Time in Patent Office: 783 Days
• Field of Search: 713153
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/008 involving homomorphic encryption
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

A method is provided for communicating messages between sender and receiver computers, connectable via a network to a system of servers, based on authentication of receiver passwords, associated with respective receiver IDs, by the system. A method is also provided for receiving a message from a sender based on authentication of a receiver password, associated with a receiver ID, by a system of servers, in a network, wherein each server stores for the ID a ciphertext produced by encrypting the receiver password under a public key via a homomorphic threshold encryption scheme having a threshold, and a key-share of a secret key corresponding to that public key, and stores an encrypted message from the sender encrypted under the public key. Systems are provided including servers, for communicating messages between sender and receiver computers based on authentication of receiver passwords, associated with respective receiver IDs, by the system.

Claims

1. A system comprising n≥

2 servers S_i, 1≤

i≤

n, for communicating messages between sender and receiver computers, connectable to said system via a network, in dependence on authentication of receiver passwords, associated with respective receiver IDs, by the system, wherein each server S_i comprises at least one hardware data processor connected with at least one memory that stores software instructions, and wherein execution of the software instructions by the at least one hardware data processor causes each server S_i;

to store, for each said receiver ID, a first ciphertext produced by encrypting the receiver password associated with that ID under a respective public key via a homomorphic threshold encryption scheme having a threshold t≤

n, and a key-share sk_i of a secret key corresponding to that public key;

in response to receipt from a sender computer of an encrypted message, produced by encrypting a message for a said receiver ID under the public key for that ID via said encryption scheme, to store the encrypted message;

in response to receipt from a receiver computer of a said receiver ID, to send said first ciphertext for that ID to the receiver computer and, following receipt from the receiver computer of an authentication value which comprises a predetermined function of that first ciphertext and a second ciphertext produced by encrypting a password attempt under the public key for that ID via said encryption scheme such that the authentication value decrypts to a predetermined value if the password attempt equals the receiver password for that ID, to produce a first decryption share dependent on the authentication value using said key-share sk_i for that ID; and

in response to receipt of said first decryption share produced by each of (t−

1) other servers S_i for the authentication value received for said ID, to determine from the t first decryption shares whether the authentication value decrypts to said predetermined value and, if so, to produce a second decryption share of a selected encrypted message using said key-share sk_i for that ID, and to send the second decryption share to said receiver computer.

2. A system as claimed in claim 1 wherein each server S_i is further caused, in a setup operation for a said receiver ID, to receive that receiver ID, said respective public key, said key-share sk_i, and said first ciphertext from a receiver computer.

3. A system as claimed in claim 2 wherein each server S_i is further caused to store said public key for each receiver ID and, in response to receipt from a sender computer of a said receiver ID, to send the public key for that ID to the sender computer.

4. A system as claimed in claim 2 wherein each server S_i is further caused to store said public key for each receiver ID and, in response to receipt from a receiver computer of a said receiver ID, to send the public key for that ID to the receiver computer.

5. A system as claimed in claim 1 wherein each server S_i is further caused to send said first decryption share to the receiver computer and to receive from the receiver computer said first decryption share produced by each of the (t−

1) other servers S_i.

6. A system as claimed in claim 1 wherein each server S_i is further caused to receive a session public key from said receiver computer supplying said receiver ID, and to encrypt said first decryption share under said session public key.

7. A system as claimed in claim 1 wherein each server S_i is further caused to publish at least a portion of said encrypted message received from said sender computer.

8. A system as claimed in claim 7 wherein each server S_i is further caused to receive at least said portion of said selected encrypted message from said receiver computer.

9. A system as claimed in claim 6 wherein each server S_i is further caused, in response to determination that said authentication value decrypts to said predetermined value, to send, encrypted under said session public key, at least a portion of each encrypted message stored by that server S_i to said receiver computer, and, in response to selection of a said encrypted message by the receiver computer, to produce said second decryption share of that encrypted message.

10. A system as claimed in claim 1 wherein said predetermined function and said first and second ciphertexts are constructed such that said authentication value encrypts a quotient of the user password and the password attempt via said encryption scheme.

11. A system as claimed in claim 10 wherein said predetermined value is one, and wherein the authentication value comprises said predetermined function of the first and second ciphertexts blinded with a random exponent r.

12. A system as claimed in claim 11 wherein each server S_i is further caused:

in response to receipt of the authentication value from said receiver computer, to produce a blinded value by blinding the authentication value with a random exponent r_i, and to send the blinded value to the receiver computer;

to receive from the receiver computer said blinded value produced by each of said (t−

1) other servers S_i and to combine the t blinded values to produce a randomized authentication value; and

to produce said first decryption share by decrypting the randomized authentication value using said key-share sk_i.

13. A system as claimed in claim 1 including at least one receiver computer, the receiver computer being adapted:

in response to receipt of said first ciphertext for a receiver ID and input of a password attempt for that ID, to produce said second ciphertext by encrypting the password attempt under the public key for that ID via said encryption scheme, to produce the authentication value comprising said predetermined function of the first ciphertext and the second ciphertext, and to send the authentication value to t servers S_i; and

in response to receipt of said second decryption share produced by each of said t servers S_i, to use the t second decryption shares to decrypt the selected encrypted message via a decryption algorithm of said encryption scheme.

14. A system as claimed in claim 13 wherein said receiver computer is further adapted to produce the authentication value by blinding said predetermined function of the first and second ciphertexts with a random exponent r.

15. A system as claimed in claim 13 wherein said receiver computer is further adapted, in a setup operation for a said receiver ID, to generate for that ID said public key and said key-share sk_i for each server S_i, and, in response to input of a receiver password for that ID, to produce the first ciphertext by encrypting the receiver password under the public key via said homomorphic threshold encryption scheme, to send the receiver ID, the first ciphertext and the public key to said servers S_i, and to send the key-shares sk_i to respective servers S_i.

16. A method for use in communicating messages between sender and receiver computers, connectable via a network to a system of n≥

2 servers S_i, 1≤

i≤

n, in dependence on authentication of receiver passwords, associated with respective receiver IDs, by said system, wherein each of the servers comprise at least one hardware data processor and at least one memory, the method comprising, at each server S_i;

storing, for each said receiver ID, a first ciphertext produced by encrypting the receiver password associated with that ID under a respective public key via a homomorphic threshold encryption scheme having a threshold t≤

n, and a key-share sk_i of a secret key corresponding to that public key;

in response to receipt from a sender computer of an encrypted message, produced by encrypting a message for a said receiver ID under the public key for that ID via said encryption scheme, storing the encrypted message;

in response to receipt from a receiver computer of a said receiver ID, sending said first ciphertext for that ID to the receiver computer and, following receipt from the receiver computer of an authentication value which comprises a predetermined function of that first ciphertext and a second ciphertext produced by encrypting a password attempt under the public key for that ID via said encryption scheme such that the authentication value decrypts to a predetermined value if the password attempt equals the receiver password for that ID, producing a first decryption share dependent on the authentication value using said key-share sk_i for that ID; and

in response to receipt of said first decryption share produced by each of (t−

1) other servers S_i for the authentication value received for said ID, determining from the t first decryption shares whether the authentication value decrypts to said predetermined value and, if so, producing a second decryption share of a selected encrypted message using said key-share sk_i for that ID, and sending the second decryption share to said receiver computer.

17. A method as claimed in claim 16 including, at the server S_i:

receiving, in a setup operation for a said receiver ID, that receiver ID, said respective public key, said key-share sk_i, and said first ciphertext from a receiver computer and further storing said public key for that ID;

in response to receipt from a sender computer of a said receiver ID, sending the public key for that ID to the sender computer; and

in response to receipt from a receiver computer of a said receiver ID, sending the public key for that ID to the receiver computer.

18. A method as claimed in claim 16 including, at the server S_i, sending said first decryption share to the receiver computer and receiving from the receiver computer said first decryption share produced by each of said (t−

1) other servers S_i.

19. A method for receiving a message from a sender computer via a network in dependence on authentication of a receiver password, associated with a receiver ID, by a system of n≥

2 servers S_i, 1≤

i≤

n, in said network, wherein each server S_i stores for said receiver ID a first ciphertext produced by encrypting said receiver password under a public key via a homomorphic threshold encryption scheme having a threshold t≤

n, and a key-share sk_i of a secret key corresponding to that public key, and further stores an encrypted message, received from the sender computer, produced by encrypting said message under said public key via said encryption scheme, wherein each server comprises at least one hardware data processor and at least one memory, the method comprising, at a receiver computer;

sending the receiver ID to said system of servers;

in response to receipt, from said system of servers, of said first ciphertext and input of a password attempt for the receiver ID, producing a second ciphertext by encrypting the password attempt under said public key via said encryption scheme and producing an authentication value comprising a predetermined function of the first ciphertext and the second ciphertext such that the authentication value decrypts to a predetermined value if the password attempt equals the receiver password;

sending the authentication value to t servers S_i for production, at respective servers, of t first decryption shares dependent on the authentication value using respective key-shares sk_i of the t servers and determination at the t servers, from the t first decryption shares, whether the authentication value decrypts to said predetermined value;

receiving from each of said t servers S_i a second decryption share of said encrypted message produced by that server S_i using the key-share sk_i thereof; and

using the t second decryption shares to decrypt the encrypted message via a decryption algorithm of said encryption scheme.