Method and system for providing a public key/secret key pair for encrypting and decrypting data

• US 20140177830A1
• Filed: 09/03/2013
• Published: 06/26/2014
• Est. Priority Date: 09/03/2012
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Europe Ltd
• Inventors: GAJEK, Sebastian
• Granted Patent: US 9,256,763 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 2209/046 of operations, operands or results of the operations
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for providing a public key/secret key pair for encrypting and decrypting data, wherein the public key of the public key/secret key pair and a master secret key are generated based on predefined policy information, and wherein the secret key of the public key/secret key pair is generated based on the generated master secret key and predefined attribute information. A method for accessing a system in an untrusted environment and a system for providing a public key/secret key pair for encrypting and decrypting data as well as a use for access control are also described.

Claims

1. A method for providing a public key/secret key pair (PK_f, SK_A, SK_B) for encrypting and decrypting data,

characterized in that

the public key (PK_f) of the public key/secret key pair and a master secret key (MSK) are generated based on predefined policy information (f), and that

the secret key (SK_A, SK_B) of the public key/secret key pair is generated based on the generated master secret key (MSK) and predefined attribute information (A₁, A₂).

2. The method according to claim 1, characterized in that the attribute information (A₁, A₂) is provided in form of a plurality of attributes (A₁, A₂), preferably based on predefined system parameters.

3. The method according to claim 1, characterized in that the policy information (f) is provided in form of an evaluation function describing one or more predefined policies (f), preferably access policies.

4. The method according to claim 3, characterized in that the evaluation function (f) is provided representing a Boolean expression.

5. The method according to claim 3, characterized in that the evaluation function (f) is a predicate over conjunction (AND), disjunction (OR) and/or threshold (TRESHOLD) gates.

6. The method according to claim 3, characterized in that the evaluation function (f) is dependent on the attribute information (A₁, A₂).

7. The method according to claim 1, characterized in that the generation of the public key (PK_f) and the generation of the secret key (SK_A, SK_B) are performed by different parties, preferably having concurrent trust relationships.

8. A method for accessing a system (c) in an untrusted environment by a user according to one or more access policies (f), characterized by the steps of

a) Encrypting challenge data (T1, T1′

, S1), preferably in form of a random number (r, r′

), with a public key (PK_f) generated according to a method of claim 1 and with policy information (f) representing at least one of the access policies,

b) Decrypting (T2, T2′

, S2) the encrypted challenge data by the user (U1, U2) with a secret key (SK_A, SK_B) generated with attribute information (A₁, A₂) representing user access information for the system (c),

c) Checking (S3) whether the decrypted information matches the unencrypted challenge data and

d) Upon matching granting (T3′

, S4) access to the system for the user (U2).

9. A system for providing a public key/secret key pair for encrypting and decrypting data, preferably for performing with a method according to claim 1,

characterized by

setup means (SM) operable to generate the public key (PK_f) of the public key/secret key pair and a master secret key (MSK) based on policy information (f), and

key generating means (KGM) operable to generate the secret key (SK_A, SK_B) of the public key/secret key pair based on the generated master secret key (MSK) and attribute information (A₁, A₂).

10. Method for accessing control to a system (c) in an untrusted environment, preferably a system located in the cloud, which comprises using the method of claim 1.