US20100153714A1 - Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates - Google Patents

Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates Download PDF

Info

Publication number
US20100153714A1
US20100153714A1 US12/712,923 US71292310A US2010153714A1 US 20100153714 A1 US20100153714 A1 US 20100153714A1 US 71292310 A US71292310 A US 71292310A US 2010153714 A1 US2010153714 A1 US 2010153714A1
Authority
US
United States
Prior art keywords
value
accumulator
authentication
computer system
period
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/712,923
Inventor
Zulfikar Amin Ramzan
Craig B. Gentry
Bernhard Bruhn
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to US12/712,923 priority Critical patent/US20100153714A1/en
Publication of US20100153714A1 publication Critical patent/US20100153714A1/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/33User authentication using certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3218Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/30Compression, e.g. Merkle-Damgard construction
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56Financial cryptography, e.g. electronic payment or e-cash
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80Wireless
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the present invention relates to performing authentication as to whether or not an element possesses a pre-specified property.
  • An example is authenticating validity of a digital revocation in a public key infrastructure, or authenticating validity of an entitlement to use a resource (e.g. to sign onto a World Wide Web site).
  • FIG. 1 illustrates digital certificate validation and revocation in a public key infrastructure.
  • Digital certificates 104 are used in public key infrastructures (PKI) to facilitate secure use and management of public keys in a networked computer environment.
  • PKI public key infrastructures
  • Users U 1 , U 2 , . . . utilize their computer systems 110 . 1 , 110 . 2 , . . . to generate respective key pairs (PK, SK) where PK is the public key and SK is the secret key.
  • FIG. 1 shows a key pair (PK U1 , SK U1 ) for user U 1 .
  • the users register their public keys PK, over a network, with a certification authority (CA) 120 .
  • CA certification authority
  • the key pairs can be generated by CA 120 and sent to the users.
  • CA 120 is a secure, trusted computer system. For each public key PK, CA 120 generates a digital certificate 104 . Certificate 104 contains the public key PK and the user's name and/or email address or addresses, may also contain the certificate's serial number SN (generated by the CA to simplify the certificate management), the certificate issue date D 1 , the expiration date D 2 , an identification of algorithms to be used with the public and secret keys, an identification of the CA 120 , and possibly other data. The data mentioned above is shown at 104 D. Certificate 104 also contains CA's signature 104 -Sig CA on the data 104 D. The signature is generated using CA's secret key SK CA . CA 120 sends the certificate 104 to the user's (key owner's) computer system 110 .
  • Either the owner or the CA 120 can distribute the certificate to other parties to inform them of the user's public key PK.
  • Such parties can verify the CA's signature 104-Sig CA with the CA's public key PK CA to ascertain that the certificate's public key PK does indeed belong to the person whose name and email address are provided in the certificate.
  • a certificate may have to be revoked prior to its expiration date D 2 .
  • the certificate owner U may change his affiliation or position, or the owner's private key SK U may be compromised. Other parties must be prevented from using the owner's public key if the certificate is revoked.
  • a CRL is a signed and time-stamped list issued by CA 120 and specifying the revoked certificates by their serial numbers SN. These CRLs must be distributed periodically even if there are no new revoked certificates in order to prevent any type of replay attack.
  • the CRL management may be unwieldy with respect to communication, search, and verification costs.
  • the CRL approach can be optimized using so-called delta-CRLs, with the CA transmitting only the list of certificates that have been revoked in the previous time period (rather than for all time periods).
  • the delta-CRL technique still has the disadvantage that the computational complexity of verifying that a certificate is currently valid is basically proportional to the number of time periods, since the verifier must confirm that the certificate is not in any of the delta-CRLs.
  • Certificate revocation trees can be used instead of CRLs as described in [15] (the bracketed numbers indicate references listed at the end before the claims).
  • CA 120 could answer queries about specific certificates.
  • user U 2 issues a query 150 with the serial number SN of certificate 104 of user U 1 .
  • CA 120 responds with a validity status information 160 containing the serial number SN, a validity status field 160 VS (“valid”, “revoked” or “unknown”), and a time stamp “Time”.
  • the response is signed by CA (field 160 -Sig CA ).
  • This approach is used for Online Certificate Status Protocol (OCSP). See [23].
  • OCSP Online Certificate Status Protocol
  • the CA's digital signature 160 -Sig CA can be quite long (over 1024 bits with RSA), especially since the CA must be very secure.
  • CA 120 becomes a validation bottleneck. If CA 120 is decentralized (replicated), the security is weakened as the CA's signing key SK CA is replicated.
  • FIG. 2 illustrates a “NOVOMODO” approach, which allows CA 120 to provide an unsigned validity status through untrusted directories 210 at pre-specified time intervals (e.g. every day, or every hour, etc.).
  • Directories 210 are computer systems that do not store secret information. The system works as follows.
  • ⁇ 0,1 ⁇ n is the set of all binary strings of a length n.
  • “Infeasible” means that given a security parameter k (e.g.
  • the pre-image z cannot be computed in a time equal to a predefined polynomial in k except with negligible probability.
  • CA 120 picks a random “seed” number x and generates a “hash chain” c 0 , c 1 , . . . c 365 wherein:
  • CA 120 inserts C 0 into the certificate 104 together with data 104 D ( FIG. 1 ).
  • CA 120 keeps all c i secret for i>0. The values x and N 0 are also secret.
  • CA 120 stores in its private storage the values x and N 0 for each certificate 104 , and possibly (but not necessarily) caches the c i values.
  • CA distributes to directories 210 a validation data structure which includes, in addition to a validity status indication (not shown in FIG. 2 , can be “valid” or “revoked”):
  • a hash chain (1) can be generated for a set of certificates 104 , and a single i-token c i can be distributed for the set if the set is “unrevoked” (i.e. all the certificates are unrevoked in the set).
  • the certificate 140 will contain a separate target c 0 for each set containing the certificate and associated with a hash chain (see [1]).
  • Certificate revocation can also be performed using accumulators. See [37].
  • An accumulator is a way to combine a set of values (e.g. a set of valid certificates) into a shorter value.
  • a formal definition of a “secure” accumulator is given in Appendix A at the end of this disclosure before the claims.
  • An accumulator example can be constructed as follows. Let us denote all possible values that can be accumulated as p 1 , . . . , p t . (For example, each p i can be a unique number assigned to a certificate, and we want to accumulate the values corresponding to the valid certificates.)
  • v 0 is the accumulator value for the empty set.
  • be a one-way function. To accumulate p 1 , we compute the accumulator as follows:
  • v 2 ⁇ (v 1 , p 2 ), and so on. More generally, the accumulator value for some set ⁇ p i 1 , . . . , p i ⁇ is
  • the function ⁇ can be chosen such that the accumulation order does not matter, i.e.
  • CA 120 can send to the directories 210 a pair (v j , t) where v j is the accumulator value for the set of the valid certificates, and t is a time stamp.
  • the directories can respond to queries 150 with some proof that the accumulator value v j accumulates the value p i corresponding to the certificate of interest.
  • a common accumulator is an RSA accumulator defined as follows:
  • v ( ⁇ p i 1 , . . . , p i m ⁇ ) v 0 pi 1 , . . . , pi m mod n (6)
  • the certificate validation is performed as follows. Without loss of generality, suppose that the values p 1 , . . . , p m correspond to the valid certificates in a period j. Then the accumulator value distributed by CA 120 to directories 210 is
  • a verifier 110 inquires a directory 210 of the status of a certificate corresponding to the value p i which is one of p 1 , . . . , p m , the directory sends to the verifier the accumulator value v j and a “witness” value
  • the verifier checks that
  • the witness s i, j is hard to forge provided that it is hard to compute the p i -th root of v j .
  • the p i -th root computation is hard if the adversary does not know the factorization of n and the strong RSA assumption is valid (this assumption is defined in Appendix A).
  • the verifier instead of providing the values s i, j and p i to the verifier, the verifier can be provided with a proof that such values exist and are known to the certificate owner.
  • Accumulators can be used more generally to prove that an element satisfies some pre-specified property.
  • the accumulator value represents the P m -th root of some value u, e.g.
  • the value (11) accumulates valid digital certificates.
  • the value (11) can be modified by exponentiation to de-accumulate all the values p l except for some given value p i i.e. to compute
  • This exponentiation can be performed by a directory 210 or by the certificate owner's system 110 , without knowledge of factorization of the modulus n.
  • the value (12) is the accumulator value as if p i were the only accumulated value.
  • the witness value needed for verification can also be computed as if p i were the only accumulated value.
  • the verification (the authentication) can be performed using the values that do not depend on accumulated values other than p i . Alternatively, the verification can be performed with the accumulator and witness values that incorporate some other accumulated values but not necessarily all the accumulated values.
  • the directory 210 or the user 110 can use an accumulator that accumulates less than all of the valid certificates. In some embodiments, this feature reduces the number of computations needed to be performed by all of the provers.
  • the accumulator accumulates the revoked certificates rather than the valid certificates.
  • the witness values for an integer p i depend on other p values.
  • the witness values are used as encryption keys for encrypting validity proofs.
  • the validity proofs can be constructed using a non-accumulator based validation system, e.g. as in FIG. 2 .
  • c j (i) denote the token c j for the period j for a certificate 140.i, where c j is formed as in (1).
  • the CA At the set-up time, when a user system 110 joins the certificate validation system, the CA generates the tokens c j (i) for all the periods j for the user.
  • the CA also generates the witness values for all the periods j.
  • the CA encrypts each token c j (i) under a key equal to (or obtained from) the witness value for the period j, under a symmetric encryption system.
  • CA 120 transmits all the encrypted values to the user.
  • CA 120 transmits the decryption key (the witness value) for the period j to the user, enabling the user to recover the token c j (i).
  • the user provides the token to the verifiers to proof the certificate validity as described above in connection with FIG. 2 .
  • Some embodiments of the invention are suitable for limited bandwidth or low reliability networks, for example in ad hoc networks, where the nodes 110 may have low computational and transmission power, and where the nodes may have only incomplete information about the topology of the network.
  • ad hoc network is a self-configuring wireless network of mobile routers.
  • Some embodiments are communication and storage efficient.
  • FIGS. 1 , 2 are block diagrams illustrating prior art certificate revocation schemes.
  • FIG. 3 illustrates a digital certificate according to some embodiments of the present invention.
  • FIG. 4 is a flowchart of operations performed by a certification authority (CA) in initial certification according to some embodiments of the present invention.
  • CA certification authority
  • FIG. 5 is a block diagram illustrating certificate re-validation operations performed by a CA according to some embodiments of the present invention.
  • FIG. 6 is a flowchart of witness derivation operations according to some embodiments of the present invention.
  • FIG. 7 is a flowchart of authentication according to some embodiments of the present invention.
  • FIG. 8 is a block diagram showing data transmitted over networks in de-accumulation operations according to some embodiments of the present invention.
  • FIG. 9 is a state diagram illustrating accumulator transmissions according to some embodiments of the present invention.
  • FIG. 10 is a block diagram showing data transmissions in determining the network paths according to some embodiments of the present invention.
  • FIG. 11 is a flowchart of operations performed by a certification authority (CA) in initial certification according to some embodiments of the present invention.
  • CA certification authority
  • FIG. 12 is a block diagram illustrating certificate re-validation operations performed by a CA according to some embodiments of the present invention.
  • FIG. 13 is a flowchart of witness derivation operations according to some embodiments of the present invention.
  • FIG. 14 is a flowchart of authentication according to some embodiments of the present invention.
  • the present invention also relates to apparatus for performing the operations herein.
  • This apparatus may be specially constructed for the required purposes, or it may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in the computer.
  • a computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a computer system.
  • a machine-readable medium includes any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer).
  • a machine-readable medium includes read only memory (“ROM”); random access memory (“RAM”); magnetic disk storage media; optical storage media; flash memory devices; electrical, optical, acoustical or other form of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.); etc.
  • a certification authority CA a certificate owner or holder Owner
  • a certificate verifier VV a certificate verifier
  • Owner has a certificate issued by CA.
  • the concept of a certification authority may apply more generally to any authority responsible for issuing access control privileges or authorizations to a plurality of individuals.
  • the concept of an owner may be tied to a specific human being or organization operating a computer or to the computer itself, e.g. a world wide web server.
  • the verifier may be tied to a specific human being or organization operating a computer or to the computer itself, e.g. an access control server determining if it should permit access to certain services.
  • VV wishes to ascertain that the certificate has not been revoked prior to its expiration date. To do so, VV must obtain a proof of validity or a proof of revocation that is or has been issued by the certification authority CA. VV may obtain this proof either from the CA directly, or through some other distribution mechanism.
  • SHA-1 has an output and IV size of 20-bytes and a 64-byte payload size.
  • iterated hashing or Merkle-trees [19] for doing so.
  • hash function instead of compression function, where it is understood that a hash function can take arbitrary length strings ⁇ 0,1 ⁇ * and produce a fixed length output in ⁇ 0,1 ⁇ v .
  • ⁇ r ⁇ the ceiling of r, that is, the smallest integer value greater than or equal to r.
  • ⁇ r ⁇ denotes the floor of r, that is, the largest integer value less than or equal to r.
  • A be an algorithm.
  • A( ⁇ ) we denote that A has one input.
  • A( ⁇ , . . . , ⁇ ) we denote that A has several inputs).
  • a (.) we will denote that A is an indexed family of algorithms.
  • y ⁇ A(x) denotes that y was obtained by running A on input x. In case A is deterministic, then this y is unique; if A is probabilistic, then y is a random variable. If S is a set, then y ⁇ S denotes that y was chosen from S uniformly at random.
  • b be a boolean function. The notation (y ⁇ A(x):b(y)) denotes the event that b(y) is true after y was generated by running A on input x.
  • each certificate owner Ui operates just one system 110.i and owns at most one certificate. This is not in fact necessary.
  • the CA 120 generates a composite modulus n.
  • n is the product of two primes, but n can also be the product of three or more primes.
  • n is public, but n is hard to factor, and the factorization is known only to the CA 120 .
  • the CA assigns a positive integer p i to u i .
  • the numbers p i are chosen to be mutually prime with the modulus n. Also, each p i does not divide the LCM (lowest common multiple) of the remaining numbers p l , 1 ⁇ i.
  • the numbers p 1 , . . . , p i can be distinct prime numbers, or pairwise relatively prime.
  • the CA computes a unique public value m i ⁇ (Z/nZ)* for the user u i .
  • Z/nZ is the ring of all residue classes modulo n
  • (Z/nZ)* is the multiplicative group of the invertible elements of Z/nZ, i.e. of the elements defined by integers mutually prime with n.)
  • H 1 is a predefined function, e.g. a one-way collision resistant function
  • u i is the user identification (e.g. user name)
  • w i is an optional string (which may contain u i 's public key and/or some other information).
  • the value m i thus binds p i to u i 's identity.
  • any one or more of the values j o , p i , m i and the identification of the function H 1 can be made part of the certificate 140 . See FIG. 3 showing a certificate 140 containing m i , j o , and specifying the functions H 1 and H 2 (H 2 is described below).
  • the CA computes an “initial certificate” value
  • the CA keeps this value secret, and transmits it to the user u i 's system 110 in an encrypted form.
  • the CA performs the following operations.
  • t denote the total number of users in the system (i.e. the total number of users for whom the initial certification of FIG. 4 has been performed).
  • UU j ⁇ UU be the subset of users that are to be re-validated in period j.
  • PP j ⁇ PP be the corresponding set of numbers p, and let
  • H 2 is the same as H 1 or some other function.
  • the CA also computes the accumulator
  • the root in (17) exists with a very high probability.
  • the CA transmits the following data to the system 110 of each user in UU j (this data can also be broadcast to a larger set of users if such broadcast transmission is more efficient in terms of communication):
  • each user u i in UU j computes its “personal accumulator” v j (p i ), i.e. the accumulator which accumulates only the user's p i value:
  • v j ⁇ ( p i ) v j pk ⁇ PP j ⁇ ⁇ p i ⁇ pk ⁇ ⁇ ( mod ⁇ ⁇ n ) ( 19 )
  • the user aggregates this personal accumulator with previous personal accumulators to obtain a witness for the period j:
  • a user u i can provide s i, j to the verifier, along with (if necessary) the values for (u i , p i , j 0 , w i ).
  • the verifier :
  • GQ Guardou-Quisquater
  • the authentication proceeds as follows:
  • the verifier sends to the user a random message m.
  • the user generates a random number r and computes:
  • H is some predefined public function (e.g. H 1 or H 2 ).
  • the user sends the values m, r P i , and D to the verifier.
  • This scheme may reduce total bandwidth because the verifier does not need the certificate 140 .
  • s i, j 0 can be computed in some other way, not necessarily as in (14).
  • the CA can set m i to be independent of the user's identity, e.g.:
  • the m i value is then provided to the user.
  • the m i value may be transmitted to the user via a secure channel (e.g., by encrypting this value such that only u i can decrypt it). Then, it follows from (14) and (21) that:
  • ZK zero-knowledge
  • the interval I can be an interval containing all the numbers p i .
  • the user can authenticate itself anonymously if and only if it has obtained an initial certificate s i, J 0 and the subsequent personal accumulator values v j (p i ) (see (18), (19)).
  • the CA can revoke the user as before—i.e., by not re-validating it (not including p i in the product P j in FIG. 5 ).
  • the accumulator techniques are not limited to a user possessing a single certificate or to a digital certificate revocation.
  • a user u i may or may not possess one or more of entitlements e 1 , e 2 , . . . e r .
  • the user u i is assigned a unique integer p i, k if the user is to be certified for an entitlement e k .
  • the entitlement proof proceeds as described above with respect to equations (13)-(26), with numbers p i replaced by p i, k with s i, j replaced by s i, k, j , etc.
  • a value p i is computed as the product of P i, k . For example, if the user is initially certified for all the entitlements, then:
  • the integers p i, k are mutually prime relative to each other and to the CA's modulus n.
  • the user can use this value to demonstrate that it possesses the entitlement that corresponds to prime p i, k without revealing the user's other entitlements.
  • the CA can revoke a specific entitlement e k for the user without revoking the user's other entitlements, simply by issuing a validation accumulator in (17) that does not accumulate p i, k (i.e. the product P j is computed as in (15) except that p i is replaced with p i /p i, k (the number p i, k is not included in the product)).
  • the CA has users (certificate owner systems) 110 in different networks, and the users move from a network to a network (e.g. some of the networks may be ad hoc networks).
  • the CA can calculate a separate accumulator (say, (17)) for each network.
  • Each accumulator will accumulate only the valid users in the corresponding network based on the CA's knowledge of the current composition of users in each network.
  • Each user will compute its personal accumulator value and/or witness value (e.g., as in (18), (20), (26), and/or (28)).
  • the user can move to another network and use the same personal accumulator value and/or witness value in the other network.
  • t′ is the number of users which take part in the aggregation (or the number of certificates or entitlements belonging to a user if each u i is a certificate or an entitlement).
  • a verifier can use the value (33) to confirm that users (or certificates or entitlements) (u i , . . . , u t′ ) are valid by confirming that:
  • the CA can (for example) compute two accumulators—one for each of two halves P 1 and P 2 of P—and transmit these two accumulators to the users, thereby allowing the users to skip the first split operation and thereby reducing their computation.
  • the CA can reduce their computation further by transmitting even more accumulators, each for an even smaller subset of the users.
  • the CA In computing these multiple accumulators, it is advantageous for the CA to use its knowledge of the current network topology to enhance the performance of the scheme. For example, suppose that the users are divided into several (say, 10) topological areas. Then, instead of using one product of integers P j as in (15), the CA can compute 10 such products P j, 1 , . . . , P j, 10 , and 10 area-specific accumulators (h j /h j ⁇ 1 ) 1/P j, k . The CA then transmits each one of these 10 area-specific accumulators to the respective one of the 10 topological areas (along with a list of the re-validated users in that area). Users in a given area can compute their personal accumulators and witnesses from the area-specific accumulators.
  • De-accumulation is also relevant to how the personal accumulators (18)-(19) are computed.
  • the users compute their personal accumulators cooperatively, as illustrated, for example, in FIG. 8 and described below.
  • PP j be the set of valid users (i.e. the set of the p numbers corresponding to the valid users).
  • the CA sends the accumulator v j (PP j ) (see (17) for example) and the numbers p in the set PP j to a designated node 110 (also marked D in FIG. 8 ).
  • Node D divides the set PP j into sub-groups (sub-sets).
  • the sub-group PP j ⁇ 0 includes one or more of nodes 110 . 0 , 110 . 00 , 110 . 01 ;
  • the sub-group PP j ⁇ 1 includes one or more of nodes 110 .
  • the third sub-group consists of node 110 itself if this is a valid node.
  • Node D computes the accumulator v j (PP j ⁇ 0) for the sub-group PP j ⁇ 0, and the accumulator v j (PP j ⁇ 1) for the sub-group PP j ⁇ 1. This computation can be performed by de-accumulating the nodes which are not sub-group members. See e.g. equation (19) and Procedure Split(v,P), steps 1 and 2. If node D is valid (i.e. its number p is in PP j ), node D also computes its personal accumulator as in FIG. 6 .
  • Node D transmits the accumulator v j (PP j ⁇ 0), and the p numbers in the set PP j ⁇ 0, to node 110 . 0 .
  • Node D transmits the accumulator v j (PP j ⁇ 1), and the p numbers in the set PP j ⁇ 1, to node 110 . 1 .
  • the nodes 110 . 0 , 110 . 1 perform the same operations as node D.
  • node 110 . 0 divides the valid users PP J ⁇ 0 into sub-groups.
  • the nodes 110 . 0 , 110 . 00 , 110 . 01 are valid; the sub-group PP j -0-0 consists of node 110 .
  • the sub-group PP j -0-1 consists of node 110 . 01 ; the third sub-group consists of node 110 . 0 .
  • the sub-groups are determined by node 110 . 0 from the p numbers in PP j -0.
  • Node 110 . 0 computes accumulators v j (PP j -0-0), v j (PP j -0-1) for the respective sub-groups PP j -0-0, PP j -0-1, and also computes its personal accumulator as in FIG. 6 .
  • Node 110 . 0 transmits the accumulator v j (PP j -0-0), and the corresponding p number, to node 110 . 00 .
  • Node 110 . 0 transmits the accumulator v j (PP j -0-1), and the corresponding p number, to node 110 . 01 .
  • the accumulators v i (PP j -0-0), v j (PP j -0-1) are personal accumulators, so the nodes 110 . 00 , 110 . 01 do not need to derive their personal accumulators.
  • Node 110 . 1 performs operations similar to those for node 110 . 0 .
  • This procedure can be extended recursively to any number of nodes.
  • the procedure is not limited to the “binary-tree” type of FIG. 8 .
  • a node can split a set of users into any number of sub-groups in addition to itself, possibly resulting in a non-binary-tree type operation.
  • the accumulators are transmitted only to valid nodes. For example, if node 110 is invalid, then CA 120 transmits the accumulator v j (PP j ) to a valid node instead.
  • the sub-groups are selected so that the communications are efficient within each sub-group. For example, in case of ad hoc networks, the sub-groups can be selected based on geographic proximity, with the proximate nodes being grouped together.
  • the designated node D chooses two “group heads” in the network, such as nodes 110 . 0 , 110 . 1 in FIG. 8 . (More than two group heads can also be selected.) These group heads can be chosen randomly. Alternatively, if the designated node has some topological information, it can use that information to attempt to choose the two group heads in a way that they are topologically distant—preferably on opposite sides of the network from each other.
  • the designated node After D picks the two group heads, the designated node tells the two group heads to transmit different messages; for example, the designated node may tell the first group head to transmit ‘0’ and the second to transmit ‘1’. Then, each group head (e.g. 110 . 0 , 110 . 1 ) “floods” the network with its particular message. When this occurs, the other nodes in the network will either receive a ‘0’ first or the ‘1’ first. Nodes that receive a ‘0’ first (e.g. nodes 110 . 00 , 110 . 01 ) report back to the designated node D (or to the group head 110 . 0 ) that they are a member of the 0-group; the members of the 1-group report similarly.
  • nodes 110 . 00 , 110 . 01 report back to the designated node D (or to the group head 110 . 0 ) that they are a member of the 0-group; the members of the 1-group report similarly.
  • the designated node D receives this information, and it de-accumulates the accumulator into two halves—one accumulator for the 0-group and one for the 1-group. If the designated node performed this de-accumulation (as in the procedure illustrated in FIG. 8 ), it passes along the appropriate accumulators to their corresponding group heads ( 110 . 0 , 110 . 1 ). Then, each group head becomes the designated node for its corresponding sub-network, and the entire process described above is repeated for the sub-networks. Now, we will provide more detail for one embodiment.
  • Each recursion step is carried out in four phases as depicted in FIG. 9 .
  • the first recursion step is started by a node which is preferably located in the center of the network. We call this node the current designated node D.
  • Node D executes the following four phases of recursion:
  • Node D selects randomly two nodes out of its group as group heads GH 0 and GH 1 .
  • Node D sends out a broadcast message m searchGH with its group ID, the addresses of GH 0 and GH 1 , and a path variable containing D's address. All receiving nodes within the same group obtain a copy of the path and check if they are GH 0 or GH 1 . If not, they add their address to the path variable in the message and forward it (broadcast it) once. The path variable provides each node with the path to D.
  • FIG. 10 shows the messages m searchGH transmitted by nodes D, 110 . 01 , 110 . 10 , 110 . 11 .
  • FIG. 10 illustrates the m buildG messages broadcast by nodes GH 0 , GH 1 , 110 . 01 , 110 . 10 , 110 . 11 , assuming that the node 110 . 01 received the m u buildG message from GH 0 first, and nodes 110 . 10 , 110 . 11 received the m buildG message from GH 1 first.
  • D After D has received all reports, it looks up the paths p0 to GH 0 and p1 to GH 1 included in the received reports, exponentiates the accumulator v j for its group to obtain the accumulators v j (0) and v j (1) for the respective sub-groups, and sends the accumulators in respective messages m transmitu0 over p0 to GH 0 and m transmitu1 over p1 to GH 1 , respectively. Additionally to the accumulators v j (0) and v j (1), these messages contain a list of the corresponding sub-group members.
  • GH 0 and GH 1 After reception of m transmitu0 or m transmitu1 , respectively, GH 0 and GH 1 become designated nodes D of their sub-groups and enter phase 910 of the next recursion step.
  • the recursion ends if the sub-group accumulator is a personal accumulator.
  • this step requires O(t′) messages, each of size log t (since it requires log t bits on average to specify a single member of a group of t elements).
  • Each message contains a path with average length C 1 ⁇ square root over (t′) ⁇ . Therefore, communication for this subnetwork is of O(t′ ⁇ square root over (t′) ⁇ log t). If we assume that the partitions are always equally-sized, the total communication of the entire recursive procedure is also O(t′ ⁇ square root over (t′) ⁇ log t).
  • This step involves a total of t messages, each of constant size, for communication complexity O(t).
  • Group membership information of the nodes is transmitted over C 3 * ⁇ square root over (t) ⁇ hops, where C 3 is a constant depending on the network density and reflecting the number of reports initiated: this results in communication of O (t′ ⁇ square root over (t′) ⁇ log t).
  • the nodes that receive the message transmit an acknowledgement message back to the designated node, and they log the designated node as the node from which they received the message.
  • the designated node logs the acknowledging nodes as the nodes that received its message. This process recurses throughout the network. Specifically, a node that received the message from the designated node broadcasts the message, and nodes that have not sent or received the message before log the identity of the node that they received the message from and they send back an acknowledgment, after which the sending node logs the acknowledgers. If a node receives the message more than once, it only logs and responds back to the first node that sent it.
  • every node in the subnetwork (except the designated node) has a unique node from which it received the message, as well as a list of the nodes that received the message directly from it.
  • Each node that has a nonempty list of acknowledgers chooses an arbitrary enumeration of those acknowledgers.
  • a tree a graph with no loops
  • this procedure can be accomplished with O(t′) communication and computation.
  • the next stage of the algorithm is to use the enumeration to approximately bisect the subnetwork.
  • One method is that each node, beginning with the nodes with no acknowledgers, could back-transmit (backwards according to the enumeration) the number of nodes in its subtree including itself; in this fashion, each node computes the number of nodes in its subtree.
  • the midpoint point As the root of the tree, it divides its children into two groups, such that the number of nodes that are in a subtree emanating from one of the children in the first group is approximately equal to the number of nodes that are in a subtree emanating from one of the children in the second group. (This can always be accomplished such that ratio between the two numbers is at most two.) Thus, all of the network nodes except the midpoint become members of one of the two groups; the midpoint is considered to be a member of both groups.
  • the step of computing how many nodes are in each subtree requires O(t′log t′) communication, since there are t transmissions, where the size of each transmission (which is a number between 1 and t′ representing how many nodes are in the given subtree) is log t′ bits.
  • a new enumeration of the nodes is established with the midpoint node as the initiator of the message, beginning with the nodes in the first group. (This new enumeration could be computed as before, or it could actually be derived indirectly from the previous enumeration. Either way, it does not add to the asymptotic communication complexity of the protocol, which is t log 2 t overall.)
  • the personal accumulators v j (p i ) and/or the witness values s i, j can be used to obtain symmetric keys that users can use to decrypt validation proofs under other validation systems.
  • An example will now be given for the validation system obtained by combining the systems of FIGS. 2 , 4 - 7 , but this is not limiting.
  • the CA When a user u i joins the system, the CA:
  • the CA At the start of, or shortly before, each period j, the CA:
  • the prover If the user u i 's certificate is valid (as indicated by the transmission of number p i in the RE-VALIDATION procedure at step 1), the prover:
  • the decryption keys can be some different function of s i, j than the encryption keys.
  • each user operates a corresponding computer system 110 and owns at most one certificate 140 .
  • This is not limiting, as a user may own multiple certificates and/or operate multiple systems 110 .
  • the scheme is also applicable to controlling resource access and other kinds of authentication.
  • We will use the word “user” to denote both the system 110 and the system's operator where no confusion arises.
  • each user u i will be assigned a positive integer p i with the same properties as in the scheme of FIGS. 4-7 (e.g. p i are mutually prime relative to the CA's public composite modulus n and to each other).
  • the symbols n, PP, p i will be as in the scheme of FIGS. 4-7 .
  • PP is the set of the p i numbers.
  • QQ j For each period j, the symbol QQ j will denote the set of the revoked p i numbers (i.e. the set of the p i numbers corresponding to the certificates to be declared as revoked in period j). Q j denotes the product of the numbers in QQ j :
  • will denote an accumulator seed, which is an integer mutually prime with the modulus n.
  • the accumulator of the values in Q j is:
  • RR j QQ j ⁇ QQ j ⁇ 1 , i.e. RR j is the set of the p numbers corresponding to the certificates declared as revoked in period j but not in period j ⁇ 1; in period j ⁇ 1 these certificates were either declared as valid or were not yet part of the validation system.
  • R j denote the product of the numbers in RR j :
  • the CA generates its modulus n and the accumulator seed ⁇ .
  • CA 120 generates p i , m i as at step 410 in FIG. 4 . These numbers can be made part of the user's certificate 140 ( FIG. 3 ).
  • the CA computes the following secret numbers:
  • the CA transmits the values t i , s i, j 0 to the user u i in an encrypted form. As will be explained, the user will be able to derive the value
  • the user computes the witness
  • the user u i provides t i s i, j (mod n) to the verifier, along with (if necessary) the values for (u i , p i , j 0 , w i ).
  • the user provides to the verifier the accumulator value v j and the CA's signature on (v j ,j).
  • the verifier checks the CA's signature and confirms that:
  • the authentication can be performed using the identity-based GQ signature scheme as described above in connection with equations (23), (24), using w i, j as a private key.
  • the authentication proceeds as follows:
  • the verifier sends to the user a random message m.
  • the user generates a random number r and computes:
  • H is some predefined public function.
  • the user sends the values m, m i , r P i , and D to the verifier.
  • This scheme may reduce total bandwidth because the verifier does not need the certificate 140 .
  • accumulator v j allows a user to revoke itself, without the CA's help.
  • user u i simply broadcasts v j 1/p (mod n), after which every other user u k can update the accumulator to be v j ⁇ v j 1/p i (mod n) and can recompute its personal s k, j and w k, j values as in (43)-(45).
  • R j can be re-computed by multiplying the previous R j value by p i .
  • this scheme allows efficient distribution (e.g. broadcast) for the CA at the stage of FIG. 12 , since the CA transmits the same information to all the users. This information requires only O(t) transmissions. On the other hand, each transmission is proportional in size to the size of RR j .
  • Clients of the CA may include many users that are not in the particular t-member network that we are concerned about. If the “super-network” of clients of the CA is very large in proportion to t, this may not be a very good solution.
  • the CA's size of each transmission is still, strictly speaking, proportional to t, since the number of revocations within the network in a given period will tend to be a constant fraction of the total number of users.
  • the communication complexity of certificate distribution in this scheme is analogous to the communication complexity of a delta-CRL scheme. Recall that in a delta-CRL scheme, the CA transmits a list of users revoked in the given period, together with a signature on that list, to all users.
  • the scheme since a personal accumulator's size is independent of the number of time periods, the scheme has better communication complexity for authentication than delta-CRLs, because in the delta-CRL scheme the verifier must separately check the delta-CRLs for all time periods to confirm that a given user has not been revoked during any of these periods.
  • the invention is not limited to the embodiments described above.
  • the invention is not limited to secure or dynamic accumulators.
  • An accumulator can be any data that accumulate some elements.
  • the invention is not limited to the accumulators described above.
  • the accumulator seed h(j)/h(j ⁇ 1) in equation (17) can be replaced with a value independent of the period j
  • the accumulator seed ⁇ in the accumulator (37) can be replaced with a function of j.
  • the accumulator methods can be used to prove (authenticate) membership in a set or possession of some property. Examples include authentication of valid entitlements, or authentication of people as being members of some organization.
  • the CA 120 , the directories 210 , and the systems 110 are computer systems communicating with each other over a network or networks. Each of these systems may itself be a computer system having components communicating over networks. Each computer system includes one or more computer processors executing computer instructions and manipulating computer data as described above.
  • the term “data” includes “computer data” and covers both computer instructions and computer data manipulated by the instructions.
  • the instructions and data can be stored on a data carrier such as a computer storage, i.e. a computer readable medium (e.g. a magnetic or optical disk, a semiconductor memory, and other types of media, known or to be invented).
  • the data carrier may include an electromagnetic carrier wave transmitted over a network, e.g. through space, via a cable, or by some other means.
  • the instructions and data are operable to cause the computer to execute appropriate algorithms as described above.
  • the invention is not limited to any particular hash functions, or to cryptographic functions (which are easy to compute but are one-way or collision resistant).
  • is a small constant (e.g. 1/10, or 1/100, or 2 ⁇ 25 , or 2 ⁇ 50 , or 2 ⁇ 80 , or 2 ⁇ 160 , or some other value).
  • is a small constant (e.g. 1/10, or 1/100, or 2 ⁇ 25 , or 2 ⁇ 50 , or 2 ⁇ 80 , or 2 ⁇ 160 , or some other value).
  • the CA, the directories, and the systems 110 may include software-programmable or hardwired computer systems interconnected via a network or networks.
  • Each function ⁇ or H represents an evaluation method performed by a computer system.
  • the invention is not limited to the step sequences shown in the flowcharts, as the step order is sometimes interchangeable and further different steps may be performed in parallel. Other embodiments and variations are within the scope of the invention, as defined by the appended claims.
  • Efficient generation There is an efficient probabilistic algorithm G that on input 1 k produces a random element f of ⁇ FF k ⁇ . G also outputs some auxiliary information about f, denoted by aux f .
  • f ⁇ FF k ⁇ is a polynomial-size circuit that, on input (u, x) ⁇ UU f x XX k , outputs a value v ⁇ UU f , where UU f is an efficiently-samplable input domain for the function f, and ⁇ XX k ⁇ is the intended input domain whose elements are to be accumulated.
  • Camenisch and Lysyanskaya ([39]) define the notion of a dynamic accumulator:
  • a secure accumulator is dynamic if it has the following property:
  • Zero-Knowledge Proofs An advantage of accumulators (at least, RSA-based accumulators, which are described later) is that it is possible to construct efficient zero-knowledge proofs (ZK proofs) that a value has been accumulated. It has been proven that any statement that is in NP (nondeterministic polynomial-time) can be proven in ZK, but some statements can be proven in ZK much more efficiently than others. Briefly, we describe the concept of a ZK proof, which was introduced independently by Brassard, Chaum, and Crepeau and by Goldwasser, Micali, and Racko, and further refined by Bellare and Goldreich.
  • P imparts “zero knowledge” to V.
  • these proofs of knowledge are instantiated by a three-pass protocol, in which the prover first sends the verifier a commitment to certain values, after which the verifier sends the prover a challenge bit-strings, and the prover finally sends a response that incorporates both the “known value”, the committed values and the challenge value in such a way that it convinces the verifier is convinced of the prover's knowledge.
  • a commitment scheme consists of the algorithms Commit and VerifyCommit with properties as follows.
  • the (commitment) verification algorithm VerifyCommit takes as input (C, m, r) and outputs 1 (accept) if C is equal to Commit(m,r) and 0 (reject) otherwise.
  • represents the (hidden) x value
  • represents r and ⁇ represents w.
  • accumulator structure has an advantage that its size does not depend on the number of accumulated elements.
  • An RSA-based accumulator makes use of a composite integer n, called a modulus, that should be chosen in such a way that it is hard to factor.
  • the modulus is an RSA modulus, which is defined as follows:
  • n in a different way—e.g., as the product of three primes, or as the product of two primes of different sizes.
  • Euler totient function is the cardinality of the group Z n * (the multiplicative group of elements having an inverse in the ring Z n of the integers modulo n; Z n * is the set of all elements mutually prime with n).
  • the security of RSA-based accumulators is based on the following assumption.
  • RSAmodulus(1 k ) is an algorithm that generates an RSA modulus as the product of two random k-bit primes, and a negligible function neg(k) is a function such that for all polynomials p(k), there is a value k 0 such that neg(k) ⁇ 1/p(k) for all k>k 0 .
  • the tuple (n, u) generated as above, is called a general instance of the strong RSA problem.
  • a secure RSA-based accumulator for a family of inputs X k is a family of functions FF k , where the particular function f ⁇ FF k depends on what the modulus n is.
  • aux f is the (secret) factorization of n.
  • the security of the construction is based on the assumption that the strong RSA problem is infeasible to solve.
  • RSA-based accumulators can be made dynamic. Recall that an accumulator is dynamic if, given an accumulator v that accumulates values of the set X and given the secret information aux f , one can “de-accumulate” a value x′ ⁇ X—i.e., compute a new accumulator v′ that accumulates the values of the set X ⁇ x′ ⁇ . Moreover, given a witness w that a value x has been accumulated (with respect to accumulator v that accumulates members of the set X) and given the accumulator v′ that only accumulates members of X ⁇ x′ ⁇ , one can compute a new witness w′ for x with respect to the accumulator v′.
  • R is a predefined public function, e.g. a redundancy function.
  • the function R maps ID into an element of Z n .
  • the function R is such that the number of elements in Z n that correspond to mappings from valid ID's is small.
  • the PKG sends B to the user via a secure channel (e.g. encrypted).
  • H is a predefined public function (e.g. a hash function).
  • Verification The verifier:

Abstract

Authentication of elements (e.g. digital certificates 140) as possessing a pre-specified property (e.g. being valid) or not possessing the property is performed by (1) assigning a distinct integer pi to each element, and (2) accumulating the elements possessing the property or the elements not possessing the property using a P-th root u1/P (mod n) of an integer u modulo a predefined composite integer n, where P is the product of the integers associated with the accumulated elements. Alternatively, authentication is performed without such accumulators but using witnesses associated with such accumulators. The witnesses are used to derive encryption and/or decryption keys for encrypting the data evidencing possession of the property for multiple periods of time. The encrypted data are distributed in advance. For each period of time, decryption keys are released which are associated with that period and with the elements to be authenticated in that period of time. Authentication can be performed by accumulating elements into data which are a function of each element but whose size does not depend on the number of elements, and transmitting the accumulator data over a network to a computer system which de-accumulates some elements as needed to re-transmit only data associated with elements needed by other computer systems. This technique is suitable to facilitate distribution of accumulator data in networks such as ad hoc networks.

Description

    CROSS REFERENCE TO RELATED APPLICATIONS
  • The present application is a continuation of U.S. patent application Ser. No. 11/454,394, filed Jun. 16, 2006, incorporated herein by reference, which is a division of U.S. patent application Ser. No. 11/304,200 filed on Dec. 15, 2005, incorporated herein by reference, which claims priority under 35 U.S.C. §119(e) to provisional U.S. patent application No. 60/637,177 filed Dec. 17, 2004, incorporated herein by reference.
  • BACKGROUND OF THE INVENTION
  • The present invention relates to performing authentication as to whether or not an element possesses a pre-specified property. An example is authenticating validity of a digital revocation in a public key infrastructure, or authenticating validity of an entitlement to use a resource (e.g. to sign onto a World Wide Web site).
  • FIG. 1 illustrates digital certificate validation and revocation in a public key infrastructure. Digital certificates 104 are used in public key infrastructures (PKI) to facilitate secure use and management of public keys in a networked computer environment. Users U1, U2, . . . utilize their computer systems 110.1, 110.2, . . . to generate respective key pairs (PK, SK) where PK is the public key and SK is the secret key. FIG. 1 shows a key pair (PKU1, SKU1) for user U1. The users register their public keys PK, over a network, with a certification authority (CA) 120. Alternatively, the key pairs can be generated by CA 120 and sent to the users. CA 120 is a secure, trusted computer system. For each public key PK, CA 120 generates a digital certificate 104. Certificate 104 contains the public key PK and the user's name and/or email address or addresses, may also contain the certificate's serial number SN (generated by the CA to simplify the certificate management), the certificate issue date D1, the expiration date D2, an identification of algorithms to be used with the public and secret keys, an identification of the CA 120, and possibly other data. The data mentioned above is shown at 104D. Certificate 104 also contains CA's signature 104-SigCA on the data 104D. The signature is generated using CA's secret key SKCA. CA 120 sends the certificate 104 to the user's (key owner's) computer system 110. Either the owner or the CA 120 can distribute the certificate to other parties to inform them of the user's public key PK. Such parties can verify the CA's signature 104-SigCA with the CA's public key PKCA to ascertain that the certificate's public key PK does indeed belong to the person whose name and email address are provided in the certificate.
  • A certificate may have to be revoked prior to its expiration date D2. For example, the certificate owner U may change his affiliation or position, or the owner's private key SKU may be compromised. Other parties must be prevented from using the owner's public key if the certificate is revoked.
  • One approach to prevent the use of public keys of revoked certificates is through a certificate revocation list (CRL). A CRL is a signed and time-stamped list issued by CA 120 and specifying the revoked certificates by their serial numbers SN. These CRLs must be distributed periodically even if there are no new revoked certificates in order to prevent any type of replay attack. The CRL management may be unwieldy with respect to communication, search, and verification costs. The CRL approach can be optimized using so-called delta-CRLs, with the CA transmitting only the list of certificates that have been revoked in the previous time period (rather than for all time periods). The delta-CRL technique still has the disadvantage that the computational complexity of verifying that a certificate is currently valid is basically proportional to the number of time periods, since the verifier must confirm that the certificate is not in any of the delta-CRLs.
  • Certificate revocation trees (CRTs) can be used instead of CRLs as described in [15] (the bracketed numbers indicate references listed at the end before the claims).
  • Instead of CRLs and CRTs, CA 120 could answer queries about specific certificates. In FIG. 1, user U2 issues a query 150 with the serial number SN of certificate 104 of user U1. CA 120 responds with a validity status information 160 containing the serial number SN, a validity status field 160VS (“valid”, “revoked” or “unknown”), and a time stamp “Time”. The response is signed by CA (field 160-SigCA). This approach is used for Online Certificate Status Protocol (OCSP). See [23]. Disadvantageously, the CA's digital signature 160-SigCA can be quite long (over 1024 bits with RSA), especially since the CA must be very secure. In addition, if CA 120 is centralized, the CA becomes a validation bottleneck. If CA 120 is decentralized (replicated), the security is weakened as the CA's signing key SKCA is replicated.
  • FIG. 2 illustrates a “NOVOMODO” approach, which allows CA 120 to provide an unsigned validity status through untrusted directories 210 at pre-specified time intervals (e.g. every day, or every hour, etc.). Directories 210 are computer systems that do not store secret information. The system works as follows.
  • Let f be a predefined public length-preserving function
  • f: {0,1}n→0,1n
  • where {0,1}n is the set of all binary strings of a length n. Let fi denote the f-fold composition; that is, fi(x)=x for i=0, and fi(x)=f(fi−1(x)) for i>0. Let f be one-way, i.e. given f(x) where x is randomly chosen, it is hard (infeasible) to find a pre-image z such that f(z)=f(x), except with negligible probability. “Infeasible” means that given a security parameter k (e.g. k=n), the pre-image z cannot be computed in a time equal to a predefined polynomial in k except with negligible probability. Let us assume moreover that f is one-way on its iterates, i.e. for any i, given y=fi(x), it is infeasible to find z such that f(z)=y.
  • We can assume, without loss of generality, that CA is required to provide a fresh validity status every day, and the certificates are valid for one year, i.e. 365 days (D2-D1=365 days). To create a certificate 104 (FIG. 2), CA 120 picks a random “seed” number x and generates a “hash chain” c0, c1, . . . c365 wherein:

  • c 365 =f(x), c 364 =f(f(x)), . . . c 1 =f 365(x), c 0 =f 366(x).   (1)
  • We will sometimes denote x as x(SN) for a certificate with a serial number SN, and similarly ci=ci(SN) where i=0, 1, . . . . The value c0 is called a “validation target”. CA 120 inserts C0 into the certificate 104 together with data 104D (FIG. 1). CA 120 also generates a random revocation seed number N0, computes the “revocation target” N1=f(N0), and inserts N1 into certificate 104. CA 120 keeps all ci secret for i>0. The values x and N0 are also secret. Clearly, all ci can all be computed from x, and the validation target c0 can be computed from any ci. CA 120 stores in its private storage the values x and N0 for each certificate 104, and possibly (but not necessarily) caches the ci values.
  • Every day i (i=1, 2, . . . 365), a certificate re-validation is performed for the valid certificates as follows. For each certificate 104, CA distributes to directories 210 a validation data structure which includes, in addition to a validity status indication (not shown in FIG. 2, can be “valid” or “revoked”):
    • 1. the certificate's “i-token” ci if the certificate is valid on day i;
    • 2. the revocation seed N0 if the certificate has been revoked.
      (We will call ci a “validity proof”, and N0 a “revocation proof”.) This information is distributed unsigned. Each directory 210 provides this information, unsigned, to a requester system 110 in response to a validity status request 150 (FIG. 1). To verify, the requester (verifier) 110 performs the following operations:
    • 1. If the validity status is “valid”, the verifier 110 checks that fi(ci)=c0.
    • 2. If the validity status is “revoked”, the verifier 110 checks that f(N0)=N1. Despite the validity information being unsigned, the scheme is secure because given ci, it is infeasible to compute the subsequent tokens ci+1, ci+2, . . . .
  • To reduce the communication between CA 120 and directories 210, a hash chain (1) can be generated for a set of certificates 104, and a single i-token ci can be distributed for the set if the set is “unrevoked” (i.e. all the certificates are unrevoked in the set). The certificate 140 will contain a separate target c0 for each set containing the certificate and associated with a hash chain (see [1]).
  • Certificate revocation can also be performed using accumulators. See [37]. An accumulator is a way to combine a set of values (e.g. a set of valid certificates) into a shorter value. A formal definition of a “secure” accumulator is given in Appendix A at the end of this disclosure before the claims. An accumulator example can be constructed as follows. Let us denote all possible values that can be accumulated as p1, . . . , pt. (For example, each pi can be a unique number assigned to a certificate, and we want to accumulate the values corresponding to the valid certificates.) Suppose v0 is the accumulator value for the empty set. Let ƒ be a one-way function. To accumulate p1, we compute the accumulator as follows:

  • v({p 1})=ƒ(v 0 , p 1)   (2)
  • Now to accumulate p2, we set the accumulator to be v2=ƒ(v1, p2), and so on. More generally, the accumulator value for some set {pi 1 , . . . , pi } is

  • v({p i 1 , . . . , pi m })=ƒ(ƒ( . . . ƒ (v 0 , p i 1 ) . . . ), p i m )   (3)
  • The function ƒ can be chosen such that the accumulation order does not matter, i.e.

  • ƒ(ƒ(v, p i), p j)=ƒ(ƒ(v, p j), p i)   (4)
  • (this is the “quasi-commutative” property).
  • In each period j, CA 120 can send to the directories 210 a pair (vj, t) where vj is the accumulator value for the set of the valid certificates, and t is a time stamp. The directories can respond to queries 150 with some proof that the accumulator value vj accumulates the value pi corresponding to the certificate of interest.
  • A common accumulator is an RSA accumulator defined as follows:

  • ƒ(v, p)=v p mod n   (5)
  • where p is a positive integer, and n=q1q2 is the product of large prime numbers q1 and q2. In this case,

  • v({p i 1 , . . . , pi m })=v 0 pi 1 , . . . , pi m mod n   (6)
  • The certificate validation is performed as follows. Without loss of generality, suppose that the values p1, . . . , pm correspond to the valid certificates in a period j. Then the accumulator value distributed by CA 120 to directories 210 is

  • v j =v 0 p 1 . . . p m mod n   (7)
  • If a verifier 110 inquires a directory 210 of the status of a certificate corresponding to the value pi which is one of p1, . . . , pm, the directory sends to the verifier the accumulator value vj and a “witness” value

  • s i, j =v 0 p 1 . . . p i−1 p i+1 . . . p m mod n   (8)
  • The verifier checks that

  • s i, j p i =v j mod n   (9)
  • If this equality holds, the certificate is assumed to be valid.
  • The witness si, j is hard to forge provided that it is hard to compute the pi-th root of vj. The pi-th root computation is hard if the adversary does not know the factorization of n and the strong RSA assumption is valid (this assumption is defined in Appendix A). However, it is possible to keep pi and si, j secret. For example, instead of providing the values si, j and pi to the verifier, the verifier can be provided with a proof that such values exist and are known to the certificate owner.
  • Accumulators can be used more generally to prove that an element satisfies some pre-specified property.
  • SUMMARY
  • This section summarizes some features of the invention. Other features are described elsewhere in this disclosure. The invention is defined by the appended claims.
  • In some embodiments of the present invention, accumulators are constructed using modular roots with exponents corresponding to the accumulated values. For example, suppose we need an accumulator to accumulate all the elements that possess some property (e.g. all the valid certificates) or all the elements that do not possess that property (e.g. all the revoked certificates). We will associate each element with an integer greater than 1. Let PPm={p1, . . . , pm} be the set of integers associated with the elements to be accumulated (as in (7)), and denote the product of these integers as Pm:
  • P m = l = 1 m p l ( 10 )
  • (By definition herein, the product of the empty set of numbers is 1; i.e. Pm=1 if PPm is empty.) In some embodiments, the accumulator value represents the Pm-th root of some value u, e.g.

  • v j =u 1/P m mod n   (11)
  • In some embodiments, the following advantages are achieved.
  • Suppose the value (11) accumulates valid digital certificates. The value (11) can be modified by exponentiation to de-accumulate all the values pl except for some given value pi i.e. to compute

  • v j p 1 . . . p i−1 p i+1 . . . p m =u 1/p i   (12)
  • This exponentiation can be performed by a directory 210 or by the certificate owner's system 110, without knowledge of factorization of the modulus n. The value (12) is the accumulator value as if pi were the only accumulated value. The witness value needed for verification can also be computed as if pi were the only accumulated value. The verification (the authentication) can be performed using the values that do not depend on accumulated values other than pi. Alternatively, the verification can be performed with the accumulator and witness values that incorporate some other accumulated values but not necessarily all the accumulated values. Therefore, if a directory 210 or a user 110 are responsible for providing validity proofs for less than all of the certificates, the directory 210 or the user 110 (the “validity prover”) can use an accumulator that accumulates less than all of the valid certificates. In some embodiments, this feature reduces the number of computations needed to be performed by all of the provers.
  • In some embodiments, the value u=u(j) can depend on the time period j for which the authentication is provided (unlike the value v0 in (7)). Therefore, the time stamp t can be omitted.
  • In some embodiments, the accumulator accumulates the revoked certificates rather than the valid certificates. In some embodiments, the witness values for an integer pi depend on other p values.
  • In some embodiments, the witness values are used as encryption keys for encrypting validity proofs. The validity proofs can be constructed using a non-accumulator based validation system, e.g. as in FIG. 2. For example, let cj(i) denote the token cj for the period j for a certificate 140.i, where cj is formed as in (1). At the set-up time, when a user system 110 joins the certificate validation system, the CA generates the tokens cj(i) for all the periods j for the user. The CA also generates the witness values for all the periods j. The CA encrypts each token cj(i) under a key equal to (or obtained from) the witness value for the period j, under a symmetric encryption system. CA 120 transmits all the encrypted values to the user.
  • In each period j, if the certificate 140.i is still valid, CA 120 transmits the decryption key (the witness value) for the period j to the user, enabling the user to recover the token cj(i). The user provides the token to the verifiers to proof the certificate validity as described above in connection with FIG. 2.
  • Some embodiments of the invention are suitable for limited bandwidth or low reliability networks, for example in ad hoc networks, where the nodes 110 may have low computational and transmission power, and where the nodes may have only incomplete information about the topology of the network. (An ad hoc network is a self-configuring wireless network of mobile routers.)
  • Some embodiments are communication and storage efficient.
  • The invention is not limited to the features and advantages described above. Other features are described below. The invention is defined by the appended claims.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • FIGS. 1, 2 are block diagrams illustrating prior art certificate revocation schemes.
  • FIG. 3 illustrates a digital certificate according to some embodiments of the present invention.
  • FIG. 4 is a flowchart of operations performed by a certification authority (CA) in initial certification according to some embodiments of the present invention.
  • FIG. 5 is a block diagram illustrating certificate re-validation operations performed by a CA according to some embodiments of the present invention.
  • FIG. 6 is a flowchart of witness derivation operations according to some embodiments of the present invention.
  • FIG. 7 is a flowchart of authentication according to some embodiments of the present invention.
  • FIG. 8 is a block diagram showing data transmitted over networks in de-accumulation operations according to some embodiments of the present invention.
  • FIG. 9 is a state diagram illustrating accumulator transmissions according to some embodiments of the present invention.
  • FIG. 10 is a block diagram showing data transmissions in determining the network paths according to some embodiments of the present invention.
  • FIG. 11 is a flowchart of operations performed by a certification authority (CA) in initial certification according to some embodiments of the present invention.
  • FIG. 12 is a block diagram illustrating certificate re-validation operations performed by a CA according to some embodiments of the present invention.
  • FIG. 13 is a flowchart of witness derivation operations according to some embodiments of the present invention.
  • FIG. 14 is a flowchart of authentication according to some embodiments of the present invention.
  • DESCRIPTION OF PREFERRED EMBODIMENTS
  • The embodiments described in this section illustrate but do not limit the invention. The invention is defined by the appended claims.
  • In the following description, numerous details are set forth. However, the present invention may be practiced without these details. Some portions of the detailed descriptions that follow are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.
  • It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussion, it is appreciated that throughout the description, discussions utilizing terms such as “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, refer to the action and processes of a computer system, or some computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and other storage into other data similarly represented as physical quantities within the computer system storage, transmission or display devices.
  • The present invention also relates to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general-purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, and each coupled to a computer system.
  • Some of the algorithms presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required operations. The required structure for a variety of these systems will appear from the description below. In addition, the present invention is not described with reference to any particular programming language. A machine-readable medium includes any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computer). For example, a machine-readable medium includes read only memory (“ROM”); random access memory (“RAM”); magnetic disk storage media; optical storage media; flash memory devices; electrical, optical, acoustical or other form of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.); etc.
  • Preliminaries
  • Model And Notation.
  • In our model, we have a certification authority CA, a certificate owner or holder Owner, and a certificate verifier VV. Here Owner has a certificate issued by CA. The concept of a certification authority may apply more generally to any authority responsible for issuing access control privileges or authorizations to a plurality of individuals. The concept of an owner may be tied to a specific human being or organization operating a computer or to the computer itself, e.g. a world wide web server. Similarly, the verifier may be tied to a specific human being or organization operating a computer or to the computer itself, e.g. an access control server determining if it should permit access to certain services.
  • In a given transaction, VV wishes to ascertain that the certificate has not been revoked prior to its expiration date. To do so, VV must obtain a proof of validity or a proof of revocation that is or has been issued by the certification authority CA. VV may obtain this proof either from the CA directly, or through some other distribution mechanism.
  • We let {0,1}* denote the set of all bit strings. For a bit string s, we denote its length by |s|. We let H denote a cryptographic compression function that takes as input a b-bit payload as well as a v-bit initialization vector or IV, and produces a v-bit output. We assume b≧2v, which holds for all well-known constructions in use. For the constructions we describe here, we typically take b=2v. We assume these cryptographic compression functions are collision resistant; that is, finding two distinct inputs m1≠m2 such that H (IV, m1)=H (IV, m2) is difficult. We assume that the IV is fixed and publicly known. For notational simplicity, we will not always explicitly list IV as an argument in the hash function. A practical example of such a cryptographic compression function is SHA-1[26]. SHA-1's compression function has an output and IV size of 20-bytes and a 64-byte payload size. In many embodiments, we will not need to operate on data larger than the compression function payload size; however there are numerous standard techniques such as iterated hashing or Merkle-trees [19] for doing so. For simplicity, we will use the term hash function instead of compression function, where it is understood that a hash function can take arbitrary length strings {0,1}* and produce a fixed length output in {0,1}v.
  • In practice, one often constructs a length preserving function that is one way on its iterates by starting with a hash function H and padding part of the payload to make it length preserving.
  • Finally, for a real number r, we set ┌r┐ to be the ceiling of r, that is, the smallest integer value greater than or equal to r. Similarly, └r┐ denotes the floor of r, that is, the largest integer value less than or equal to r.
  • Let A be an algorithm. By A(·) we denote that A has one input. By A(·, . . . ,·) we denote that A has several inputs). By A(.) we will denote that A is an indexed family of algorithms. y←A(x) denotes that y was obtained by running A on input x. In case A is deterministic, then this y is unique; if A is probabilistic, then y is a random variable. If S is a set, then y←S denotes that y was chosen from S uniformly at random. Let b be a boolean function. The notation (y←A(x):b(y)) denotes the event that b(y) is true after y was generated by running A on input x. Finally, the expression

  • Pr[{x i ←A i(y i)}1≦i≦n :b(x n)]
  • denotes the probability that b(xn) is TRUE after the value xn was obtained by running algorithms A1 . . . , An on inputs y1, . . . yn.
  • Accumulation of Valid Certificates
  • Some accumulator schemes will now be described with respect to the digital certificate validation. These schemes can also be used for other authentication operations as described above.
  • To simplify the description, we will assume that each certificate owner Ui operates just one system 110.i and owns at most one certificate. This is not in fact necessary.
  • CA Set-Up.
  • The CA 120 generates a composite modulus n. In some embodiments, n is the product of two primes, but n can also be the product of three or more primes. In some embodiments, n is public, but n is hard to factor, and the factorization is known only to the CA 120.
  • Initial Certification (FIG. 4):
  • Suppose the i-th user ui joins the system in or after some time period j0. At step 410, the CA assigns a positive integer pi to ui. The numbers pi are chosen to be mutually prime with the modulus n. Also, each pi does not divide the LCM (lowest common multiple) of the remaining numbers pl, 1≠i. For example, the numbers p1, . . . , pi can be distinct prime numbers, or pairwise relatively prime.
  • The CA computes a unique public value mi∈(Z/nZ)* for the user ui. (Z/nZ is the ring of all residue classes modulo n, and (Z/nZ)* is the multiplicative group of the invertible elements of Z/nZ, i.e. of the elements defined by integers mutually prime with n.) In some embodiments,

  • m i =H 1(u i , p i , j 0 , w i)∈(Z/nZ)*   (13)
  • where H1 is a predefined function, e.g. a one-way collision resistant function, ui is the user identification (e.g. user name), and wi is an optional string (which may contain ui's public key and/or some other information). The value mi thus binds pi to ui's identity. If desired, any one or more of the values jo, pi, mi and the identification of the function H1 can be made part of the certificate 140. See FIG. 3 showing a certificate 140 containing mi, jo, and specifying the functions H1 and H2 (H2 is described below).
  • At step 420, the CA computes an “initial certificate” value

  • s i, j 0 =m i 1/p i (mod n)   (14)
  • The CA keeps this value secret, and transmits it to the user ui's system 110 in an encrypted form.
  • Certificate Re-Validation by CA in Time Period j (FIG. 5):
  • At the start of, or shortly before, the period j, the CA performs the following operations. Let t denote the total number of users in the system (i.e. the total number of users for whom the initial certification of FIG. 4 has been performed). Let UU denote the set of these users: UU={u1, . . . . , ut}. PP denotes the set of the corresponding p numbers: PP={p1, . . . , pt}. Let UUj UU be the subset of users that are to be re-validated in period j. Let PPj PP be the corresponding set of numbers p, and let

  • P jpk ∈PP j pk   (15)
  • i.e., Pj is the product of the integers in PPj. (By definition, the product of the empty set of numbers is 1.) The CA computes

  • h j =H 2(j)∈(Z/nZ)*, h j−1 =H 2(j−1)∈(Z/nZ)*   (16)
  • where H2 is the same as H1 or some other function. The CA also computes the accumulator

  • v j =v j(PP j)=(h j /h j−1)1/P j (mod n)   (17)
  • Of note, in some embodiments, the root in (17) exists with a very high probability.
  • The CA transmits the following data to the system 110 of each user in UUj (this data can also be broadcast to a larger set of users if such broadcast transmission is more efficient in terms of communication):
    • 1. v j;
    • 2. the list of users in UUj, which may be just the list of numbers pi in PPj. (Since there can be overlap among these lists for different periods j, the CA can simply transmit the information that has changed since the previous period; in this case, the CA transmits the list of numbers in PPj to each new user at step 430 of FIG. 4.)
  • Personal Accumulator and Witness Derivation by Users (FIG. 6):
  • At step 610, each user ui in UUj computes its “personal accumulator” vj(pi), i.e. the accumulator which accumulates only the user's pi value:

  • v j(p i)=(h j /h j−1)1/p i (mod n)   (18)
  • This value is computed from the vj value (17) by exponentiation:
  • v j ( p i ) = v j pk PP j { p i } pk ( mod n ) ( 19 )
  • At step 620, the user aggregates this personal accumulator with previous personal accumulators to obtain a witness for the period j:

  • s i, j =s i, j−1 v j(p i)=s i, j−1(h j /h j−1)1/p i (mod n)   (20)
  • The equations (20) and (14) imply that

  • s i, j =s i, j 0 (h j /h j 0 )1/p i (mod n)   (21)
  • User Authentication (FIG. 7):
  • A user ui can provide si, j to the verifier, along with (if necessary) the values for (ui, pi, j0, wi). At step 710, the verifier:
    • 1. computes mi from (13) or obtains it from the certificate 140 (FIG. 3);
    • 2. computes hj=H2(j) and hj o =H2(jo) (see (16)); and
    • 3. confirms that

  • s i, j p i =m i h j /h j 0 (mod n)   (22)
  • Alternative User Authentication:
  • Instead of giving the witness si, j to the verifier, the user can use si, j as a private key in an identity-based GQ (Guillou-Quisquater) signature scheme. This scheme is described in Appendix B at the end of this disclosure before the claims. The CA performs the functions of GQ's PKG (private key generator); GQ's parameters are set as follows: B=si, j, v=pi, and J=mi −1 mod n. The authentication proceeds as follows:
  • The verifier sends to the user a random message m.
  • The user generates a random number r and computes:

  • d=H(m∥r p i ), D=rs i, j d   (23)
  • where H is some predefined public function (e.g. H1 or H2). The user sends the values m, rP i , and D to the verifier.
  • The verifier computes J=mi −1 mod n and checks that the following equations hold:

  • d=H(m∥J d D p i )   (24)

  • J d D p i =r p i (h j /h j o )d (mod n)
  • This scheme may reduce total bandwidth because the verifier does not need the certificate 140. Note: for the GQ signature scheme to be secure, it is desirable that each pi>2160.
  • Remarks.
  • 1. First, si, j 0 can be computed in some other way, not necessarily as in (14).
  • 2. Anonymous Authentication.
  • If we want to allow the user nodes 110 to sign messages anonymously—i.e., to be able to authenticate themselves as users that have been certified by the CA, but without revealing their actual identities—we can handle initial certification differently. For example, instead of (13), the CA can set mi to be independent of the user's identity, e.g.:

  • m i =h j 0 =H(j 0)∈(Z/nZ)*   (25)
  • The mi value is then provided to the user. To hide the fact that the mi value is provided to the user, the mi value may be transmitted to the user via a secure channel (e.g., by encrypting this value such that only ui can decrypt it). Then, it follows from (14) and (21) that:

  • s i, j =h j 1/p i (mod n)   (26)
  • As mentioned below in Appendix A, there are efficient zero-knowledge (ZK) proofs through which user ui can prove, in the jth time period, that it knows a pth root of hj modulo n for some (unrevealed) number p that is contained in a specified interval I of integers, i.e.

  • PK{(α, β): αβ =h j mod n
    Figure US20100153714A1-20100617-P00001
    β∈I}
  • See [41], [42]. The interval I can be an interval containing all the numbers pi. Using this scheme, the user can authenticate itself anonymously if and only if it has obtained an initial certificate si, J 0 and the subsequent personal accumulator values vj(pi) (see (18), (19)).
    The CA can revoke the user as before—i.e., by not re-validating it (not including pi in the product Pj in FIG. 5).
  • As mentioned above, the accumulator techniques are not limited to a user possessing a single certificate or to a digital certificate revocation. For example, a user ui may or may not possess one or more of entitlements e1, e2, . . . er. During initial certification, the user ui is assigned a unique integer pi, k if the user is to be certified for an entitlement ek. The entitlement proof proceeds as described above with respect to equations (13)-(26), with numbers pi replaced by pi, k with si, j replaced by si, k, j, etc.
  • In some of these embodiments, however, a value pi is computed as the product of Pi, k. For example, if the user is initially certified for all the entitlements, then:

  • p i =p i, 1 . . . p i, r   (27)
  • In some embodiments, the integers pi, k are mutually prime relative to each other and to the CA's modulus n. The user ui's initial certificate is si, j 0 =mi 1/p i (mod n) as in (14), and ui can use exponentiation to de-accumulate all the values pi, l except a selected value pi, k for some k:
  • s i , k , j 0 = m i 1 / p i , k ( mod n ) = s i , j 0 l k p i , l ( mod n ) ( 28 )
  • The user can use this value to demonstrate that it possesses the entitlement that corresponds to prime pi, k without revealing the user's other entitlements. The CA can revoke a specific entitlement ek for the user without revoking the user's other entitlements, simply by issuing a validation accumulator in (17) that does not accumulate pi, k (i.e. the product Pj is computed as in (15) except that pi is replaced with pi/pi, k (the number pi, k is not included in the product)). If the user wants to sign anonymously and unlinkably, then the user cannot reveal its specific value of pi, k, but it would seem to make it difficult for a verifier to determine what entitlement the user is claiming (if the verifier cannot see the value of pi, k). We can get around this problem by, for example, associating each entitlement ek to a range of integers Ii. This range will contain all the pi, k values for all the users ui initially certified to have the entitlement ek. The ranges Ik do not overlap in some embodiments. Then the user can prove in ZK that it possesses a modular p-th root (for some unrevealed number p in the range Ik) of the appropriate value, i.e. the user can provide the following proof of knowledge:

  • PK{(α, β): αβ =C mod n
    Figure US20100153714A1-20100617-P00001
    β∈Ik}  (29)
  • where C=mihj/hj−1 or C=hj (see (21), (26)). See [41], [42]. The user can also prove that it possesses multiple entitlements simultaneously, e.g., by proving (in ZK if desired) its possession of a pth root for some p that is the product of (for example) two integers p1 and p2 in ranges corresponding to the claimed entitlements:

  • PK{(α, β): αβ =C mod n
    Figure US20100153714A1-20100617-P00001
    β=β1β2
    Figure US20100153714A1-20100617-P00001
    β1∈Ik 1
    Figure US20100153714A1-20100617-P00001
    β2∈Ik 2 }  (30)
  • See [41], [42].
  • Users Moving From Network to Network:
  • Suppose the CA has users (certificate owner systems) 110 in different networks, and the users move from a network to a network (e.g. some of the networks may be ad hoc networks). The CA can calculate a separate accumulator (say, (17)) for each network. Each accumulator will accumulate only the valid users in the corresponding network based on the CA's knowledge of the current composition of users in each network. Each user will compute its personal accumulator value and/or witness value (e.g., as in (18), (20), (26), and/or (28)). The user can move to another network and use the same personal accumulator value and/or witness value in the other network.
  • Aggregation of Personal Accumulators:
  • Multiple personal accumulators can be aggregated into a single value, in order to save bandwidth; from this aggregated value, a verifier can batch-verify that multiple users are indeed certified. For example, in the scheme of equations (17), (22), user ui (if it is still valid) possesses a personal value si, j that satisfies

  • s i, j p i =m i(h j /h j 0, i )(mod n)   (31)
  • where mi as in (13), and jo, i is the period jo for the user ui. Denote

  • z i =m i(h j /h j 0, i )(mod n).   (32)
  • Then, for multiple users in period j, their personal values can simply be multiplied together
  • S = i = 1 t s i , j ( mod n ) ( 33 )
  • where t′ is the number of users which take part in the aggregation (or the number of certificates or entitlements belonging to a user if each ui is a certificate or an entitlement). A verifier can use the value (33) to confirm that users (or certificates or entitlements) (ui, . . . , ut′) are valid by confirming that:
  • S i = 1 t p i = i = 1 t z i 1 p i i = 1 t p i ( mod n ) . ( 34 )
  • De-Accumulation.
  • We will now discuss concrete approaches to the de-accumulation of values from the accumulator computed by the CA; however, we note that the CA does not need to compute a single accumulator value that accumulates all of the values associated to all of the valid nodes 110 in the network. Instead, the CA can use a tradeoff, which we now describe. De-accumulation is somewhat computationally expensive. Procedure Split(v,P) below performs de-accumulation on an accumulator v that accumulates t k-bit numbers P={pi}; the procedure's output is t personal accumulators; the execution time is O(t log2 t) (where we consider k to be a constant). Let us denote the accumulator accumulating an empty set of values as u (in equation (17), u=h(j)/h(j−1)).
  • Then

  • u=v π pi ∈P pi (mod n).   (35)
  • Procedure Split(v,P):
      • 1. Split the set P into two disjoint halves P1 and P2.
      • 2. Compute v1 =v π pi ∈P 2 pi (mod n); this is the accumulator for the set P1.
      • 3. Compute v2 =v π pi ∈P 1 pi (mod n); this is the accumulator for the set P2.
      • 4. If P1 has only one member, output (v1, P1), otherwise call Split (v1, P1).
      • 5. If P2 has only one member, output (v2, P2), otherwise call Split (v2, P2).
        End of Split (v,P)
  • As a rule of thumb, exponentiating a number modulo n by a product of t′ numbers takes time proportional to t′; thus, the first split operation (steps 2 and 3 in procedure Split(v,P)) is the most expensive one in the recursion above. (Actually, since there are t distinct numbers (p1, . . . , pt), the pi are O(log t) bits apiece on average, so that the exponentiation is proportional to t′ log t′; since the Split algorithm can recurse to a depth of log t′, the overall computation complexity is t log2 t.) To reduce the amount of de-accumulation that needs to be performed, the CA can (for example) compute two accumulators—one for each of two halves P1 and P2 of P—and transmit these two accumulators to the users, thereby allowing the users to skip the first split operation and thereby reducing their computation. The CA can reduce their computation further by transmitting even more accumulators, each for an even smaller subset of the users. In computing these multiple accumulators, it is advantageous for the CA to use its knowledge of the current network topology to enhance the performance of the scheme. For example, suppose that the users are divided into several (say, 10) topological areas. Then, instead of using one product of integers Pj as in (15), the CA can compute 10 such products Pj, 1, . . . , Pj, 10, and 10 area-specific accumulators (hj/hj−1)1/P j, k . The CA then transmits each one of these 10 area-specific accumulators to the respective one of the 10 topological areas (along with a list of the re-validated users in that area). Users in a given area can compute their personal accumulators and witnesses from the area-specific accumulators.
  • De-accumulation is also relevant to how the personal accumulators (18)-(19) are computed. Clearly, in terms of computation, it is non-optimal for each of the t users to perform de-accumulation (18), (19) independently; doing it this way would entail O(t2) computation (actually, worse, since the size of the pi must grow at least as fast as log t). In some embodiments, the users compute their personal accumulators cooperatively, as illustrated, for example, in FIG. 8 and described below.
  • If the performance metric is minimum communication, a simple broadcast by the CA of the accumulator (17) to t users (see FIG. 5) is a good way of accumulator distribution. This results in overall communication of O(t). However, overall computation is at least O(t2) because each of t users has to perform t−1 exponentiations on the same accumulator.
  • Referring to FIG. 8, let PPj be the set of valid users (i.e. the set of the p numbers corresponding to the valid users). At the stage of FIG. 5 (re-validation), the CA sends the accumulator vj(PPj) (see (17) for example) and the numbers p in the set PPj to a designated node 110 (also marked D in FIG. 8). Node D divides the set PPj into sub-groups (sub-sets). In one example, the sub-group PPj−0 includes one or more of nodes 110.0, 110.00, 110.01; the sub-group PPj−1 includes one or more of nodes 110.1, 110.10, 110.11; the third sub-group consists of node 110 itself if this is a valid node. Node D computes the accumulator vj(PPj−0) for the sub-group PPj−0, and the accumulator vj(PPj−1) for the sub-group PPj−1. This computation can be performed by de-accumulating the nodes which are not sub-group members. See e.g. equation (19) and Procedure Split(v,P), steps 1 and 2. If node D is valid (i.e. its number p is in PPj), node D also computes its personal accumulator as in FIG. 6. Node D transmits the accumulator vj(PPj−0), and the p numbers in the set PPj−0, to node 110.0. Node D transmits the accumulator vj(PPj−1), and the p numbers in the set PPj−1, to node 110.1. The nodes 110.0, 110.1 perform the same operations as node D. In particular, node 110.0 divides the valid users PPJ−0 into sub-groups. In one example, the nodes 110.0, 110.00, 110.01 are valid; the sub-group PPj-0-0 consists of node 110.00; the sub-group PPj-0-1 consists of node 110.01; the third sub-group consists of node 110.0. The sub-groups are determined by node 110.0 from the p numbers in PPj-0. Node 110.0 computes accumulators vj(PPj-0-0), vj(PPj-0-1) for the respective sub-groups PPj-0-0, PPj-0-1, and also computes its personal accumulator as in FIG. 6. Node 110.0 transmits the accumulator vj(PPj-0-0), and the corresponding p number, to node 110.00. Node 110.0 transmits the accumulator vj(PPj-0-1), and the corresponding p number, to node 110.01. The accumulators vi(PPj-0-0), vj(PPj-0-1) are personal accumulators, so the nodes 110.00, 110.01 do not need to derive their personal accumulators.
  • Node 110.1 performs operations similar to those for node 110.0.
  • This procedure can be extended recursively to any number of nodes. The procedure is not limited to the “binary-tree” type of FIG. 8. A node can split a set of users into any number of sub-groups in addition to itself, possibly resulting in a non-binary-tree type operation. Also, in some embodiments, the accumulators are transmitted only to valid nodes. For example, if node 110 is invalid, then CA 120 transmits the accumulator vj(PPj) to a valid node instead. For communication efficiency, the sub-groups are selected so that the communications are efficient within each sub-group. For example, in case of ad hoc networks, the sub-groups can be selected based on geographic proximity, with the proximate nodes being grouped together.
  • Now, we describe one approach for selecting the sub-groups, where nodes only have local topology information. Roughly speaking, the idea is as follows. To partition (a portion of) the network, the designated node D chooses two “group heads” in the network, such as nodes 110.0, 110.1 in FIG. 8. (More than two group heads can also be selected.) These group heads can be chosen randomly. Alternatively, if the designated node has some topological information, it can use that information to attempt to choose the two group heads in a way that they are topologically distant—preferably on opposite sides of the network from each other. After D picks the two group heads, the designated node tells the two group heads to transmit different messages; for example, the designated node may tell the first group head to transmit ‘0’ and the second to transmit ‘1’. Then, each group head (e.g. 110.0, 110.1) “floods” the network with its particular message. When this occurs, the other nodes in the network will either receive a ‘0’ first or the ‘1’ first. Nodes that receive a ‘0’ first (e.g. nodes 110.00, 110.01) report back to the designated node D (or to the group head 110.0) that they are a member of the 0-group; the members of the 1-group report similarly. The designated node D (or the respective group heads) receives this information, and it de-accumulates the accumulator into two halves—one accumulator for the 0-group and one for the 1-group. If the designated node performed this de-accumulation (as in the procedure illustrated in FIG. 8), it passes along the appropriate accumulators to their corresponding group heads (110.0, 110.1). Then, each group head becomes the designated node for its corresponding sub-network, and the entire process described above is repeated for the sub-networks. Now, we will provide more detail for one embodiment.
  • At the beginning, there is only a single group PP of users which covers the whole network. Each recursion step is carried out in four phases as depicted in FIG. 9. The first recursion step is started by a node which is preferably located in the center of the network. We call this node the current designated node D. Node D executes the following four phases of recursion:
  • Search Group Heads (State 910):
  • Node D selects randomly two nodes out of its group as group heads GH0 and GH1. (For the sake of illustration, assume that node GH0 is node 110.0 of FIG. 8 or 10, and node GH1 is node 110.1). Node D sends out a broadcast message msearchGH with its group ID, the addresses of GH0 and GH1, and a path variable containing D's address. All receiving nodes within the same group obtain a copy of the path and check if they are GH0 or GH1. If not, they add their address to the path variable in the message and forward it (broadcast it) once. The path variable provides each node with the path to D. FIG. 10 shows the messages msearchGH transmitted by nodes D, 110.01, 110.10, 110.11.
  • Build Group (State 920):
  • If the receiver of msearchGH is either GH0 or GH1, it starts building a sub-group by broadcasting a message mbuildG containing its address. If a receiver of mbuildG which belongs to the same group hasn't already received a message from a group head and therefore, joined its sub-group, he joins the sub-group announced in mbuildG and forwards the message once. FIG. 10 illustrates the mbuildG messages broadcast by nodes GH0, GH1, 110.01, 110.10, 110.11, assuming that the node 110.01 received the mu buildG message from GH0 first, and nodes 110.10, 110.11 received the mbuildG message from GH1 first.
  • Report Group (State 930):
  • After some prescribed amount of time, all members of both sub-groups start reporting their membership status to D. Therefore, they include their addresses together with their sub-group IDs 0 or 1 in the message mreportG and send it over the path obtained in phase 1 to D. To make the reporting more efficient, nodes which are more distant from D start the reporting first. Nodes on the path of mreportG add their sub-group membership information to the message and forward it according to the path to D. Nodes having forwarded a mreportG don't initiate a report themselves.
  • Transmit Accumulator (State 940):
  • After D has received all reports, it looks up the paths p0 to GH0 and p1 to GH1 included in the received reports, exponentiates the accumulator vj for its group to obtain the accumulators vj(0) and vj(1) for the respective sub-groups, and sends the accumulators in respective messages mtransmitu0 over p0 to GH0 and mtransmitu1 over p1 to GH1, respectively. Additionally to the accumulators vj(0) and vj(1), these messages contain a list of the corresponding sub-group members. After reception of mtransmitu0 or mtransmitu1, respectively, GH0 and GH1 become designated nodes D of their sub-groups and enter phase 910 of the next recursion step. The recursion ends if the sub-group accumulator is a personal accumulator.
  • Considering a set of all users UU with cardinality |UU|=2R=t, and equal distribution of each group PP into two groups of identical size |PP|/2, the recursion will end after R steps with a total number of t sub-groups of size 1. Here, we mention a few aspects of the scheme's computational and communication complexity, assuming that, at each step, the split is into approximately equal halves.
  • Search Group Heads:
  • Within a subnetwork of size t′, this step requires O(t′) messages, each of size log t (since it requires log t bits on average to specify a single member of a group of t elements). Each message contains a path with average length C1 √{square root over (t′)}. Therefore, communication for this subnetwork is of O(t′√{square root over (t′)} log t). If we assume that the partitions are always equally-sized, the total communication of the entire recursive procedure is also O(t′√{square root over (t′)} log t).
  • Build Group:
  • This step involves a total of t messages, each of constant size, for communication complexity O(t).
  • Report Group:
  • Group membership information of the nodes is transmitted over C3*√{square root over (t)} hops, where C3 is a constant depending on the network density and reflecting the number of reports initiated: this results in communication of O (t′ √{square root over (t′)} log t).
  • Transmit Accumulator:
  • Accumulators together with group membership information of t nodes is transmitted over C4*√{square root over (t)} hops, where C4 is a constant depending on the network density: this results in communication of O (t′√{square root over (t′)} log t) and computation of O(tR log t)=O(t log2 t).
  • Overall, the communication is O(t√{square root over (t)} log t) and the computation is O(t log2 t).
  • If we assume that there is an entity E of the network with less stringent limitations in terms of computational power and energy such as the certification authority itself, another interesting opportunity arises. By acquiring some topology knowledge this entity may pre-de-accumulate the accumulator into accumulators for constant size groups. In detail, such a scheme works as follows: Some node C which holds the current accumulator for all users and has connectivity to E initiates a distributed clustering algorithm of FIG. 9. In a second step, C provides the clustering information to E and lets E perform the pre-de-accumulation for all clusters. Then C distributes the accumulators to the clusters. Suitable clustering algorithms have communication complexity of O(t√{square root over (t)} log t), but perhaps with a smaller constant factor than the approach described above.
  • Briefly, we mention a distributed approach that splits a connected network into two connected subnetworks, where neither subnetwork is more than twice the size of the other. As before, we begin with a sub-network that has a designated node. We assume that the sub-network is connected, and that its topology is basically constant during the accumulator distribution (though it may change dramatically from period to period). The first step in the preferred algorithm for achieving O(t log t) communication and O(t log t) computation is that, in a distributed fashion, the nodes of the sub-network establish an enumeration of themselves. This can be accomplished as follows. The designated node initiates the procedure by broadcasting a message. The nodes that receive the message transmit an acknowledgement message back to the designated node, and they log the designated node as the node from which they received the message. The designated node logs the acknowledging nodes as the nodes that received its message. This process recurses throughout the network. Specifically, a node that received the message from the designated node broadcasts the message, and nodes that have not sent or received the message before log the identity of the node that they received the message from and they send back an acknowledgment, after which the sending node logs the acknowledgers. If a node receives the message more than once, it only logs and responds back to the first node that sent it. In this fashion, since the subnetwork is connected, every node in the subnetwork (except the designated node) has a unique node from which it received the message, as well as a list of the nodes that received the message directly from it. Each node that has a nonempty list of acknowledgers chooses an arbitrary enumeration of those acknowledgers. In effect, from this procedure, we have constructed a tree (a graph with no loops) from the network, as well as an enumeration of all of the tree nodes given by the depth-first pre-order traversal of the tree. If the subnetwork has t′ nodes, this procedure can be accomplished with O(t′) communication and computation.
  • The next stage of the algorithm is to use the enumeration to approximately bisect the subnetwork. There are a variety of different ways of doing this. One method is that each node, beginning with the nodes with no acknowledgers, could back-transmit (backwards according to the enumeration) the number of nodes in its subtree including itself; in this fashion, each node computes the number of nodes in its subtree. There must be exactly one node that has at least half of the nodes in its subtree, but such that none of its children have at least half. This node is designated to be the midpoint of the subnetwork. Now, viewing the midpoint point as the root of the tree, it divides its children into two groups, such that the number of nodes that are in a subtree emanating from one of the children in the first group is approximately equal to the number of nodes that are in a subtree emanating from one of the children in the second group. (This can always be accomplished such that ratio between the two numbers is at most two.) Thus, all of the network nodes except the midpoint become members of one of the two groups; the midpoint is considered to be a member of both groups. The step of computing how many nodes are in each subtree requires O(t′log t′) communication, since there are t transmissions, where the size of each transmission (which is a number between 1 and t′ representing how many nodes are in the given subtree) is log t′ bits. Viewing the midpoint node as the root node, a new enumeration of the nodes is established with the midpoint node as the initiator of the message, beginning with the nodes in the first group. (This new enumeration could be computed as before, or it could actually be derived indirectly from the previous enumeration. Either way, it does not add to the asymptotic communication complexity of the protocol, which is t log2 t overall.)
  • Accumulator-Based Encryption of Validity Proofs
  • The personal accumulators vj(pi) and/or the witness values si, j (see e.g. equations (17), (20), (21), (26)) can be used to obtain symmetric keys that users can use to decrypt validation proofs under other validation systems. An example will now be given for the validation system obtained by combining the systems of FIGS. 2, 4-7, but this is not limiting.
  • Initial Certification:
  • When a user ui joins the system, the CA:
    • 1. Generates the validation and revocation seeds x, N0 as in FIG. 2.
    • 2. Generates all the tokens cj for all the periods j (see FIG. 2 and equation (1)).
    • 3. Generates the certificate 140 as in FIG. 2 and transmits the certificate to the user ui.
    • 4. Performs the steps of FIG. 4, i.e. generates the values pi, mi, si, j 0 and transmits Si, j 0 to the validity prover (which can be the user ui and/or the directories 210). The values pi, mi, can also be transmitted to the prover.
    • 5. Generates all the witness values si, j (for all the periods j) for the user ui. Also generates the encryption keys Ki, j of which is si, j or some function of si, j .
    • 6. Encrypts each token cj (generated at step 2 in this procedure) with the encryption key Ki, j under some encryption scheme (possibly a symmetric encryption scheme). Let us denote the encrypted cj value as Ei, j.
    • 7. Transmits all the values Ei, j (for all j) to the prover (i.e. the directories 210 and/or the certificate owner ui).
  • Re-Validation by CA:
  • At the start of, or shortly before, each period j, the CA:
    • 1. Performs the procedure of FIG. 5, i.e. computes and broadcasts the accumulator value vj and the list of valid p numbers to the provers.
    • 2. If the user ui's certificate is invalid, the CA transmits the revocation seed N0 to the prover corresponding to the certificate (e.g. to the user ui and/or the directories 210).
  • Proof Derivation by the Prover:
  • If the user ui's certificate is valid (as indicated by the transmission of number pi in the RE-VALIDATION procedure at step 1), the prover:
    • 1. Performs the procedure of FIG. 6 to derive the witness value si, j.
    • 2. Obtains the decryption key Ki, j from si, j.
    • 3. Decrypts Ei, j to recover
  • Authentication (Validity Proof): As in FIG. 2.
  • Many variations are possible. For example, the decryption keys can be some different function of si, j than the encryption keys.
  • Accumulation of Revoked Certificates
  • Above, we have described an approach in which an accumulator accumulates the valid certificates; an alternative approach is to accumulate revoked certificates. The valid certificates' owners (or validity provers) then use the “dynamic” feature of dynamic accumulators to compute a new accumulator for the valid nodes, and to compute their personal accumulators with respect to this new accumulator.
  • As before, we will assume for the sake of illustration that each user operates a corresponding computer system 110 and owns at most one certificate 140. This is not limiting, as a user may own multiple certificates and/or operate multiple systems 110. The scheme is also applicable to controlling resource access and other kinds of authentication. We will use the word “user” to denote both the system 110 and the system's operator where no confusion arises. As described below, each user ui will be assigned a positive integer pi with the same properties as in the scheme of FIGS. 4-7 (e.g. pi are mutually prime relative to the CA's public composite modulus n and to each other). The symbols n, PP, pi will be as in the scheme of FIGS. 4-7. In particular, PP is the set of the pi numbers.
  • For each period j, the symbol QQj will denote the set of the revoked pi numbers (i.e. the set of the pi numbers corresponding to the certificates to be declared as revoked in period j). Qj denotes the product of the numbers in QQj:

  • Q jPk ∈QQ j Pk   (36)
  • The symbol α will denote an accumulator seed, which is an integer mutually prime with the modulus n. The accumulator of the values in Qj is:

  • v j1/Q j mod n   (37)
  • Let RRj=QQj−QQj−1, i.e. RRj is the set of the p numbers corresponding to the certificates declared as revoked in period j but not in period j−1; in period j−1 these certificates were either declared as valid or were not yet part of the validation system. Let Rj denote the product of the numbers in RRj:

  • R jPk ∈RR j Pk   (38)
  • It is easy to see from (37) that if each certificate cannot be “unrevoked” (i.e. cannot be made valid once revoked), then:

  • v j =v j−1 1/R j mod n   (39)
  • CA Set Up:
  • The CA generates its modulus n and the accumulator seed α. The CA sets the initial accumulator value vj=α for the initial period j.
  • Initial Certification (FIG. 11):
  • Suppose a user ui wants to join the system in a period jo, to be validated starting the next period jo+1. At step 1110, CA 120 generates pi, mi as at step 410 in FIG. 4. These numbers can be made part of the user's certificate 140 (FIG. 3). At step 1120, the CA computes the following secret numbers:

  • t i =m i 1/p i (mod n)   (40)

  • s i, j 0 =v j 0 1/p i (mod n)   (41)
  • Here, vj 0 is the accumulator value for the period jo (vj 0 =α if QQj 0 is empty). At step 1130, the CA transmits the values ti, si, j 0 to the user ui in an encrypted form. As will be explained, the user will be able to derive the value

  • s i, j =v j 1/p i (mod n)   (42)
  • for each period j>jo for which the certificate is valid.
  • Certificate Re-Validation (FIG. 12):
  • In period j, suppose that vj−1∈Z/nZ is the accumulator value for period j−1. For validation in period j, the CA:
    • 1. Computes vj (using the equation (37) or (39) for example);
    • 2. Transmits the value vj together with a list of the newly-revoked certificates (perhaps represented by the set RRj) to the users. If desired, the CA may also sign the pair (vj, j) and transmit the signature to the users.
  • Witness Derivation (FIG. 13):
  • If a user ui is valid for the period j, then the user has the value si, j−1=vj−1 1/p i (mod n). See (41), (42). At step 1310, the user computes si, j=vj 1/p i as follows:
    • 1. The user applies the Extended Euclidian Algorithm to compute integers a and b such that

  • ap i +bR j=1   (43)
  • (this is possible because pi∉RRj, so pi and Rj are mutually prime).
    • 2. The user sets si, j to the value:

  • v j a s i, j−1 b mod n   (44)
  • This value is indeed a pi-th root of vj modulo n, because (note equation (39)):
  • ( v j a s i , j - 1 b ) p i = v j ap i v j - 1 1 p i bp i = v j ap i v j R j b = v j mod n
  • At step 1320, the user computes the witness

  • w i, j =t i s i, j   (45)
  • User Authentication (FIG. 14):
  • The user ui provides tisi, j (mod n) to the verifier, along with (if necessary) the values for (ui, pi, j0, wi). In addition, the user provides to the verifier the accumulator value vj and the CA's signature on (vj,j). At step 1410, the verifier checks the CA's signature and confirms that:

  • w i, j p i =m i v j (mod n)   (46)
  • Alternative User Authentication:
  • The authentication can be performed using the identity-based GQ signature scheme as described above in connection with equations (23), (24), using wi, j as a private key. The CA performs the functions of GQ's PKG (private key generator); GQ's parameters are set as follows: B=wi, j, v=pi, and J=mi −1 mod n. The authentication proceeds as follows:
  • The verifier sends to the user a random message m.
  • The user generates a random number r and computes:

  • d=H(m∥r p i ), D=rw i, j d (mod n)   (47)
  • where H is some predefined public function. The user sends the values m, mi, rP i , and D to the verifier.
  • The verifier computes J=mi −1 mod n and checks that the following equations hold:

  • d=H(m∥J d D p i )   (48)

  • J d D p i =r p i v j (mod n)
  • This scheme may reduce total bandwidth because the verifier does not need the certificate 140. Note: for the GQ signature scheme to be secure, it is desirable that pi>2160.
  • The use of accumulator vj allows a user to revoke itself, without the CA's help. To revoke itself in a period j, user ui simply broadcasts vj 1/p(mod n), after which every other user uk can update the accumulator to be vj←vj 1/p i (mod n) and can recompute its personal sk, j and wk, j values as in (43)-(45). Of note, Rj can be re-computed by multiplying the previous Rj value by pi.
  • In some embodiments, this scheme allows efficient distribution (e.g. broadcast) for the CA at the stage of FIG. 12, since the CA transmits the same information to all the users. This information requires only O(t) transmissions. On the other hand, each transmission is proportional in size to the size of RRj. Clients of the CA may include many users that are not in the particular t-member network that we are concerned about. If the “super-network” of clients of the CA is very large in proportion to t, this may not be a very good solution. Even if the CA only manages our t-member network, the CA's size of each transmission is still, strictly speaking, proportional to t, since the number of revocations within the network in a given period will tend to be a constant fraction of the total number of users. In this sense, the communication complexity of certificate distribution in this scheme is analogous to the communication complexity of a delta-CRL scheme. Recall that in a delta-CRL scheme, the CA transmits a list of users revoked in the given period, together with a signature on that list, to all users. On the other hand, since a personal accumulator's size is independent of the number of time periods, the scheme has better communication complexity for authentication than delta-CRLs, because in the delta-CRL scheme the verifier must separately check the delta-CRLs for all time periods to confirm that a given user has not been revoked during any of these periods.
  • The invention is not limited to the embodiments described above. The invention is not limited to secure or dynamic accumulators. An accumulator can be any data that accumulate some elements. Further, the invention is not limited to the accumulators described above. For example, the accumulator seed h(j)/h(j−1) in equation (17) can be replaced with a value independent of the period j, and the accumulator seed α in the accumulator (37) can be replaced with a function of j. The accumulator methods can be used to prove (authenticate) membership in a set or possession of some property. Examples include authentication of valid entitlements, or authentication of people as being members of some organization.
  • In some embodiments, the CA 120, the directories 210, and the systems 110 are computer systems communicating with each other over a network or networks. Each of these systems may itself be a computer system having components communicating over networks. Each computer system includes one or more computer processors executing computer instructions and manipulating computer data as described above. The term “data” includes “computer data” and covers both computer instructions and computer data manipulated by the instructions. The instructions and data can be stored on a data carrier such as a computer storage, i.e. a computer readable medium (e.g. a magnetic or optical disk, a semiconductor memory, and other types of media, known or to be invented). The data carrier may include an electromagnetic carrier wave transmitted over a network, e.g. through space, via a cable, or by some other means. The instructions and data are operable to cause the computer to execute appropriate algorithms as described above.
  • The invention is not limited to any particular hash functions, or to cryptographic functions (which are easy to compute but are one-way or collision resistant). In some embodiments, it is desirable that a function ƒ or H be collision resistant not in the sense that it is difficult to find different x and y with the same image but in the sense that if x and y are uniformly drawn from the function's domain, the probability is small that they both will have the same image:

  • P{H(x)=H(y)}≦α
  • where α is a small constant (e.g. 1/10, or 1/100, or 2−25, or 2−50, or 2−80, or 2−160, or some other value). Some or all of the techniques used for validity proofs can also be used for invalidity proofs and vice versa. The CA, the directories, and the systems 110 may include software-programmable or hardwired computer systems interconnected via a network or networks. Each function ƒ or H represents an evaluation method performed by a computer system. The invention is not limited to the step sequences shown in the flowcharts, as the step order is sometimes interchangeable and further different steps may be performed in parallel. Other embodiments and variations are within the scope of the invention, as defined by the appended claims.
  • REFERENCES
  • All of the following references are incorporated herein by reference.
    • [1] W. Aiello, S. Lodha, and R. Ostrovsky. Fast digital identity revocation. In Proc. of CRYPTO '98, 1998.
    • [2] G. Ateniese, J. Camenisch, M. Joye, and G. Tsudik. A Practical and Provably Secure Coalition-Resistant Group Signature Scheme. In Proceedings of CRYPTO 2000, 2000.
    • [3] M. Bellare and P. Rogaway. Random oracles are practical: A paradigm for designing efficient protocols. In Proc. First Annual Conference on Computer and Communications Security, ACM, 1993.
    • [4] D. Boneh, B. Lynn, and H. Shacham. Short signatures from the Weil pairing. In Proceedings of Asiacrypt '01, 2001.
    • [5] F. Elwailly and Z. Ramzan. QuasiModo: More Efficient Hash Tree-Based Certificate Revocation. Manuscript, 2003.
    • [6] I. Gassko, P. S. Gemmell, and P. MacKenzie. Efficient and fresh certification. In Proceedings of PKC 2000, 2000.
    • [7] S. Goldwasser, S. Micali, and R. L. Rivest. A Digital Signature Scheme Secure Against Adaptive Chosen-Message Attacks. SIAM Journal on Computing, 17(2):281-308, 1988.
    • [8] Y-C. Hu, A. Perrig, and D. Johnson. Efficient security mechanisms for routing protocols. In proceedings of the 10th Annual Network and Distributed System Security Symposium (NDSS), 2003.
    • [10] M. Jakobsson, J-P. Hubaux, and L. Buttyan. A micropayment scheme encouraging collaboration in multi-hop cellular networks. In Proceedings of the 7th International Conference on Financial Cryptography, 2003.
    • [10] M. Jakobsson, T. Leighton, S. Micali, and M. Szydlo. Fractal merkle tree representation and traversal. In Proceedings of the Cryptographer's Track, RSA Conference., 2003.
    • [11] S. Jarecki and A. Odlyzko. An efficient micropayment system based on probabilistic polling. In Proceedings of the 1st International Conference on Financial Cryptography, 1997.
    • [12] Robert Johnson, David Molnar, Dawn Xiaodong Song, and David Wagner. Homomorphic signature schemes. In CT-RSA, pages 244-262, 2002.
    • [13] C. Jutla and M. Yung. PayTree: Amortized signatures for flexible micropayments. In Proceedings of the second USENIX workshop on electronic commerce, 1996.
    • [14] S. Kim and H. Oh. An atomic micropayment system for a mobile computing environment. IEICE Transactions of Information and Systems, E84-D(6):709-716, 2001.
    • [15] P. Kocher. On Certificate Revocation and Validation. In Proceedings of the 2nd International Conference on Financial Cryptography, 1998.
    • [16] Satoshi Koga and Kouichi Sakurai. A distributed certificate status protocol with single public key. In Proceedings of PKC 2004, pages 389-401, 2004.
    • [17] R. J. Lipton and R. Ostrovsky. Micro-Payments via Efficient Coin Flipping. In Proceedings of the 2nd International Conference on Financial Cryptography, 1998.
    • [18] A. Malpani, R. Housely, and T. Freeman. Simple Certificate Validation Protocol—(SCVP). In IETF Draft—draft-ietf-pkix-scvp-12.txt, June 2003.
    • [19] R. C. Merkle. Protocols for Public-Key Cryptography. In IEEE Symposium on Security and Privacy, 1980.
    • [20] S. Micali. Efficient Certificate Revocation. MIT/LCS/TM 542b, Massachusetts Institute of Technology, 1996.
    • [21] S. Micali. Efficient Certificate Revocation. In Proceedings of the RSA Data Security Conference, 1997. Also U.S. Pat. No. 5,666,416.
    • [22] S. Micali. NOVOMODO: scalable certificate validation and simplified PKI management. In Proceedings of the 1st Annual PKI Research Workshop, 2002.
    • [23] M. Myers, R. Ankney, A. Malpani, S. Galperin, and C. Adams. X.509 internet public key infrastructure Online Certificate Status Protocol—OCSP. In Internet RFC 2560, June 1999.
    • [24] M. Naor and K. Nissim. Certificate Revocation and Certificate Update. In Proceedings of USENIX Security, 1998.
    • [25] National Bureau of Standards. NBS FIPS PUB 81: DES modes of operation. 1980.
    • [26] National Institute of Standards. FIPS 180-1: Secure hash standard. 1995.
    • [27] M. Pierce and D. O'Mahony. Micropayments for Mobile Networks. In Proceedings of European Wireless, 1999. Winner of Best Paper Award.
    • [28] R. L. Rivest. The MD5 message digest algorithm. In Internet RFC 1321, April 1992.
    • [29] R. L. Rivest. Electronic Lottery Tickets as Micropayments. In Proceedings of the 2nd International Conference on Financial Cryptography, 1997.
    • [30] R. L. Rivest and A. Shamir. PayWord and MicroMint—Two Simple Micropayment Schemes. CryptoBytes (RSA Laboratories), 2(1), 1996. Proceedings of 1996 International
  • Workshop on Security Protocols.
    • [31] R. L. Rivest, A. Shamir, and L. Adleman. A Method for Obtaining Digital Signatures and Public-Key Cryptosystems. Communications of the ACM, 21:120-126, 1978.
    • [32] Ron Steinfeld, Laurence Bull, and Yuliang Zheng. Content extraction signatures. In Proceedings of the 4th International Conference Seoul on Information Security and Cryptology, pages 285-304. Springer-Verlag, 2002.
    • [33] H. Tewari and D. O'Mahony. Multiparty Micropayments for Ad-Hoc Networks. In Proceedings of the IEEE Wireless Communications and Networking Conference (WCNC), 2003.
    • [34] H. Tewari and D. O'Mahony. Real-Time Payments for Mobile IP. IEEE Communications, 41(2):126- 136, 2003.
    • [35] D. Wheeler. Transactions Using Bets. In Proceedings of Fourth Cambridge Workshop on Security Protocols, 1996.
    • [36] J. Zhou and K-Y. Lam. Undeniable Billing in Mobile Communication. In Proceedings of MOBICOM, 1998.
    • [37] M. Goodrich, R. Tamassia. An Efficient Dynamic and Distributed Cryptographic Accumulator. 2001.
    • [38] J. Benaloh and M. de Mare. One-Way Accumulators: A Decentralized Alternative to Digital. Signatures.
    • [39] J. Camenisch and A. Lysyanskaya. Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials. 2002.
    • [40] S. Gokhale and P. Dasgupta. Distributed Authentication for Peer-to-Peer Networks. Symposium on Applications and the Internet Workshops (SAINT'03 Workshops), 2003.
    • [41] O. Goldreich, S. Micali, A. Wigderson. Proofs that Yield Nothing But their
  • Validity and a Methodology of Cryptographic Protocol Design. Extended Abstract, 27th FOCS, 1986 (IEEE).
    • [42] O. Goldreich and A. Kahan. How to Construct Constant-Round Zero-Knowledge Proof Systems for NP. Journal of Cryptology, Volume 9, No. 3, 1996, pages 167190.
    Appendix A Accumulators and Proofs of Knowledge
  • Definition (Secure Accumulator).
  • A secure accumulator for a family of inputs {XXk} is a family of families of functions GG={FFk} with the following properties:
  • Efficient generation: There is an efficient probabilistic algorithm G that on input 1k produces a random element f of {FFk}. G also outputs some auxiliary information about f, denoted by auxf.
  • Efficient evaluation: f∈{FFk} is a polynomial-size circuit that, on input (u, x)∈UUfx XXk, outputs a value v∈UUf, where UUf is an efficiently-samplable input domain for the function f, and {XXk} is the intended input domain whose elements are to be accumulated.
  • Quasi-commutative: For all k, for all f∈FFk, for all u∈UUf, for all x1, x2∈XXk, f(f(u, x1), x2)=f(f(u, x2), x1). If X={x1, . . . , xm}⊂XXk, then by f(u, X) we denote f(f(. . . (u, x1), . . . ).
  • Witnesses: Let v∈UUf and x∈XXk. A value w∈UUf is called a witness for x in v under f if v=f(w, x).
  • Security: Let UU′f x XX′k denote the domains for which the computational procedure for function f∈FFk is defined (thus UUf UU′f, XXk XX′k). For all probabilistic polynomial-time adversaries Ak,

  • Pr[f←G(1k); u←UU f, (x, w, X)←A k(f, UU f, u) : X∈XX k ; w∈UU f′; x∈XX k ; x∉X; ƒ(w, x)=ƒ(u, X)] −neg(k).
  • Camenisch and Lysyanskaya ([39]) define the notion of a dynamic accumulator:
  • Definition (Dynamic Accumulator).
  • A secure accumulator is dynamic if it has the following property:
  • Efficient Deletion: There exist efficient algorithms D and W such that, if v=f(u, X), x, x′∈X, and f(w, x)=v, then:

  • D(auxf , v, x′)=v′ such that v′=f(u, X−{x′}) and

  • W(f, v, v′, x, x′)=w′ such that f (w′, x)=v′.
  • Zero-Knowledge Proofs. An advantage of accumulators (at least, RSA-based accumulators, which are described later) is that it is possible to construct efficient zero-knowledge proofs (ZK proofs) that a value has been accumulated. It has been proven that any statement that is in NP (nondeterministic polynomial-time) can be proven in ZK, but some statements can be proven in ZK much more efficiently than others. Briefly, we describe the concept of a ZK proof, which was introduced independently by Brassard, Chaum, and Crepeau and by Goldwasser, Micali, and Racko, and further refined by Bellare and Goldreich.
  • Let x be an input, and let R be a polynomially computable relation. Roughly speaking, a zero-knowledge proof of knowledge of a witness w such that R(x, w)=1 is a probabilistic polynomial-time protocol between a prover P and a verifier V such that, after the protocol, V is convinced that P knows such a witness w, but V does not obtain any explicit information about w. In other words, apart from “proving” that it knows a witness w such that R(x, w)=1, P imparts “zero knowledge” to V.
  • In the sequel, we may use the notation introduced by Camenisch and Stadler for various proofs of knowledge of discrete logarithms and proofs of the validity of statements about discrete logarithms. For instance,

  • PK {(α, β, γ): y=g α hβ
    Figure US20100153714A1-20100617-P00001
    =g′α h′γ
    Figure US20100153714A1-20100617-P00001
    (u≦α≦v)}
  • denotes a zero-knowledge Proof of Knowledge of integers α, β, and γ such that y=gα hβ and y′=g′α h′γ, where u≦α≦v and where g, g′, h, h′, y, and y′ are elements of some groups G=<g>=<h> and G′=<g′>=<h′>. The convention is that Greek letters denote quantities the knowledge of which is being proved, while all other parameters are known to the verifier. Using this notation, a proof-protocol can be described by just pointing out its aim while hiding all details.
  • Often, these proofs of knowledge are instantiated by a three-pass protocol, in which the prover first sends the verifier a commitment to certain values, after which the verifier sends the prover a challenge bit-strings, and the prover finally sends a response that incorporates both the “known value”, the committed values and the challenge value in such a way that it convinces the verifier is convinced of the prover's knowledge.
  • These proofs of knowledge can be turned into signature schemes via the Fiat-Shamir heuristic. That is, the prover determines the challenge c by applying a collision-resistant hash function H to the commitment and the message m that is being signed and then computes the response as usual. We denote such signature proofs of knowledge by the notation, e.g., SPK {α:y=ƒ(α)}(m). Such SPK's can be proven secure in the random oracle model, given the security of the underlying proofs of knowledge.
  • ZK proofs are often accomplished with the help of a commitment scheme. A commitment scheme consists of the algorithms Commit and VerifyCommit with properties as follows. The commitment algorithm Commit takes as input a message m, a random string r and outputs a commitment C, i.e., C=Commit(m,r). The (commitment) verification algorithm VerifyCommit takes as input (C, m, r) and outputs 1 (accept) if C is equal to Commit(m,r) and 0 (reject) otherwise. The security properties of a commitment scheme are as follows. The hiding property is that a commitment C=Commit(m, r) contains no (computational) information on m. The binding property is that given C, m, and r, where 1 =VerifyCommit(C,m,r), it is (computationally) impossible to find a message m0 and a string r0 such that 1 =VerifyCommit(C, m0, r0).
  • To prove, in ZK, knowledge of a witness w of a value x that has been accumulated—i.e., that f(w, x)=v, where v is the accumulator value—the usual method is to choose a random string r and construct a commitment c=Commit(x, r) and then provide the following proof of knowledge:

  • PK{(α, β, γ):c=Commit(α, γ)
    Figure US20100153714A1-20100617-P00001
    ƒ(γ,α)=v}.
  • Above α represents the (hidden) x value, while β represents r and γ represents w.
  • Rsa-Based Accumulators.
  • Here we describe a common concrete instantiation of accumulators, which uses mathematics related to the well-known RSA public-key cryptosystem, invented by Rivest, Shamir and Adleman in 1977. Above, our description focused on some RSA-based instantiation of accumulators, but this description should not be considered limiting; our accumulator-based certificate revocation schemes could be used with any type of accumulators. An accumulator structure has an advantage that its size does not depend on the number of accumulated elements. An RSA-based accumulator makes use of a composite integer n, called a modulus, that should be chosen in such a way that it is hard to factor. In some embodiments of the schemes defined above, the modulus is an RSA modulus, which is defined as follows:
  • Definition (RSA modulus). A 2k -bit number n is called an RSA modulus if n=pq, where p and q are k-bit prime numbers.
  • Of course, one can choose n in a different way—e.g., as the product of three primes, or as the product of two primes of different sizes.
  • Definition (Euler totient function). Let n be an integer. The Euler totient function φ(n) is the cardinality of the group Zn * (the multiplicative group of elements having an inverse in the ring Zn of the integers modulo n; Zn * is the set of all elements mutually prime with n).
  • If n=pq is the product of two primes, then φ(n)=(p−1)(q−1).
  • The security of RSA-based accumulators is based on the following assumption.
  • Definition (Strong RSA Assumption) The strong RSA assumption is that it is “hard,” on input an RSA modulus n and an element u∈Zn *, to compute values e>1 and v such that ve=u(mod n). By “hard”, we mean that, for all polynomial-time circuit families {Ak}, there exists a negligible function neg(k) such that

  • Pr[n←RSAmodulus(1k); u←Z n *; (v, e)←A k(n, u): v e=u(mod n)]=neg(k),
  • where RSAmodulus(1k) is an algorithm that generates an RSA modulus as the product of two random k-bit primes, and a negligible function neg(k) is a function such that for all polynomials p(k), there is a value k0 such that neg(k)<1/p(k) for all k>k0. The tuple (n, u) generated as above, is called a general instance of the strong RSA problem.
  • Corollary 1. Under the strong RSA assumption, it is hard, on input a flexible RSA instance (n, u), to compute integers e>1 and v such that ve=u(mod n).
  • The most common concrete instantiation of accumulators is based on the above strong-RSA assumption. Roughly speaking, the idea is as follows: Given a fixed base u(mod n), one can compute an accumulator of values x1 and x2 (for example) as v=ux 1 x 2 (mod n). To prove that x1 (for example) has been accumulated, one can forward the witness w=ux 2 (mod n) and a verifier can confirm that indeed wx 1 (mod n).
  • Now, we relate the formal description of accumulators to the concrete RSA-based construction. A secure RSA-based accumulator for a family of inputs Xk is a family of functions FFk, where the particular function f∈FFk depends on what the modulus n is. For reasons that will become clear later, we assume that elements of Xk are pairwise relatively prime integers. Then, auxf is the (secret) factorization of n. As alluded to above, given an initial accumulator value v′, an additional value x is added to the accumulator by computing a new accumulator value v=v′x (mod n). Notice that the computational complexity of this algorithm is independent of the number of prior values that have been accumulated. The RSA-based accumulator possesses the quasi-commutative property; e.g., regardless of the order in which x1 and x2 are incorporated into an initial accumulator v′, the result is v=v′x 1 x 2 (mod n). Given an accumulator v(mod n), the witness that a value x has been accumulated is w=v1/x (mod n), which can readily be verified by confirming that v=wx(modn). To reiterate, the security of the construction is based on the assumption that the strong RSA problem is infeasible to solve.
  • RSA-based accumulators can be made dynamic. Recall that an accumulator is dynamic if, given an accumulator v that accumulates values of the set X and given the secret information auxf, one can “de-accumulate” a value x′∈X—i.e., compute a new accumulator v′ that accumulates the values of the set X−{x′}. Moreover, given a witness w that a value x has been accumulated (with respect to accumulator v that accumulates members of the set X) and given the accumulator v′ that only accumulates members of X−{x′}, one can compute a new witness w′ for x with respect to the accumulator v′. Specifically, for RSA-based accumulators, one can use the factorization of n to de-accumulate x′ by computing v′=v1/x′(mod n). And given a witness w for x with respect to v—i.e., wx=v(mod n)—and given the value of v′, one can compute a witness w′ for x with respect to v′—i.e., w′x=v′=v′1/x′(mod n)←w′=v′1/xx′(mod n) as follows. Assuming that x and x′ are relatively prime, one can compute integers (a, b) such that ax+bx′=1, by using the Extended Euclidean Algorithm. Then w′=v′awb=va/x′vb/x=v(ax+bx′)/xx′=v1/xx′(mod n). Notice that the computation of w′ is efficient, and (after v′ is computed) it doesn't require any secret knowledge (e.g., the factorization of n).
  • Given a witness w that a value x is accumulated (with respect to an accumulator v(mod n)), it also well-known in the art how to construct a ZK proof of knowledge of a pair (w, x) that satisfies wx=v(mod n) (that hides the values of both w and x from the verifier).
  • End of Appendix A APPENDIX B Guillou-Quisquater (GQ) ID-based Signature Scheme
  • Set-Up:
  • 1. A public key generator (PKG, a trusted party), publishes its public key (v, n) where n=q1q2 (a product of two primes) is such that its factorization is hard to find, and v is a prime less than φ(n)=(p−1)(q−1).
  • 2. For a user with an identity ID (e.g., an email address), the PKG computes the secret signing key B such that JBv=1 mod n, where J=R(ID), where R is a predefined public function, e.g. a redundancy function. In some embodiments, the function R maps ID into an element of Zn. The function R is such that the number of elements in Zn that correspond to mappings from valid ID's is small. The PKG sends B to the user via a secure channel (e.g. encrypted).
  • Signing: To sign a message M, the user:
    • 1. Computes J=R(ID)
    • 2. Generates a random number r and computes

  • d=H(M∥r v), D=rB d   (B-1)
  • where H is a predefined public function (e.g. a hash function).
    • 3. Sends the values M, rv, d, D to the verifier.
  • Verification: The verifier:
    • 1. Computes J=R(ID);
    • 2. Checks that d=H(M∥rv);
    • 3. Checks that JdDv=rv.
      End of Appendix B

Claims (10)

1. A network transmission method comprising transmitting, over a computer network, a computer program operable to perform a computer-implemented authentication method for providing authentication for a plurality of elements as possessing a pre-specified property, wherein for each time period j of a plurality of successive time periods, the authentication is to be provided for each said element which possesses the pre-specified property, each element being operable to acquire the property and/or to lose the property in each of the successive time periods j, each element being associated with a distinct integer greater than 1, the authentication method comprising, for at least one element El which is one of said elements, performing a set-up operation for the authentication, the set-up operation comprising:
a first computer system generating the distinct integer pE1 associated with the element E1;
the first computer system obtaining data representing a pE1-th root of a base number modulo a predefined composite integer whose factorization is a secret of the first computer system;
the first computer system providing said data to a second computer system to enable the second computer system to prove that the element E1 possesses the pre-specified property;
wherein for each said period j for which the element E1 is to be authenticated as possessing said property, the authentication is to be performed by operations comprising:
the second computer system obtaining data representing an accumulator value which accumulates all the entities in a set P1j which is either (i) a set of the entities certified as possessing the pre-specified property in the period j, or (ii) a set of the entities certified as not possessing the pre-specified property in the period j;
the second computer system combining the accumulator value with a value dependent on said pE1-th root of the base number to obtain a witness value which is a pE1-th root, modulo said composite integer, of a first value dependent on the base number and the accumulator value, the authentication comprising verifying that the pE1-th power of the witness value equals the first value.
2. The network transmission method of claim 1 wherein the elements are either (a) digital certificates each of which certifies that a cryptographic key is associated with an entity, or (b) entitlements to use one or more resources, and said property is validity of a digital certificate or an entitlement.
3. The network transmission method of claim 1 wherein in the authentication, the first value is made available to a verifier together with the witness value or a proof of knowledge of the witness value.
4. The network transmission method of claim 3 wherein the computer program is operable to perform the authentication operations for at least one said time period j.
5. The network transmission method of claim 1 wherein the accumulator value is a Pj-th root u1/P j (mod n) of an integer u modulo said predefined composite integer, where Pj is the product of the distinct integers associated with the members of the set P1j, where u is a constant or is a predefined function of the period of time.
6. The network transmission method of claim 1 wherein said verifying, that the pE1-th power of the witness value equals the first value, is performed by a verifier computer system, and the pE1-th root of the base number is a secret not provided to the verifier computer system.
7. The network transmission method of claim 2 wherein in the authentication, the first value is made available to a verifier together with the witness value or a proof of knowledge of the witness value.
8. The network transmission method of claim 7 wherein the computer program is operable to perform the authentication operations for at least one said time period j.
9. The network transmission method of claim 2 wherein the accumulator value is a Pj-th root u1/P j (mod n) of an integer u modulo said predefined composite integer, where Pj is the product of the distinct integers associated with the members of the set P1j, where u is a constant or is a predefined function of the period of time.
10. The network transmission method of claim 2 wherein said verifying, that the pE1-th power of the witness value equals the first value, is performed by a verifier computer system, and the pE1 -th root of the base number is a secret not provided to the verifier computer system.
US12/712,923 2004-12-17 2010-02-25 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates Abandoned US20100153714A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/712,923 US20100153714A1 (en) 2004-12-17 2010-02-25 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US63717704P 2004-12-17 2004-12-17
US11/304,200 US7266692B2 (en) 2004-12-17 2005-12-15 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US11/454,394 US7747857B2 (en) 2004-12-17 2006-06-16 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US12/712,923 US20100153714A1 (en) 2004-12-17 2010-02-25 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US11/454,394 Continuation US7747857B2 (en) 2004-12-17 2006-06-16 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates

Publications (1)

Publication Number Publication Date
US20100153714A1 true US20100153714A1 (en) 2010-06-17

Family

ID=36588615

Family Applications (5)

Application Number Title Priority Date Filing Date
US11/304,200 Expired - Fee Related US7266692B2 (en) 2004-12-17 2005-12-15 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US11/454,394 Expired - Fee Related US7747857B2 (en) 2004-12-17 2006-06-16 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US11/454,262 Expired - Fee Related US7743252B2 (en) 2004-12-17 2006-06-16 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US12/712,912 Abandoned US20100174904A1 (en) 2004-12-17 2010-02-25 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US12/712,923 Abandoned US20100153714A1 (en) 2004-12-17 2010-02-25 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates

Family Applications Before (4)

Application Number Title Priority Date Filing Date
US11/304,200 Expired - Fee Related US7266692B2 (en) 2004-12-17 2005-12-15 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US11/454,394 Expired - Fee Related US7747857B2 (en) 2004-12-17 2006-06-16 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US11/454,262 Expired - Fee Related US7743252B2 (en) 2004-12-17 2006-06-16 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US12/712,912 Abandoned US20100174904A1 (en) 2004-12-17 2010-02-25 Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates

Country Status (4)

Country Link
US (5) US7266692B2 (en)
EP (1) EP1825377A4 (en)
JP (1) JP2008524930A (en)
WO (1) WO2006066142A2 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10333696B2 (en) 2015-01-12 2019-06-25 X-Prime, Inc. Systems and methods for implementing an efficient, scalable homomorphic transformation of encrypted data with minimal data expansion and improved processing efficiency

Families Citing this family (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8239917B2 (en) * 2002-10-16 2012-08-07 Enterprise Information Management, Inc. Systems and methods for enterprise security with collaborative peer to peer architecture
US7840806B2 (en) * 2002-10-16 2010-11-23 Enterprise Information Management, Inc. System and method of non-centralized zero knowledge authentication for a computer network
US7266692B2 (en) * 2004-12-17 2007-09-04 Ntt Docomo, Inc. Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
US8683020B2 (en) * 2005-02-26 2014-03-25 Coco Communications Corp. Naming system layer
US8874477B2 (en) 2005-10-04 2014-10-28 Steven Mark Hoffberg Multifactorial optimization system and method
US20070168297A1 (en) * 2006-01-18 2007-07-19 Cheng Siu L Efficient method and system for secure business-to-business transaction
CN101421973B (en) * 2006-04-12 2014-01-29 艾利森电话股份有限公司 Method and device for plural telecommunications functions having sharing transaction(s)
IL178488A0 (en) * 2006-10-05 2008-01-20 Nds Ltd Improved key production system
EP3010174A1 (en) * 2006-11-07 2016-04-20 Security First Corp. Systems and methods for distributing and securing data
TWI340354B (en) * 2006-12-14 2011-04-11 Inst Information Industry System, method, and computer readable medium for micropayment with varying denomination
KR101301775B1 (en) * 2007-01-31 2013-09-02 삼성전자주식회사 Method for executing distributed verification for measured data in sensor network and system for executing the method
FR2913154A1 (en) * 2007-02-28 2008-08-29 France Telecom Identity based cryptographic method for encrypting and decrypting e.g. electronic message, involves encrypting message using symmetric encryption key and broadcasting cryptogram and encrypted message from transmitting entity
US9497028B1 (en) 2007-05-03 2016-11-15 Google Inc. System and method for remote storage auditing
US8752207B2 (en) * 2007-05-18 2014-06-10 Secure Keys Pty Limited Security token and system and method for generating and decoding the security token
EP1998491A1 (en) * 2007-05-31 2008-12-03 Thomson Licensing Method for calculating compressed RSA moduli
JP4988448B2 (en) * 2007-06-25 2012-08-01 株式会社日立製作所 Batch verification apparatus, program, and batch verification method
US8538014B2 (en) * 2008-05-12 2013-09-17 Oracle America, Inc. Fast computation of one-way hash sequences
US20090285387A1 (en) * 2008-05-15 2009-11-19 Chiou-Haun Lee Symmetric encryption/decryption method of variable length and application thereof
US9130757B2 (en) * 2008-08-11 2015-09-08 International Business Machines Corporation Method for authenticated communication in dynamic federated environments
US8683259B2 (en) 2010-05-19 2014-03-25 Cleversafe, Inc. Accessing data in multiple dispersed storage networks
WO2012059794A1 (en) * 2010-11-05 2012-05-10 Nokia Corporation Method and apparatus for providing efficient management of certificate revocation
US8839381B2 (en) 2010-12-07 2014-09-16 Microsoft Corporation Revoking delegatable anonymous credentials
FR2969879A1 (en) * 2010-12-23 2012-06-29 France Telecom ANONYMOUS ACCESS TO SERVICE WITH AGREGATE CERTIFICATES
EP2705629A4 (en) * 2011-05-06 2015-07-29 Certicom Corp Validating a batch of implicit certificates
US9425967B2 (en) * 2013-03-20 2016-08-23 Industrial Technology Research Institute Method for certificate generation and revocation with privacy preservation
EP2843587A1 (en) * 2013-08-27 2015-03-04 OpenLimit SignCubes AG Method for generating evidence-data for a long-term data storage system for datasets
MY169097A (en) * 2014-10-01 2019-02-18 Mimos Berhad Method for secure network establishment via authentication of single-use passwords with counter measures against password replay
US10951423B2 (en) * 2016-03-29 2021-03-16 Koninklijke Philips N.V. System and method for distribution of identity based key material and certificate
US10862683B2 (en) * 2016-05-19 2020-12-08 Arris Enterprises Llc Implicit RSA certificates
US10374809B1 (en) * 2016-12-13 2019-08-06 Amazon Technologies, Inc. Digital signature verification for asynchronous responses
CN107592293A (en) * 2017-07-26 2018-01-16 阿里巴巴集团控股有限公司 The means of communication, digital certificate management method, device and electronic equipment between block chain node
CN111684764B (en) * 2018-02-05 2023-07-04 Lg 电子株式会社 Cryptographic method and system for digital certificate revocation using blind activation codes
US11005654B2 (en) 2019-05-14 2021-05-11 Google Llc Outsourcing exponentiation in a private group
CN110135909A (en) * 2019-05-15 2019-08-16 山东工商学院 Data processing method, system, equipment and storage medium based on zero-knowledge proof
US10848481B1 (en) * 2019-05-17 2020-11-24 The Florida International University Board Of Trustees Systems and methods for revocation management in an AMI network

Citations (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4914698A (en) * 1988-03-16 1990-04-03 David Chaum One-show blind signature systems
US5140634A (en) * 1987-09-07 1992-08-18 U.S Philips Corporation Method and apparatus for authenticating accreditations and for authenticating and signing messages
US5666416A (en) * 1995-10-24 1997-09-09 Micali; Silvio Certificate revocation system
US5687235A (en) * 1995-10-26 1997-11-11 Novell, Inc. Certificate revocation performance optimization
US5699431A (en) * 1995-11-13 1997-12-16 Northern Telecom Limited Method for efficient management of certificate revocation lists and update information
US5717757A (en) * 1996-08-29 1998-02-10 Micali; Silvio Certificate issue lists
US5717758A (en) * 1995-11-02 1998-02-10 Micall; Silvio Witness-based certificate revocation system
US5793868A (en) * 1996-08-29 1998-08-11 Micali; Silvio Certificate revocation system
US5903651A (en) * 1996-05-14 1999-05-11 Valicert, Inc. Apparatus and method for demonstrating and confirming the status of a digital certificates and other data
US5982892A (en) * 1997-12-22 1999-11-09 Hicks; Christian Bielefeldt System and method for remote authorization for unlocking electronic data
US6044462A (en) * 1997-04-02 2000-03-28 Arcanvs Method and apparatus for managing key revocation
US6097811A (en) * 1995-11-02 2000-08-01 Micali; Silvio Tree-based certificate revocation system
US6128740A (en) * 1997-12-08 2000-10-03 Entrust Technologies Limited Computer security system and method with on demand publishing of certificate revocation lists
US6226743B1 (en) * 1998-01-22 2001-05-01 Yeda Research And Development Co., Ltd. Method for authentication item
US6292893B1 (en) * 1995-10-24 2001-09-18 Silvio Micali Certificate revocation system
US6301659B1 (en) * 1995-11-02 2001-10-09 Silvio Micali Tree-based certificate revocation system
US20020124175A1 (en) * 2001-03-02 2002-09-05 Seiko Epson Corporation Data processing system utilizing discrete operating device
US20020165824A1 (en) * 1995-10-02 2002-11-07 Silvio Micali Scalable certificate validation and simplified PKI management
US6487658B1 (en) * 1995-10-02 2002-11-26 Corestreet Security, Ltd. Efficient certificate revocation
US20030177352A1 (en) * 2001-12-21 2003-09-18 International Business Machines Corporation Revocation of anonymous certificates, credentials, and access rights
US20030217265A1 (en) * 2002-05-09 2003-11-20 Toshihisa Nakano Public key certificate revocation list generation apparatus, revocation judgement apparatus, and authentication system
US20030221101A1 (en) * 1995-10-02 2003-11-27 Silvio Micali Efficient certificate revocation
US20030236976A1 (en) * 2002-06-19 2003-12-25 Microsoft Corporation Efficient membership revocation by number
US20040049675A1 (en) * 1995-10-02 2004-03-11 Silvio Micali Physical access control
US20040128504A1 (en) * 2002-09-30 2004-07-01 Tero Kivinen Method for producing certificate revocation lists
US6766450B2 (en) * 1995-10-24 2004-07-20 Corestreet, Ltd. Certificate revocation system
US20050053045A1 (en) * 2003-07-08 2005-03-10 Samsung Electronics Co., Ltd. Method and system for distributed certificate management in ad-hoc networks
US20050081037A1 (en) * 2003-10-10 2005-04-14 Yoko Kumagai Method and apparatus for accelerating public-key certificate validation

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4748668A (en) * 1986-07-09 1988-05-31 Yeda Research And Development Company Limited Method, apparatus and article for identification and signature
EP0693836A1 (en) * 1994-06-10 1996-01-24 Sun Microsystems, Inc. Method and apparatus for a key-management scheme for internet protocols.
KR100402348B1 (en) 2003-07-02 2003-10-22 Bong Taek Kim Automatic train protection stop device for controlling railroad using data communication
US7266692B2 (en) * 2004-12-17 2007-09-04 Ntt Docomo, Inc. Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates

Patent Citations (33)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5140634A (en) * 1987-09-07 1992-08-18 U.S Philips Corporation Method and apparatus for authenticating accreditations and for authenticating and signing messages
US4914698A (en) * 1988-03-16 1990-04-03 David Chaum One-show blind signature systems
US6487658B1 (en) * 1995-10-02 2002-11-26 Corestreet Security, Ltd. Efficient certificate revocation
US20020165824A1 (en) * 1995-10-02 2002-11-07 Silvio Micali Scalable certificate validation and simplified PKI management
US20040049675A1 (en) * 1995-10-02 2004-03-11 Silvio Micali Physical access control
US20030221101A1 (en) * 1995-10-02 2003-11-27 Silvio Micali Efficient certificate revocation
US5666416A (en) * 1995-10-24 1997-09-09 Micali; Silvio Certificate revocation system
US6292893B1 (en) * 1995-10-24 2001-09-18 Silvio Micali Certificate revocation system
US20050055548A1 (en) * 1995-10-24 2005-03-10 Silvio Micali Certificate revocation system
US6766450B2 (en) * 1995-10-24 2004-07-20 Corestreet, Ltd. Certificate revocation system
US5960083A (en) * 1995-10-24 1999-09-28 Micali; Silvio Certificate revocation system
US5687235A (en) * 1995-10-26 1997-11-11 Novell, Inc. Certificate revocation performance optimization
US6097811A (en) * 1995-11-02 2000-08-01 Micali; Silvio Tree-based certificate revocation system
US20020046337A1 (en) * 1995-11-02 2002-04-18 Silvio Micali Tree-based certificate revocation system
US5717758A (en) * 1995-11-02 1998-02-10 Micall; Silvio Witness-based certificate revocation system
US6301659B1 (en) * 1995-11-02 2001-10-09 Silvio Micali Tree-based certificate revocation system
US5699431A (en) * 1995-11-13 1997-12-16 Northern Telecom Limited Method for efficient management of certificate revocation lists and update information
US5903651A (en) * 1996-05-14 1999-05-11 Valicert, Inc. Apparatus and method for demonstrating and confirming the status of a digital certificates and other data
US6532540B1 (en) * 1996-05-14 2003-03-11 Valicert, Inc. Apparatus and method for demonstrating and confirming the status of a digital certificates and other data
US6442689B1 (en) * 1996-05-14 2002-08-27 Valicert, Inc. Apparatus and method for demonstrating and confirming the status of a digital certificates and other data
US5717757A (en) * 1996-08-29 1998-02-10 Micali; Silvio Certificate issue lists
US5793868A (en) * 1996-08-29 1998-08-11 Micali; Silvio Certificate revocation system
US6044462A (en) * 1997-04-02 2000-03-28 Arcanvs Method and apparatus for managing key revocation
US6128740A (en) * 1997-12-08 2000-10-03 Entrust Technologies Limited Computer security system and method with on demand publishing of certificate revocation lists
US5982892A (en) * 1997-12-22 1999-11-09 Hicks; Christian Bielefeldt System and method for remote authorization for unlocking electronic data
US6226743B1 (en) * 1998-01-22 2001-05-01 Yeda Research And Development Co., Ltd. Method for authentication item
US20020124175A1 (en) * 2001-03-02 2002-09-05 Seiko Epson Corporation Data processing system utilizing discrete operating device
US20030177352A1 (en) * 2001-12-21 2003-09-18 International Business Machines Corporation Revocation of anonymous certificates, credentials, and access rights
US20030217265A1 (en) * 2002-05-09 2003-11-20 Toshihisa Nakano Public key certificate revocation list generation apparatus, revocation judgement apparatus, and authentication system
US20030236976A1 (en) * 2002-06-19 2003-12-25 Microsoft Corporation Efficient membership revocation by number
US20040128504A1 (en) * 2002-09-30 2004-07-01 Tero Kivinen Method for producing certificate revocation lists
US20050053045A1 (en) * 2003-07-08 2005-03-10 Samsung Electronics Co., Ltd. Method and system for distributed certificate management in ad-hoc networks
US20050081037A1 (en) * 2003-10-10 2005-04-14 Yoko Kumagai Method and apparatus for accelerating public-key certificate validation

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10333696B2 (en) 2015-01-12 2019-06-25 X-Prime, Inc. Systems and methods for implementing an efficient, scalable homomorphic transformation of encrypted data with minimal data expansion and improved processing efficiency

Also Published As

Publication number Publication date
US20060242699A1 (en) 2006-10-26
US7266692B2 (en) 2007-09-04
EP1825377A2 (en) 2007-08-29
US20100174904A1 (en) 2010-07-08
JP2008524930A (en) 2008-07-10
US20060248334A1 (en) 2006-11-02
US20060137006A1 (en) 2006-06-22
WO2006066142A3 (en) 2007-12-21
US7747857B2 (en) 2010-06-29
WO2006066142A2 (en) 2006-06-22
EP1825377A4 (en) 2011-05-04
US7743252B2 (en) 2010-06-22

Similar Documents

Publication Publication Date Title
US7747857B2 (en) Use of modular roots to perform authentication including, but not limited to, authentication of validity of digital certificates
Gentry et al. Identity-based aggregate signatures
US7315941B2 (en) Multi-certificate revocation using encrypted proof data for proving certificate&#39;s validity or invalidity
US7814314B2 (en) Revocation of cryptographic digital certificates
Li et al. Certificate-based signature: security model and efficient construction
Zhang et al. Efficient many-to-one authentication with certificateless aggregate signatures
Menezes et al. Security of signature schemes in a multi-user setting
Wu et al. A new efficient certificateless signcryption scheme
Yang Broadcast encryption based non-interactive key distribution in MANETs
Jin et al. Certificateless multi-proxy signature
Tonien et al. Multi-party concurrent signatures
Han et al. Adaptive secure multicast in wireless networks
Zhou et al. Certificate-based generalized ring signcryption scheme
EP1843516A2 (en) Proof for cryptographic digital certificates
Yang et al. Efficient mediated certificates public-key encryption scheme without pairings
Lee et al. A new proxy signature scheme providing self-delegation
Zhang et al. An efficient certificate-based signature scheme without pairings
Dang et al. Hierarchical pseudonym-based signature scheme and self-generated pseudonym system in Ad Hoc networks
Yao et al. Anonymous Role-based Delegation With Group Signatures

Legal Events

Date Code Title Description
STCB Information on status: application discontinuation

Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION