Apparatus and method based on direct anonymous attestation

Abstract

Apparatus and methods based on direct anonymous attestation. One technique includes generating a direct anonymous attestation (DAA) signature to prove that an electronic device is a member of a group. Generating the signature includes determining a reciprocal of a prime modulus, and determining the reciprocal of the prime modulus includes left-shifting a Barrett multiplier by a predetermined number of bits and multiplying the left-shifted result of the Barrett multiplier by the prime modulus.

Description

BACKGROUND

[0001] Direct Anonymous Attestation (DAA) provides a way for an electronic device to prove that the device is a member of a group without revealing which member. In DAA, an issuer creates a group public key, and an electronic device obtains a unique membership private key from the issuer. The electronic device can prove that the device is a member of the group by generating a signature using the device's private key, such that the signature can be verified by a verifier using the group public key. DAA includes a revocation mechanism to revoke an electronic device's membership from a public group. Enhanced Privacy ID (EPID) is a particular DAA-based scheme with enhanced revocation capabilities. BRIEF DESCRIPTION OF DRAWINGS

[0002] Figure 1 is a schematic diagram of an electronic device according to an example implementation.

[0003] Figure 2 is a flow diagram depicting a resource-efficient Barrett reduction technique for determining a reciprocal of a prime modulus, according to an example implementation.

[0004] Figure 3 and Figure 4 is a flow diagram depicting a technique for generating a Direct Anonymous Attestation (DAA) signature in a resource-constrained electronic device, according to an example implementation.

[0005] Figure 5 is a flow diagram depicting a resource-efficient multi-exponentiation technique, according to an example implementation.

[0006] Figure 6 is a schematic diagram of an electronic device according to an example implementation.

[0007] Figure 7 is a schematic diagram of an enhanced privacy ID (EPID) hardware of an electronic device according to an example implementation. Figure 6 DETAILED DESCRIPTION

[0008] ​According to example implementations, techniques and apparatuses are described herein that allow resource-constrained electronic devices to generate direct anonymous attestation (DAA) signatures. In this context, a resource-constrained device refers to an electronic device, such as an Internet of Things (IoT) device, that has a limited amount of memory capacity and / or processing power for purposes of generating DAA signatures as compared to other electronic devices, such as tablet computers, notebook computers, desktop computers, and the like. Generally, an IoT device includes one or more sensors (biometric sensors, image sensors, pressure sensors, temperature sensors, cameras, and the like), and the electronic device is to transmit data acquired by the sensors and record and / or process the received data with a computing system component (e.g., a cloud server) connected to the Internet. As an example, an IoT device can be used to acquire information related to a biomedical device (e.g., a heart transplant), a manufacturing process, a status of an automobile component, and the like.

[0009] According to example implementations, an electronic device can be configured to perform an enhanced privacy identification (EPID) attestation, which is a particular type or category of DAA. According to other example implementations, the systems and techniques described herein can be applied to DAA schemes other than EPID attestation.

[0010] Depending on the particular implementation, a DAA-based signature, such as an EPID signature, can be used for various purposes. For example, according to some implementations, an IoT device can generate a signature based on a private key and a group public key for purposes of attesting to membership in a public group. For example, attesting to such membership can be used for purposes of an IoT device communicating with another computer system (e.g., a cloud server) to authenticate the IoT device, provide resources (keys and the like), register the IoT device, and the like.

[0011] Because an IoT device can serve a particular purpose and is not a general-purpose computer, the IoT device can have a limited amount of resources involved in relatively memory- and processing-intensive operations. For example, an IoT device can perform various cryptographic operations, such as verification and signing operations in which the electronic device generates a DAA signature, such as an EPID signature. The IoT device can encounter problems performing the cryptographic operations involved in generating an EPID signature because these operations can be resource-intensive if not for the techniques and apparatuses described herein. As an example, such potentially resource-intensive operations can include processing-intensive operations, such as operations to determine a prime modulus inverse using multiplication operations (i.e., determining a where "p" is a prime number and "q" is a prime number. " indicates a prime number). As another example, a potential resource-intensive operation can be a memory-intensive operation, such as an operation that uses a relatively large memory space occupation to perform exponentiation (i.e., to compute a product of multiple power functions such as "2Λx * 3Λx * 5Λx * 7Λx * 11Λx * 13Λx * 17Λx * 19Λx * 23Λx * 29Λx * 31Λx * 37Λx * 41Λx * 43Λx * 47Λx * 53Λx * 59Λx * 61Λx * 67Λx * 71Λx * 73Λx * 79Λx * 83Λx * 89Λx * 97Λx").

[0012] Depending on the particular implementation, the electronic device can take different forms (and thus can or can not be an IoT device). In general, the electronic device can be any device that can benefit from the techniques and apparatuses described herein for generating DAA signatures. As examples, the electronic device can be an IoT device; a thin client; a server; a client; a desktop computer; a portable or laptop computer; a tablet computer; a smart phone; a wearable device (e.g., a watch); and the like.

[0013] For the example implementations described herein, the electronic device is a processor-based device, i.e., a device in which one or more hardware components (e.g., one or more central processing units (CPUs) or CPU processing cores) execute machine-executable instructions (i.e., "software" and / or "firmware") to perform various functions of the electronic device, as described herein, including functions related to generating DAA signatures. Note that, according to example implementations, one or more functions of the electronic device can be performed by hardware circuitry that does not execute machine-executable instructions, such as, for example, application-specific integrated circuits (ASICs) and / or field-programmable gate arrays (FPGAs). Moreover, according to example implementations, all or portions of the functions of the electronic device for generating DAA signatures as described herein can be performed by hardware circuitry that does not execute machine-executable instructions.

[0014] According to example implementations, the electronic device can use a Barrett-based reduction to determine the inverse of a prime modulus using a single multiplication operation in a ring (e.g., as opposed to two multiplication operations) using an iterative Barrett reduction, thereby reducing processing and memory resources. According to example implementations, the electronic device can use two 3072-bit temporary variables (e.g., as opposed to sixteen variable 3072-bit temporary variables) to perform exponentiation, thereby reducing processing and memory resources.

[0015] According to example implementations, the approaches described herein for determining the inverse of a prime modulus and performing exponentiation can reduce processing latency by fifty percent, reduce energy consumption by fifty percent, and can reduce memory complexity by a factor of eight as compared to existing exponentiation techniques and systems. According to other example implementations, other and different results can be achieved. Thus, the techniques and systems described herein make EPID technology feasible for resource-constrained electronic devices, such as loT devices.​

[0016] Reference Figure 1 As a more specific example, according to some implementations, the electronic device 100 includes various hardware and / or software components, such as a processor 124 (e.g., one or more CPUs or CPU processing cores, for example) and one or more hardware components that provide a cryptographic engine 164 (further described herein). As described herein, the cryptographic engine 164 has features to minimize the impact on resources of the electronic device 100 for purposes of generating DAA signatures, such as EPID signatures, for the electronic device 100. In particular, as described herein, according to some implementations, the cryptographic engine 164 includes a prime reduction engine 166 and a power multiplication engine 168. Note that the electronic device 100 can contain various other software and / or hardware components, such as one or more applications 170, an operating system 180, one or more device drivers 174, and the like.

[0017] According to some implementations, the cryptographic engine 164 can be formed by a general purpose processor, such as the processor 124 or another processor, executing machine executable instructions (or "software") that are stored on the electronic device 100. As such, such instructions can be stored in, for example, a non-transitory storage medium (storage medium stored from a semiconductor memory device, a volatile memory device, a non-volatile memory device, a memristor, a phase change memory device, a magnetic storage, a combination of one or more of the foregoing storage technologies, and the like). According to further example implementations, the cryptographic engine 164 can be formed from a hardware component, such as an ASIC or FPGA, that does not execute machine executable instructions. According to further example implementations, the cryptographic engine 164 can include one or more specialized processors that are dedicated to performing cryptographic related operations for the electronic device 100, such as operations related to, for example, encrypting data, decrypting data, generating DAA based signatures, generating EPID based signatures, and the like. Further, according to further example implementations, the cryptographic engine 164 can be formed from a combination of one or more hardware components that execute machine executable instructions and one or more hardware processors that execute machine executable instructions.

[0018] According to example implementations, the cryptographic engine 164 generates DAA-based signatures (also referred to herein as "DAA signatures"), such as EPID-based signatures (also referred to herein as "EPID signatures") in processes involving the determination of a prime number or the reciprocal of a prime number modulus (i.e., the reciprocal of a prime number). One way of performing EPID prime reduction involves the use of multiple Barrett reduction iterations, which can be described as follows for the purpose of computing the reciprocal of the most significant 32 bits of a prime number:

[0019] I. multiply the Barrett multiplier (32-bit reciprocal) by the most significant ) bits of the result of the intermediate reduction;

[0020] II. multiply the most significant 32 bits of the result of step I by the prime number modulus;

[0021] III. subtract the result of step II from the most significant ) bits of the result of the intermediate reduction;

[0022] IV. left shift the intermediate result by 32 bits to form a new result of the intermediate reduction; and

[0023] V. repeat steps I through IV until the result is reduced to k bits.

[0024] In conjunction with Figure 1 Referring to Figure 2 , according to example implementations, the prime reduction engine 166 can perform EPID prime reduction according to technique 200, which is less processing-intensive than the EPID prime reduction described above. Generally speaking, technique 200 follows the EPID prime reduction described above. In other words, blocks 214, 218, 222, and 226 of technique 200 respectively follow steps II through V of the EPID prime reduction outlined above. However, unlike the EPID prime reduction described above, according to example implementations, technique 200 performs EPID prime reduction in a manner that conserves processing resources. As such, technique 200 performs the operation depicted in block 210 (instead of step II) to eliminate the processing-intensive multiplication operation involved in the prime redactor.

[0025] As such, according to example implementations, generating a given EPID signature involves applying Barrett reduction twice to determine the reciprocals of two prime numbers p and q. The value of the most significant 32 bits of the EPID prime (both p and q) happens to be . Thus, the Barrett multiplier (i.e., the reciprocal) is Thus, instead of the multiplication operation described above in step II, block 210 involves left-shifting the intermediate reduction result. In other words, the output of block 210 of the technique is a left-shifted multiplicand that is 32 bits, and the most significant 32 bits of this output are used in block 218. Thus, according to an example implementation, the technique 200 reduces the number of multiplications from two to one per iteration of the EPID prime reduction, which results in 50% better latency and energy efficiency.

[0026] Thus, in conjunction with Figure 1 Referring to Figure 3 According to an example implementation, an electronic device such as the electronic device 100 including the prime reduction engine 166 can perform the technique 300, the computing 300 including performing multiple iterations of Barrett reduction to determine an inverse of a prime modulus. A given iteration of the multiple iterations includes left-shifting (block 310) a Barrett multiplier by a predetermined number of bits and multiplying the left-shifted result of the Barrett multiplier by the prime modulus. The technique 300 includes generating (block 314) a DAA-based signature based on the private key and the public key to prove membership of the electronic device in the public group based on the determined inverse of the prime modulus.

[0027] Referring to Figure 1 According to some implementations, the exponentiation engine 168 performs the multiplication of the multiple power functions (referred to herein as performing "exponentiation") using a technique that saves the allocation of memory for temporary variables involved in the process.

[0028] As a more specific example, the generation of an EPID signature by the electronic device 100 can involve computing or determining the "A" "B" "C" and "D" values as follows: More specifically, according to some implementations, "A", "B", "C", and "D" represent respective 3072-bit numbers; and "a", "b", "c", and "d" represent respective 256-bit numbers. One way of performing this operation can be described as follows:

[0029]

[0030] Example 1.

[0031] In Example 1, the first part of the exponentiation technique is a pre-computation phase in which a sixteen-entry auxiliary table is created based on A, B, C, and D The second part of Example 1 is an evaluation phase in which the multiplication operations are performed. As can be seen, the evaluation phase involves 256 iterations, with each iteration involving multiplication with respect to the auxiliary table. Since the auxiliary table has sixteen entries, each iteration of the computation phase involves storing sixteen temporary variables, one for each entry of the auxiliary table. Moreover, each of these temporary variables stores 3072 bits of data. According to an example implementation, to conserve resources for resource-constrained electronic devices, the temporary variables are stored in a 32-bit register For purposes of performing the exponentiation, the exponentiation engine 168 can use the following techniques to determine the exponentiation product:

[0032]

[0033] Example 2.

[0034] In contrast to the sixteen temporary variables in Example 1, the exponentiation of Example 2 uses two 3072-bit temporary variables, namely and Thus, Example 2 involves a pre-computation phase with respect to two computations: and The computation phase of Example 2 involves manipulation of only these two temporary variables. In this regard, the two temporary variables and are reused in each of the 256 iterations, with temporary variable providing the final result (as a result of the final iteration) and the input for the next iteration (for iterations other than the final iteration).

[0035] Thus, in conjunction with Figure 1 reference to Figure 4 , according to an example implementation, an electronic device, such as the electronic device 100 including the exponentiation engine 168, can perform techniques 400 for purposes of performing an exponentiation. The techniques 400 include determining (block 404) an exponentiation product of a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent. According to block 408, a plurality of iterations is performed, where each iteration is associated with a different bit position and includes using no more than two temporary variables in each iteration. According to block 412, a DAA-based signature can be generated to prove that the electronic device is a member of the group based on the determined exponentiation product.

[0036] More specifically, in conjunction with Figure 1 reference to Figure 5According to example implementations, the exponentiation engine 168 can perform exponentiation as depicted in technique 500. Technique 500 includes squaring a value stored in a first temporary variable (block 504) and storing the value in a second temporary variable based on bits of a first second number associated with a position associated with the iteration (block 508). Technique 500 includes multiplying the value stored in the first temporary variable by the value stored in the second temporary variable (block 512) and storing the product in the second temporary variable. Technique 500 includes storing the value stored in the second temporary variable in the first temporary variable based on bits of the first and second numbers associated with a bit position associated with the iteration (block 516). According to block 520, technique 500 includes storing the value in the second temporary variable based on bits of the second and third numbers associated with the bit position associated with the iteration. Technique 500 includes multiplying the value stored in the first temporary variable by the value stored in the second temporary variable (block 524) and storing the product in the second temporary variable; and storing the value stored in the second temporary variable in the first temporary variable based on bits of the second and third numbers associated with the bit position associated with the iteration (block 528). If another iteration is to be performed (decision block 532), control returns to block 504. Otherwise, the first temporary variable stores data representing the exponentiation product.

[0037] According to example implementations, the electronic device 100 can have an architecture as depicted in FIG. 6. Referring to FIG. 6, according to example implementations, the processor 124 can include one or more central processing units (CPUs) 610, a main memory 604, an input / output (I / O) subsystem 614, and one or more network interfaces 618. According to example implementations, the electronic device 100 can include one or more additional components, such as a data storage device 620, a display device 622 (e.g., a touchscreen display that provides visual output for the electronic device and touch-based input for the electronic device 100), one or more peripheral devices 626, and the like. According to example implementations, one or more of the components depicted in FIG. 6 can be incorporated into another component or otherwise form part of another component. For example, according to some implementations, the main memory 604 or portions thereof can be incorporated into the CPU 610. Figure 6 Figure 6 Figure 6

[0038] The CPU 610 can be embodied as any type of processor capable of performing the functions described herein. Depending on the particular implementation, the CPU 610 can be a single core processor, a multi-core processor, a microcontroller, or other processor or processing / control circuitry. For example, the CPU 610 can be a single core processor according to some implementations, and a multi-core processor according to other implementations. Figure 6 ​​​In example implementations, CPU 610 can include one or more CPU cores 670. According to example implementations, one or more CPU cores 670 can be part of a single integrated circuit package.

[0039] Depending on the particular implementation, main memory 604 can be a non-transitory memory, which depending on the particular implementation, can be formed from semiconductor memory devices, memristors, magnetic storage devices, phase change memory devices, 3D cross-point non-volatile memory, and the like, by way of example.

[0040] According to example implementations, main memory 604 can store data 606 and machine executable instructions 608 for purposes of implementing one or more techniques described herein, such as performing prime reduction and / or exponentiation as described herein, for example.

[0041] As Figure 6 As depicted in FIG. 6, according to example implementations, electronic device 100 can include a cryptographic processor or cryptoprocessor 640, which for purposes of performing cryptographic functions for electronic device 100, can include one or more CPUs or CPU cores, for example, cryptographic functions such as functions related to determining EPID signatures and performing prime reduction and exponentiation as described herein. According to further example implementations, cryptoprocessor 640 can include one or more hardware units that perform portions of the techniques described herein, as well as perform all of the techniques without executing machine executable instructions. In this regard, according to these example implementations, the hardware units can be FPGAs, ASICs, for example. Regardless of its particular form, according to some implementations, cryptoprocessor 640 can perform EPID-based functions and include EPID hardware 644, which is described below. According to some implementations, processor 610 and cryptoprocessor 640 can be part of the same semiconductor package.

[0042] Generally, I / O subsystem 614 can facilitate input / output operations with CPU 610, main memory 604, cryptoprocessor 640, and other components of electronic device 100. As an example, I / O subsystem 614 can include a memory controller hub, an input / output control hub, an integrated sensor hub, firmware devices, communication links (i.e., point-to-point links, bus links, wires, cables, light guides, printed circuit board traces, etc.), and / or other components and subsystems that facilitate input / output operations. According to example implementations, I / O subsystem 614 can form part of a system on a chip (SoC) and be incorporated on a single integrated circuit chip with one or more of CPU 610, main memory 604, and other components of electronic device 100.

[0043] As Figure 6 depicted in FIG. 6B, according to some implementations, the electronic device 100 can include one or more sensors 660. As such, for example implementations in which the electronic device is an IoT device, the sensors 660 can include, for example, pressure sensors, temperature sensors, sensors for sensing various aspects of manufacturing operations, biometric sensors, image sensors, cameras, and the like. As Figure 6 depicted in FIG. 6B, the sensors 660 can be coupled to the I / O subsystem 614.

[0044] Also as Figure 6 depicted in FIG. 6B, according to some implementations, the network interface 618 can be contained on one or more plug-in boards, daughter cards, network interface cards, controller chips, chipsets, or other devices that can be used by the electronic device 100. According to example implementations, the network interface 618 can be a system-on-a-chip (SoC) that includes one or more processors or be included on a multi-chip package that also contains one or more processors. According to example implementations, the network interface 618 can include one or more local processors (not shown) and / or local memory (not shown) that are local to the network interface 618. According to example implementations, the local processors of the network interface 618 can be capable of performing one or more functions of the electronic device 100 as described herein. In general, the network interface 618 can communicate a variety of data including data representing private keys, public keys, objects signed by EPID signatures, and the like.

[0045] According to example implementations, the network interface 618 can communicate over a variety of network fabrics. As Figure 6 depicted in FIG. 6B, according to some implementations, the network interface 618 can communicate via one or more antennas 619 with a wireless access point or radio tower. In general, the network fabric with which the network interface 618 communicates can include any type of wired or wireless communication network including a cellular network (e.g., Global System for Mobile Communications (GSM), 3G, Long-Term Evolution (LTE), Worldwide Interoperability for Microwave Access (WiMAX), etc.), a digital subscriber line (DSL) network, a cable network (e.g., coaxial network, fiber-optic network, etc.), a telephone network, a local area network (LAN) or wide area network (WAN), a global network (e.g., the Internet), or any combination thereof. Moreover, according to example implementations, the network fabric can include any number of network devices for the purpose of facilitating communication between the electronic device 100 and another network component.

[0046] Referring to Figure 7According to example implementations, EPID hardware 644 can include components 710 for the purpose of performing EPID joining, signing, and verification operations, and interfaces 740 for the purpose of performing Ate pairings over Barreto-Naehrig (BN) curves. Also as depicted in Figure 7 According to some implementations, for the purpose of performing extension field arithmetic for cryptographic processor 640, EPID hardware 644 can include an error-correcting code (ECC) library 770 and components 750, as depicted in

[0047] According to example implementations, for the purpose of performing extension field arithmetic for cryptographic processor 640, EPID hardware 644 can include an error-correcting code (ECC) library 770 and components 750, as depicted in Figure 7 According to example implementations, for the purpose of performing extension field arithmetic for cryptographic processor 640, EPID hardware 644 can include an error-correcting code (ECC) library 770 and components 750, as depicted in represents a Galois field of order ; represents a degree two finite field extension of order ; ; represents a degree three extension of order ; ; and represents a degree two extension of order ; Generally, components compute the sum of two values in their respective finite field; components compute the difference of two values in their respective finite field; components compute the product of two values in their respective finite field; components compute the finite field inverse of an input value; and components compute the negation of an input value in a finite field. Conjugate components represent a binomial formed by negating the second term of a binomial. The conjugate of is .

[0048] components represent point addition and point doubling operations with respect to an elliptic curve defined over . According to example implementations, hardware 644 computes in Jacobian projected coordinates.

[0049] components represent scalar multiplication with respect to an elliptic curve defined over . A component represents a powering. and The component can be highly side channel vulnerable and involved in handling a private key during generation of an EPID signature.

[0050] A set of technical solutions is provided below:

[0051] 1. A method comprising:

[0052] generating a direct anonymous attestation (DAA)-based signature to prove that an electronic device is a member of a group, wherein generating the signature comprises determining a reciprocal of a prime modulus, and wherein determining the reciprocal of the prime modulus comprises left-shifting a Barrett multiplier by a predetermined number of bits and multiplying the left-shifted result of the Barrett multiplier by the prime modulus.

[0053] 2. The method of technical solution 1, wherein generating the DAA-based signature comprises generating an enhanced privacy identification (EPID) signature.

[0054] 3. The method of technical solution 1, wherein determining the reciprocal of the prime modulus comprises performing a Barrett reduction.

[0055] 4. The method of technical solution 1, wherein the electronic device comprises an Internet of Things (IoT) device.

[0056] 5. The method of technical solution 1, wherein determining the modulus comprises determining a set of most significant bits of the prime modulus.

[0057] 6. The method of technical solution 5, wherein the set of most significant bits comprises 32 bits.

[0058] 7. The method of technical solution 1, further comprising:

[0059] subtracting, from the set of most significant bits of the Barrett multiplier, a result of multiplying the left-shifted result of the Barrett multiplier by the prime modulus.

[0060] 8. The method of technical solution 7, further comprising left-shifting a result of the subtraction.

[0061] 9. The method of technical solution 8, wherein determining the reciprocal of the prime modulus further comprises performing a plurality of iterations, wherein performing each iteration comprises performing the left-shifting of the Barrett multiplier, the subtracting of the result of multiplying the left-shifted result of the Barrett multiplier, and the left-shifting of a result of the subtraction.

[0062] 10. The method of technical solution 1, further comprising:

[0063] further basing the generation of the signature on a power multiplication of the first number raised to a first exponent, the second number raised to a second exponent, the third number raised to a third exponent, and the fourth number raised to a fourth exponent; and

[0064] performing multiple iterations to generate the power multiplication, wherein each iteration of the multiple iterations is associated with a different bit position of the multiple bit positions and includes using no more than two temporary variables in each iteration.

[0065] 11. The method of technical solution 1, wherein generating the DAA-based signature includes generating the signature based on the public key and the private key.

[0066] 12. An electronic device, the electronic device comprising:

[0067] a network interface; and

[0068] a cryptographic processor to generate a signature based on a private key and a public key to prove membership of the electronic device in a public group and to transmit the signature using the network interface, wherein the cryptographic processor is to:

[0069] perform multiple iterations of a Barrett reduction to determine a reciprocal of a prime modulus, wherein a given iteration of the multiple iterations includes left-shifting a Barrett multiplier by a predetermined number of bits and multiplying the left-shifted result of the Barrett multiplier by the prime modulus; and

[0070] generate the signature based on the determined reciprocal of the prime modulus.

[0071] 13. The electronic device of technical solution 12, wherein the cryptographic processor is to generate the signature to authenticate an Internet of Things (IoT) device.

[0072] 14. The electronic device of technical solution 12, wherein the predetermined number of bits includes a number of most significant bits of the Barrett multiplier that is constant between the multiple iterations.

[0073] 15. The electronic device of technical solution 12, wherein the cryptographic processor is to transmit data representing the signature with the cloud-based server using the network interface to register the Internet of Things (IoT) device.

[0074] 16. The electronic device of technical solution 12, wherein the cryptographic processor is to:

[0075] further basing the generation of the signature on a power multiplication of the first number raised to a first exponent, the second number raised to a second exponent, the third number raised to a third exponent, and the fourth number raised to a fourth exponent; and

[0076] performing a plurality of iterations to generate a power multiplication product, wherein each iteration of the plurality of iterations is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

[0077] 17. A non-transitory storage medium storing processor-based machine-readable instructions that, when executed by a processor, cause the processor to:

[0078] performing a plurality of iterations of a Barrett reduction to determine a reciprocal of a prime number, wherein a given iteration of the plurality of iterations includes left-shifting a Barrett multiplier by a predetermined number of bits, multiplying the left-shifted result of the Barrett multiplier by the prime number, subtracting the result of multiplying the left-shifted result of the Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting the result of the subtraction to form an input to another iteration of the plurality of iterations; and

[0079] generating a direct anonymous attestation (DAA) signature based on the reciprocal of the prime number.

[0080] 18. The storage medium of claim 17, wherein the instructions, when executed by the processor, cause the processor to generate an enhanced privacy identification (EPID) signature based on the reciprocal of the prime number.

[0081] 19. The storage medium of claim 17, wherein the processor-based machine comprises an Internet of Things (IoT) device.

[0082] 20. The storage medium of claim 17, wherein the instructions, when executed by the processor, cause the processor to transmit the signature to a server for application to a resource of an Internet of Things (IoT) device.

[0083] Examples

[0084] Illustrative examples of the technologies disclosed herein are provided below. An embodiment of the technologies can include any one or more, and any combination of, the examples described below.

[0085] Example 1 includes a method comprising generating a direct anonymous attestation (DAA)-based signature to prove that an electronic device is a member of a group. Generating the signature includes determining a reciprocal of a prime modulus, and determining the reciprocal of the prime modulus includes left-shifting a Barrett multiplier by a predetermined number of bits and multiplying the left-shifted result of the Barrett multiplier by the prime modulus.

[0086] In Example 2, the subject matter of Example 1 can optionally include generating an enhanced privacy identification (EPID) signature.

[0087] In Example 3, the subject matter of Examples 1-2 can optionally include including a reciprocal of a determined prime modulus that performs a Barrett reduction.

[0088] In Example 4, the subject matter of Examples 1-3 can optionally include the electronic device including an Internet of Things (IoT) device.

[0089] In Example 5, the subject matter of Examples 1-4 can optionally include determining a modulus including determining a set of most significant bits of a prime modulus.

[0090] In Example 6, the subject matter of Examples 1-5 can optionally include including a set of 32 most significant bits.

[0091] In Example 7, the subject matter of Examples 1-6 can optionally include subtracting a result of left-shifting a Barrett multiplier from a result of multiplying the Barrett multiplier by a prime modulus.

[0092] In Example 8, the subject matter of Examples 1-7 can optionally include left- shifting a result of the subtraction.

[0093] In Example 9, the subject matter of Examples 1-8 can optionally include further including performing a plurality of iterations of a reciprocal of a determined prime modulus. Performing each iteration includes performing a left-shift of a Barrett multiplier, subtracting a result of multiplying a result of the left-shift of the Barrett multiplier, and left-shifting a result of the subtraction.

[0094] In Example 10, the subject matter of Examples 1-9 can optionally include further basing generation of the signature on a power multiplication product of a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent; and performing a plurality of iterations to generate the power multiplication product, wherein each iteration of the plurality of iterations is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

[0095] In Example 11, the subject matter of Examples 1-10 can optionally include generating the signature based on a public key and a private key.

[0096] In Example 12, an electronic device includes a network interface and a cryptographic processor. The cryptographic processor generates a signature based on a private key; a public key to prove membership of the electronic device in a public group and transmits the signature using the network interface. The cryptographic processor is to perform a plurality of iterations of a Barrett reduction to determine a reciprocal of a prime modulus. A given iteration of the plurality of iterations includes left-shifting a Barrett multiplier by a predetermined number of bits and multiplying a result of the left-shift of the Barrett multiplier by the prime modulus. The cryptographic processor is to generate the signature based on the determined reciprocal of the prime modulus.

[0097] In Example 13, the subject matter of Example 12 can optionally include generating the signature to authenticate an Internet of Things (IoT) device.

[0098] In Example 14, the subject matter of Examples 12-13 can optionally include the predetermined number of bits including a plurality of most significant bits of a Barrett multiplier that is constant between multiple iterations.

[0099] In Example 15, the subject matter of Examples 12-14 can optionally include the cryptographic processor to communicate data representing the signature with a cloud-based server using a network interface to register the Internet of Things (IoT) device.

[0100] In Example 16, the subject matter of Examples 12-15 can optionally include the cryptographic processor to further cause generation of the signature based on a power multiplication product of a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent; and perform multiple iterations to generate the power multiplication product, wherein each iteration of the multiple iterations is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

[0101] The cryptographic processor of Examples 12-16 can be implemented using various means.

[0102] In an example, the cryptographic processor can include a system on a chip (SoC) incorporated into a touch-enabled device.

[0103] In another example, a system includes a display, a memory, and a cryptographic processor of one or more of the above examples.

[0104] In Example 17, a method includes performing multiple iterations of a Barrett reduction to determine a reciprocal of a prime number, wherein a given iteration of the multiple iterations includes left-shifting a Barrett multiplier by a predetermined number of bits, multiplying the left-shifted result of the Barrett multiplier by the prime number, subtracting a result of multiplying the left-shifted result of the Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting a result of the subtraction to form an input to another iteration of the multiple iterations. The method includes generating a Direct Anonymous Attestation (DAA) signature based on the reciprocal of the prime number.

[0105] In Example 18, the subject matter of Example 17 can optionally include generating the DAA signature includes generating an Enhanced Privacy Identification (EPID) signature based on the reciprocal of the prime number.

[0106] In Example 19, the subject matter of Examples 17-18 can optionally include generating the signature includes generating a signature for an Internet of Things (IoT) device.

[0107] In Example 20, the subject matter of Examples 17-19 can optionally include transmitting the signature to a server for application to a resource of an Internet of Things (IoT) device.

[0108] In Example 21, a machine-readable storage medium stores instructions that, when executed, cause a machine to perform the method of any of Examples 17, 18, 19, or 20.

[0109] In another example, a computer-readable medium comprising data that, when accessed by at least one machine, causes the at least one machine to manufacture at least one

[0110] In another example, a device comprising means for performing the method of any of Examples 17, 18, 19, or 20.

[0111] In Example 22, an electronic device comprising means for communicating with a network; and means for generating a signature based on a private key and a public key to prove membership of the electronic device in a public group and transmitting the signature using the means for communicating. The means for generating the signature performs multiple iterations of Barrett reduction to determine a reciprocal of a prime modulus, where a given iteration of the multiple iterations includes left-shifting a Barrett multiplier by a predetermined number of bits and multiplying the left-shifted result of the Barrett multiplier by the prime modulus. The means for generating the signature generates the signature based on the determined reciprocal of the prime modulus.

[0112] In Example 23, the subject matter of Example 22 can optionally include the predetermined number of bits includes a most significant bit of the plurality of Barrett multipliers that is constant between the multiple iterations.

[0113] In Example 24, the subject matter of Examples 22-23 can optionally include means for generating to register an Internet of Things (IoT) device using a network interface to transmit data representing the signature to a cloud-based server.

[0114] In Example 25, the subject matter of Examples 22-24 can optionally include where the means for generating the signature further causes the generation of the signature to be based on a power multiplication product of a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent; and the multiple iterations are performed to generate the power multiplication product, where each iteration of the multiple iterations is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

[0115] In Example 26, a technique includes generating a signature based on a direct anonymous attestation (DAA) to prove that an electronic device is a member of a group, where generating the signature includes determining a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent; and generating the signature includes performing a number of iterations, where each iteration is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

[0116] In Example 27, the subject matter of Example 26 can optionally include using no more than two temporary variables in each iteration includes reusing a first and a second temporary variable in each iteration.

[0117] In Example 28, the subject matter of Examples 26-27 can optionally include reusing the first and the second temporary variables includes, in a given iteration, setting a value stored in the first temporary variable equal to a square of the value; setting a value stored in the second temporary variable equal to a product of the value stored in the second temporary variable and the value stored in the first temporary variable; and selectively changing the value stored in the first temporary variable based on bits of the first, second, third, and fourth numbers.

[0118] In Example 29, the subject matter of Examples 26-28 can optionally include each iteration is associated with a different bit position of a plurality of bit positions and includes squaring a value stored in the first temporary variable; storing a value in the second temporary variable based on bits of the first and second numbers associated with the bit position associated with the iteration; multiplying the value stored in the first temporary variable by the value stored in the second temporary variable and storing the product in the second temporary variable; storing the value stored in the second temporary variable in the first temporary variable based on bits of the first and second numbers associated with the bit position associated with the iteration; storing a value in the second temporary variable based on bits of the second and third numbers associated with the bit position associated with the iteration; multiplying the value stored in the first temporary variable by the value stored in the second temporary variable and storing the product in the second temporary variable; and storing the value stored in the second temporary variable in the first temporary variable based on bits of the second and third numbers associated with the bit position associated with the iteration. The value stored in the first temporary variable after performing the iterations represents the power product.

[0119] In Example 30, a machine-readable storage medium stores instructions that, when executed, cause a machine to perform the method of any of Examples 26-29.

[0120] In another example, a computer readable medium comprising data that, when accessed by one or more machine(s) cause the machine(s) to fabricate at least one integrated circuit to perform the method of any of examples 26-29.

[0121] In another example, an apparatus comprising means for performing the method of any of examples 26-29.

[0122] While this disclosure has been described in relation to limited number of implementations, those skilled in the art having the benefit of this disclosure will appreciate numerous modifications and variations therefrom. The appended claims are intended to cover all such modifications and variations.

Claims

1. An electronic device for generating a direct anonymous attestation (DAA) signature, the electronic device comprising: a network interface; and a cryptographic processor to generate a direct anonymous attestation signature based on a private key and a public key to prove membership of the electronic device in a public group and to communicate the signature using the network interface, wherein the cryptographic processor is to: perform a plurality of iterations of a Barrett reduction to determine a reciprocal of a prime number, wherein a given iteration of the plurality of iterations includes left-shifting a Barrett multiplier by a predetermined number of bits, multiplying the left-shifted result of the Barrett multiplier by the prime number, subtracting the result of multiplying the left-shifted result of the Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting the result of the subtraction to form an input for another iteration of the plurality of iterations; and generate the direct anonymous attestation signature based on the determined reciprocal of the prime number.

2. The electronic device of claim 1, wherein the cryptographic processor is to generate the signature to authenticate an Internet of Things (IoT) device.

3. The electronic device of claim 1 or 2, wherein the predetermined number of bits includes a plurality of most significant bits of the Barrett multiplier that are constant between the plurality of iterations.

4. The electronic device of claim 1 or 2, wherein the cryptographic processor is to communicate data representing the signature with a cloud-based server using the network interface to enroll the Internet of Things (IoT) device.

5. The electronic device of claim 1 or 2, wherein the cryptographic processor is to: further base the generation of the signature on a power multiplication product of a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent; and perform the plurality of iterations to generate the power multiplication product, wherein each iteration of the plurality of iterations is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

6. An electronic device for generating a direct anonymous attestation (DAA) signature, the electronic device comprising: means for communicating with a network; and means for generating a direct anonymous attestation signature based on a private key and a public key to prove membership of the electronic device in a public group and to communicate the signature using the means for communicating, wherein the means for generating the signature: performs a plurality of iterations of a Barrett reduction to determine a reciprocal of a prime number, wherein a given iteration of the plurality of iterations includes left-shifting a Barrett multiplier by a predetermined number of bits, multiplying the left-shifted result of the Barrett multiplier by the prime number, subtracting the result of multiplying the left-shifted result of the Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting the result of the subtraction to form an input for another iteration of the plurality of iterations; and generates the direct anonymous attestation signature based on the determined reciprocal of the prime number.

7. The electronic device of claim 6, wherein the predetermined number of bits includes a plurality of most significant bits of the Barrett multiplier that are constant between the plurality of iterations.

8. The electronic device of claim 6 or 7, wherein the means for generating transmits data representing the signature to a cloud-based server using a network interface to register the Internet of Things (IoT) device.

9. The electronic device of claim 6 or 7, wherein the means for generating the signature: further causes the generation of the signature to be based on a power multiplication product of a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent; and performs a plurality of iterations to generate the power multiplication product, wherein each iteration of the plurality of iterations is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

10. A method for generating a Direct Anonymous Attestation (DAA)-based signature for an electronic device, the method comprising: generating the DAA-based signature to attest that the electronic device is a member of a group, wherein generating the signature includes determining an inverse of a prime number, and wherein determining the inverse of the prime number includes left-shifting a Barrett multiplier by a predetermined number of bits, multiplying the left-shifted result of the Barrett multiplier by the prime number, subtracting the result of multiplying the left-shifted result of the Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting the result of the subtraction to form an input for another iteration of the plurality of iterations; and generating the DAA-based signature based on the inverse of the prime number.

11. The method of claim 10, wherein generating the DAA-based signature includes generating an Enhanced Privacy ID (EPID) signature.

12. The method of claim 10 or 11, wherein determining the inverse of the prime number includes performing a Barrett reduction.

13. The method of claim 10 or 11, wherein the electronic device comprises an Internet of Things (IoT) device.

14. The method of claim 10 or 11, wherein determining the prime number includes determining a set of most significant bits of the prime number.

15. The method of claim 14, wherein the set of most significant bits comprises 32 bits.

16. The method of claim 10, wherein determining the inverse of the prime number further includes performing a plurality of iterations, wherein performing each iteration includes performing a left-shift of a Barrett multiplier, a subtraction of a result of multiplying the left-shifted result of the Barrett multiplier, and a left-shift of a result of the subtraction.

17. The method of claim 10 or 11, further comprising: further causing the generation of the signature to be based on a power multiplication product of a first number raised to a first exponent, a second number raised to a second exponent, a third number raised to a third exponent, and a fourth number raised to a fourth exponent; and performing a plurality of iterations to generate the power multiplication product, wherein each iteration of the plurality of iterations is associated with a different bit position of a plurality of bit positions and includes using no more than two temporary variables in each iteration.

18. A method for generating a Direct Anonymous Attestation (DAA) signature, the method comprising: performing multiple iterations of Barrett reduction to determine an inverse of the prime number, wherein a given iteration of the multiple iterations includes left-shifting the Barrett multiplier by a predetermined number of bits, multiplying the result of the left-shifting of the Barrett multiplier by the prime number, subtracting the result of multiplying the result of the left-shifting of the Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting the result of the subtraction to form an input for another iteration of the multiple iterations; and generating the direct anonymous attestation signature based on the inverse of the prime number.

19. The method of claim 18, wherein generating the direct anonymous attestation signature includes generating an enhanced privacy identification (EPID) signature based on the inverse of the prime number.

20. The method of claim 18, wherein generating the signature includes generating the signature for an Internet of Things (IoT) device.

21. A machine-readable storage medium for storing instructions that, when executed, cause a machine to perform the method of any of claims 10-20.

22. A device for generating a direct anonymous attestation (DAA)-based signature for an electronic device, the device comprising: means for generating the DAA-based signature to prove that the electronic device is a member of a group, wherein the means for generating the signature includes means for determining an inverse of a prime number, and wherein the means for determining the inverse of the prime number includes means for left-shifting a Barrett multiplier by a predetermined number of bits, multiplying the result of the left-shifting of the Barrett multiplier by the prime number, subtracting the result of multiplying the result of the left-shifting of the Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting the result of the subtraction to form an input for another iteration of the multiple iterations, and means for generating the DAA-based signature based on the inverse of the prime number.

23. The device of claim 22, wherein the means for generating the DAA-based signature includes means for generating an enhanced privacy identification (EPID) signature.

24. The device of claim 22 or 23, wherein the means for determining the inverse of the prime number includes means for performing Barrett reduction.

25. The device of claim 22 or 23, wherein the electronic device includes an Internet of Things (IoT) device.

26. The device of claim 22 or 23, wherein the means for determining the prime number includes means for determining the set of most significant bits of the prime number.

27. The device of claim 26, wherein the set of most significant bits includes 32 bits.

28. The device of claim 22, wherein the means for determining the inverse of the prime number further includes means for performing the multiple iterations, wherein the means for performing each iteration includes means for performing the left-shifting of the Barrett multiplier, the subtraction of the result of the multiplying of the result of the left-shifting of the Barrett multiplier, and the left-shifting of the result of the subtraction.

29. The device of claim 22 or 23, further comprising: an apparatus for further basing generation of the signature on a power-of-product of the first number raised to a first exponent, the second number raised to a second exponent, the third number raised to a third exponent, and the fourth number raised to a fourth exponent; and an apparatus for performing a plurality of iterations to generate the power-of-product, wherein each iteration of the plurality of iterations is associated with a different bit position of the plurality of bit positions and includes using no more than two temporary variables in each iteration.

30. An apparatus for generating a direct anonymous attestation (DAA) signature, the apparatus comprising: an apparatus for performing a plurality of iterations of Barrett reduction to determine a reciprocal of a prime number, wherein a given iteration of the plurality of iterations includes left-shifting a Barrett multiplier by a predetermined number of bits, multiplying the left-shifted Barrett multiplier by the prime number, subtracting a result of multiplying the left-shifted Barrett multiplier by the prime number from a set of most significant bits of the Barrett multiplier, and left-shifting a result of the subtraction to form an input for another iteration of the plurality of iterations; and an apparatus for generating the direct anonymous attestation signature based on the reciprocal of the prime number.

31. The apparatus of claim 30, wherein the apparatus for generating the direct anonymous attestation signature comprises an apparatus for generating an enhanced privacy identification (EPID) signature based on the reciprocal of the prime number.

32. The apparatus of claim 30, wherein the apparatus for generating the signature comprises an apparatus for generating a signature for an internet of things (IoT) device.

Images