Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
  • H04L63/102—Entity profiles
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

• the present disclosure relates to a method and a computer system for controlling access to tokens in a distributed data transaction system.
• the present disclosure relates to computer-implemented method and a computer system for controlling access of a user device to tokens in a distributed data transaction system implemented on one or more node devices of a network.
• Computer networks require users or events to be adequately identified before access is granted, or prior to performing any computations or exchanging data.
• the authentication of devices, objects or computable documents hereafter and without loss of generality, tokens, or parts of those tokens thereof) that a valid user can subsequently manipulate to store or disseminate information, or grating the ability to perform transactions in a computer network.
• Tokens are typically data containers that store user-specific information (a data store) and register the result of operations, be it transactions or computations involving data already stored in them or otherwise exchanged.
• nodes In a distributed platform there are multiple computing entities, usually denoted as nodes, that are tasked to perform, and eventually keep a record of, any instructions issued by a valid user manipulating the tokens, typically involving exchanges of information registered, in whole or in part, in those data stores.
• any authenticated tokens should be uniquely associated and exclusively handled by a valid userand bealso independently recognized as valid constructs by the participating nodes in the computer network.
• KGC Key Generation Center
• CLI certificate-less cryptography
• TTP Trusted Third Party
• the above-mentioned objects are particularly achieved in a computer-implemented method of controlling access of a user device to tokens stored in a distributed data transaction system implemented on one or more node devices of a network, in that the method comprises: generating, by a computer system, pairs of key elements, whereby the key elements of a particular key element pair are cryptographically linked to a common base value common to the particular key element pair; generating, by the computer system, a pair of cryptographic keys from the key element pairs, including in one of the cryptographic keys of the key pair one cryptographic key element from one of the key element pairs and including in the other cryptographic key of the key pair the other cryptographic key element from the one of the key element pairs; and providing, by the computer system, one of the cryptographic keys of the key pair as an access key to the user device, and providing, by the computer system, the other cryptographic key of the key pair to one or more of the node devices as an access control key for the distributed data transaction system, enabling the node devices to control access
• the key elements are generated to include a plurality of digits
• the method further comprises the computer system permutating the digits of at least some of the key elements included in the access control key for at least some of the node devices, enabling the node devices to control access to the particular token stored in the distributed data transaction system by verifying that each key element included in the access key of the user device has a corresponding key element in the access control key, whereby a particular permutation of the digits of a particular key element included in the access control key corresponds to a particular key element included in the access key, if the particular permutation of the digits of the particular key element included in the access control key and the particular key element included in the access key are cryptographically linked to the same base value.
• generating a particular key element pair comprises the computer system executing a modulo operation using a prime number, enabling the node devices to determine the particular permutation of the digits of the particular key element included in the access control key by executing a modulo operation, using a prime number for the particular key element.
• generating a particular key element pair comprises the computer system executing a modulo operation using a prime number as a divisor; and generating the pair of cryptographic keys comprises the computer system including the divisors used in calculating the key element pairs in the cryptographic keys, enabling the node devices to determine the particular permutation of the digits of the particular key element included in the access control key by executing a modulo operation, using the divisor included in the access control key for the particular key element.
• including the divisors used in calculating the key element pairs in the cryptographic keys comprises the computer system inserting padding digits in the cryptographic keys, and obfuscating the divisors as a result of an arithmetic function applied to a plurality of digits of the cryptographic keys, including the padding bits of the cryptographic keys.
• generating a particular key element pair comprises the computer system calculating the key elements of the particular key element pair from the common base value associated with the particular key element pair, using a mathematical algorithm and one or more calculation parameters associated with the particular key element pair; and generating the pair of cryptographic keys comprises the computer system including at least some of the calculation parameters associated with the key element pairs in the cryptographic keys, enabling the node devices to verify that a particular key element included in the access control key and a particular key element included in the access key are cryptographically linked to the same base value by applying a mathematical algorithm to the particular key element included in the access key, using the calculation parameters included in the access key for the particular key element.
• executing the mathematical algorithm for generating the particular key element pair comprises the computer system executing a first mathematical function for calculating a pair of seed values, using the common base value associated with the particular key element pair, a first secret calculation parameter for a first seed value of the seed value pair, and a second secret calculation parameter for a second seed value of the seed value pair, such that modulo operations using the seed values as dividends and prime numbers associated with the key element pair produce a predefined result value, and executing a second mathematical function to calculate the key elements for the particular key element pair from the seed values, using a computational parameter associated with the particular key element pair.
• executing the mathematical algorithm for generating the particular key element pair comprises the computer system executing a first mathematical function for calculating a pair of seed values, using the common base value associated with the particular key element pair, a first secret calculation parameter for a first seed value of the seed value pair, and a second secret calculation parameter for a second seed value of the seed value pair, such that modulo operations using the seed values as dividends and prime numbers associated with the key element pair as divisor produce a predefined result value, and executing a second mathematical function to calculate the key elements for the particular key element pair from the seed values, using a computational parameter associated with the particular key element pair.
• generating the pairs of key elements further comprises the computer system determining from a set of non-negative integers a first secret calculation parameter and a second secret calculation parameter, determining a subset of non-negative integers, by removing the first secret calculation parameter and the second secret calculation parameter from the set of non-negative integers, and determining the common base value associated with the particular key element pair by applying a transformation to the subset of non-negative integers.
• generating the pair of cryptographic keys from the key element pairs comprises the computer system including in the access control key for the node devices the key elements cryptographically linked to key elements included in several access keys for several user devices.
• the method is configured to control access of the user device to the particular token stored in a Blockchain of the distributed data transaction system implemented on a plurality of the node devices of the network.
• the present disclosure further relates to a computer system for controlling access of a user device to a token in a distributed data transaction system implemented on one or more node devices of a network.
• the computer system comprises one or more processors configured to perform the steps: generating pairs of key elements, whereby the key elements of a particular key element pair are cryptographically linked to a common base value common to the particular key element pair; generating a pair of cryptographic keys from the key element pairs, including in one of the cryptographic keys of the key pair one cryptographic key element from one of the key element pairs and including in the other cryptographic key of the key pair the other cryptographic key element from the one of the key element pairs; and providing one of the cryptographic keys of the key pair as an access key to the user device, and providing, by the computer system, the other cryptographic key of the key pair to one or more of the node devices as an access control key forthe distributed data transaction system, enabling the node devices to control access to a particular token stored in the distributed data transaction system by verify
• the one or more processors are configured to generate the key elements to include a plurality of digits, and to permutate the digits of at least some of the key elements included in the access control key for at least some of the node devices, enabling the node devices to control access to the particular token stored in the distributed data transaction system by verifying that each key element included in the access key of the user device has a corresponding key element in the access control key, whereby a particular permutation of the digits of a particular key element included in the access control key corresponds to a particular key element included in the access key, if the particular permutation of the digits of the particular key element included in the access control key and the particular key element included in the access key are cryptographically linked to the same base value.
• the one or more processors are configured to generate a particular key element pair by executing a modulo operation using a prime number enabling the node devices to determine the particular permutation of the digits of the particular key element included in the access control key by executing a modulo operation, using a prime number for the particular key element.
• the one or more processors are configured to generate a particular key element pair by executing a modulo operation using a prime number as a divisor; to generate the pair of cryptographic keys by including the divisors used in calculating the key element pairs in the cryptographic keys enabling the node devices to determine the particular permutation of the digits of the particular key element included in the access control key by executing a modulo operation, using the divisor included in the access control key for the particular key element.
• the one or more processors are configured to include the divisors used in calculating the key element pairs in the cryptographic keys by inserting padding digits in the cryptographic keys, and obfuscating the divisors as a result of an arithmetic function applied to a plurality of digits of the cryptographic keys, including the padding bits of the cryptographic keys.
• the one or more processors are configured to generate a particular key element pair by calculating the key elements of the particular key element pair from the common base value associated with the particular key element pair, using a mathematical algorithm and one or more calculation parameters associated with the particular key element pair; and to generate the pair of cryptographic keys by including at least some of the calculation parameters associated with the key element pairs in the cryptographic keys, enabling the node devices to verify that a particular key element included in the access control key and a particular key element included in the access key are cryptographically linked to the same base value by applying a mathematical algorithm to the particular key element included in the access key, using the calculation parameters included in the access key for the particular key element.
• the one or more processors are configured to executethe mathematical algorithm for generating the particular key element pair by executing a first mathematical function for calculating a pair of seed values, using the common base value associated with the particular key element pair, a first secret calculation parameter for a first seed value of the seed value pair, and a second secret calculation parameter for a second seed value of the seed value pair, such that modulo operations using the seed values as dividends and prime numbers associated with the key element pair produce a predefined result value, and executing a second mathematical function to calculate the key elements for the particular key element pair from the seed values, using a computational parameter associated with the particular key element pair.
• the one or more processors are configured to generate the pairs of key elements by determining from a set of non-negative integers a first secret calculation parameter and a second secret calculation parameter, determining a subset of non negative integers, by removing the first secret calculation parameter and the second secret calculation parameterfrom the set of non-negative integers, and determining the common base value associated with the particular key element pair by applying a transformation to the subset of non-negative integers.
• the one or more processors are configured to generate the pair of cryptographic keys from the key element pairs by including in the access control key for the node devices the key elements cryptographically linked to key elements included in several access keys for several user devices.
• the present disclosure further relates to a computer program product comprising a non-transitory computer-readable medium having stored thereon computer code configured to control one or more processors of a computer system to perform the steps: generating pairs of key elements, whereby the key elements of a particular key element pair are cryptographically linked to a common base value common to the particular key element pair; generating a pair of cryptographic keys from the key element pairs, including in one of the cryptographic keys of the key pair one cryptographic key element from one of the key element pairs and including in the other cryptographic key of the key pair the other cryptographic key element from the one of the key element pairs; and providing one of the cryptographic keys of the key pair as an access key to the user device, and providing, by the computer system, the other cryptographic key of the key pair to one or more of the node devices as an access control key for the distributed data
• the present method and the computer system for controlling access of a user device to a token provide a mechanism for cryptographically signing tokens, or parts thereof, without requiring a Trusted Third Party (TTP) for validation once the key pair has been issued by a Key Generation Center (KGC) or a comparable entity in a computer system.
• TTP Trusted Third Party
• KGC Key Generation Center
• a comparable entity in a computer system.
• KYC Know Your Customer
• AML Anti Money Laundering
• the present method and the computer system for controlling access of a user device to a token provide a scheme for generating a digital signature (DS) for tokens that is attributable, verifiable, trustable, linkable and portable.
• DS digital signature
• the protocol does not provide a computation framework nor a validation instance for any information in a token that otherwise has a correct DS attached. Hence it only ensures that the tokens, or parts thereof, are independently recognized as valid constructs in their domain of application.
• the protocol in terms of resilience to attacks, is understood to be secure against passive impersonators and provably secure against active impersonators, although in the latter case it ultimately depends on the deployment and operation of the distributed data transaction system.
• the key pairs can be created so to restrict the authentication process to an arbitrary subset of nodes in the distributed network, hence providing additional hard guarantees against potential spawning attacks.
• Figure 1 shows a block diagram illustrating schematically a computer system for controlling access of a user device to tokens in a distributed data transaction system implemented on one or more node devices of a network;
• Figure 2 shows a flow diagram illustrating an exemplary sequence of steps for generating cryptographic keys for controlling access of a user device to tokens in a distributed data transaction system implemented on one or more node devices of a network. DESCRIPTION OF THE EMBODIMENTS
• reference numeral 5 refers to a computer system for generating cryptographic keys used for controlling access of user devices 1 to tokens 6 in a distributed data transaction system 2 implemented on one or more node devices 3 of a network 4.
• the computer system 5 comprises one or more computers with one or more processors.
• the processors of the computer system 5 are controlled by computer program code stored on a computer readable medium.
• the processors of the computer system 5 and the computer program code, respectively, are configured to implement a Key Generation Center (KGC).
• KGC Key Generation Center
• the processors of the computer system 5 and the computer program code, respectively, are configured to execute the functions of a KGC, as will be described below in more detail.
• the user devices 1 comprises various computerized electronic devices, such as stationary or mobile personal computers, tablet computers, and/or mobile communication devices, such as mobile radio phones, smart watches or the like.
• the node devices 3 comprise various computing devices, such as personal computers, server computers, and the like.
• Network 4 comprises local area networks (LAN), wireless local area networks (WLAN), mobile radio networks, and/orthe Internet.
• reference numeral 2 refers to a distributed data transaction system.
• the distributed data transaction system 2 is defined by a data registration protocol which is executed by the node devices 3 connected to the (distributed) network 4.
• the distributed data transaction system 4 comprises blockchain- based distributed systems such as Ethereum, Hyperledger, Corda, Neo, orthe like, or other distributed ledger or distributed data transaction systems, such as Hashgraph.
• the computer system 5 which implements the KGC is a special node connected to the (distributed) network 4 and the distributed data transaction system 2.
• reference numeral 6 refers to a token; more specifically, to a data token 6 stored in the distributed data transaction system 2.
• the token 6 is stored on one or more node devices 3 implementing the distributed data transaction system 2.
• described with reference to Figure 2 is an exemplary sequence of steps for controlling access of a user device 1 to tokens 6 in the distributed data transaction system 2 implemented on one or more node devices 3 of network 4.
• Table 1 below gives an overview of steps P1, P2, P3, P4, P5, and P6 for generating cryptographic keys K, L for controlling access to the tokens 6.
• step P1 the computer system 5 or its processors, respectively, operate on a sample space ⁇ c composed of non-negative integers .
• Step P1 relates to defining a dictionary to be used and its coding.
• it can be chosen as dictionary the 26 letters of the English alphabet, coding them numerically from 1 to 26, say (as in the well-known Hill’s cipher).
• N non- negative integers in ⁇ c that can be defined in an arbitrary way, or be sampled from a uniform distribution in .
• the computer system 5 or its processors randomly extracts two secret calculation parameters denoted S 1 and S 2 , together with a set B, all being non-negative integers drawn from ⁇ c .
• step P2 the components of ⁇ c are segmented such that two of its elements are randomly chosen to become salts, leaving the remaining N-2 elements to create a set of common base values (or primitives) W.
• This selection is made algorithmically and is immutable throughout the lifespan of the process.
• the computer system 5 or its processors respectively, determine the set of common base values (or primitives) W.
• an arbitrary mixing function is defined which takes the elements in B as arguments to generate the set of primitives . If the transformation is such that size (W) ⁇ size (B) then mixing also implies aggregation.
• step P4 the computer system 5 or its processors, respectively, calculate seed values y1r and y2r to conform the set Y.
• step P4 a transformation ⁇ ( ⁇ ) is applied on the elements belonging to the set of primitives W, using the salts S 1 and S2 to generate the seeds in the set Y.
• the function ⁇ ( ⁇ ) should be invertible but is otherwise set arbitrarily.
• the motifs are defined in our method as integers composed of Q digits.
• yir mod g ir 0.
• mod denotes a modulo operation performed over g ir .
• step P5 the computer system 5 or its processors, respectively, generate elements m1r and m2r belonging respectively to the sets M 1 and M 2 , where every element in M 1 is uniquely linked to an element in M 2 in a one- to-one correspondence (or bijection).
• M q for q ⁇ 1, 2 ⁇ to allow for the possibility that q ⁇ i. The reason for this will become apparent in the discussion further below.
• the seeds in set Y are transformed by a function ⁇ ( ⁇ ) and positive integers to generate the elements in M q . By default, .
• step P6 the computer system 5 or its processors, respectively, generate access (control) key K and lock L.
• step P6 given that q is not necessarily equal to i elements m1r from set M 1 can appear in M key (the base pattern for a key) or in M lock (the base pattern for a lock), and likewise for elements m2r from set M 2 .
• a further obfuscation step can be added to generate the access (control) key K and lock L.
• Obfuscation is achieved, for example, by the addition of padding bits to both sequences combined with an (invertible) mixing process. Denoting obfuscation by the operator, then and . If no obfuscation is inserted, then simply becomes an identity matrix. This can be considered as a special case.
• m ir denotes an individual motif in position r .
• a single key can be used to alternatively validate a token with (or grant access to) different nodes in a distributed computer network, without resorting to a central coordinator or the deployment of shared information, as the process is done algorithmically and at node level (or locally).

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Lock And Its Accessories (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=74095611

Family Applications (1)

Country Status (2)

Family Cites Families (1)

• 2021
  • 2021-06-22 EP EP21740431.8A patent/EP4169205A1/de active Pending
  • 2021-06-22 WO PCT/EP2021/067007 patent/WO2021259933A1/en not_active Ceased

Also Published As

Similar Documents

Legal Events