Implementation of the Butterfly Key Extension Scheme

Abstract

Implementation of butterfly key extension scheme. The present disclosure relates to methods, computer programs and registration authority modules for implementing butterfly key extension scheme. The present disclosure also relates to a security credential management system using these methods, computer programs or registration authority modules for implementing butterfly key extension scheme. In a first step, a public larva signature key and a first pseudo-random function in a private / public larva signature key pair are received (S1) from a requesting device. The public larva signature key is expanded (S2) to a public cocoon signature key using the first pseudo-random function. Then, based on the public cocoon signature key, a certificate signing request is generated (S4), for example, by creating (S3) a public butterfly signature key from each public cocoon signature key and inserting each public butterfly signature key into a corresponding certificate signing request. Subsequently, the certificate signing request is sent (S5) to a certificate authority module. In response, a signed pseudonym certificate is received (S6) from the certificate authority module. Then, the signed pseudonym certificate is encrypted (S7) to generate a response packet. The generated response packet can be further signed (S8) and provided (S9) for downloading by the requesting device.

Description

Technical Field

[0001] The present disclosure relates to a method, a computer program and a registration authority module for implementing a butterfly key expansion scheme. The present disclosure also relates to a secure credential management system using such a method, a computer program or a registration authority module for implementing a butterfly key expansion scheme. Background Art

[0002] As the demand for smart transportation vehicles increases, security and privacy requirements are critical. For example, the authenticity of data exchanged through vehicle-to-vehicle or vehicle-to-infrastructure communications needs to be ensured to prevent abuse of smart transportation systems. Although traditional certificates can be used for this purpose, this approach conflicts with requirements regarding user privacy.

[0003] In order to cope with the requirements of authenticity and privacy, various proposals for vehicle public key infrastructure have been published. One particularly interesting approach uses pseudonym certificates, which do not contain any information that can be easily associated with the corresponding user. Therefore, pseudonym certificates are well suited for signing broadcast messages without compromising privacy.

[0004] A prominent solution for providing batches of pseudonymous certificates is described in the article “A Security Credential Management System for V2X Communications” by B. Brecht et al. [1]. In the described system, a registration authority creates batches of pseudonymous certificates for authorized vehicles based on a single request. To this end, a butterfly key extension scheme is used, which requires two separate public / private key pairs, which need to be provided by the requesting vehicle. The registration authority scrambles the created certificates and sends them to the pseudonymous certificate issuing authority, which individually signs and encrypts the certificates before sending them back to the registration authority. The registration authority then provides the signed and encrypted certificates to the requesting vehicle.

[0005] A more efficient version of a security credential management system called unified butterfly key expansion is described in the article "The Unified Butterfly Effect: Efficient Security Credential Management System for Vehicular Communications" by MA Simplicio Jr. et al. [2]. Unified butterfly key expansion unifies the two separate public / private key pairs that need to be provided to the registration authority into a single key, which reduces the processing and bandwidth usage for certificate provisioning.

[0006] Both solutions require different processing of certificate signing requests at the certificate authority compared to conventional public key infrastructures, since additional calculations and processing need to be performed at the certificate authority. Therefore, the described solutions cannot be used in markets that only offer conventional certificate authorities for pseudonymous certificate generation.

[0007] Methods that do not require certificate signing requests to be handled differently at the certificate authority, such as the EU C-ITS Credential Management System, which provides a traditional certificate authority but does not use the butterfly key extension. Summary of the invention

[0008] The object of the present invention is to provide a solution for implementing the butterfly key extension scheme without requiring a certificate authority to implement a different processing of certificate signing requests.

[0009] The above objects are achieved by a method according to claim 1, a corresponding computer program according to claim 12, a registration authority module according to claim 13 and a secure credential management system according to claim 14. The dependent claims contain advantageous further developments and improvements of the invention as described below.

[0010] In a first aspect, a method for implementing a butterfly key extension scheme implemented in a registration authority module comprises:

[0011] - receiving a public caterpillar signing key and a first pseudo-random function from a requesting device in a private / public caterpillar signing key pair;

[0012] - expanding the public larva signature key into a public cocoon signature key using a first pseudo-random function;

[0013] -Generate a certificate signing request based on the public cocoon signing key;

[0014] - Send a certificate signing request to the certificate authority module;

[0015] - receiving a signed pseudonym certificate from a certification authority module; and

[0016] -Encrypt the signed pseudonym certificate to generate a response packet.

[0017] In a second aspect, a computer program comprises instructions which, when executed by a computer, cause the computer to perform the following steps for implementing a butterfly key expansion scheme:

[0018] - receiving a public larval signature key and a first pseudo-random function from a requesting device in a private / public larval signature key pair;

[0019] - expanding the public larva signature key into a public cocoon signature key using a first pseudo-random function;

[0020] -Generate a certificate signing request based on the public cocoon signing key;

[0021] - Send a certificate signing request to the certificate authority module;

[0022] - receiving a signed pseudonym certificate from a certification authority module; and

[0023] -Encrypt the signed pseudonym certificate to generate a response packet.

[0024] The term computer should be understood broadly. It may also include workstations, distributed processing solutions or other processing units.

[0025] For example, the computer program may be provided for downloading or stored on a computer-readable storage medium.

[0026] In a third aspect, a registration authority module configured to implement a butterfly key extension scheme includes:

[0027] - a first receiving module configured to receive a public larval signature key of a private / public larval signature key pair and a first pseudo-random function from a requesting device;

[0028] - an expansion module configured for expanding the public larvae signature key into a public cocoon signature key using a first pseudo-random function;

[0029] - a generator module configured to generate a certificate signing request based on a public cocoon signing key;

[0030] - a transmission module configured to send a certificate signing request to a certificate authority module;

[0031] - a second receiving module configured to receive a signed pseudonym certificate from a certificate authority module; and

[0032] - an encryption module configured to encrypt the signed pseudonym certificate to generate a response packet.

[0033] The advantage of the current solution is that it allows the implementation of the butterfly key extension scheme in a secure credential management system without the need for an adapted certificate authority. Instead, a conventional certificate authority can be used. In contrast to the classic butterfly key extension scheme and the unified butterfly key extension scheme, the required requirement is the need to trust the registration authority, since the registration authority is able to understand which pseudonymous certificates belong to which device.

[0034] In one embodiment, a certificate signing request is generated by inserting each public cocoon signing key into the corresponding certificate signing request. The advantage of this solution is that the registration authority can skip creating the public butterfly signing keys, which reduces the processing load on the registration authority. However, the requesting device needs to adjust its key derivation function accordingly to calculate the corresponding private key for the generated pseudonymous certificate.

[0035] In one embodiment, a certificate signing request is generated by creating a public butterfly signing key from each public cocoon signing key and inserting each public butterfly signing key into a corresponding certificate signing request. The public butterfly signing keys are preferably created from the public cocoon signing keys using random numbers. In this way, requesting devices do not need to adjust their key derivation functions to calculate the corresponding private key of the generated pseudonymous certificate.

[0036] In one embodiment, a random number is included in the response packet. This ensures that the requesting device can calculate the private butterfly signature key based on the pseudonym certificate.

[0037] In one embodiment, the signed pseudonym certificate is encrypted using the public cocoon signature key. In this way, it is ensured that only the requesting device can decrypt the response of the certificate authority to understand the public butterfly signature key and calculate the corresponding private butterfly signature key.

[0038] In one embodiment, the signed pseudonymous certificate is encrypted using a public cocoon encryption key. The public cocoon encryption key is preferably derived by expanding the public larva encryption key of the private / public larva encryption key pair using a second pseudorandom function. For example, the public larva encryption key and the second pseudorandom function can be received by the registration authority module from the requesting device. In this way, it is ensured that only the requesting device can decrypt the response of the certificate authority to understand the public butterfly signature key and calculate the corresponding private butterfly signature key.

[0039] In one embodiment, the response packet is signed. For example, signing the response packet can prevent the registration authority from manipulating the public cocoon encryption key.

[0040] In one embodiment, a response package is provided for the requesting device to download. To this end, the registration authority stores the encrypted responses from the certificate authority until the requesting device is online again to download them. In this way, the requesting device does not need to be online continuously.

[0041] Advantageously, the security credential management system comprises a registration authority module as described above, or is configured to perform the method for implementing the butterfly key expansion scheme as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Other features of the present invention will become apparent from the following description and appended claims, taken in conjunction with the accompanying drawings.

[0043] Figure 1 A flow chart of the classic butterfly key expansion scheme is shown;

[0044] Figure 2 A flow chart of a unified butterfly key expansion scheme is shown;

[0045] Figure 3 A flow chart showing a first butterfly key extension scheme working with a conventional certificate authority;

[0046] Figure 4 A flow chart showing a second butterfly key extension scheme working with a conventional certificate authority;

[0047] Figure 5 A flow chart of a method for implementing a butterfly key expansion scheme according to the present principles is shown;

[0048] Figure 6 Schematically illustrates a first embodiment of a registration authority module configured for implementing butterfly key expansion according to the present principles;

[0049] Figure 7 schematically illustrates a second embodiment of a registration authority module configured to implement butterfly key expansion according to the present principles; and

[0050] Figure 8 A system diagram of a secure credential management system is schematically shown. DETAILED DESCRIPTION

[0051] To better understand the principles of the present invention, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. For the purpose of illustrating and clearly understanding the various aspects related to the devices, systems, and methods described herein, the accompanying drawings and descriptions provided herein may have been simplified, and at the same time, other aspects that can be found in typical devices, systems, and methods have been eliminated for clarity. Those of ordinary skill in the art will recognize that other elements and / or operations may be desirable and / or necessary to implement the devices, systems, and methods described herein. Since these elements and operations are well known in the art and since they do not facilitate a better understanding of the present disclosure, no discussion of these elements and operations is provided herein. However, the present disclosure is considered to inherently include all such elements, variations, and modifications of the described aspects that are known to those of ordinary skill in the art.

[0052] Next, the classical butterfly key expansion scheme and the unified butterfly key expansion scheme will be described in more detail.

[0053] Figure 1 A flowchart of the classical butterfly key expansion scheme is shown. In the classical butterfly key expansion scheme, the requesting device DEV creates a signature key pair (s, S = s·G) and an additional encryption key pair (e, E = e·G), where G is the generator of the elliptic curve group. These initial key pairs are referred to as caterpillar key pairs. In addition, the requesting device DEV creates two pseudo-random functions f1 and f2. Then, the requesting device DEV sends the pseudo-random functions f1 and f2 and the public parts S and E of the caterpillar key pairs to the registration authority RA. The registration authority RA uses the provided functions f1 and f2 to expand the public caterpillar keys S and E into n public cocoon signature keys and cocoon encryption keys where, for any value of n, 0 ≤ i < n. The registration authority RA creates a certificate signature request CSR for each public cocoon signature key and sends it together with the corresponding public cocoon encryption key to the pseudonymous certificate authority PCA. The registration authority RA has been doing this since the moment the requesting device DEV sends the information for generating the required number of certificates. In this step, the registration authority RA shuffles the certificate signature requests CSRs from different requesting devices DEV together. Then, the pseudonymous certificate authority PCA must first create a public butterfly key for each certificate signature request CSR by adding a true random number r i : The pseudonymous certificate authority PCA inserts the generated public butterfly key into the certificate signature request CSR and signs it to create a pseudonymous certificate cert i。Then, the pseudonym certificate authority PCA uses the public cocoon encryption key to encrypt the certificate cert i together with the random number r i . Finally, the pseudonym certificate authority PCA signs the encrypted response before sending it back to the registration authority RA. The registration authority RA stores the encrypted response from the pseudonym certificate authority PCA until the requesting device DEV goes online again to download them.

[0054] Figure 2 Fig. shows the flowchart of the unified butterfly key expansion scheme. In the unified butterfly key expansion scheme, the requesting device DEV creates a signature key pair (s, S = s·G), where G is the generator of the elliptic curve group. This initial key pair is called the larval key pair. In addition, the requesting device DEV creates a pseudorandom function f1. Then, the requesting device DEV sends the pseudorandom function f1 and the public part S of the larval key pair to the registration authority RA. The registration authority RA uses the provided function f1 to expand the public larval key S into n public cocoon signature keys where, for any value of n, 0 ≤ i < n. The registration authority RA creates a certificate signing request CSR for each public cocoon signature key and sends it to the pseudonym certificate authority PCA. The registration authority RA has been doing this since the moment it sends the information for generating the required number of certificates from the requesting device DEV. In this step, the registration authority RA shuffles the certificate signing requests CSRs from different requesting devices DEV together. Then, the pseudonym certificate authority PCA must first create a public butterfly key for each certificate signing request CSR by adding a true random number r i : The pseudonym certificate authority PCA inserts the generated public butterfly key into the certificate signing request CSR and signs it to create the pseudonym certificate cert i . Then, the pseudonym certificate authority PCA uses the public cocoon signature key to encrypt the certificate cert i and the random number r i . Finally, the pseudonym certificate authority PCA sends the encrypted response back to the registration authority RA.

[0055] In both the classical butterfly key expansion scheme and the unified butterfly key expansion scheme, the behavior of the pseudonym certificate authority PCA is different from that of a traditional certificate authority, which takes the certificate signing request CSR as it is and signs it before sending it back unencrypted.

[0056] To retain the advantages of the classical Butterfly key expansion scheme and the unified Butterfly key expansion scheme, such as bandwidth savings or the constant pre-generation of certificates, and in the case where only traditional certificate authorities are available, the steps performed by the registration authority are modified according to current principles. The processing performed on the requesting device side is retained.

[0057] Figure 3 A flowchart of a first Butterfly key expansion scheme working with a traditional certificate authority is shown, which is based on the classical Butterfly key expansion scheme. The requesting device DEV creates two larval key pairs, namely a signature key pair (s, S = s·G) and an additional encryption key pair (e, E = e·G), where G is the generator of the elliptic curve group. In addition, the requesting device DEV creates two pseudo-random functions f1 and f2. Then, the requesting device DEV sends the pseudo-random functions f1 and f2 and the public parts S and E of the larval key pairs to the registration authority RA. The registration authority RA uses the provided functions f1 and f2 to expand the public larval keys S and E into n public cocoon signature keys and cocoon encryption keys where, for any value of n, 0 ≤ i < n. Contrary to the classical Butterfly key expansion scheme, now, the registration authority RA adopts the public cocoon signature key and creates the public Butterfly key by adding a true random number r i : Thus, the creation of the public Butterfly key is no longer performed by the certificate authority CA. The registration authority RA inserts the public Butterfly key into a separate certificate signing request CSR and sends the certificate signing request CSR to the traditional certificate authority CA. The certificate authority CA signs the certificate signing request CSR and immediately sends back the resulting pseudonym certificate cert i Now, the registration authority RA adopts the public cocoon encryption key and encrypts the pseudonym certificate cert i together with the random number r used to generate the public Butterfly key i Then, the registration authority RA signs the encrypted package and provides the result for the requesting device DEV to download.

[0058] Figure 4The flowchart shows a second Butterfly key expansion scheme that works with a traditional certificate authority and is based on the unified Butterfly key expansion scheme. The requesting device DEV creates a larval key pair, i.e., a signature key pair (s, S = s·G), where G is the generator of the elliptic curve group. In addition, the requesting device DEV creates a pseudorandom function f1. Then, the requesting device DEV sends the pseudorandom function f1 and the public part S of the larval key pair to the registration authority RA. The registration authority RA uses the provided function f1 to expand the public larval key S into n public cocoon signature keys where, for any value of n, 0 ≤ i < n. Contrary to the unified Butterfly key expansion scheme, now, the registration authority RA adopts the public cocoon signature keys and creates the public Butterfly keys by adding a true random number r i as follows: Therefore, the creation of the public Butterfly keys is no longer performed by the certificate authority CA. The registration authority RA inserts the public Butterfly keys into a separate certificate signature request CSR and sends the certificate signature request CSR to the traditional certificate authority CA. The certificate authority CA signs the certificate signature request CSR and immediately sends back the resulting pseudonym certificate cert i Now, the registration authority RA adopts the public cocoon signature keys and encrypts the pseudonym certificate cert i together with the random number r used to generate the public Butterfly keys i Then, the registration authority RA provides the encrypted package for the requesting device DEV to download.

[0059] In a slightly modified method applicable to Figure 3 and Figure 4 the Butterfly key expansion scheme shown, the registration authority RA can skip the step of creating the public Butterfly keys and instead use the public cocoon signature keys in the certificate signature request CSR Everything else remains the same except that the response package now does not include r i The requesting device DEV must accordingly change its key derivation function to calculate the corresponding private key for the pseudonym certificate cert i

[0060] In Figure 5 ​A flow chart of a method for implementing a butterfly key extension scheme according to the current principles is shown in FIG. In a first step, a public larva signature key and a first pseudo-random function of a private / public larva signature key pair of S1 are received from a requesting device. In addition, a public larva encryption key and a second pseudo-random function of a private / public larva encryption key pair of S1 can be received from a requesting device. The public larva signature key is extended S2 to a public cocoon signature key using the first pseudo-random function. Similarly, the larva encryption key can be extended S2 to a public cocoon encryption key using a second pseudo-random function. Then, based on the public cocoon signature key, a S4 certificate signature request is generated, for example, by optionally creating an S3 public butterfly signature key from each public cocoon signature key and inserting each public butterfly signature key into a corresponding certificate signature request. For example, a random number can be used to create an S3 public butterfly signature key from a public cocoon signature key. Alternatively, an S4 certificate signature request can be generated by inserting each public cocoon signature key into a corresponding certificate signature request. Subsequently, the certificate signature request is sent S5 to a certificate authority module. In response, a pseudonymous certificate signed by S6 is received from the certificate authority module. The signed pseudonym certificate is then encrypted S7 to generate a response packet. For this purpose, a public cocoon signature key or a public cocoon encryption key may be used. Where random numbers are used to create S3 a public butterfly signature key from a public cocoon signature key, these random numbers are preferably included in the response packet. The generated response packet may further be signed S8 and provided S9 for downloading by the requesting device.

[0061] exist Figure 6, a block diagram of a first embodiment of a registration authority module RA according to the present principles configured to implement butterfly key expansion is shown in . The registration authority module RA has a first transmission module 11, which is configured to receive a public larva signature key and a first pseudo-random function of a private / public larva signature key pair from a requesting device DEV via a first interface 10. In addition, the first transmission module 11 can be configured to receive a public larva encryption key and a second pseudo-random function of a private / public larva encryption key pair from the requesting device DEV. The expansion module 12 is configured to use the first pseudo-random function to expand the public larva signature key to a public cocoon signature key. Similarly, the expansion module 12 can be configured to use the second pseudo-random function to expand the larva encryption key to a public cocoon encryption key. The generator module 13 is configured to generate a certificate signing request based on the public cocoon signature key, for example by creating a public butterfly signature key from each public cocoon signature key, and inserting each public butterfly signature key into a corresponding certificate signing request. For example, a random number can be used to create a public butterfly signature key from a public cocoon signature key. Alternatively, the generator module 13 can be configured to generate a certificate signing request by inserting each public cocoon signature key into the corresponding certificate signing request. The second transmission module 14 is configured to send the certificate signing request to the certificate authority module CA through the second interface, and receive the signed pseudonym certificate from the certificate authority module CA. The encryption module 15 is configured to encrypt the signed pseudonym certificate to generate a response packet. To this end, a public cocoon signature key or a public cocoon encryption key can be used. In the case of creating a public butterfly signature key from a public cocoon signature key using random numbers, these random numbers are preferably included in the response packet. The generated response packet can be further signed and provided for downloading by the requesting device DEV via the first interface 10.

[0062] The various modules 11-15 of the registration authority module RA can be controlled by a control module 16. A user interface 19 can be provided to enable a user to modify the settings of the different modules 11-16. The data available in the registration authority module RA can be stored in a local storage unit 17, for example for later evaluation, or for use by the various components of the registration authority module RA. The different modules 11-16 can be implemented as dedicated hardware units. Of course, they can also be fully or partially combined into a single unit, or implemented as software running on a processor, such as a GPU or a CPU. The second interface 19 can also be combined with the first interface 10 into a single bidirectional interface.

[0063] exist Figure 7A block diagram of a second embodiment of a registration authority module RA according to the present principles configured for implementing butterfly key expansion is shown in The registration authority module RA comprises a processing device 20 and a storage device 21 storing instructions which, when executed, cause the registration authority module RA to perform steps according to one of the described methods.

[0064] For example, the processing device 20 may be a processor adapted to perform steps according to one of the described methods. In an embodiment according to the present principles, the adaptation comprises configuring the processor, such as programming the processor, to perform steps according to one of the described methods. The processor used herein may include one or more processing units, such as a microprocessor, a digital signal processor, or a combination thereof.

[0065] The registration authority module RA has an input 22 for receiving data, in particular from a requesting device. The data generated by the processing device 20 are made available at an output 23. They may also be stored in a storage device 21. The input 22 and the output 23 may be combined into a bidirectional interface.

[0066] The local storage unit 17 and the storage device 21 may include volatile and / or non-volatile storage areas and storage devices such as hard disk drives and DVD drives. A portion of the memory is a non-transitory program storage device readable by the processing device 20, which tangibly implements a program of instructions executable by the processing device 20 to perform the program steps described herein according to the present principles.

[0067] In one embodiment, the computer program comprises a program code which, when executed by a computing system, causes the computing system to perform a method according to the present principles.

[0068] Figure 8 A system diagram of a security credential management system SCMS is schematically shown. Only the elements of the security credential management system SCMS that are relevant to the present principle are shown. Basically, the security credential management system SCMS comprises a requesting device DEV, such as a transport vehicle or a mobile communication device, at least one registration authority module RA and at least one certificate authority module CA. The requesting device DEV sends the public larva keys S, E and the pseudo-random functions f1, f2 to the registration authority module RA. Based on these input data, the registration authority module RA generates certificate signing requests CSR and sends these certificate signing requests CSR to the certificate authority module CA. The certificate authority CA signs the certificate signing request CSR and sends the generated pseudonym certificate cert i The registration authority module RA sends the pseudonym certificate cert back to the registration authority module RA. iThe RA module encrypts the response packet and provides the encrypted packet for downloading by the requesting device DEV. If necessary, the registration authority module RA can also sign the response packet.

[0069] It should be understood that the embodiments of the present disclosure may be implemented using dedicated or shared hardware included in a transport vehicle. Therefore, other components of a transport vehicle may use components of the module to provide vehicle functionality without departing from the scope of this disclosure.

[0070] Exemplary embodiments are provided so that the present disclosure is thorough and fully conveys the scope to those skilled in the art. Numerous specific details, such as examples of specific components, devices, and methods, are described to provide a comprehensive understanding of the embodiments of the present disclosure. In some illustrative embodiments, well-known processes, well-known device structures, and well-known technologies are not described in detail.

[0071] The term is only used to describe the purpose of specific illustrative embodiments here, and is not intended to be limited. Unless the context otherwise indicates, the singular form of the element mentioned above is intended to include the plural form. The method steps, processes and operations described here should not be interpreted as necessarily requiring them to perform in the specific order discussed or illustrated, unless it is clearly identified as an execution order or a specific order is inherently necessary for operating an embodiment. It should also be understood that additional or replacement steps can be adopted.

[0072] The disclosed embodiments include the methods described herein and their equivalents, non-transitory computer-readable media programmed to perform these methods, and computing systems configured to perform these methods. In addition, a vehicle is included, which includes components, which include any of the methods, non-transitory computer-readable media programmed to implement instructions or execute methods, and systems for executing methods. The computing system and any sub-computing system generally include a machine-readable storage medium containing executable code; one or more processors; a memory coupled to one or more processors; an input device and an output device connected to one or more processors for executing code. The machine-readable medium may include any mechanism for storing or transmitting information in a form readable by a machine, such as a computer processor. For example, the information may be stored in a volatile or non-volatile memory. In addition, the embodiment functions may be implemented using an embedded device and an online connection to a cloud computing infrastructure, which is available via a radio connection (e.g., wireless communication) to such infrastructure.

[0073] It is understood that the embodiments of the subject matter and functional operations described in this specification can be implemented in digital electronic circuits, in tangibly implemented computer software or firmware, in computer hardware (including the structures disclosed in this specification and their structural equivalents), or in a combination of one or more thereof. The embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory storage medium for execution by a data processing device or for controlling the operation of a data processing device. The computer storage medium can be a machine-readable storage device, a machine-readable storage device, a random or serial access storage device, or a combination of one or more thereof. Alternatively, or in addition, the program instructions can be encoded on an artificially generated propagation signal, such as a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information for transmission to a suitable receiver device for execution by a data processing device.

[0074] Although this specification contains many specific implementation details, these should not be interpreted as limitations on the scope of the invention or the scope of what may be claimed, but rather as descriptions of features that may be specific to a particular embodiment of a particular invention. Certain features described in this specification in the context of several separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination. In addition, although the above-mentioned features may be described as working in certain combinations, or even initially claimed, in some cases one or more features may be deleted from the combination, and the claimed combination may involve sub-combinations or variations of sub-combinations.

[0075] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring the specific order shown or to perform these operations in that order, or to perform all the operations shown to be performed, to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of the various system modules and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can be generally integrated into a single software product or packaged into multiple software products.

[0076] References

[0077] [1]B.Brecht et al.: "A Security Credential Management System for V2XCommunications", IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS, VOL.19(2018), pp.3850-3871.(https: / / ieeexplore.ieee.org / stamp / stamp.jsp?tp=&arnumber=8309336)

[0078] [2]MASimlicio Jr.et al.: "The Unified Butterfly Effect: EfficientSecurity Credential Management System for Vehicular Communications", 2018 IEEEVehicular Networking Conference (VNC, pp.1-8. https: / / eprint.iacr.org / 2018 / 089

[0079] Reference numerals list

[0080] 10 First Interface

[0081] 11. First transmission module

[0082] 12 Extension Modules

[0083] 13 Generator Module

[0084] 14 Second transmission module

[0085] 15 Encryption Module

[0086] 16 Control Module

[0087] 17 Local storage unit

[0088] 18 Second interface

[0089] 19 User Interface

[0090] 20 Processing equipment

[0091] 21 Storage Devices

[0092] 22 Input

[0093] 23 Output

[0094] CA Certificate Authority Module

[0095] cert i Certificate

[0096] CSR Certificate Signing Request

[0097] DEV Request device

[0098] PCA Pseudonymous Certificate Authority Module

[0099] RA Registration Authority Module

[0100] SCMS Security Credential Management System

[0101] S1 receives the public larval key and pseudo-random function

[0102] S2 Expand the public larva key into a public cocoon key

[0103] S3 creates a public butterfly signing key

[0104] S4 Generates a certificate signing request

[0105] S5 sends a certificate signing request to the certificate authority module

[0106] S6 Receive signed pseudonym certificate

[0107] S7 Signing of signed pseudonym certificate

[0108] S8 Sign the response packet

[0109] S9 provides a response package for download

Claims

1. A method for implementing a butterfly key extension scheme implemented in a registration authority module (RA), the method comprising: - receiving (S1) from a requesting device (DEV) a public larva signature key (S) of a private / public larva signature key pair (s, S) and a first pseudo-random function (f1); - Expand (S2) the public larva signature key (S) into a public cocoon signature key using the first pseudo-random function (f1) - Based on public cocoon signing key Generate (S4) a certificate signing request (CSR); - sending (S5) a certificate signing request (CSR) to a certificate authority module (CA); - receiving (S6) a signed pseudonym certificate (cert i ); as well as -Pseudonymous certificate for signature i ) is encrypted (S7) to generate a response packet.

2. The method according to claim 1, wherein: By adding each public cocoon signing key Insert into the corresponding certificate signing request (CSR) to generate (S4) a certificate signing request (CSR).

3. The method according to claim 1, wherein: By signing the key from each public cocoon Create (S3) public butterfly signing key And each public butterfly signature key Insert the corresponding certificate signing request (CSR) to generate (S4) a certificate signing request (CSR).

4. The method according to claim 3, wherein: Use random numbers (r i ) from the public cocoon signing key Create (S3) public butterfly signing key 5. The method according to claim 4 further comprises: i ) is included in the response packet.

6. The method according to claim 1, wherein: Using the public cocoon signing key Pseudonymous certificate for signatures (cert i ) is encrypted (S7).

7. The method according to claim 1, wherein: Using public cocoon encryption key Pseudonymous certificate for signatures (cert i ) is encrypted (S7).

8. The method according to claim 7, wherein: The public cocoon encryption key is derived by expanding (S2) the public larva encryption key (E) of the private / public larva encryption key pair (e, E) using a second pseudo-random function (f2) 9. The method according to claim 8, wherein: A public larva encryption key (E) and a second pseudo-random function (f2) are received (S1) by a registration authority module (RA) from a requesting device (40).

10. The method according to claim 7, further comprising signing the response packet (S8).

11. The method according to any one of claims 1 to 10, further comprising providing (S9) a response package for downloading by the requesting device (DEV).

12. A computer-readable storage medium, wherein: A computer program is stored on the computer-readable storage medium. The computer program includes instructions. When executed by a computer, the instructions enable the computer to perform the method for implementing the butterfly key expansion scheme according to any one of claims 1 to 11.

13. A registration authority module (RA), configured to implement a butterfly key extension scheme, the registration authority module (RA) comprising: - a first receiving module (11) configured to receive (S1) a public larva signature key (S) of a private / public larva signature key pair (s, S) and a first pseudo-random function (f1) from a requesting device (DEV); - an expansion module (12) configured to expand (S2) the public larva signature key (S) into a public cocoon signature key using a first pseudo-random function (f1) - A generator module (13) configured to generate a signature based on a public cocoon key Generate (S4) a certificate signing request (CSR); - a second transmission module (14) configured to send (S5) a certificate signing request (CSR) to a certificate authority module (CA) and to receive (S6) a signed pseudonym certificate (cert i ); as well as - a cryptographic module (15) configured to authenticate the signed pseudonym certificate (cert i ) is encrypted (S7) to generate a response packet.

14. A security credential management system (SCMS), wherein: The secure credential management system (SCMS) comprises a registration authority module (RA) according to claim 13, or is configured to perform a method for implementing a butterfly key extension scheme according to any one of claims 1 to 11.

Images