Method and system for standard-compliant confidential reception of data for encrypted data processing

Abstract

The invention relates to a method for the standard-compliant confidential reception of data, the method being carried out by means of a system for data processing, in particular for the standard-compliant confidential reception of data, the data having been divided into secret shares when received, in this way, no one of the servers involved sees the received data in the form of a plaintext, and the method thus enables encrypted data processing and secure data reception.

Description

TECHNICAL FIELD

[0001] The present invention relates to the technical field of encrypted data processing. More specifically, the present invention relates to a method and system for standard-compliant confidential reception of data, which enables encrypted data processing. BACKGROUND

[0002] In the modern digital world, the protection of sensitive information is of paramount importance. Encryption methods are a necessary tool for ensuring the confidentiality and integrity of data. These methods convert readable data (plaintext) into an unreadable form (ciphertext), which can only be converted back to plaintext by an authorized recipient using a key. Thus, the development and application of such encryption methods are of central interest for a wide range of applications, including the communication, storage, and transmission of data.

[0003] Symmetric encryption methods use the same key for encryption and decryption of data. A prominent example is the Advanced Encryption Standard (AES). Symmetric methods are generally very efficient and are particularly suitable for encrypting large amounts of data. The main prerequisite for their security is the secure exchange of secret keys between communication partners.

[0004] Asymmetric encryption methods (also known as public-key methods) use a key pair consisting of a public key and a private key. The public key is used for encryption, while the private key is used for decryption. Known examples are the RSA method and the ElGamal method. These methods enable a secure communication channel without prior key exchange, but are computationally more complex than symmetric methods.

[0005] Hybrid encryption methods combine the advantages of symmetric and asymmetric methods. Typically, a symmetric key is securely exchanged using an asymmetric method, which is then used to encrypt the actual message. These hybrid methods provide the efficiency of symmetric encryption and the security advantages of asymmetric encryption.

[0006] Block ciphers such as AES can be used in different modes of operation to meet different security requirements. Common modes include:

[0007] ECB (Electronic Codebook Mode): A simple but insecure mode in many applications, where each block of data is independently encrypted.

[0008] CBC (Cipher Block Chaining Mode): Each block is linked to the previous cipher block before encryption, which prevents pattern formation in the ciphertext.

[0009] CTR (Counter Mode): A block cipher is converted into a stream cipher by encrypting a counter and combining it with the plaintext using XOR. This mode allows parallel processing.

[0010] The choice of appropriate encryption method depends on various factors, including the type of data to be protected, performance requirements, and specific security requirements. Symmetric methods offer high efficiency, while asymmetric methods offer the advantage of secure key exchange. Hybrid methods combine these advantages and provide a flexible solution for most applications. Security can be further customized and optimized by using operational modes.

[0011] To describe the potential technical problem of known encryption methods, first consider the example of a secure email provider that promises its customers that all emails are stored in encrypted form only, without access to the plain text itself. This provides very strong protection for the confidentiality of the email, even if the email provider's computer systems are compromised by an attacker. However, the prior art does not guarantee that the email provider will never have access to the email. The reason for this is that the email provider has no influence on whether and how emails it receives for its customers from third-party providers are also encrypted by the respective sender (e.g., with PGP or S / MIME encryption). In fact, emails are often sent in plain text. As a result, the email provider can read all plain text emails it receives for its customers at the time of receipt. To achieve the promised encrypted storage, the email is encrypted immediately after receipt so that only the recipient can decrypt it. However, this prior art has the following significant disadvantages:

[0012] 1. Despite the implementation of encrypted storage of emails, the email provider can still access received plain text emails at least for a short time. Therefore, the confidentiality of the received data cannot be guaranteed.

[0013] 2. If the provider's computer systems are compromised, an attacker can also have full access to the plain text of the received emails, thereby bypassing the encryption.

[0014] 3. Encrypted storage prevents the provider from processing plain text emails on the server side, for example, to implement search functions or automatic content classification using AI.

[0015] The provider can develop and implement a new proprietary email process in which emails are always encrypted by the sender. However, such a new development would not be compatible with existing email infrastructure. Since email is a standardized process widely used on the Internet, such a proprietary process seems impossible to implement. Finding a solution that both complies with standards and ensures that emails are never stored in plain text on a single provider system seems impossible with conventional technology.

[0016] Secure email is just one of many examples of applications in which this problem occurs. Other examples are:

[0017] Reliable benchmarking: Various companies provide confidential key data to a central service provider. This confidentially processes the key data and uses it to compute statistics that enable the participating companies to perform reliable benchmarking. This benchmarking allows to identify the potential of efficiency gains or cost savings. This comes with three main challenges, which correspond to the three disadvantages described above: 1. When benchmarking against confidential key data, the service provider should not have access to the confidential data. 2. In case of a breach, an attacker should not be granted access. 3. When using regular encryption, it is not possible for the service provider to process the data and thus compute the statistics.

[0018] Confidential machine data: Various operators of production machines collect machine data. This data is confidential, as it allows to draw conclusions about the production process and thus about trade secrets. This data is sent to a central service provider, which confidentially processes the data. This data is used, for example, to predict maintenance requirements (predictive maintenance), to identify the potential for optimization in machine operation, or to collect and compare key performance indicators such as downtime and maintenance intensity in order to identify the potential for improvement.

[0019] The challenges that arise here are: 1. When processing confidential machine data that can allow to draw conclusions about secret production processes, the service provider should not have access to the confidential data either. 2. In case of a breach, an attacker should not be granted access. 3. When using regular encryption, joint processing of the data by the service provider becomes impossible.

[0020] Medical data: Confidential medical patient data is highly sensitive and should therefore be stored in encrypted form (i.e., end-to-end). At the same time, it would be helpful to be able to evaluate a large number of people for the development of medical research and treatments, the detection of side effects, etc. This can be achieved by jointly storing the data at a shared service provider.

[0021] The challenges that arise here are: 1. When processing confidential patient data, the service provider should not have access to the confidential data either. 2. In case of a breach, an attacker should not be granted access. 3. When using regular encryption, joint processing of the data by the service provider becomes impossible.

[0022] Data spaces and data trustees: In the process of digitization, data spaces and data trustees are being discussed and implemented. One example of this is the mobility data space (https: / / bmdv.bund.de / DE / Themen / Digitales / Mobility-Data-Space / mds.html). The idea behind shared data spaces is to provide data to data trustees for joint processing, which can then process it centrally.

[0023] The challenges that arise here are: 1. The data trustees have full access to all data, so all participants must fully trust them. They also represent a single point of failure. The trustees should also not have access to confidential data when handling confidential data. 2. In case of compromise, the attacker should not be granted access. 3. When using regular encryption, joint processing of data by the trustees becomes impossible.

[0024] Secure file storage with server-side functionality: Secure file storage in the cloud can be implemented, for example, by encrypting with a dedicated tool. However, encryption makes it impossible for the cloud provider to enable server-side functionality such as search or filter functions, automatic document classification, spell checking, processing with large language models such as ChatGPT, or access via a web interface. These functionalities can only be implemented with unencrypted file storage.

[0025] The challenges that arise here are: 1. The cloud provider has full access to all files, so all users must fully trust the cloud provider. The cloud provider should not have access to confidential data when handling confidential data, or this can even be prohibited by legal frameworks or contracts with business partners. 2. In case of compromise of the cloud provider, the attacker should not be able to access the files. 3. When using regular encryption, the cloud provider cannot process the files.

[0026] Evaluation of confidential data by AI models: AI providers offer the use of widely trained AI models to classify confidential data.

[0027] The challenges that arise here are: 1. If the AI provider is given full access to the data to be classified, the customer must fully trust the AI provider. The AI provider should also not have access to confidential data when handling confidential data. At the same time, the AI provider cannot share its widely trained AI model with the customer, as this model represents its business advantage. 2. In case of compromise of the AI provider or the customer, the attacker should not be able to access the data or the model. 3. When using regular encryption, joint processing of data by the AI provider becomes impossible.

[0028] In essence, there are three different approaches to address the aforementioned shortcomings and challenges:

[0029] 1. Acceptance of the shortcoming. The problem is considered unrealistic and the shortcoming is accepted. In practice, most solutions are still based on this approach. The risk is accepted and data is shared with third parties. In this case, the usefulness of the data outweighs its protection. Alternatively, sharing confidential data with other companies or external service providers is considered unacceptable or is excluded by law (e.g. data protection, labor law, anti-trust law) or is prevented by confidentiality agreements with customers and business partners. In this case, data protection outweighs availability and potential efficiency and optimization gains are also abandoned.

[0030] 2. Trusted Execution Environment. Trusted Execution Environments (TEE), such as Intel's SGX (Software Guard Extensions) technology. These constitute a secure function (secure enclave) that is integrated into modern CPUs and is designed to enable secure execution, where even the operating system of the processing system cannot access confidential data. This technology offers many advantages over processing data in plain text. However, there is also a long list of vulnerabilities and attacks, such as Freshadow, CacheOut, SGAxe, Plundervolt and Load Value Injection, which indicate that such secure enclaves are difficult to implement securely.

[0031] 3. Oblivious TLS (https: / / eprint.iacr.org / 2021 / 318): This is an implementation of the TLS protocol using cryptographic secure multi-party computation (MPC) technology. In principle, this approach makes it possible to overcome all the shortcomings and challenges described above. Since the entire TLS protocol is implemented in MPC technology, it requires several orders of magnitude more hardware resources and runtime than a conventional TLS implementation. Therefore, the practical use of this technology can currently be thought of at best in niche applications. SUMMARY

[0032] The problem addressed by the present invention is to provide a method and a system for the standard-compliant confidential reception of data for encrypted data processing, wherein the method provides a significant performance gain over the methods known from the prior art.

[0033] The technical problem is solved by the subject matter having the features according to the independent claims. Advantageous embodiments are the subject matter of the dependent claims, the description and the drawings.

[0034] According to one aspect, the technical problem of the present invention is solved by a computer-implemented method for the standard-compliant confidential reception of data, wherein the method can be executed by means of a system for data processing, in particular a system for the standard-compliant confidential reception of data, comprising:

[0035] At least one client (C), wherein the client (C) is configured to send data,

[0036] At least one server (S), wherein the server (S) has implemented a cryptographic protocol for encrypting data and is configured to receive data from the client (C).

[0037] At least one proxy server (P) is located on the communication path (K) between the client (C) and the server (S), wherein the communication between the client (C) and the server (S) is partially or entirely carried out via the proxy server (P).

[0038] The method includes the following steps:

[0039] A. Exchange data for calculating the shared key k between the client (C) and the server (S), wherein the server (S) derives at least one key k from the key k. Enc , wherein k is preferred Enc The key is the same as or preferably computed from k using a key derivation function or hash function.

[0040] B. Data is sent from the client (C) to the server (S), where the data is encrypted using an operation mode in which an operational block cipher is applied for symmetric encryption, wherein the i-th message t from the client (C) to the server (S) is... i Includes encryption M i It is the plaintext data of the i-th message, and K i From k Enc The key for the exported operation mode, and the value t. i It is the password value of the message.

[0041] C. The proxy server (P) receives the data and processes the value t according to the cryptographic protocol. i , where t i It is the password value of the message.

[0042] D. A random string R is selected by the proxy server (P). i , where the random string R i The length corresponds to Length,

[0043] E. Forwarding via a proxy server (P) The random string R is sent to the server (S) and stored by the proxy server (P). i ,

[0044] F. Received by the server (S) Using key K iCalculated value wherein the application thereby the proxy server (P) and the server (S) each obtain data M i the addition secret sharing,

[0045] wherein the method for sending a message comprises the following steps:

[0046] G. computing the encrypted secret share by means of the server (S) wherein K j is derived from k Enc and is a secret share of held by the server (S),

[0047] H. sending the encryption via the server (S) to the proxy server (P), the proxy server (P) computing the ciphertext by applying the share .

[0048] The invention relates to a method for standard-compliant confidential reception of data, wherein the method is executable by a system for data processing, in particular a system for standard-compliant confidential reception of data. The basic idea of the invention is that the data is already divided into secret shares at reception, so that none of the involved servers sees the received data in plain text, and the method thus enables encrypted data processing and secure data reception. The method divides a single server receiving confidential data into at least two servers P and S, so that P and S each receive an encrypted secret share of the received data. Secret sharing ensures that no single server receives information about the received data; from the perspective of each individual server, the data is purely random. Distributing the data across multiple servers prevents a single compromised server from accessing all confidential data. Even if one server is compromised, an attacker cannot access the complete data, as only a fraction of the data (one secret share) is available. Since the complete data is not stored in a single location, the attack area is reduced. An attacker would have to compromise both servers to access the entire data, which significantly increases the security barrier. Secret sharing ensures that the data is divided into multiple parts and is not readable during transmission and storage. Only by combining the corresponding shares can the original data be reconstructed, which protects confidentiality. In contrast to previous prior art, the method enables secure reception of data in such a way that the data is already divided into secret shares at reception, so that none of the involved servers sees the received data in plain text. The method is only slightly less efficient compared to e.g. standard TLS implementations, as the proxy server P only forwards data packets or applies a simple binary XOR operation on them, which can be very efficiently implemented. At the same time, secret sharing provides a basis for the application of modern cryptographic secure multi-party computation techniques, which enable P and S to jointly process data without any single server seeing the complete data. An attacker who wants to gain access to the received data must compromise P and S at the same time. P and S can be implemented on different operating systems, so that the probability of a simultaneous security breach is very low. In various embodiments of the invention, there are different methods for securely exchanging a symmetric key k between the client and the server. One possibility is to manually enter the key on both computers by a trusted person, which requires this person to securely hold and transfer the key. Another method is to exchange the key via encrypted e-mail, wherein both parties must already have secure e-mail encryption, such as PGP or S / MIME. Similarly, the key can be stored in an encrypted file archive in a cloud storage service, e.g. using Zip with AES encryption, so that both parties can download and decrypt the key. In addition, a secure file exchange service operating via the Tor network, such as SecureDrop or OnionShare, can be used to securely transfer the key.Another option is to partially transmit the key via a secure telephone call, where part of the key is transmitted over the call and another part is transmitted via another secure method to increase security. The key can also be converted into a QR code and then exchanged between the parties using a secure physical scanning medium. Alternatively, the key can be loaded onto a smart card or hardware security module (HSM) and then physically transmitted to the system involved for use there. Transmission via NFC (Near Field Communication) or Bluetooth is also possible, provided both devices are very close and the transmission is encrypted. Another option is to exchange the key via a secure transport protocol such as TLS or IPSec, where a secure connection is first established and then the key is transmitted over that connection. Instead of directly exchanging the key k, both parties can derive the key k from a shared secret and additional parameters such as a random number. Public Key Infrastructure (PKI) can also be used, whereby one party encrypts a symmetric key with the other party's public key and sends it, allowing the recipient to decrypt the key using their private key.

[0049] In a technically advantageous embodiment of the invention, step D is omitted, and the proxy server (P) only... length Send to server (S), where proxy server (P) uses As its secret share, and the server (S) uses As its secret share. The proxy server (P) then uses it in the calculation. As The secret share, and the server (S) uses it in the calculation. The former Position as The secret share. Due to The principle remains the same; the proxy server (P) and the server (S) still possess the correct share of the secret. This embodiment of the invention has the advantage that the proxy server (P) only needs to send to the server (S). And it eliminates random selection Efforts.

[0050] In one embodiment of the invention, the MAC is also calculated. For this purpose, the server (S) directly uses k as k. MAC Alternatively, use a key export function or hash function to export k. MAC To derive key k from k MAC In an embodiment of the invention, the proxy server (P) receives k from the server (S). MAC This is to calculate or verify the MAC. However, the client and server can also interactively calculate the correct MAC together. For this, the agent does not need to receive k. MACThe secret shares held by the server (S) and the proxy server (P) are sufficient for this purpose. The specification verification of the MAC (Message Authentication Code) consists of the recipient generating a MAC using the same MAC computation function as the sender, using the same key and the same message. This newly computed MAC is then compared to the received MAC. If both MACs match, the message is considered authentic and unaltered, because only the legitimate sender and recipient know the secret key and are able to compute the correct MAC. This verification method ensures the integrity and authenticity of the message.

[0051] In another technically advantageous embodiment of the application, the data exchange for computing a shared key k between the client (C) and the server (S) comprises starting a communication session between the client (C) and the server (S), wherein the cryptographic protocol for exchanging k comprises at least one of the following protocols: OPC Unified Architecture OPC UA, Secure Shell SSH, Wireguard, Transport Layer Security TLS and / or Internet Protocol Security IPSec. The commonality of all protocols (OPCUA, SSH, Wireguard, TLS and IPSec) is that the communication can be roughly divided into two phases: a key exchange phase and a communication phase. This method can equally be applied to each of these protocols. During the key exchange phase, the proxy only forwards the communication and only becomes active during the communication phase. In the key exchange phase of all these protocols, the client (C) and the proxy server (P) subsequently derive a common key k The proxy server (P) does not learn the key k, even though it can read all the communication between the client (C) and the server (S). However, during the communication phase described above, the proxy server (P) can intervene in the communication in such a way that the proxy server (P) and the server (S) only receive secret shares of the plain text messages This allows the proxy server (P) and the server (S) to communicate with the client (C) in such a way that it appears to the client (C) as if it is communicating with a normal server according to one of the aforementioned protocols (OPCUA, SSH, Wireguard, TLS and IPSec, while at the same time the proxy server (P) and the server (S) only receive secret shares of the transmitted data. In this case, the messages corresponding to the plain text of the messages of the respective protocol (OPCUA, SSH, Wireguard, TLS or IPSec) in the communication phase of the respective protocol, are computed in step G using secure multi-party computation. Since the proxy server (P) and the server (S) only compute secret shares of these messages, they do not learn anything about the content of the plain text messages.

[0052] OPC Unified Architecture (OPC UA) is a communication protocol specifically developed for industrial automation systems. It provides a platform-independent interface that enables reliable communication and data exchange between different devices and systems. A key advantage of OPC UA is its ability to integrate and standardize different types of data, which significantly improves the interoperability and scalability of automation solutions. OPC UA also offers robust security mechanisms, including encryption and authentication, to ensure the integrity and confidentiality of transmitted data. Secure Shell (SSH) is a network protocol primarily used for secure remote access to network devices and servers. It provides encrypted connections that ensure the confidentiality and integrity of transmitted data. A major advantage of SSH is that it offers a secure method for managing servers over insecure networks such as the Internet. By using strong authentication mechanisms such as public-key authentication, SSH increases security and prevents unauthorized access. WireGuard is a modern VPN protocol known for its simplicity and performance. In contrast to traditional VPN protocols, WireGuard features a lean codebase and simple configuration, which improves security and makes it easier to manage. One of the biggest advantages of WireGuard is its high speed and efficiency, which is achieved through modern cryptography. This makes it particularly suitable for resource-constrained environments and mobile devices. Transport Layer Security (TLS) is a widely used security protocol for encrypting data transmission over the Internet. It ensures that communication between web browsers and servers remains confidential and protected from manipulation. TLS offers several security features, including data encryption, integrity protection, and authentication, which collectively improve the security of online transactions and confidential data. A key advantage of TLS is its ability to provide a secure communication layer superior to existing Internet protocols, making it versatile and widely used. Transport Layer Security (TLS) provides a comprehensive solution for securing communication over networks. Key advantages include confidentiality through strong encryption, data integrity through MAC and hash functions, authentication through digital certificates, and protection against various types of attacks. In addition, TLS offers flexibility, interoperability, efficient session management, and advanced security features such as perfect forward secrecy. Internet Protocol Security (IPSec) is a suite of protocols used to protect Internet Protocol communications by authenticating and encrypting each IP packet within a communication session. IPSec is particularly useful for establishing Virtual Private Networks (VPNs) and provides comprehensive protection at the network layer through encryption and authentication. One advantage of IPSec is its ability to integrate security-related functions directly into the IP layer, providing seamless and transparent security for all applications and services on the network.

[0053] In a technically advantageous embodiment of the invention, the method comprises encrypting a message authentication code, MAC, for authenticity and integrity, wherein an encryption key k MAC is the MAC key k MACand the server (S) derives a MAC key k from the key k MAC and makes it available to the proxy server (P). The MAC enables the recipient to ensure that the received data has not been altered. Any change to the message, even if it affects only one bit, results in a different MAC, making it easy to detect manipulation. The MAC ensures that the message actually originated from the specified sender. Since the MAC is computed using a secret key, only someone who knows the key can generate the correct MAC. This prevents an attacker from forging a message and impersonating a legitimate sender. The MAC key derived in the process is a secret key shared by both the sender and the recipient and is used to compute and verify the MAC. This key is a critical part of the MAC method and plays a central role in ensuring the security and integrity of the data. It is particularly advantageous if the message authentication code MAC computed in the operational mode is checked using a cryptographically secure multi-party computation, MPC, method. The use of MPC ensures that the computation and checking of the MAC are tamper-proof. No participant can influence the result of the check without being noticed. The MPC protocol is designed to deliver the correct result even in the case of malicious behavior by some participants. This ensures that the MAC check is reliable. Furthermore, it is advantageous if the computation and verification of the MAC is performed using secure multi-party computation and the key k MAC is not available to the proxy server (P).

[0054] In a technically advantageous embodiment of the application, the proxy server (P) uses the key k MAC The required message authentication code MAC is computed according to at least one of the following protocols: OPC Unified Architecture OPC UA, Secure Shell SSH, Wireguard, Transport Layer Security TLS and / or Internet Protocol Security IPSec, in order to obtain the ciphertext to be sent to the client (C).

[0055] In another technically advantageous embodiment of the present application, the method comprises as operational mode the Counter Mode (CTR), the Galois Counter Mode (GCM) and / or ChaCha20-Poly1305. The operational modes Counter Mode (CTR), Galois / Counter Mode (GCM) and the algorithm ChaCha20-Poly1305 each provide specific advantages in terms of security, efficiency and field of application. Counter Mode (CTR) is an operational mode for block ciphers that turns a block cipher into a stream cipher. CTR mode is ideal for parallel processing since each block can be encrypted independently of the others. This results in higher encryption and decryption speed. CTR is relatively easy to implement since there is no dependency between blocks. Each block is generated by encrypting an incrementing counter. It allows direct access to any block of data without the need to decrypt previous blocks. This is particularly useful for applications that require frequent access to specific blocks of data. Errors in a cipher block only affect the corresponding plaintext block, not the entire data transmission.

[0056] Galois / Counter Mode (GCM) combines the Counter Mode with an authentication function to ensure confidentiality and integrity of data. This provides the following advantages. Integrated authentication: GCM provides authenticated encryption with associated data (AEAD), which means that both the integrity and confidentiality of data are ensured. This prevents manipulation and unauthorized access. GCM is very efficient and can be used in parallel for encryption and authentication. This makes it ideal for high-speed applications. By using Galois field multiplication for authentication, GCM provides strong security against various attacks. GCM is particularly optimized for hardware implementation and provides high speed with low latency, making it particularly suitable for network-based applications.

[0057] ChaCha20-Poly1305 is a combination of the ChaCha20 stream cipher and the Poly1305 authentication function. ChaCha20 is a secure and robust stream cipher that resists known attacks. Poly1305 provides strong authentication to ensure data integrity. ChaCha20-Poly1305 performs very well on a variety of platforms, including those without AES hardware acceleration. This makes it particularly useful for mobile and embedded systems. ChaCha20 is designed to be secure against timing attacks since it does not use lookup tables that could lead to such attacks. The algorithm is easy to implement and provides flexibility in use, making it a good choice for a wide range of applications. Like GCM, ChaCha20-Poly1305 also provides authenticated encryption, which means that both the confidentiality and integrity of data are ensured.

[0058] In another embodiment of the invention, the computation of the key k is performed jointly in a handshake between the client (C) and the server (S) using another protocol (e.g. OPC Unified Architecture OPC UA, Secure Shell SSH, Wireguard, Transport Layer Security TLS and / or Internet Protocol Security IPSec). Integrating the key computation into another protocol provides advantages in terms of security, efficiency and interoperability in many applications. All the mentioned protocols provide strong authentication mechanisms that ensure that the communication only takes place between authenticated parties. Integrating the key computation into the handshake procedure ensures that the key is securely and in a trusted way exchanged between the communication partners. These protocols provide protection against man-in-the-middle attacks by using encryption and authentication during the handshake. Computing all keys during the handshake also enables centralized management and reduces complexity by merging the key generation and distribution into a single procedure. The simultaneous computation and distribution of the keys during the handshake minimizes the latency that might otherwise be caused by a separate key distribution mechanism. Integrating the key computation into existing handshake protocols effectively utilizes the already established communication channels and resources. OPC UA, SSH, Wireguard, TLS and IPSec are widely used standards that are employed in many industrial and IT systems. The use of these protocols ensures that the solution is interoperable and compatible with existing systems. The use of standardized protocols ensures that the implementation is consistent and easy to integrate. Integrating the key computation into the handshake allows for flexible scaling of the solution as it can easily be adapted to different network sizes and topologies. The solution can easily be extended by using additional security mechanisms within the protocol to meet future security requirements. The use of established and proven protocols such as OPC UA, SSH, Wireguard, TLS and IPSec increases the reliability of the system and provides robust error handling mechanisms. By integrating them into the handshake procedure, the keys are only generated and distributed upon successful authentication and handshake, thus making the system more resistant to attacks.

[0059] In a technically advantageous embodiment of the invention, the proxy server (P) receives the exchanged handshake messages from both the client (C) and the server (S) and forwards them to the other party.

[0060] In a technically advantageous embodiment of the invention, the method comprises the following additional steps:

[0061] The proxy server (P) computes the random string R using a pseudo-random function (PRF) or a pseudo-random number generator (PRG) i .

[0062] The proxy server is used to compute the random string R using a pseudo-random function (PRF) iSeveral advantages are provided, especially in cryptographic and security related applications. The most important advantage here is the high unpredictability: PRFs are designed such that their output is hard to predict based on secret input values (seeds). This is crucial for security in cryptographic applications, where predictability of random values can lead to security breaches. Consistency and repeatability: unlike true random sources that generate different values each time of invocation, PRFs can always produce the same result when the same seed and input value are used. This is useful for scenarios that require repeatability, such as test environments. Additional advantages lie especially in the efficiency of using PRFs. PRFs are efficient in algorithm and can be computed quickly, making them ideal for applications that require fast generation of random values. The low resource consumption of PRFs is also advantageous. PRFs require less resources than some true random number generators, which can rely on special hardware or external physical sources. Since PRFs are deterministic, the same input can always produce the same output. This is particularly useful for debugging and log verification, as it ensures that the same sequence of operations always produces the same result. A proxy server can centrally generate many random values for different clients or applications, which simplifies the management and distribution of random values. A proxy server can efficiently scale and distribute the generation of random values to handle high load or many simultaneous requests. PRFs can be used for various cryptographic applications, including key generation, one-time password books, initialization vectors for encryption, etc. The seed or input value can be easily changed to generate different random values, allowing for flexibility. PRFs are based on well-established cryptographic principles and provide strong security guarantees as long as the seed is kept secret. They are less susceptible to environmental factors or manipulation that can affect physical random number generators. A PRF-based system implemented as described above resists various attacks, including prediction attacks and replay attacks.

[0063] In a technically advantageous embodiment of the invention, the secret shares of the received data are processed and the data to be transmitted is calculated by applying a cryptographically secure multi-party computation (MPC) method Multi-party computation (MPC), also known as secure multi-party computation, is a branch of cryptography that allows multiple parties to jointly perform computations without any party knowing the private inputs of the others. The goal of MPC is to maintain the confidentiality of individual inputs while ensuring the correct result of the computation. By using secret sharing and MPC, parties do not have to disclose their data. The data remains encrypted and secure throughout the process, minimizing the risk of data leakage or unauthorized access. MPC enables multiple parties to perform computations without any party controlling or accessing the entire dataset. This prevents insider attacks and ensures that malicious actors cannot compromise the data. The use of MPC ensures that all computations are performed correctly and in a way that is secure against manipulation. No participant can change the result of the computation without being detected. MPC protocols can be configured to provide correct results even in the event of failures or misdirection by individual participants. This increases the robustness and reliability of the system. MPC eliminates the need for a central trusted authority to handle the data. This reduces single points of failure and increases the resilience of the system to attacks. Computations are distributed across multiple participants, which evenly distributes the load and improves the scalability of the system. MPC protocols can be easily scaled to handle more participants or larger amounts of data. This makes them flexible and suitable for different application requirements. Therefore, MPC can be suitable for a variety of cryptographic applications and scenarios, including secure cloud computing, private data analysis, and collaborative decision-making. At the same time, the server can apply a secure multi-party computation (MPC) method to secret shares in order to perform any computation on the data, such as filtering, computing statistics, data analysis, or evaluating an AI model.

[0064] In a technically advantageous embodiment of the invention, the method comprises the following additional steps:

[0065] Pre-computations are performed using the proxy server and the server before receiving the data of the client.

[0066] Pre-computations can be performed by the proxy server and the server even before receiving the message from the client, which allows for a more efficient execution of the MPC method. In particular, in an advantageous embodiment of the invention, the step of performing pre-computations using the proxy server and the server before receiving the data of the client can comprise the following additional steps:

[0067] Pre-computations of a random string R and its response shares are performed by the proxy server (P) even before receiving the message ,

[0068] Based on this pre-computation, a garbled circuit is computed,

[0069] The garbled circuit is sent to the server, where, once the data is received from the client, the server uses oblivious transfer (OT) to select the labels that match its shares and evaluates the garbled circuit to obtain its response shares ,

[0070] Sending shares to the proxy server in encrypted form.

[0071] A garbled circuit is a specific technique in secure multi-party computation introduced by Andrew Yao in the 1980s. It enables two parties to perform a joint computation without revealing their inputs. The functioning of a garbled circuit can be summarized as follows:

[0072] Circuit generation: The function to be computed is represented as a logical circuit consisting of gates (such as AND, OR, XOR).

[0073] Circuit garbling (scrambling): The "scrambler" (one party) scrambles the circuit by generating random keys for each possible input and output of the gates and encrypting the truth table of the gates.

[0074] Input encoding: The scrambler encrypts its inputs with the corresponding keys and sends the scrambled circuit and the encrypted inputs to the evaluator (the other party).

[0075] Circuit evaluation: The evaluator uses its own encrypted inputs and the garbled circuit to perform the computation. In doing so, it decrypts the truth table of the gates with the appropriate keys and eventually obtains an encrypted result.

[0076] Result decryption: The evaluator decrypts the result to obtain the final result of the computation.

[0077] The advantages of using garbled circuits are first security, as they enable secure computation where no party knows the input of the other; flexibility, as they can be used for secure computation of any function; and confidentiality, as sensitive information is protected during computation. Oblivious Transfer (OT) is a cryptographic protocol that allows a sender to transfer one or more messages to a receiver without the sender knowing which message(s) the receiver has received. This protocol plays an important role in secure multi-party computation (MPC) and other cryptographic applications, as it ensures confidentiality and data protection. In the context of garbled circuits, and particularly in secure multi-party computation, "label selection" refers to the process by which the receiver obtains the correct encrypted values (labels) for its inputs. These labels are encrypted representations of the input values used in the garbled circuit.

[0078] In one embodiment of the invention, the proxy server (P) is located on the client side instead of the server side. The proxy and the client function in the same way as the server and the proxy functioned previously. This alternative can also be applied in conjunction with the original form of the invention, such that this proxy server is located on both the client side and the server side.

[0079] The invention also provides a system for data processing, comprising means for performing the steps of the above method.

[0080] Furthermore, the present application specifies a computer program product comprising instructions for causing the above-mentioned system to perform the steps of the above-mentioned method. BRIEF DESCRIPTION OF DRAWINGS

[0081] Exemplary embodiments of the present application are illustrated in the accompanying drawings and will be explained in more detail in the following text.

[0082] In the drawings:

[0083] Figure 1 a block diagram of a system for standard-compliant confidential reception of data according to exemplary embodiments of the present application is shown,

[0084] Figure 2 a flowchart of a method for standard-compliant confidential reception of data according to exemplary embodiments of the present application is shown. DETAILED DESCRIPTION

[0085] Figure 1 a block diagram of a system for standard-compliant confidential reception of data according to exemplary embodiments of the present application is shown. In particular, the system is a system for data processing and comprises a plurality of components configured to work together in a coordinated manner to collect, process, store and output data. The components of the system comprise at least one processor for performing calculations and controlling other system components, and a memory for temporary and permanent storage of data and programs.

[0086] As Figure 1 shown, the system comprises a server S, which in one exemplary embodiment of the present application can be implemented as a TLS server, e.g. implementing the TLS standard (e.g. TLS 1.3, RFC 8446) and receiving data from a client. Furthermore, the system comprises a client C, which in one exemplary embodiment also implements the TLS standard and is set up to send data to the server S using a symmetric encryption method, which is described in more detail in the flowchart of Figure 2 Furthermore, the system comprises at least one proxy server P, which is located on the communication path between C and S. All communication between the client C and the server S runs via the proxy server P. Basically, the method now divides the single server S receiving confidential data into at least two servers P and S, so that P and S each receive an encrypted secret share of the received data. The secret sharing guarantees that no single server receives information about the received data; from the perspective of each individual server, the data is purely random. At the same time, however, the servers can apply modern secure multi-party computation (MPC) methods to the secret shares in order to perform any calculations on the data, such as filtering, calculating statistics, data analysis or evaluating AI models.

[0087] Now using an exemplary embodiment according to the present application Figure 2 The method is described in more detail by the flowchart shown. The method is a computer implemented method using a system for data processing comprising at least one client C, one server S and one proxy server P. The client C is arranged to send data, wherein the server S has implemented a cryptographic protocol for encrypting the data and is arranged to receive data from the client C. The proxy server P is located on the communication path K between the client C and the server S, wherein any communication between the client C and the server S runs at least partly or completely via the proxy server P.

[0088] The method comprises Figure 2 the steps shown in Fig. A. In step A, data for calculating a shared key k is exchanged between the client C and the server S. In exemplary embodiments of the present application, there are various methods that can securely exchange a symmetric key k between the computers C and S. One possibility is to manually enter the key on both computers by a trusted person, which requires this person to securely hold and transfer the key. Another method is to exchange the key via encrypted e-mail, wherein both parties must already have secure e-mail encryption, such as PGP or S / MIME. Similarly, the key can be stored in an encrypted file archive in a cloud storage service, for example using Zip with AES encryption, so that both parties can download and decrypt the key. In addition, a secure file exchange service operating via the Tor network, such as SecureDrop or OnionShare, can be used to securely transfer the key. Another option is to partially transfer the key via a secure phone call, wherein one part of the key is transferred via the call and the other part is transferred via another secure method for added security. The key can also be converted into a QR code, which is then exchanged between the parties using a secure physical scanning medium. Alternatively, the key can be loaded onto a smart card or hardware security module (HSM), which is then physically transferred to the systems involved and used there. Transfer via NFC (near field communication) or Bluetooth is also possible, as long as both devices are very close and the transfer is encrypted. Another option is to exchange the key via a secure transport protocol, such as TLS or IPSec, wherein a secure connection is first established and then the key is transferred via this connection. Instead of directly exchanging the key k, the parties can derive the key k from a shared secret and an additional parameter, such as a random number. A public key infrastructure (PKI) can also be used, whereby one party encrypts the symmetric key with the other party's public key and sends it, so that the recipient can decrypt the key with their private key. For example, if the cryptographic protocol is the Transport Layer Security TLS encryption protocol, the TLS handshake can be used to start a communication session between the client C and the server S. Since TLS uses a message authentication code (MAC), the server S derives a MAC key k MACand make it available to P. The cryptographic protocol can comprise at least one of the following protocols: OPC Unified Architecture OPC UA, Secure Shell (SSH), Wireguard, Transport Layer Security (TLS), and / or Internet Protocol Security (IPSec). A commonality of all protocols (OPCUA, SSH, Wireguard, TLS, and IPSec) is that the communication can be roughly divided into two phases: a key exchange phase and a communication phase. The method can equally be applied to each of these protocols. During the key exchange phase, the proxy only forwards the communication and only becomes active during the communication phase.

[0089] In step B, data is sent from the client C to the server S, wherein the data is encrypted using an operational mode in which an operational block cipher is applied for symmetric encryption, wherein the i-th message from the client C to the server S consists of the encryption Here, M i is the plaintext data of the i-th message, K i is the key of the operational mode derived from k, and the value t i is the cryptographic value of the message. In one exemplary embodiment of the invention, the operational mode can comprise the Counter Mode CTR, the Galois Counter Mode GCM, and / or the ChaCha20-Poly1305 method.

[0090] In step C, the data is received by the proxy server P and the value t i is processed according to the cryptographic protocol, wherein t i is the cryptographic value of the message. If the cryptographic protocol is the Transport Layer Security TLS encryption protocol, the value t i is processed according to the TLS standard.

[0091] In step D, the proxy server P selects a random string R i , wherein the length of the random string R i corresponds to the length .

[0092] In step E, is forwarded by the proxy server P to the server S, and the random string R i is stored by the proxy server P.

[0093] In step F, is received by the server S and the value is calculated using the key K i , wherein applies, whereby the proxy server P and the server S each obtain the additive i of the data M Secret sharing. For example, the message authentication code (MACS) additionally computed in the Galois counter mode can be checked by applying a cryptographically secure multi-party computation (MPC) method.

[0094] Sending a message comprises the following steps. First, in a first step, a secret share of an encryption is computed by the server S, where K j is derived from k Enc and is a secret share held by the server. The encryption is then sent via the server S to the proxy server P, and the proxy server P computes the ciphertext using the share and a valid MAC computed by the proxy server P using k MAC . Additionally, the proxy server P can apply the key k MAC to compute the required MAC according to the TLS standard, and thus obtain the ciphertext to be sent to the client. In one exemplary embodiment of the invention, the secret shares of the received data are processed, and the data to be sent is computed by applying a cryptographically secure multi-party computation (MPC) method.

[0095] As already described in the introductory part of the description, confidential e-mails are only one of many examples of applications for which the method according to the invention can be used. Other fields of application of the method are, for example:

[0096] Reliable benchmarking: Various companies provide confidential key data to a central service provider. This confidentially processes the key data and uses it to compute statistical data that enables the participating companies to perform a reliable benchmarking. Such a benchmarking allows to identify possibilities for efficiency gains or cost savings.

[0097] Confidential machine data: Various operators of production machines collect machine data. This data is confidential, as it allows to draw conclusions about the production process and thus about trade secrets. This data is sent to a central service provider, which confidentially processes the data. The data is used, for example, to predict maintenance requirements (predictive maintenance), to identify possibilities for optimization in machine operation, or to collect and compare key performance indicators such as downtime and maintenance intensity in order to identify possibilities for improvement.

[0098] Medical data: Confidential medical patient data is highly sensitive and should therefore be stored in encrypted form (i.e. end-to-end). At the same time, it would be helpful to be able to evaluate large numbers of people for the development of medical research and treatments, the detection of side effects, etc. This can be achieved by jointly storing the data at a shared service provider.

[0099] Data space and data trustee: In the process of digitization, data spaces and data trustees are being discussed and implemented. One example thereof is the mobility data space (https: / / bmdv.bund.de / DE / Themen / Digitales / Mobility-Data-Space / mds.html). The idea behind the shared data space is to provide data to data trustees for joint processing, which the data trustees can then process centrally.

[0100] Secure file storage with server-side functionality: Secure file storage in the cloud can be implemented, for example, by encryption with a dedicated tool. However, encryption makes it impossible for the cloud provider to enable server-side functionality, such as search or filter functions, automatic document classification, spell checking, processing with large language models such as ChatGPT, or access via a web interface. These functions can only be implemented with unencrypted file storage.

[0101] All features described in connection with the various embodiments of the present application can be provided in different combinations in accordance with the subject matter of the present application in order to simultaneously achieve their advantageous effects, even if they have already been described in different embodiments.

[0102] The scope of protection of the present application is given by the claims, and is not restricted to the features explained in the description or shown in the drawings.

[0103] The underlying invention of the present patent application was developed with funding from BMWK, in particular as part of the "EXIST - Start-up from Science" program of the European structural funds from the federal budget and from the project: "EXIST Transfer of Research: SIGMA". Funding number: 03 EFVNW330. Implementing body: BUW - Bergische Universität Wuppertal.

[0104] List of reference signs

[0105] Server S

[0106] Client C

[0107] Proxy server P; P1,..., P n

[0108] Data M

[0109] Communication path K

Claims

1. A computer-implemented method for the confidential reception of data in accordance with standards, wherein, The method can be performed using a system for data processing, particularly a system for the confidential reception of data in accordance with standards, the system comprising: At least one client (C), wherein the client (C) is configured to send data, At least one server (S), wherein the server (S) has implemented a cryptographic protocol for encrypting data and is configured to receive data from the client (C). At least one proxy server (P) is located on the communication path (K) between the client (C) and the server (S), wherein the communication between the client (C) and the server (S) is partially or entirely carried out via the proxy server (P). The method includes the following steps: A. Exchange data for calculating a shared key k between the client (C) and the server (S), wherein the server (S) derives at least one key k from the key k. Enc , wherein k is preferred Enc The key is the same as or preferably computed from k using a key derivation function or hash function. B. Data is sent from the client (C) to the server (S), wherein the data is encrypted using an operation mode in which an operational block cipher is applied for symmetric encryption, wherein the i-th message t from the client (C) to the server (S) i Includes encryption M i It is the plaintext data of the i-th message, and K i From k Enc The key for the exported operation mode, and the value t. i It is the password value of the message. C. The proxy server (P) receives data and processes the value t according to the cryptographic protocol. i , where t i It is the password value of the message. D. The proxy server (P) selects a random string R. i The random string R i The length corresponds to Length, E. Forwarding through the proxy server (P) The random string R is sent to the server (S) and stored by the proxy server (P). i , F. Received by the server (S) Using key K i Calculated value Applications Thus, the proxy server (P) and the server (S) each obtain data M. i addition Secret sharing, Among them, the method used to send messages Includes the following steps: G. Calculate the encrypted secret share using the server (S). K j From k Enc Exported, and It is held by the server. The secret share, H. Send encrypted data to the proxy server (P) via the server (S), and pass the application share via the proxy server (P). To calculate ciphertext .

2. The method according to claim 1, characterized in that, The proxy server (P) only sends the value to the server (S). The length of which the proxy server (P) uses As its secret share, and the server (S) uses As its secret share.

3. The method according to any one of the preceding claims, characterized in that, Exchanging data for calculating the shared key k between the client (C) and the server (S) includes initiating a communication session between the client (C) and the server (S), wherein the cryptographic protocol used for exchanging k includes at least one of the following protocols: OPC Unified Architecture (OPCUA), Secure Shell (SSH), Wireguard, Transport Layer Security (TLS), and / or Internet Protocol Security (IPSec).

4. The method according to any one of the preceding claims, characterized in that, The method includes an encrypted message authentication code (MAC) to ensure authenticity and integrity, wherein the encryption key k MAC It is a MAC key, and the server (S) derives the MAC key k from the key k. MAC And make it available to the proxy server (P).

5. The method according to claim 4, characterized in that, Secure multi-party computation is used to perform MAC computation and verification, and the key k MAC Not usable on proxy servers (P).

6. The method according to any one of claims 4 or 5, characterized in that, In order to obtain the ciphertext to be sent to the client (C), the proxy server (P) uses the key k MAC Calculate the required message authentication code (MAC) according to at least one of the following protocols: OPC Unified Architecture (OPCUA), Secure Shell (SSH), Wireguard, Transport Layer Security (TLS), and / or Internet Protocol Security (IPSec).

7. The method according to any one of the preceding claims, characterized in that, The operating modes include counter mode CTR, Galois counter mode GCM, and / or the ChaCha20-Polyl305 method.

8. The method according to any one of the preceding claims, characterized in that, The calculation of the key k is performed jointly using at least one of the following protocols in the handshake between the client (C) and the server (S): OPC Unified Architecture (OPC UA), Secure Shell (SSH), Wireguard, Transport Layer Security (TLS), and / or Internet Protocol Security (IPSec).

9. The method according to claim 8, characterized in that, The proxy server (P) receives the exchanged handshake messages from both the client (C) and the server (S) and forwards them to the other party.

10. The method according to any one of the preceding claims, characterized in that, The method includes the following additional steps: The proxy server (P) uses a pseudo-random function PRF or a pseudo-random number generator PRG to calculate a random string R. i .

11. The method according to any one of the preceding claims, characterized in that, The system processes the secret share of the received data and calculates the data to be sent by applying a cryptographically secure multi-party computation (MPC) method. .

12. The method according to any one of the preceding claims, characterized in that, The method includes the following additional steps: Pre-computation is performed using the proxy server (P) and the server (S) before receiving data from the client (C).

13. The method according to claim 12, characterized in that, The pre-computation process performed using the proxy server (P) and the server (S) before receiving data from the client (C) includes the following additional steps: Even before receiving the message, the proxy server (P) executes a random string R. i Pre-calculation and its response share , Based on this, a confusion circuit is pre-calculated. The obfuscation circuit is sent to the server (S), whereby once data is received from the client (C), the server (S) uses unintentional transmission (OT) to select a tag matching its share and evaluates the obfuscation circuit to obtain its response share. , The share is sent to the proxy server (P) in encrypted form.

14. The method according to any one of the preceding claims, characterized in that, The proxy server (P) is located on the client (C) side, not on the server (S) side.

15. A system for data processing, comprising means for performing the steps of the method according to any one of the preceding claims.

16. A computer program product comprising instructions for causing the system of claim 15 to perform the method steps of any one of claims 1 to 14.

Images