Light weight authentication and secret retrieval

• US 8,595,504 B2
• Filed: 08/12/2008
• Issued: 11/26/2013
• Est. Priority Date: 08/12/2008
• Status: Active Grant

• Current Assignee: Industrial Technology Research Institute
• Original Assignee: Industrial Technology Research Institute
• Inventors: Huang, Shih-I, Shieh, Shiuh-Pyng, Chang, Sheng-Ming, Wang, Chi-Wei
• Primary Examiner(s): Davis, Zachary A
• Assistant Examiner(s): Pan, Joseph
• Application Number:
  US12/190,238
• Publication Number:
  US 20100042842A1
• Time in Patent Office: 1,932 Days
• Field of Search: 713/161, 713/168, 713/170, 713/176, 713/180, 726/2, 380/229
• US Class Current: 713/176
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A method for authenticating a message in a network is provided. The method includes a step of generating, in a sink device, a private key and a public key. The private key includes a plurality of sub-private keys. The method further includes a step of generating, in the sink device, a signature for the message. The signature includes a sub-private key and an authentication path associated with the sub-private key in a hash tree. The hash tree is constructed during the generation of the sub-public keys.

Claims

1. A method for authenticating a message in a network, the method comprising:

generating, in a sink device, a private key and a public key, wherein the private key comprises a plurality of sub-private keys and the public key comprises a plurality of sub-public keys, the generation of the public key comprising;

hashing the sub-private keys;

constructing a plurality of hash trees, the hash trees comprising a plurality of leaf nodes, root nodes, and intermediate nodes between the leaf nodes and the root nodes, wherein the leaf nodes are the hashed sub-private keys; and

selecting the root nodes of the hash trees as the sub-public keys; and

generating, in the sink device, a signature for the message, wherein the signature comprises one of the sub-private keys and an authentication path associated with the one of the sub-private keys in a first one of the hash trees, and the generation of the signature comprises;

hashing the message into a hash value;

splitting the hash value into k piece(s), wherein one value of the k piece(s) is k1;

using k1 as an index to select the one of the sub-private keys; and

using the one of the sub-private keys to select the authentication path.

2. The method of claim 1 further comprising:

transmitting the public key, the message, and the signature from the sink device to a tag device; and

verifying, in the tag device, the signature by constructing a first verifying hash tree using the sub-private key and the authentication path.

3. The method of claim 2 further comprising storing, in the tag device, the message if the signature is verified.

4. The method of claim 3, wherein the signature is a first signature and the authentication path is a first authentication path, the method further comprising:

generating, in the sink device, a search message for searching the message stored in the tag device; and

generating, in the sink device, a second signature for the search message, wherein the second signature comprises a second one of the sub-private keys and a second authentication path associated with the second one of the sub-private keys in a second one of the hash trees.

5. The method of claim 4, further comprising:

transmitting the search message and the second signature from the sink device to the tag device; and

verifying, in the tag device, the second signature by constructing a second verifying hash tree using the second one of the sub-private keys and the second authentication path.

6. In an authentication system, a method for a tag device to verify a message from a sink device, wherein the sink device has a computation capability greater than the tag device, the method comprising:

generating, in the sink device, a private key and a public key, wherein the private key comprises a plurality of sub-private keys and the public key comprises a plurality of sub-public keys;

storing, in the sink device, the private key;

generating, in the sink device, a signature for the message, wherein the signature comprises one of the sub-private keys and an authentication path associated with the one of the sub-private keys in a hash tree, the hash tree being constructed during the generation of the sub-public keys, and wherein the generation of the signature comprises;

hashing the message into a hash value;

splitting the hash value into k piece(s), wherein one value of the k piece(s) is k1;

using k1 as an index to select the one of the sub-private keys; and

using the one of the sub-private keys to select the authentication path; and

transmitting the public key, the message, and the signature from the sink device to the tag device,

wherein the generation of the public key comprises;

hashing the sub-private keys;

constructing a plurality of hash trees, the hash trees comprises a plurality of leaf nodes, root nodes, and intermediate nodes between the leaf nodes and the root node, wherein the leaf nodes are the hashed sub-private keys; and

selecting root nodes of the hash trees as the sub-public keys.

7. The method of claim 6, wherein

the quantity of the sub-private keys is t and the quantity of the hash trees is d,

wherein a height of each of the hash trees is equal to (ln t−

ln d).

8. The method of claim 6, wherein

the one of the sub-private keys is a first sub-private key, and the authentication path is a first authentication path;

and

wherein the generation of the signature for the message in the sink device further comprising;

selecting a second sub-private key in a second hash tree; and

selecting a second authentication path associated with the second sub-private key.

9. The method of claim 6, wherein the hash value is a first hash value, and wherein the verification of the signature in the tag device further comprises:

generating a second hash value by computing the message;

splitting the second hash value into m piece(s), wherein one value of the m piece(s) is m1;

selecting a sub-public key in the public key by using ml as an index; and

verifying the sub-public key.

10. A method for uploading a message from a sink device into a tag device, wherein the sink device has a computation capability greater than the tag device, the method comprising:

generating, in the sink device, a private key, wherein the private key comprises a plurality of sub-private keys;

hashing the sub-private keys;

generating a public key by constructing a plurality of hash trees having root nodes, using the hashed sub-private keys as leaf nodes, wherein the root nodes of the hash trees are selected as the sub-public keys that form the public key;

encrypting the message into an encrypted message;

generating a signature for the encrypted message in the sink device by;

hashing the message into a hash value;

splitting the hash value into k piece(s), wherein one value of the k piece(s) is k1;

using k1 as an index to select one of the sub-private keys; and

selecting an authentication path associated with the one of the sub-private keys; and

transmitting the encrypted message and the signature to the tag device.

11. The method of claim 10, further comprising verifying, in the tag device, the signature;

and storing, in the tag device, the message if the signature is verified.

12. The method of claim 10, wherein the selected authentication path in the hash tree does not comprise the root node of the hash tree.

13. The method of claim 10, wherein the encryption of the message further comprises:

hashing the message to be a first hash value;

hashing a secret to be a second hash value; and

computing the message with the first hash value and the second hash value by an operation of exclusive disjunction,

wherein the secret is shared by the sink device and the tag device.

14. A method for a sink device to search an encrypted message stored in a tag device without decryption of the encrypted message, the sink device having a computation capability greater than the tag device, the method comprising:

hashing, in the sink device, a message to be a first hash value;

hashing, in the sink device, a secret to be a second hash value, wherein the secret is shared between the sink device and the tag device;

hashing, in the sink device, an index message to be a third hash value, wherein the index message is associated with the message;

encrypting, in the sink device, the message by an operation of exclusive disjunction over the message, the first hash value, and the second hash value, and encrypting the index message by an operation of exclusive disjunction over the index message, the second hash value, and the third hash value;

generating, in the sink device, a first signature for the encrypted message and the encrypted index message; and

storing, in the tag device, the encrypted message and the encrypted index message.

15. The method of claim 14, further comprising:

generating, in the sink device, a search message by an operation of exclusive disjunction over the index message and the third hash value;

generating, in the sink device, a second signature for the search message;

transmitting the search message and the second signature to the tag node;

computing, in the tag device, the search message with the second hash value by an operation of exclusive disjunction to obtain an index verification;

comparing the index verification with the encrypted index message; and

transmitting the encrypted message from the tag device to the sink device if the index verification is equal to the encrypted index message.

16. The method of claim 15, further comprising:

generating, in the sink device, a private key, wherein the private key comprises a plurality of sub-private keys;

hashing, in the sink device, the sub-private keys;

generating, in the sink device, a public key by constructing a plurality of hash trees using the hashed sub-private keys as leaf nodes; and

storing, in the tag device, the public key.

17. The method of claim 16, wherein the second signature comprises a second sub-private key and a second authentication path in a third hash tree, the method further comprising:

verifying, in the tag device, the second signature by constructing a fourth hash tree with the second sub-private key and the second authentication path to compute a root node of the fourth hash tree, and by comparing the root node of the fourth hash tree with the public key.

18. A system comprising:

a sink device; and

a tag device, the sink device comprising;

a memory for storing instructions and data; and

a processor coupled to the memory, the processor operable to execute instructions stored in the memory for;

generating a private key and a public key, wherein the private key comprises a plurality of sub-private keys and the public key comprises a plurality of sub-public keys, the generation of the public key comprising;

hashing the sub-private keys;

constructing a plurality of hash trees, the hash trees comprising a plurality of leaf nodes, a root node, and intermediate nodes between the leaf nodes and the root node, wherein the leaf nodes are the hashed sub-private keys; and

selecting the root nodes of the hash trees as the sub-public keys;

generating a signature for a message, wherein the signature comprises one of the sub-private keys and an authentication path associated with the one of the sub-private keys in one of the hash trees, and wherein the generation of the signature comprises;

hashing the message into a hash value;

splitting the hash value into k piece(s), wherein one value of the k piece(s) is k1;

using k1 as an index to select the one of the sub-private keys; and

using the one of the sub-private keys to select the authentication path; and

transmitting the public key, the message and the signature from the sink device to the tag device.

19. The system of claim 18, wherein the memory is a first memory and the processor is a first processor, and wherein the tag device comprises:

a second memory; and

a second processor coupled to the second memory, the second processor operable to execute instructions in the second memory for verifying the signature by constructing a verifying hash tree using the sub-private key and the authentication path.

20. A system for uploading a message in a network, the system comprising:

a sink device and a tag device, the sink device comprising;

a memory for storing instructions and data; and

a processor coupled to the memory, the processor operable to execute instructions stored in the memory for;

generating a private key, wherein the private key comprises a plurality of sub-private keys;

hashing the sub-private keys;

generating a public key by constructing a plurality of hash trees having root nodes, using the hashed sub-private keys as leaf nodes, wherein the root nodes of the hash trees are selected as the sub-public keys constituting the public key;

encrypting the message into an encrypted message;

generating a signature for the encrypted message by;

hashing the message into a hash value;

splitting the hash value into k piece(s), wherein one value of the k piece(s) is k1;

using k1 as an index to select one of the sub-private keys; and

selecting an authentication path associated with the one of the sub-private keys; and

transmitting the encrypted message and the signature to the tag device.

21. The system of claim 20, wherein the selected authentication path in one of the hash trees does not comprise the root node of the one of the hash trees.

22. A system for searching an encrypted message within a network without decryption of the encrypted message, the system comprising:

a tag device; and

a sink device, the sink device comprising;

a first memory for storing instructions and data; and

a first processor coupled to the first memory, the first processor operable to execute instructions stored in the first memory for;

hashing a message to be a first hash value;

hashing a secret to be a second hash value, wherein the secret is shared between the sink device and the tag device;

hashing an index message to be a third hash value, wherein the index message is associated with the message;

encrypting the message by an operation of exclusive disjunction over the message, the first hash value, and the second hash value, and encrypting the index message by an operation of exclusive disjunction over the index message, the second hash value, and the third hash value;

generating a first signature for the encrypted message and the encrypted index message;

transmitting the encrypted message, the encrypted index message, and the first signature to the tag device;

generating a search message by an operation of exclusive disjunction over the index message and the third hash value;

generating a second signature for the search message in the sink device; and

transmitting the search message and the second signature to the tag node.

23. The system of claim 22, wherein the tag device comprises:

a second memory; and

a second processor coupled to the second memory, the second processor operable to execute instructions in the second memory for;

receiving the encrypted message, the encrypted index message, and the first signature;

storing the encrypted message and the encrypted index message in the second memory if the first signature is verified;

receiving the search message and the second signature;

verifying the second signature;

computing the search message and the second hash value to obtain an index verification;

comparing the index verification with the encrypted index message; and

transmitting the encrypted message to the sink device if the index verification is equal to the encrypted index message.