Secure communication

Abstract

A method for deriving shared secret information between a first device (A) and a second device (B) is disclosed. The method comprises the following steps: acquiring a data set DA by equipment A; and obtaining, by the device B, a data set DB. Then, for respective N subsets DAi and DBi (i = 1, 2,..., N; ngt; the method comprises the steps of: determining, by a device A, a first value VAi = MA (DAi) based on DAi, where MA comprises an entropy reduction function and / or a statistical function; determining, by the device B, a second value VBi = MB (DBi based on DBi, where MB comprises an entropy reduction function and / or a statistical function; and exchanging one or more messages between the device A and the device B to determine whether a condition based on the first value VAi and the second value VBi is satisfied. The method further comprises obtaining, by the device A, a simplified data set DA'based on the subsets DAi satisfying the condition; and obtaining, by the device B, a simplified dataset DB 'based on the subsets DBi satisfying the condition. The method may further comprise repeating the steps of determining, exchanging and obtaining the simplified dataset one or more times until one or more termination criteria are satisfied, where the dataset used in one iteration comprises the simplified dataset obtained in the previous iteration.

Description

Technical Field

[0001] Certain examples of the present disclosure provide one or more techniques for deriving shared secret information between two or more devices. Certain examples of the present disclosure provide one or more techniques for performing security operations (eg, secure communications) using shared secret information. Background Art

[0002] The fundamental problem in communication theory is how to transmit a message M between two parties without making it available to third parties. For example, in the field of electronic financial transactions, it is very important to maintain confidentiality in the communication between two parties.

[0003] Typically, the two parties who wish to exchange messages are called Alice (A) and Bob (B), and the eavesdropper who wishes to gain unauthorized access to the message M is called Eve (E).

[0004] A variety of communication techniques have been developed to address this problem. One class of techniques relies on Eve's computational limitations, which prevent her from performing certain mathematical operations in a reasonable amount of time. For example, the security of RSA public-key cryptography relies heavily on the computational difficulty of factoring very large integers. This type of technique is called "conditionally secure" or "computationally secure."

[0005] One problem with conditionally secure techniques is that confidence in their security relies on still-unproven mathematical results in the field of complexity theory. Therefore, it is not yet certain whether these techniques will be unbreakable in the future using only the resources of classical computers, if suitable mathematical tools can be developed. Furthermore, the development of quantum computing technology makes conditionally secure techniques vulnerable due to their potential ability to perform certain mathematical operations (including those on which computational security techniques rely) much faster than classical computers.

[0006] As a result, there is great interest in developing a class of communication techniques that make no assumptions about Eve’s computing power. This type of technology is called “unconditionally secure.”

[0007] An example of an unconditionally secure data transmission scheme is called a "one-time pad." According to this technique, Alice performs a bit-by-bit modulo-2 addition (i.e., an XOR operation) on a binary plaintext string (message M) and a secret random binary string (the one-time pad) of the same length as the message. The resulting binary ciphertext string (encrypted message M) is ε ) is transmitted to Bob instead of the original message M. To recover the original message M, Bob compares his local copy of the one-time pad with the received encrypted message M. ε Perform bit-by-bit modulo 2 addition. Even if Eve intercepts the transmitted encrypted message M ε, Eve cannot recover the original message M without knowing the one-time pad. As the name implies, a one-time pad is used only once to help ensure security.

[0008] A basic requirement of any secure communication scheme is that Alice and / or Bob must possess some secret information unknown to Eve. This secret information is used as the basis for encryption and / or subsequent decryption of messages. In some schemes, both Alice and Bob must possess at least some secret information, and this secret information is at least partially shared between them. For example, the secret information can be in the form of a random binary string in the one-time pad scheme described above. In this case, the secret information is fully shared between Alice and Bob.

[0009] In various techniques, shared secret information is first distributed between Alice and Bob using a first mechanism, and then Alice and Bob exchange messages using a second mechanism involving the shared secret information. One reason for using this two-phase approach rather than simply exchanging messages directly using the first mechanism is that, in some cases, a mechanism that is suitable for allowing Alice and Bob to obtain shared secret information without pre-shared information may not be suitable or practical for the message exchange. For example, some mechanisms allow Alice and Bob to obtain shared secret information, but do not allow Alice and Bob to control the exact content of the shared secret information.

[0010] A problem with any secure communication technology that requires sharing secret information is how to distribute the secret information between Alice and Bob without Eve knowing it. This problem is particularly severe with technologies such as one-time pads, where the amount of secret information required is comparable to the amount of plaintext message data. Therefore, a technology that allows Alice and Bob to obtain shared secret information is desired.

[0011] The above information is presented as background information only to assist with an understanding of the present disclosure. No determination has been made, and no assertion is made, as to whether any of the above might be applicable as prior art with respect to the present disclosure. Summary of the invention

[0012] The purpose of some examples of the present disclosure is to at least partially address, solve, alleviate or eliminate at least one problem and / or disadvantage associated with the related art, such as at least one problem and / or disadvantage mentioned herein. Some examples of the present disclosure are intended to provide at least one advantage over the related art, such as at least one advantage mentioned herein.

[0013] The invention is defined in the independent claim. Advantageous features are defined in the dependent claims.

[0014] Embodiments, aspects or examples disclosed in the specification and / or drawings beyond the scope of the claims should be understood as examples to help understand the present invention.

[0015] Other aspects, advantages, and salient features of the disclosure will become apparent to those skilled in the art from the following detailed description, which, taken in conjunction with the annexed drawings, discloses examples of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The relationship between various quantities associated with three random variables X, Y, and Z is shown;

[0017] Figure 2 is a flow chart of an exemplary method for deriving shared secret information between a first device (device A) and a second device (device B);

[0018] Figure 3 An example of deriving a simplified data set based on a data set is shown;

[0019] Figure 4 is a message flow diagram of a first exemplary technique for deriving shared secret information;

[0020] Figure 5 is a message flow diagram of a second exemplary technique for deriving shared secret information; and

[0021] Figure 6 is a block diagram of an exemplary device for deriving secret information shared with another device. DETAILED DESCRIPTION

[0022] The examples of the present disclosure described below with reference to the accompanying drawings are provided to assist in a comprehensive understanding of the present invention as defined by the claims. The description includes various specific details to assist in understanding, but these should be considered as exemplary only. Therefore, those of ordinary skill in the art will recognize that various changes and modifications may be made to the examples described herein.

[0023] Certain examples of the present disclosure provide one or more techniques for deriving shared secret information between two or more devices (or apparatuses). Certain examples of the present disclosure provide one or more techniques for performing security operations (eg, secure communications) using shared secret information.

[0024] The device capable of implanting one or more of the techniques described herein may be of any suitable type, for example, a mobile device (such as a mobile phone), a computer terminal, a relay device, a server, a node in a network (such as the Internet or a private network), or any other suitable type of device for communication. In addition, such a device may be a manually operated device (e.g., a device operated by a user), or may be a partially or fully automated device. In some examples, one or more of the techniques described herein may be applied to communications between internal components of one or more devices. Therefore, references herein to a 'device' that communicates with another device may also include references to an internal component of a device that communicates with another internal component of the same device or a different device.

[0025] The techniques described herein may be used in a variety of applications, including but not limited to financial transactions, police, armed forces, government, mobile data, mobile voice, navigation and location information (e.g., GPS), financial services, banking, shipping communications, user services, mobile security services, distributed networks, remote access, Internet communications, virtual private networks, satellite communications, remote command and control systems, aircraft (e.g., drones), remote control, data storage and archiving, and identity management and security. The skilled person will recognize that the shared secret information obtained using one or more of the techniques described herein may be used in any suitable type of security operation, not limited to secure communications.

[0026] A skilled person will recognize that the techniques described herein can be used to enable a group of two or more devices to obtain shared secret information (i.e., obtain information known to the devices but unknown to any other entity). In some examples, device A and device B can use the techniques to obtain first shared secret information (shared between device A and device B). In some examples, device A and device C can also use the techniques to obtain second shared secret information (shared between device A and device C). In some examples, a group of three or more devices {A, B, C, ...} can use the techniques to obtain third shared secret information (shared between devices {A, B, C, ...}).

[0027] Before proceeding with the following description, some useful concepts in the field of information theory will now be briefly described.

[0028] Consider the probability distribution function P X Characterize the discrete random variable X. The entropy H of X is defined as:

[0029]

[0030] In Equation 1, x represents a specific result of X, and P X(x) is the probability of outcome x, and b is an arbitrary logarithmic base that determines the units of entropy. Often, the base b is chosen to be 2, in which case the units of entropy are "bits". The entropy of X can be viewed as a measure of the uncertainty associated with the outcome of X. One interpretation is that when using a best guess strategy, the entropy (in bits) gives the average number of yes / no type questions required to guess the outcome of X, and is the average number of bits per outcome required to encode a sequence of outcomes for X.

[0031] The conditional entropy H(X|Y) of discrete random variables X and discrete random variables Y is defined as:

[0032]

[0033] In Equation 2, x and y represent specific results of X and Y respectively, and P X (x) and P Y (y) are the probabilities of outcome x and outcome y, respectively, P X|Y (x|y) is the conditional probability of outcome x given outcome y, P XY (x, y) is the joint probability distribution of X and Y, and b is an arbitrary logarithmic base. The conditional entropy H(X|Y) can be interpreted as a measure of the uncertainty of X after observing Y.

[0034] The mutual information I(X;Y) of a discrete random variable X and a discrete random variable Y is defined as:

[0035]

[0036] In Equation 3, x and y represent specific results of X and Y respectively, and P X (x) and P Y (y) are the probabilities of outcome x and outcome y, respectively, P XY (x, y) is the joint probability distribution of X and Y, and b is an arbitrary logarithmic base.

[0037] As can be seen from Equation 3, the mutual information I(X;Y) can be interpreted as the reduction in uncertainty about X after observing Y. Equivalently, the mutual information I(X;Y) can be interpreted as the amount of information gained about X after observing Y, or as the amount of information shared between X and Y. If X and Y are relatively highly correlated, the mutual information I(X;Y) will be relatively high. Conversely, if X and Y are relatively uncorrelated, the mutual information I(X;Y) will be relatively low. If X and Y are completely uncorrelated, then I(X;Y)=0, and if X=Y, then I(X;Y)=H(X). Mutual information is symmetric in its independent variables: I(X;Y)=I(Y;X).

[0038] As an example, in the above one-time password scheme, the message M and the encrypted message Mε The mutual information between them is equal to 0, that is, I(M; M ε )=0. Therefore, Eve obtains the encrypted message M ε No information about the message M is obtained. This property makes the above one-time pad scheme unconditionally secure as long as the one-time pad remains secret.

[0039] The definitions of conditional entropy and mutual information given above can be extended to consider more than two discrete random variables. For example, in the case of three discrete random variables X, Y, and Z, the conditional entropy H(X|YZ) can be interpreted as the uncertainty of X after observing Y and Z. The mutual information I(X; Y; Z) can be interpreted as the information shared between X, Y, and Z. The mutual information I(X; Y|Z) can be interpreted as the information shared between X and Y, but not shared with Z.

[0040] The relationships between various quantities associated with random variables can be schematically represented by Venn diagrams. For example, Figure 1 The relationship between various quantities associated with three random variables X, Y, and Z is shown. The three overlapping circles represent H(X), H(Y), and H(Z). The quantities I(X;Y), H(Y|X), H(Z|XY), I(X;Y|Z), and I(X;Y;Z) are represented by the shaded areas. It can be deduced by symmetry that Figure 1 The conditional entropy and mutual information of other combinations of variables in the area.

[0041] Various exemplary techniques for deriving shared secret information between a first device and a second device will now be described. In the following examples, the first device may be referred to as device A (Alice), and the second device may be referred to as device B (Bob). However, the skilled person will recognize that these labels are merely exemplary.

[0042] Figure 2 is a flow chart of an exemplary technique for deriving shared secret information between device A and device B. Figure 2 The left hand side of shows the operations performed by device A, and Figure 2 The right hand side of shows the operations performed by device B.

[0043] In this technique, device A and device B separately obtain different data sets (e.g., bit sequences). Then, by performing various operations and message exchanges, each device derives its own reduced data set, including by selectively discarding and retaining certain elements of the original data set, so that the reduced data set tends to contain a higher proportion of matching elements (e.g., matching bits) than the original data set. The decision about which elements to discard and retain is made based on calculating an entropy reduction function or a statistical function (e.g., a parity function) of a subset of the data set.

[0044] Statistical functions can include functions whose outputs contain statistical information based on the inputs. For example, a statistical function can be viewed as a function whose output "summarizes" the input in some respects. Entropy reduction functions can include functions that reduce the information content or entropy of an input to generate an output. For example, information content or entropy can be defined according to any suitable known definition used in information theory. Entropy reduction functions can be considered as functions whose outputs have a lower complexity than the inputs. In some examples, statistical functions can be viewed as a type of entropy reduction function. However, in other examples, depending on the definition used, the output of a statistical function does not necessarily have a lower entropy than the input. The use of entropy reduction functions or statistical functions reduces the amount of information about a data set revealed to a potential eavesdropper.

[0045] Figure 3 An example of deriving a reduced data set from a data set is shown.

[0046] Now refer to Figure 2 and Figure 3 These steps are described in more detail.

[0047] In step 201A, device A obtains a first data set D A .

[0048] In the corresponding step 201B, device B obtains a second data set D B .

[0049] Dataset D A and dataset D B Each may include an indexable collection of elements, where each element can take one of two or more values. For example, the data set D A and dataset D B Each may include a data sequence (eg, a bit sequence).

[0050] Dataset D A and dataset D B Each may include a random data set. However, in other examples, the data sets may be non-random.

[0051] Dataset D A and dataset D B However, the dataset should include at least some matching elements (e.g., at the same index value, D A At least some of the elements have B For example, in the case where the data set comprises a bit sequence, D A and D B The bit values ​​of D match at least some bit positions. In this case, there is at least some information overlap between the data sets:A ;D B )>0. Some of the techniques described in this paper aim to increase information overlap, for example, until the data sets are identical or differ by less than a certain threshold.

[0052] Dataset D A and dataset D B Confidentiality should be maintained (ie, remain unknown to unauthorized parties, such as potential eavesdroppers).

[0053] Device A and device B may use any suitable technique to obtain data set D A and dataset D B . For example, a random data set can be generated based on a pseudo-random number generator. In other examples, a random data set can be obtained based on one or more natural sources of randomness. For example, a known data set can be encoded into a signal, and the signal can then be transmitted to a device through a noisy communication channel. The device can then compare the known data set with a data set obtained from the received signal to obtain an error signal that forms a data set. Alternatively or additionally, the random data set can be obtained by sampling random noise of an electronic component. In some examples, a non-random data set can be obtained by sampling an audio signal (e.g., obtained using a microphone) and / or an image signal (e.g., obtained using an imaging device). In another example, the non-random data set may include a predetermined data set.

[0054] In the following, we assume that the dataset D A and dataset D B However, the skilled person will appreciate that the techniques described herein are applicable to other types of data sets.

[0055] Figure 3 An exemplary data set D comprising a 16-bit sequence [0101 1100 0111 0010] is shown. A 301A and an exemplary data set D comprising a 16-bit sequence [0101 1111 1001 0010] B 301B.

[0056] After step 201A and step 201B, various steps are performed as follows to obtain the data set D A and dataset D B Export includes the data set D A and dataset D B The respective simplified data set D of a higher proportion of matching elements (e.g., matching bits) A ' and D A '. Specifically, consider D alone A The subset and corresponding D BBased on each subset, an entropy reduction function or statistical function is calculated, and based on the result, D is discarded or retained. A and D B These steps will now be described in more detail.

[0057] For D A and D B Each of the N subsets D A i and D B i For each subset in (i=1, 2, ..., N; N>1), the following steps 203A, 203B, 205A (including 205'A) and 205B (including 205'B) are performed. Figure 2 , which is shown as the loops "for i=1 to N" and "next i" indicated by dashed lines. Each repetition of the loop corresponds to processing a single pair of corresponding subsets D with a specific index value i (i=1, 2, ..., N; N>1). A i and D B i .

[0058] N subsets D A i and D B i Including D A and D B For example, N subsets D A i and D B i Can each include D A and D B A group of n (e.g., n=4) data elements (e.g., consecutive bits) of D A and D B The corresponding subsets of may include elements of the respective data sets having the same index. For example, the first corresponding subset may include D A and D B The first four (or any other suitable number) bits of D A and D B The next four bits of the subsets, and so on. In other examples, the bits of the subsets need not include a contiguous set of bits. The subsets may include the same number of bits. However, in other examples, at least some of the subsets may have different sizes.

[0059] Figure 3 Each data set D is shown A 301A and D B301B is divided into four exemplary subsets, each having four consecutive bits. A 1 =

[0101] ,D A 2 =

[1100] , D A 3 =

[0111] and D A 4 =

[0010] , and D B 1 =

[0101] ,D B 2 =

[1111] ,D B 3 =

[1001] and D B 4 =

[0010] .

[0060] In step 203A, device A uses D A i , determine the first value V A i =M A (D A i ). In some examples, M A An entropy reduction function or a statistical function may be included. In some examples, M A Can include filter functions.

[0061] In the corresponding step 203B, device B based on D B i , determine the second value V B i =M B (D B i ). In some examples, M B An entropy reduction function or a statistical function may be included. In some examples, M B Can include filter functions.

[0062] M A Can have the same B Same function. For example, M A and / or M B One or more of a parity check function, a Hamming distance function, a mean function, and a variance function may be included. When applied to a bit sequence, these functions may be defined as follows.

[0063] Given the i-th subset D A i =[a0, a1, …, a j , …, a n], a j ∈{0, 1}, D A i The parity value can be defined as:

[0064]

[0065] Given the i-th subset D A i =[a0, a1, …, a j , …, a n ], a j ∈{0, 1}, and given the code B i =[b0, b1, …, b j , …, b n ], b j ∈{0, 1}, D A i Relative to B i The Hamming distance (HD) of can be defined as:

[0066]

[0067] For example, code B i It may be a one-time code including random bits defined for the ith subset.

[0068] The two-part value can be defined as M A (D A i )=[HD(D A i , B i ), B i ]

[0069] Given the i-th subset D A i =[a0, a1, …, a j , …, a n ], a j ∈{0, 1}, D A i The mean value can be defined as:

[0070]

[0071] Given the i-th subset D A i =[a0, a1, …, a j , …, a n ], a j ∈{0, 1}, D A i The variance value can be defined as:

[0072]

[0073] The function M in each term in the above example can be defined similarly B (D A i ).

[0074] Figure 3 shows the use of the parity check function from the subset D A i 310A export value V A i 303A, and from subset D B i 301B Export value V B i Example of 303B. For example:

[0075] D A 1 =

[0101] →V A 1 =[0] D B 1 =

[0101] →V B 1 =[0]

[0076] D A 2 =

[1100] →V A 2 =[0] D B 2 =

[1111] →V B 2 =[0]

[0077] D A 3 =

[0111] →V A 3 =[1] D B 3 =

[1001] →V B 3 =[0]

[0078] D A 4 =

[0010] →V A 4 =[1] D B 4 =

[0010] →V B 4 =[1]

[0079] You can choose function M A and function MB , so that the input value cannot be determined from the output value. That is, it is impossible to determine the input value from M A (D A i )Determine D A i , and cannot be based on M B (D B i )Determine D B i For example, M A and M B Each of M can be defined so that multiple inputs map to the same output. A (D A i ) and M B (D A i ), get the D A i and D B i , so this property allows confidentiality to be maintained.

[0080] Furthermore, the function can be chosen so that if M A (D A i )≠M B (D B i ), then D A i ≠D B i That is, if the output values ​​based on two subsets are different, it means that the two subsets are not the same. For example, M A and M B Each of can be defined so that two different outputs cannot map to the same input. This property allows device A and device B to identify corresponding explicitly mismatched subsets D A i and subset D B i Such subsets can then be discarded to increase the matching probability among the remaining subsets.

[0081] In step 205A and step 205B, device A and device B exchange one or more messages to determine whether the first value V is satisfied. A i and the second value V B i For example, if the function M A and function M B The same condition can be to determine whether V Ai =V B i (exist Figure 2 205′A and 205′B). In function M A and function M B In different situations, the conditions can be modified accordingly. For example, if M A is defined as “the number of 1s in a subset” and M B is defined as the number of 0s in a subset, then this condition can determine whether V A i =size–V B i , where “size” is the number of bits in the subset.

[0082] In one example, exchanging messages and determining whether a condition is satisfied may include the following steps. First, device A may set a first value V A i is transmitted to device B, and device B can transmit the second value V B i is transmitted to device A. Then, because each of device A and device B knows V A i and V B i Both, so each of device A and device B can be based on the first value V A i With the second value V B i Compare between them to determine whether the conditions are met.

[0083] In another example, exchanging messages and determining whether a condition is satisfied may include the following steps. First, one of device A and device B, as device X, may X i is transmitted to device A and device B as another device in device Y. Next, knowing V X i and V Y i Both devices Y can compare the value V X i and V Y i Device Y can then transmit to device X a value C indicating the result of the comparison. i (For example, C i =0 means "no match" or C i =1 means "match").

[0084] exist Figure 2In the example, each iteration of the loop corresponds to processing a subset D of single pair correspondences. A i and subset D B i In this case, follow {203A / B, then 205A / B} i These steps are performed in the order in which {X} i Here, it means repeating X i times. Here, step 205 'A / B is considered as a part of step 205A / B. Figure 4 is the message flow diagram corresponding to this situation.

[0085] In some alternative examples, these steps may be performed in a different order. For example, step 203A / B may be performed for all corresponding subset pairs D A i and D B i Repeat, then step 205A / B can be repeated for all corresponding subset pairs. In this case, according to {203A / B} i Then {205A / B} i In this case, the information related to the different subsets communicated in step 205A / B can be combined in a single message. For example: for all values ​​of V A i Values ​​can be transferred from device A to device B in a single message in the form of a list; for all values ​​of V at the i-th time B i The values ​​may be transmitted from device B to device A in a single message in the form of a list; and / or for all values ​​of C at the i-th time i The values ​​can be transferred from device Y to device X in a single message in the form of a list. Figure 5 is the message flow diagram corresponding to this situation.

[0086] After the above steps, device A and device B have acquired subsets D that allow them to determine which corresponding A i and subset D B i Information that is definitely not matched (i.e., the probability of matching is zero). For example, if M A and M B are the same function, then the subset that does not match is definitely V A i ≠V B i On the other hand, the corresponding subset D A i and subset D B i, for V A i =V B i In some cases, they may not match, but there is also a non-zero probability that they will match. By discarding the corresponding subsets that are definitely not matched while retaining the corresponding subsets with non-zero matching probability, the total matching probability between the datasets increases, and the information overlap between the datasets tends to increase accordingly (i.e., I(DA; DB) increases).

[0087] like Figure 3 As shown, in step 305, V A i and V B i The value of V A i and V B i The subset D is retained or rejected based on whether the value of A i and subset D B i .exist Figure 3 In the example, when i=3, the value V A i Sum value V B i mismatch, and due to the mismatch between the slave values ​​(i.e., V A 3 =[1] and V B 3 = [0]), we can know that the corresponding subset (i.e., D A 3 =

[0111] and D B 3 =

[1001] ) are definitely different, so the subset D when i=3 A i and subset D B i On the other hand, the values ​​V when i = 1, 2, and 4 A i Sum value V B i matches, and since the matching value V A i Sum value V B i Indicates the corresponding subset D A i and D B i The matching probability is non-zero, so the subset D when i = 1, 2 and 4 A i and subset D Bi is retained. A i and V B i In the matching subset, the corresponding subset D A i and D B i Matches when i = 1 and 4, mismatches when i = 2. Although a pair of non-matching subsets (i.e., i = 2) is retained, a pair of definitely non-matching subsets (i.e., i = 3) is rejected, tending to increase the overall information overlap between the retained subsets.

[0088] When N subsets (D A i and D B i ) after each of the steps 203A, 203B, 205A and 205B are executed, steps 207A and 207B are executed.

[0089] In step 207A, device A selects the subsets D that meet the above conditions. A i (i.e., the retained subset), and obtain the simplified data set D A '.

[0090] In the corresponding step 207B, device B selects the subsets D that meet the above conditions. B i (i.e., the retained subset), and obtain the simplified data set D B '.

[0091] Get the simplified data set D A ' can include the following steps. First, for each subset D that satisfies the condition X i , can be based on D X i , and obtain the corresponding subset D X i '. Then, the corresponding subsets D can be combined X i 'To generate a simplified data set D X '.

[0092] In some examples, the corresponding dataset D X i 'Can include D X i For example, D X i 'Can be with D X i same.

[0093] In some examples, the corresponding dataset D X i 'Can include D X i For example, D at a predetermined bit position may be discarded. X i ', and the remaining bits can form D X i '.

[0094] In some examples, the corresponding dataset D X i 'Can include D X i For example, the function S may include a parity check function. For example, D may be calculated X i The parity of the bit set of D, and the resulting single parity bit can form D X i '.

[0095] In some examples, the corresponding dataset D X i 'Can include D X i For example, D at predetermined bit positions may be discarded. X i ', the parity of the remaining bits can be calculated, and a single parity bit can form D X i '.

[0096] However, D X i 'From D X i Export, D X i ' can be combined in any suitable manner, for example, by concatenation, interlacing or any other suitable technique, to form D X ’ .

[0097] Figure 3 The subset D reserved by device A 307A is shown A i and the subset D reserved by device B 307B B i . Figure 3An example of a reduced data set is also shown, which can be obtained by retaining the first two bits of each retained subset and discarding the other bits, and concatenating the retained bits to form a reduced data set. A reduced data set D of device A is shown at 309A. A ', and at 309B a simplified data set D of device B is shown B In an alternative example, the reduced data set may include only connections that retain a subset, as shown at 307A and 307B.

[0098] As mentioned above, by excluding D A and D B The definitely mismatched subset is used to derive the simplified dataset D A ' and simplified data set D B ', then D A 'With D B The information overlap between ' will often be higher than D A With D B The information overlap between A ';D B ')>I(D A ;D B ). However, due to M(D A i )=M(D B i ) does not guarantee D A i =D B i , so D A ' and D B ' can still have one or more unmatched subsets.

[0099] Therefore, in some examples, the above process can be repeated to further increase the information overlap. Specifically, the steps of determining (steps 203A and 203B), exchanging (steps 205A and 205B), and obtaining a simplified data set (steps 207A and 207B) can be repeated one or more times until one or more termination criteria 209A, 209B are met. When repeating these steps, the data set D used in one iteration A , Dataset D B Include the simplified dataset D obtained in the previous iteration A ', Simplify the data set D B '.like Figure 2 As shown, in step 209A / B, if one or more termination criteria are not met, the method returns to step 203A / B, otherwise, the method ends.

[0100] Termination criteria 209A and termination criteria 209B may be selected so that after the termination of the process, the data sets (e.g., bit sequences) of device A and device B match, or are likely to match (e.g., the probability of matching is greater than a certain threshold). For example, one or more termination criteria may include: the number of iterations has reached a predetermined threshold. In this case, the threshold may be determined based on theoretical calculations, experiments, and / or simulations. For example, threshold 3 or threshold 4 may be used in some examples.

[0101] In some applications, an exact match between the resulting data sets (e.g., bit sequences) of device A and device B may be required. On the other hand, in other applications, an exact match may not be required. For example, if the data sets of device A and device B are used as a one-time pad for subsequent data communication, errors between the data sets will result in errors in the data. However, some errors may be acceptable for some applications, for example, if the data includes error correction codes.

[0102] Once a data set (e.g., a bit sequence) has been obtained using the above techniques, these data sets can be used to perform security operations, such as secure communication between device A and device B. For example, the data set can be used as a one-time password for transmitting data. In some examples, if an error is detected in the transmitted data, this can be interpreted as an indication that the data set does not match exactly. In this case, the above process can be repeated. In some cases, further iterations of the method can be performed based on the existing data set. However, in other examples, the entire process can be repeated from the beginning.

[0103] The above technique allows two devices to derive shared secret information between them. However, the technique can be extended to allow more than two devices to derive shared secret information between them. For example, similar to the case of two devices, in the case of three devices, each device obtains its own data set. Then, considering subsets of the data set, the three devices exchange messages between each other to identify and discard those subsets that are definitely not matched between all three devices. Then, similar to the case of two devices, each of the three devices derives a reduced data set based on the remaining subsets. Similar to the case of two devices, the process can be repeated until one or more termination criteria are met.

[0104] Certain examples of the present disclosure may be based on processing an abstract data set to obtain a shared data set. In some examples, a data set (e.g., a binary data sequence) may be obtained based on one or more signals (e.g., physical signals), such as audio signals and / or light / image signals. The signal (e.g., audio signal and / or light / image signal) obtained by device A (e.g., via a predetermined phrase spoken by a user and / or by capturing an image of a predetermined object) may be decomposed into packets (corresponding to the above subsets), and each packet may be filtered to generate a filtered signal (corresponding to an entropy reduction function or statistical function applied to the packet). For example, a mean filter may be applied to the packet. A similar process may be performed by device B. A comparison between the filtered packets of device A and device B may then be performed, and the filtered packets may be selectively discarded or retained based on the comparison to obtain a "simplified signal" (e.g., audio signal and / or light / image signal). The process may then be repeated as described above. The processing of the signal may be performed digitally or by analog processing (e.g., using any suitable electronic components).

[0105] Figure 6 An exemplary device (or apparatus) for deriving shared secret information with another device and / or for communicating with another device is shown. Figure 6 The disclosed device is used to implement Figures 2 to 5 For example, device A and device B may include Figure 6 The disclosed device. The device 600 includes a processor (or controller) 601 for controlling the overall operation of the device 600. For example, the processor 601 can be configured to perform the operations described above for deriving shared secret information. The device 600 also includes a memory 603 for storing information and data required for the aforementioned operations. The device 600 also includes an external interface 605 for communicating with another device via any suitable communication link (e.g., wired or wireless). For example, under the control of the processor 601, the external interface 605 can be configured to transmit and receive messages, as described above.

[0106] In some examples, the device 600 may also include a user input / output (I / O) unit 607 for allowing a user to interact with the device 600. For example, the user I / O unit 607 may include one or more input devices (e.g., keyboard, touch screen, etc.) for inputting commands to the device 600. The user I / O unit 607 may include one or more output devices (e.g., display, LED, speaker, etc.) for outputting information (e.g., status information) to the user. In some examples, if the device 600 is configured to operate autonomously, the user I / O unit 607 may be omitted. In some examples, the device 600 may be configured to dock with another device in close proximity. In this case, the interface between the device 600 and another device may be a wired link or a relatively short-range communication link (such as a Bluetooth or NFC link). In other examples, the device 600 may be configured to dock with another device of a remote location. In this case, the device 600 may communicate with another device via a network (e.g., the Internet).

[0107] The terms and words used in this specification are not limited to the bibliographical meanings, but, are merely used to enable a clear and consistent understanding of the present disclosure.

[0108] The same or similar components may be denoted by the same or similar reference numerals even though they are shown in different drawings.

[0109] For the sake of clarity and conciseness, and to avoid obscuring the subject matter of the present disclosure, detailed descriptions of elements, features, components, structures, constructions, functions, operations, processes, characteristics, attributes, integers, and steps known in the art may be omitted.

[0110] Throughout this specification, the words “includes,” “comprising,” “containing,” and “having,” and variations of these words, such as “covering” and “comprising,” mean “including but not limited to,” and are not intended to (and do not) exclude other elements, features, components, structures, constructions, functions, operations, processes, characteristics, attributes, integers, steps, and / or groups thereof.

[0111] Throughout this specification, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. For example, reference to "an object" includes reference to one or more of such objects.

[0112] The term "substantially" means that the characteristic, parameter or value described need not be achieved precisely, but deviations or variations (including, for example, tolerances, measurement errors, measurement precision limitations and other factors known to those skilled in the art) may occur in amounts that do not interfere with the effect that the characteristic, parameter or value is intended to provide.

[0113] Throughout this specification, language in the general form of “X is for Y” (where Y is some action, process, function, activity, operation or step, and X is some means for implementing the action, process, function, activity, operation or step) encompasses means X that is specifically, but not exclusively, adapted, configured or arranged to perform Y.

[0114] Any elements, features, components, structures, constructions, functions, operations, processes, characteristics, attributes, integers, steps, and / or groups thereof described herein in conjunction with a particular aspect, embodiment, example, or claim should be understood to be applicable to any other aspect, embodiment, example, or claim disclosed herein unless incompatible therewith.

[0115] It should be understood that the examples of the present disclosure may be implemented in the form of hardware, software, or any combination of hardware and software. Any such software may be stored in any suitable form of volatile or non-volatile storage device or medium, such as ROM, RAM, memory chip, integrated circuit, or optical or magnetically readable medium (e.g., CD, DVD, disk, or tape).

[0116] Some examples of the present disclosure provide a computer program comprising instructions, which, when executed by a computer or a processor, causes the computer or the processor to perform a method according to any example, implementation, aspect and / or claim disclosed herein. Some examples of the present disclosure provide a computer or processor readable data carrier having such a computer program stored thereon.

[0117] The technology described herein can be implemented using any appropriately configured device and / or system. Such device and / or system can be configured to perform a method according to any aspect, embodiment, example or claim disclosed herein. Such device may include one or more elements, such as one or more of a receiver, a transmitter, a transceiver, a processor, a controller, a module, a unit, etc., each of which is configured to perform one or more corresponding processes, operations and / or method steps for implementing the technology described herein. For example, the operation / function of X can be performed by a module (or X module) configured to perform X. Device and / or one or more of its elements can be implemented in the form of hardware, software, a virtualization function instantiated on an appropriate platform (e.g., in a cloud infrastructure), or any combination of these.

[0118] While the invention has been shown and described with reference to certain examples, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention as defined by the following claims.

Claims

1. A method for deriving shared secret information between a first device (A) and a second device (B), the method comprising: Data set D is obtained by device A A ; Data set D is obtained by device B B ; For D A and D B Each of the N subsets D A i and D B i For each subset in (i=1, 2, ..., N; N>1): The device A is based on D A i , determine the first value V A i =M A (D A i ),in, M A including entropy reduction functions and / or statistical functions; The device B is based on D B i , determine the second value V B i =M B (D B i ),in, M B including an entropy reduction function and / or a statistical function; and One or more messages are exchanged between the device A and the device B to determine whether the first value V is satisfied. A i and the second value V B i conditions; The device A selects the subsets D based on the subsets D satisfying the condition. A i , get the simplified data set D A ';and The device B selects the subsets D based on the conditions. B i , get the simplified data set D B '.

2. The method according to claim 1, further comprising: Repeating the steps of determining, exchanging, and obtaining a reduced data set one or more times until one or more termination criteria are met, The data set used in one iteration includes the simplified data set obtained in the previous iteration.

3. The method according to claim 2, wherein: The one or more termination criteria include: the number of iterations has reached a predetermined threshold.

4. The method according to claim 1, 2 or 3, wherein: The dataset D A and the dataset D B Each includes a data sequence (eg, a bit sequence).

5. A method according to any preceding claim, wherein: The N subsets D A i and D B i Including D A and D B Mutually exclusive subsets of .

6. A method according to any preceding claim, wherein: The N subsets D A i and D B i Including D A and D B A set of n (eg, n=4) data elements (eg, consecutive bits) of.

7. A method according to any preceding claim, wherein: M A With M B Same functionality.

8. A method according to any preceding claim, wherein: M A and M B Includes one or more of a parity check function, a Hamming distance function, a mean function, and a variance function.

9. A method according to any preceding claim, wherein: Exchanging the messages and determining whether the condition is satisfied comprises: The first value V is transmitted from the device A to the device B. A ; The second value V is transmitted from the device B to the device A. B ;and Each of the device A and the device B is based on the first value V A With the second value V B Compare between them to determine whether the conditions are met.

10. The method according to any one of claims 1 to 7, wherein: Exchanging the messages and determining whether the condition is satisfied comprises: A value V is transmitted from one of the device A and the device B as device X to the other of the device A and the device B as device Y. X ; The device Y compares the value V X Sum value V Y ;and A message indicating the comparison result is transmitted from the device Y to the device X.

11. A method according to any preceding claim, wherein: Get the simplified data set D A 'include: For each subset D that satisfies the condition X i , based on D X i , get the corresponding subset D X i ';and Combine the corresponding subsets D X i ', to generate a simplified data set D X '.

12. The method according to claim 11, wherein: Corresponding subset D X i 'Include one of the following: D X i all elements of; D X i a predetermined subset of the elements of ; D X i Function S of all elements of ; as well as D X i A function S of a predetermined subset of the elements of .

13. The method according to claim 12, wherein: The function S comprises a parity check function.

14. A method according to any preceding claim, wherein: The dataset D A and the dataset D B Each includes a random data set.

15. A computer program comprising instructions which, when executed by a computer or a processor, cause the computer or the processor to perform the method according to any one of claims 1 to 14.

16. A computer or processor readable data carrier having stored thereon a computer program according to claim 15.

Images