METHOD AND SYSTEM FOR ENSURING THE INTEGRITY OF CONFIDENTIAL BROADCASTING DATA

Description

[0001] The invention relates to a method and a system for ensuring the integrity of confidential data broadcast within a communication system using the secret coding technique better known by the English term "secrecy coding".

[0002] The “secrecy coding” disclosed for example in the document AL-HASSAN SALAH ET AL: “Secrecy coding for the wiretap channel using best known linear codes”, GLOBAL INFORMATION INFRASTRUCTURE SYMPOSIUM - GIIS 2013, IEEE, October 28, 2013 (2013-10-28), pages 1-6, XP032531241, DOI: 10.1109 / GIIS.2013.6684342 or in the document HARRISON WILLIE K ET AL: "Coding for Secrecy: An Overview of Error-Control Coding Techniques for Physical-Layer Security", IEEE SIGNAL PROCESSING MAGAZINE, IEEE, USA, vol. 30, no. 5, September 1, 2013 (2013-09-01), pages 41-50, XP011524815,ISSN: 1053-5888, DOI: 10.1109 / MSP.2013.2265141 [retrieved 2013-08-19]. refers to a theoretical framework known in the state of the art of information theory that analyzes the possibility for a sender Alice to transmit to a receiver Bob a message over a communication channel confidentially without using a previously shared secret key.This framework relies solely on the supposedly distinct characteristics of the propagation channel and the reception noise at Bob's level on the one hand, and at the level of the potential attacker on the other hand (attacker called Eve). The simplest theoretical example is the jumper channel model where Bob receives the bits transmitted by Alice without error and Eve can only recover them with a non-zero error rate. This model generalizes to more complex cases of error models in reception (at Bob's level) and in listening (at Eve's level). Another example borrowed from the protection of radio communications systems is the security of the physical layer known by the English abbreviation PHYSEC, one of the processes of which is the addition of artificial noise according to the following (simplified) scheme: when Alice wants to send a message m to Bob, she encodes the message and transmits C(m) with a modulation technique that adds artificial noise. J m for any point in space, except the area where Bob is located. This noise is modified at each message m. Bob receives, after demodulation, the encoding of the message C(m) + η B with transmission noise η B . The noise level η B allows Bob to correctly decode the message m. On the other hand, Eve located outside the point occupied by Bob, the only point where the demodulation is “correct”, receives the encoded message C ( m ) + J m + η E with artificial noise J m which adds to its reception noise η E . With this noise level, Eve cannot decode message m as correctly as Bob.

[0003] Generally speaking, within the framework of information theory, for a communication channel model which fixes the characteristics of the noise (at Bob's level, and at Eve's level), we show that it is possible to effectively code the useful information before its transmission on the communication channel in such a way as to ensure: its confidentiality (Eve's information on the message remains close to zero), its error-free transmission (Bob decodes the information with a very high probability).

[0004] To simultaneously ensure these two properties, the theory introduces a theoretical bound on the possible transmission rate, called "secrecy capacity". This confidentiality technique is then said to be unconditionally secure (i.e. it does not depend on the attacker's computing capabilities), provided of course that the channel model is correct and that the associated "secrecy capacity" bound has consequently been respected.

[0005] As such, "secrecy coding", or its consolidated variant, the subject of the applicant's patent application FR1701398, published under number FR3076365 after the filing of this patent application, aims in particular to ensure the confidentiality of messages exchanged without it being necessary for the sender and receiver to share pre-established keys or secrets. In this context, secrecy coding is a mechanism that guarantees only the confidentiality of the messages transmitted, but not necessarily their integrity, nor the authentication of the interlocutors. The subject of the patent is a mechanism complementary to the secrecy coding mechanism, which aims to guarantee new security properties, always in an unconditionally secure manner and without using keys previously shared or secrets pre-established by Alice and Bob, which the secrecy coding mechanism alone does not guarantee: a) Integrity: guarantee that the messages received and accepted by the recipient have not been altered (voluntarily by the attacker Eve or fortuitously (noise)), b) Authentication of the sender: Bob and Alice have the assurance at all times that they are always communicating with each other and not with a third party Eve who would momentarily take the role of sender.

[0006] An unconditionally secure integrity solution described in the state of the art of cryptography is the so-called Carter&Wegman mechanism known to those skilled in the art. This state-of-the-art solution is disclosed in WEGMAN MN ET AL: "NEW HASH FUNCTIONS AND THEIR USE IN AUTHENTICATION AND SET EQUALITY", JOURNAL OF COMPUTER AND SYSTEM SCIEN, ACADEMIC PRESS, INC., LONDON, GB, vol. 3, no. 22, June 1981 (1981-06), pages 265-279, XP008003418, ISSN: 0022-0000, DOI: 10.1016 / 0022-0000(81)90033-7, and is based on the following elements: ▪ Alice and Bob want to exchange messages x(1), x(2), ..., x(i), ... ▪ Alice and Bob select, according to a random key k 0 shared by Alice and Bob, a hash function h k0 in a family of hash functions called "universal" (the family can be known by the attacker Eve), ▪ Then, for each message x(i) transmitted, the integrity of the message x(i) is guaranteed by the transmission of an associated integrity pattern tag(i) of the form: tag i = h k 0 x i ⊕ k i ▪ where h k 0 (x(i)) is the hash of the message x(i) calculated with the previously selected hash function h k0 , it is the same for all messages x(i), ⊕ is the exclusive OR logical operator, and ▪ k(i) is a “one-time pad”. In this solution, to ensure the unconditionally secure nature of the integrity, it is imperative that the key k 0 and all the random values ​​k(i) consumed with each new message transmitted, are perfectly random secret keys, independent of each other and initially shared by Alice and Bob before the message communication phase.

[0007] The present invention can be seen as an original variation of the same principle, adapted to the framework of a communication channel implementing a "secrecy coding" technique providing confidentiality without using a key. It is based on the addition of a tag [tag(i)] in each message x(i) transmitted before its processing by the secrecy coding mechanism. The tag is also calculated using a hash function selected from a family, as is the case for the Carter&Wegman principle, but it does not require random numbers k(i) to be previously shared between Alice and Bob.

[0008] The invention is defined in the appended claims.

[0009] In the remainder of the description, the following notations will be used: The stream of useful data that Alice wants to transmit to Bob : x 1 , x 2, ... ,x i , ... The output flow: x 1 ∗ , x 2 ∗ , … , x i ∗ , … obtained by adding a tag (or identifier) ​​i to each message x i , Block encoding x i ∗ transmitted by the technique of "secrecy coding" is designated by C x 1 ∗ , C x 2 ∗ , … . , C x i ∗ , … producing after transmission the flows X 1 ∗ , X 2 ∗ , … , X i ∗ , … received by Bob, On reception, after decoding the encoded streams X i ∗ , Bob produces the useful messages received X 1 , X 2, ..., X i ,... and associated labels Tag 1 , Tag 2, ..., Tag i ,... In the nominal case of transmission with errors corrected by decoding according to a method known to those skilled in the art, we return to the useful information flows, that is to say we obtain: X 1 ∗ = x 1 ∗ , X 2 ∗ = x 2 ∗ , … , X i ∗ = x i ∗ , … Then X 1 = x1 , , X 2 = x 2, ..., X i = x i , .. . And Tag 1 = tag 1 , Tag 2 = tag 2 ..., Tag i = tag i .

[0010] The invention relates to a method for ensuring data integrity using a secret coding protocol ensuring unconditional confidentiality of the data to be transmitted between at least one transmitter A and one receiver B, characterized in that it comprises at least the following steps: To convey a message x i sender A adds to the message x i , containing the data to be transmitted, a tag i defined by tag ih(xi ), using a hash function h known only to the transmitter A and the receiver B, intended to guarantee the authentication and integrity control of the transmitted data, The message x i ∗ composed of the useful data message x i and the tag i is encoded to produce a message C x i ∗ which is transmitted to receiver B, the encoding is carried out in such a way as to guarantee confidentiality using secret coding, After transmission, receiver B receives the message X i ∗ to which he applies a secret decoding to recover a data message X i and a label Tag i , then the receiver B checks the authentication and integrity of the useful message received X i by checking that the relation Tag i = h(X i ) is respected, guaranteeing X i = x i .

[0011] The label added to the message x i is generated by a hash function h k 0 ( x i ), let tag i = h k 0 ( x i ), the hash function h k 0 depends on an initial key k 0 transmitted confidentially by transmitter A to receiver B, using secret coding.

[0012] According to one embodiment, the secret initial keyk 0 is, for example, exchanged between transmitter A and receiver B using a Maurer protocol.

[0013] According to one embodiment, the secret initial key k 0 is obtained using a secret key generation protocol (SKG).

[0014] The invention also relates to a system for ensuring the integrity of confidential data between at least one transmitter A and a receiver B, using the technique of secret coding or secrecy coding. The system is characterized in that the transmitter A comprises a processor configured to add to the messages containing the data to be transmitted a tag i = h( x i ) defined using a function h known only to transmitter A and transmitter B and guaranteeing the authentication and integrity control of the transmitted data, and receiver B comprises a processor configured to verify after secret decoding of a received message X i and a received label Tag i, the integrity of said message by verifying the correct respect of the relation Tag i = h( X i ), the transmission of the message using a secret encryption protocol.

[0015] For label generation by function h, the processor can be configured to perform a hash function h k 0 ( x i ) dependent on an initial key k 0 transmitted confidentially by transmitter A to receiver B, using secret coding.

[0016] The invention is used for a transmitter and / or a receiver corresponding to a node or a terminal in a communication network.

[0017] Other characteristics and advantages of the present invention will appear more clearly on reading the description, of exemplary embodiments given for illustrative and non-limiting purposes, appended to the figures which represent: Figure 1 , an overall diagram of the method implemented by the invention, and Figure 2 , a diagram representing the addition of a tag at the data level before transmission to the coding block.

[0018] The solution which is the subject of the present invention is based on the following principle (Alice plays the role of the sender, Bob that of the recipient, the same principle applies to both directions of communication): 1) When the sender Alice initiates a communication session with the recipient Bob, it randomly draws a key k 0 which it transmits to the recipient Bob in complete confidentiality using the secrecy coding process (without a key); 2) Then, for each message x i that Alice wants to transmit to Bob, he uses the secrecy coding mechanism to transmit the message ( x i , tag(i)), ie x i completed with a tag noted tag(i), such as: tag i = h k 0 x i

[0019] The integrity tag tag i is simpler than the one used in the Carter&Wegman solution.

[0020] On reception, Bob decodes X i ∗ following the principle of secrecy coding, it retrieves the useful message X i and the associated tag Tag i then verifies the authentication and integrity by checking that the label Tag i = h k 0 ( X i ) is well respected.

[0021] In order to better understand the method according to the invention, the example is given in the case of an exchange between a first transmitter / receiver user A (Alice) and a second transmitter / receiver user B (Bob), in the presence of an unauthorized third-party receiver E (Eve) who is likely to intercept the communications and access the content of the data exchanged between A and B.

[0022] There figure 1 illustrates an example of a system according to the invention. The transmitter / receiver A is, for example, a node or a terminal of a communication network comprising a calculation unit 11, a coding / decoding module 12, a modulation / demodulation module 13, a module composed of antennas 14, and radio transmission and reception means 15e, 15r. The calculation unit 11 is configured to insert at the level of the data to be coded or the messages to be transmitted a “tag” having in particular the objective of increasing the security (authentication, integrity) in the transmission of the message.

[0023] Similarly, the transmitter / receiver B, 20, comprises, for example, a calculation unit 21, a coding / decoding module 22, a modulation / demodulation module 23, a module composed of antennas 24, radio transmission and reception means 25e, 25r. The calculation unit 21 is configured to read the tags and use the reading results for the purposes of authenticating the transmitter and checking the integrity of the messages transmitted by this transmitter.

[0024] The secrecy coding block 30 is known to those skilled in the art and will not be detailed. Its function is to ensure the confidentiality of all data transmitted between A and B.

[0025] It is possible to use a secrecy coding block supplemented by a keyless scrambling function, as described in patent application FR 1701398.

[0026] There figure 2 illustrates in detail the steps of a first variant of the invention, the aim of which is in particular to increase the security of data transmission. The method, in its normal operation, does not require an encryption key.

[0027] The transmitted message may be composed of blocks of data, bits, or be in a format known in the field of data transmission security.

[0028] There figure 2 represents in detail the steps implemented by the method according to the invention which includes a step where an identifier tag i is added to the message (data) before its transmission to the “secrecy coding” block in order to increase the transmission integrity.

[0029] When the sender Alice wants to transmit a message x i , it goes, 201, prior to the transmission of the message x i to the coding block, add a "label" tag i to the content of this message x i . The label or tag is calculated according to the description given above, x i ∗ = x i , tag i , ie x i completed with a tag noted tag i , such as tag i = h k 0 ( x i ).

[0030] The message x i ∗ including the initial data to be encoded and the tag i is transmitted to the secrecy coding block 202. Then the encoded and modulated message C x i ∗ is transmitted to Bob, the message actually received by Bob (tainted by any transmission errors) being noted X i ∗ .

[0031] Bob, after decoding the received message X i ∗ following a secret decoding principle, produces the received useful data X i and the associated tags received Tag i , then it verifies the authentication and integrity of said message by verifying that Tag i = h k 0 ( X i ), which then guarantees that X i = x i and Tag i = tag i , 203.

[0032] During a first initialization step to calculate the labels tag i , Alice and Bob will exchange a secret key k 0. This exchange is done confidentially, using the secret coding block. Different variants are possible here: ∘ The use of the Maurer protocol known to those skilled in the art, ∘ The use of a secret key generation protocol (SKG) known to those skilled in the art, or ∘ Any other confidential exchange protocol without a pre-established key or shared secret. In the communication step, Alice uses a hash function to calculate the tag i associated with each message xi∗ , as indicated above tag i = h k 0 ( xi ), Bob will be the only one to access this information, because the data necessary to restore the tag label i and its exploitation to authenticate Alice and control the integrity of the transmitted messages are buried in the secretly encoded message and transmitted confidentially. The tag label i of i th< message is like this, h k 0 ( xi ), Or k 0 is a key defined at the start of the protocol. The key is transmitted confidentially by the secrecy coding scheme between Alice and Bob. Depending on the key k 0 , the method chooses a hash function from a family of so-called "universal" hash functions, a term known to those skilled in the art. The key k 0 shared between Alice and Bob can be the same for all messages.

[0033] To create the integrity tag, any function with characteristics similar to those of the so-called universal hash function presented in the example above (in particular the fact of being unknown to the attacker) may be used, without departing from the scope of the invention.

[0034] The invention has the advantage of increasing security in data transmission without having to use secret keys, within the framework of normal operation of the system. The costs of such a system are modest.

[0035] The method according to the invention has the particular advantage of not using any secret key previously shared between the transmitter and the receiver: a) On the one hand, it involves a single secret key k 0 which is transmitted directly from Alice to Bob, in a preliminary phase of the communication session between Alice and Bob, the transmission being protected in confidentiality by the use of the "secrecy coding" block (without key); b) On the other hand, this new unconditionally secure integrity mechanism is much easier to implement than the state-of-the-art Carter&Wegman solution, in particular in that it does not need, for each new message m(i) processed, to consume a new previously shared secret message key k(i) necessary for the operation of the Carter&Wegman principle.

Claims

1. A method for ensuring the integrity of data using a keyless secrecy coding protocol ensuring unconditional confidentiality of the data to be transmitted between at least one sender A and one recipient B, the method containing at least the following steps: a first initialisation step, in which sender A confidentially transmits a secret key k0 to receiver B by using secrecy coding (202), a step of transmitting several messages xi containing the data to be transmitted, in which method: to transmit each message xi, sender A adds, to the message xi, a tag tagi, defined by tagi = hk0(xi ), by using a hash function hk0(xi ) known only to sender A and to recipient B, which is intended to guarantee the authentication and the integrity control of the transmitted data (201), the hash function hk0 being dependent on the initial key k0 transmitted confidentially by sender A to recipient B, by using the secrecy coding (202), the message x i ∗ , composed of the message of the useful data xi and of the tag tagi is encrypted so as to produce a message C x i ∗ , which is transmitted to recipient B, the encryption being carried out so as to guarantee confidentiality using secrecy coding (202), after transmission, (203), recipient B receives the message X i ∗ to which it applies secrecy decoding to retrieve a data message Xi and the tag Tagi, then it checks the authentication and the integrity of the received useful message Xi by verifying that the relation Tagi = h(Xi) is indeed satisfied, guaranteeing Xi = xi.

2. The method according to claim 1, characterised in that the secret initial key k0 is exchanged between sender A and recipient B by using a Maurer protocol.

3. The method according to claim 1, characterised in that the secret initial key k0 is obtained by using a secret key generation (SKG) protocol.

4. A system for ensuring the integrity of the confidential data between at least one sender A and one recipient B, using the secrecy coding technique or keyless secrecy coding, in which system: sender A is configured to, in a first initialisation step, confidentially transmit a secret key k0 to receiver B by using the secrecy coding (202), and to transmit several messages containing the data to be transmitted to receiver B by using the secrecy coding protocol, sender A contains a processor (11) that is configured to add, to each message containing the data to be transmitted, a tag tagi = h(xi), defined by using a function hk0(xi ) known only to sender A and to recipient B, and guaranteeing the authentication and the integrity control of the transmitted data (201), the hash function hk0(xi ) being dependent on the initial key k0 transmitted confidentially by sender A to recipient B, by using the secrecy coding (202), and recipient B comprises a processor (21) that is configured to verify, after secrecy decoding of a received message X i ∗ to retrieve a data message Xi and the received tag Tagi, the integrity of said message by verifying that the relation Tagi = h(Xi) is indeed satisfied.

5. The system according to claim 4, characterised in that a sender and / or a recipient is a node or a terminal in a communication network.