Encryption, trapdoor generation and pattern detection methods and devices
Patent Information
- Application Number
- EP2023786075
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2022-10-17
- Filing Date
- 2023-10-09
- Publication Date
- 2025-08-27
Smart Images
Figure 1.1
Abstract
Description
Methods and devices for encryption, trapdoor generation and pattern detection Background of the invention
[0001] The invention relates to the field of telecommunications.
[0002] It concerns more particularly a so-called "searchable" encryption system, that is to say a system making it possible to detect the presence of a pattern in an encrypted data flow.
[0003] Today, we see that most, around 90%, of data flows exchanged over telecommunications networks are encrypted. This is the case, for example, for HTTPS requests or DNS queries.
[0004] This encryption prevents the supervision of these data flows, for example for the detection of attacks (viruses, denial of service, etc.) or content filtering (parental control, etc.).
[0005] One solution for monitoring encrypted data exchanged between a service provider, described in Lin-Shung Huang, Alex Rice, Erling Ellingsen, and Collin Jackson. Analyzing forged SSL certificates, 2014 IEEE Symposium on Security and Privacy, pages 83–97. IEEE Computer Society Press, May 2014, is to use a proxy server that impersonates the service provider, obtains the encryption key, decrypts the characters, parses them in plaintext, re-encrypts them, and transmits them to the user. This solution is unsatisfactory because it reveals the data to the proxy server.
[0006] Another family of cryptographic solutions in which the invention falls is called "searchable encryption". Searchable encryption makes it possible to detect whether a data stream contains a cipher of a pattern, provided that certain information, usually called a "trapdoor", is held and previously associated with this pattern.
[0007] Les trois documents suivants proposent de telles solutions :[1] Justine Sherry, Chang Lan, Raluca Ada Popa, and Sylvia Ratnasamy. BlindBox: Deep Packet Inspection over Encrypted Traffic. In Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication, SIGCOMM ’15;[2] Nicolas Desmoulins, Pierre-Alain Fouque, Cristina Onete, and Olivier Sanders. Pattern matching on encrypted streams. In Thomas Peyrin and Steven Galbraith, editors, ASIACRYPT 2018; et[3] Elie Bouscatié, Guilhem Castagnos and Olivier Sanders. Public Key Encryption with Flexible Pattern Matching. ASIACRYPT 2021.
[0008] The solution described in [1], based on symmetric encryption, only allows the detection of fixed-size patterns. It is therefore very limited and in particular is not suitable for detecting viruses whose sizes can vary greatly. The solutions described in [2] and [3] are very complex, particularly because they require the use of pairing-friendly elliptic curves.
[0009] The present invention provides a searchable encryption system that overcomes and / or improves upon deficiencies / drawbacks of the prior art. Subject matter and summary of the invention
[0010] Thus, and according to a first aspect, the invention relates to a method for generating a trapdoor in an encryption system, said trapdoor being associated with a pattern w comprising elementary characters w[1], …w[v] included in an alphabet supplemented by a special character which can replace any character of said alphabet, said system defining a secret key parameterized by integers n and t and comprising:- an integer a c,i for any character c of the alphabet and for any integer i between 1 and the integer n; and- an integer b k for any integer k between 1 and the integer t; the method comprising steps of:- selecting an integer s between 1 and the integer t; and- calculating a value T = b s *(r1a w[1],1 + r2a w[2],2 +…+ r v has w[v],v ), r i =0 if w[i] is said special character and r i is equal to an integer r otherwise, said trapdoor comprising the elements s, r, and T.
[0011] Correlatively, the invention relates to a device for generating a trapdoor in an encryption system, said trapdoor being associated with a pattern w comprising elementary characters w[1], …w[v] included in an alphabet supplemented by a special character which can replace any character of said alphabet, said system defining a secret key parameterized by integers n and t and comprising:- an integer a c,i for any character c of the alphabet and for any integer i between 1 and the integer n; and- an integer b k for any integer k between 1 and the integer t; the device comprising:- a module for selecting an integer s between 1 and the integer t; and- a module for calculating a value T = b s *(r1a w[1],1 + r2a w[2],2 +…+ r v has w[v],v ), r i =0 if w[i] is said special character and r i is equal to an integer r otherwise,
[0012] the hatch comprising the elements s, r, and T.
[0013] The trapdoor thus generated allows to detect any size pattern in a data stream by means of the detection procedure described later.
[0014] According to a second aspect, the invention relates to an encryption method implemented in an encryption system defining a public key, to obtain a cipher by encryption of data m comprising at least u elementary characters m[i], the public key comprising:- elements g c,i for any integer i between 1 and an integer u, the elements g c,i being of the form g^(a c,i ) where a c,i is an integer between 0 and an integer p-1 and g a generator of a group G of order p;- elements h k , for any integer k between 1 and an integer t, the elements h k being of the form g^(1 / b k ) where b kis an integer between 0 and p-1;- the generator g;- a description of the group G; and- a description of a function H with a value in a finite set,said method comprising steps of:- selection of an integer a between 0 and p-1;- calculation for any integer k between 1 and t, of a value E k = H(h k ^(a)) ;- calculation for any integer i between 1 and u, of a value C i equal to g m[i],i ^a,- obtaining the cipher, said cipher being made up of the elements {E k , C i}.
[0015] Correlatively, the invention relates to an encryption device implemented in an encryption system defining a public key, the device being configured to obtain a ciphertext C by encryption of data m, comprising at least u elementary characters m[i], the public key comprising:- elements g c,i for any integer i between 1 and an integer u, the elements g c,i being of the form g^(a c,i ) where ac,i is an integer between 0 and an integer p-1 and g a generator of a group G of order p ;- elements h k , for any integer k between 1 and an integer t, the elements h k being of the form g^(1 / b k ) where b k is an integer between 0 and p-1.;- the generator g of a group G;- a description of the group G; and- a description of a function H with a value in a finite set,said device comprising:- a module for selecting an integer a between 0 and p-1;- a first calculation module for any integer k between 1 and t, of a value E k = H(h k ^(a)),- a second calculation module for any integer i between 1 and u, of a value C i equal to g m[i],i ^a, and a module for obtaining the ciphertext, said ciphertext being made up of the elements {E k , C i}.
[0016] Patterns and data are strings of characters belonging to an alphabet. Characters can be of any type. For example, characters can be encoded on 2 bits, 8 bits, etc. Strings of characters can be DNA sequences.
[0017] Very advantageously, the encryption process is carried out independently of the patterns to be detected. Thus, the device that encrypts the data stream does not take into account during encryption the patterns that will possibly be searched for in the stream, nor the size of these patterns.
[0018] In a particular implementation mode, the device that receives the encrypted stream generates the traps associated with the patterns that are to be detected. It can perform the detection itself or entrust this task to another device to which it communicates these traps.
[0019] According to a third aspect, the invention relates to a method for detecting, in an encryption system, a pattern w in a cipher obtained by data encryption, said pattern w comprising elementary characters (w[1], …w[v]) included in an alphabet supplemented by a special character which can replace any character of said alphabet, the method comprising steps of: - obtaining a trapdoor associated with said pattern; - calculating an element Q = C1^r1*…*C v ^r v with r i =0 if w[i] is said special character and r i = r otherwise;- calculation of a value D equal to Q^(1 / T), where T is an element of said trapdoor;- calculation of a value H(D) where H is a function H with a value in a finite set;- detection that the data includes said pattern w if H(D) is equal to E s , where s is an integer included in said trapdoor.
[0020] Correlatively, the invention relates to a device for detecting, in an encryption system, a pattern w in a cipher obtained by data encryption, said pattern comprising elementary characters (w[1], …w[v]) included in an alphabet supplemented by a special character which can replace any character of said alphabet, the device comprising:- a module for obtaining a trapdoor associated with said pattern;- a first module for calculating an element Q = C1^r1*…*C v ^r v with r i =0 if w[i] is said special character and r i = r otherwise;- a second module for calculating a value D equal to Q^(1 / T), where T is an element of said trapdoor;- a third module for calculating a value H(D) where H is a function H with a value in a finite set;- a detection module configured to detect that the data includes said pattern w if H(D) is equal to E s , where s is an integer included in said trapdoor.
[0021] In one embodiment, the ciphertext is obtained by an encryption method as mentioned above and the trapdoor is obtained by a trapdoor generation method as mentioned above.
[0022] The process of detecting the presence of a pattern is of very low complexity compared to the solutions described in documents [2] and [3] introduced previously, these requiring the use of coupled elliptic curves.
[0023] Advantageously, the detection device does not need any knowledge about the plaintext data that has been encrypted. The pattern can be detected without decrypting the data stream.
[0024] Very advantageously, the pattern can be searched for at any position in the stream. According to the invention, the detection is carried out on the first w characters of the ciphertext. To shift the position of the pattern to be detected, it is sufficient to start said pattern with an appropriate number of special characters.
[0025] The invention also relates to a method for decrypting a cipher obtained by data encryption comprising at least u elementary characters, the cipher being generated in accordance with an encryption method as mentioned above, the decryption method comprising: - obtaining a trapdoor associated with each of the distinct elementary data of the data stream, said trapdoor being generated in accordance with a method for generating a trapdoor as mentioned above, - detecting the presence of said trapdoor, in accordance with the method for detecting a pattern as mentioned above.
[0026] The invention also relates to an encryption system comprising:
[0027] - a trap generation device,
[0028] - an encryption device, and
[0029] - a device for detecting the presence of a pattern in a cipher as mentioned above.
[0030] The present invention can in particular be used to detect viruses (in English "malware"), by generating traps associated with these viruses. A list of patterns for virus detection is published at https: / www.snort.org / .
[0031] The present invention can also be used to perform parental control by generating traps corresponding to keywords to be filtered, and blocking streams that include these keywords.
[0032] In a particular embodiment, the various steps of the trap generation, encryption and detection methods are determined by computer program instructions or are implemented by a silicon chip which comprises transistors adapted to constitute logic gates of non-programmable hard-wired logic.
[0033] Consequently, the invention also relates to a computer program on an information medium, this program being capable of being implemented in a controller computer, this program comprising instructions adapted to the implementation of the steps of a method as described above.
[0034] This program may use any programming language, and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.
[0035] The invention also relates to a computer-readable information medium, and comprising instructions of a computer program as mentioned above. The information medium may be any entity or device capable of storing the program. For example, the medium may comprise a storage means, such as a ROM, a non-volatile memory of the flash type or even a magnetic recording means, for example a hard disk. Furthermore, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded from a network such as the Internet. Alternatively, the information medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.
[0036] Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended drawings which illustrate exemplary embodiments thereof which are not in any limiting nature. In the figures:
[0037] Larepresents a cipherable encryption system according to a particular embodiment;
[0038] The represents the main steps of a key generation method according to a particular embodiment;
[0039] The represents the main steps of an encryption method according to a particular embodiment;
[0040] The represents the main steps of a method of generating a trapdoor according to a particular embodiment;
[0041] The represents the main steps of a method for detecting the presence of a pattern in accordance with a particular embodiment;
[0042] Larepresents an encryption device according to a particular embodiment;
[0043] Larepresents a trapdoor generating device according to a particular embodiment;
[0044] The represents a device for detecting the presence of a pattern in accordance with a particular embodiment.
[0045] Note that we are using here a usual notation in cryptography in which:
[0046] - “x_i” represents “x index i”, or “xi”;
[0047] - “g^x” represents “g to the power of x”, or “gx”,
[0048] - the product is represented by an asterisk: “*” when many indexed factors are involved. A notation where the asterisk is absent is also possible: “2n” for “2 * n”,
[0049] - addition is classically represented by the “+” sign when many indexed factors are involved.
[0050] Larepresents a searchable encryption system SYS according to the invention. This system SYS makes it possible to detect the presence of a pattern w in an encrypted data stream C.
[0051] In this figure, an encryption device DC encrypts plaintext data to generate an encrypted data stream C and to send this encrypted stream C to a decryption device RX configured to decrypt this encrypted stream and recover the plaintext data stream.
[0052] The SYS encryption system is based on a public key cryptography system. For this purpose, it relies on a secret key sk and an associated public key pk. It is assumed that a key generation device KG is arranged to generate the key pair sk, pk according to a known method.
[0053] A trapdoor generation device DG is configured to generate, for a given pattern w, a trapdoor TR(w) associated with this pattern. The trapdoor generation device DG is shown independent but can for example be integrated into the RX decryption device.
[0054] The trapdoor TR(w) is intended to be used by a detection device DD to detect the presence of the pattern w in the encrypted stream. The trapdoor generation device DG is configured to transmit the trapdoor(s) it has generated to the detection device DD.
[0055] The SYS encryption system thus includes the trapdoor generation device DG, the encryption device DC, and the detection device DD.
[0056] In the embodiment described here, the encryption system SYS uses a group G of order p. This group can be any, but in the remainder of the description, it can notably be a group of points of an elliptic curve, or a multiplicative subgroup of a finite field.
[0057] Subsequently, the data is treated as character strings. These characters belong to an alphabet S.
[0058] La represents the main steps K10 to K28 that can be implemented by the key generation device KG according to a particular embodiment. The secret key is parameterized by integers n and t.
[0059] The key generation method comprises a first step K10 of selecting the system parameters, these parameters comprising: n: a maximum number of characters that can be encrypted by the encryption method; t: an integer; p: a prime number; G: a group of order p; g: an element of G that is not the neutral element, called generator; H: a function H taking as input any string of bits and with a value in a finite set D. In practice, it will be possible, for example, to use any cryptographic hash function, such as SHA-256 or SHA-3.
[0060] During a step K20, the key generation method generates a key pair {pk, sk} comprising a secret key sk and an associated public key pk.
[0061] During a step K22, for any character c of the alphabet S and for any integer i between 1 and n, the key generation method selects an integer a c,i between 0 and p-1 and calculates g c,i= g^(a c,i )
[0062] During a step K24, for any integer k between 1 and t, the method selects an integer b k between 0 and p-1 and calculates h k = g^(1 / b k ).
[0063] During a step K26, the method defines the public key pk of the cryptographic system as the set consisting of:- the elements g c,i , h k and g ;- of the description of the group G; and- of the description of the function H.
[0064] We note pk = {g c,i , h k , g, G, H}
[0065] During a step K28, the method defines the secret key sk of the cryptographic system as the set consisting of:- the integers a c,i and b k ;- or any information that allows them to be found.
[0066] We note sk = {a c,i , b k , g, G, H}
[0067] As is known, the public key pk is assumed to be known to all devices in the SYS system, including the encryption device DC. The secret key sk is known to the trapdoor generation device DT and the decryption device RX.
[0068] La represents the main steps C22 to C28 of an encryption method according to a particular embodiment.
[0069] The encryption method allows to encrypt any string of characters m = m[1], m[2], …, m[u] in which the size u of this string is less than or equal to the maximum size n of the data that can be encrypted and decrypted by the system SYS. The characters m[i], whatever i, are elements of the alphabet S.
[0070] This encryption method uses the public key pk = {g c,i , h k , g, G, H} to encrypt the data.
[0071] During a step C22, the encryption method selects an integer a between 0 and p-1.
[0072] During a step C24, the encryption method calculates, for any integer k between 1 and t, E k = H(h k ^(a)). We recall here that the function H takes as input any string of bits and has a value in a finite set D.
[0073] During a step C26, the encryption method calculates, for any integer i between 1 and u, C i = g m[i],i ^a.
[0074] During a step C28, the encryption method obtains the ciphertext C consisting of all the elements E k etc i. We note C = {E k , C i}. We note that this cipher contains t+u elements with: - t: integer chosen as part of the system parameters; and - u: size of the data to be encrypted.
[0075] In the embodiment described herein, the encryption method is implemented by the encryption device DC and the encryption device DC sends the ciphertext C to the decryption device RX.
[0076] La represents the main steps T22 to T26 of a trap generation method according to a particular embodiment.
[0077] The trapdoor generation method allows generating a trapdoor for any pattern w = w[1], w[2], …, w[v] in which the size v of the pattern is less than or equal to the maximum size n of data that can be encrypted and decrypted by the system SYS, and w[i], regardless of i, an element of the alphabet S or a special character “*”.
[0078] This method uses the secret key sk = {a c,i , b k , g, G, H}
[0079] During a step T22, the trap generation method selects an integer s between 1 and t.
[0080] During a step T24, the trapdoor generation method selects an integer r between 1 and p-1 and calculates T = b s *(r1a w[1],1 + r2a w[2],2 +…+ r v has w[v],v ), where :- r i =0 if w[i] is the special character “*” and- r i = r otherwise.
[0081] In a particular embodiment r = 1 for all hatches.
[0082] In a step T26, the generation method obtains the trapdoor TR(w) for the pattern w, with TR(w) = {s, r, T}. Note that r does not need to be secret.
[0083] In the embodiment described herein, the trapdoor generation method is implemented by the RX decryption device.
[0084] In the embodiment described here, the decryption device RX sends the trap TR(w) to the pattern presence detection device DD.
[0085] La represents the main steps D22 to D32 of a method for detecting the presence of a pattern in accordance with a particular embodiment.
[0086] The pattern presence detection method allows testing whether the pattern w = w[1], w[2], …, w[v] corresponds to v elements of the plaintext data m that have been encrypted to generate the ciphertext C = {E k , C i}, k being between 1 and t, i being between 1 and u.
[0087] This method uses: - the alphabet S; - the integer t; - the size u of the plaintext string before encryption; - the length v of the pattern w; - the ciphertext C = {E k , C i} ;- the trapdoor TR(w) = {s, r, T} associated with this pattern w; and- the function H.
[0088] In the embodiment described herein, this detection method comprises the following steps D22 to D32.
[0089] During a step D22, the detection method calculates an element Q = C1^r1*…*C v ^r v with :- r i =0 if w[i] is the special character “*” and- r i = r otherwise.
[0090] During a step D24, the detection method calculates an element D = Q^(1 / T).
[0091] During a step D26, the detection method calculates H(D).
[0092] During a step D28, the detection method compares H(D) with E s , s being the first element of the trapdoor TR(w) and E s , the element of rank s of the ciphertext C.
[0093] If H(D) = E s , the detection method determines or detects (step D30) that the data m, encrypted in C, comprise the pattern w. Otherwise the detection method determines (step D32) that the data m, encrypted in C, do not comprise the pattern w. This detection is carried out without decrypting the ciphertext C.
[0094] Below we provide proof of the validity of the encryption presented above.
[0095] If a pattern w = w[1],…,w[v] is present in data m = m[1],…,m[u], then w[i] = m[i] for all i between 1 and v such that w[i] is different from the special character “*”.
[0096] Let J denote the set of such i.
[0097] Then, the element Q calculated in step D22 is exactly the product of the C i ^r for i belonging to J.
[0098] As Ci = g m[i],i ^a = g^(a*a m[i],i ) = g^(a * a w[i],i ), this product is exactly g^(a * r * A), where A is the sum of the a w[i],i for i belonging to J.
[0099] Thus Q^(1 / T) allows this sum to be simplified and gives exactly g^(a / b s ). By calculating the image by H of this last value we fall back exactly on E s .
[0100] Conversely, if the pattern differs, even if only in a single position, from the sequence of encrypted characters, we can prove that the probability of falling back on E s is at most 1 / p, which is negligible in practice. Indeed, p can be chosen for example close to 2 256 .
[0101] The invention also relates to a method for decrypting a cipher obtained by data encryption comprising at least u elementary characters, the cipher being generated in accordance with an encryption method as described previously, the decryption method comprising: - obtaining a trapdoor associated with each of the distinct elementary data of the data stream, said trapdoor being generated in accordance with a method for generating a trapdoor as described previously, - detecting the presence of this trapdoor, in accordance with the method for detecting a pattern as described previously.
[0102] A trapdoor generation DG device in an encryption system, according to an exemplary embodiment, will now be described in relation to the. This DG device is a computer device, such as a computer.
[0103] The DG trap generation device includes:
[0104] - a processing unit or processor 601, or "CPU" (from the English "Central Processing Unit"), intended to load instructions into memory, to execute them, to carry out operations;
[0105] - a set of memories, including a volatile memory 602, or "RAM" (for "Random Access Memory") used to execute code instructions, store variables, etc., and a storage memory 603 of the "EEPROM" type (from English "Electrically Erasable Programmable Read Only Memory"). In particular, the storage memory 603 is arranged to store a trapdoor generation software module which comprises code instructions for implementing the steps of the trapdoor generation method as described previously. The storage memory 603 is also arranged to store in a secure area the secret key sk of the encryption system.
[0106] The DG trap generation device also includes:- an MT22 module for selecting an integer s between 1 and t;- an MT24 module for calculating a value T = b s *(r1a w[1],1 + r2a w[2],2 +…+ r v has w[v],v ), r i=0 if w[i] is said special character and r i is equal to an integer r otherwise, and- a RES module to restore the trapdoor comprising the elements s, r, and T.
[0107] A DC encryption device, according to an exemplary embodiment, will now be described in relation to the. This DC encryption device is a computer device, such as a computer.
[0108] It includes:
[0109] - a processing unit or processor 701, or CPU, intended to load instructions into memory, to execute them, to carry out operations;
[0110] - a set of memories, including a volatile memory 702, or RAM used to execute code instructions, store variables, etc., and a storage memory 703 of EEPROM type. In particular, the storage memory 703 is arranged to store an encryption software module which comprises code instructions for implementing the steps of the encryption method as described previously. The memory 703 is also arranged to store the public key pk of the encryption system.
[0111] The DC encryption device also includes:- an MC22 module for selecting an integer a between 0 and p-1;- a first MC24 module for calculating any integer k between 1 and an integer t, with a value E k = H(h k ^(a))- a second MC26 module for calculating any integer i between 1 and an integer u, of a value C i equal to g m[i],i^a, and an MC28 module for obtaining the ciphertext, said ciphertext being made up of the elements {E k , C i}.
[0112] A DD device for detecting the presence of a pattern, according to an exemplary embodiment, will now be described in relation to the. This DD device is a computer device, such as a computer.
[0113] It includes:
[0114] - a processing unit or processor 801, or CPU, intended to load instructions into memory, to execute them, to carry out operations;
[0115] - a set of memories, including a volatile memory 802, or RAM used to execute code instructions, store variables, etc., and a storage memory 803 of EEPROM type. In particular, the storage memory 803 is arranged to store a software module for detecting a pattern in a stream which comprises code instructions for implementing the steps of the pattern detection method as described previously.
[0116] The DD device for detecting the presence of a pattern also includes:
[0117] - an MD20 module for obtaining a trapdoor TR(w) associated with said pattern; - a first MD22 module for calculating an element Q = C1^r1*…*C v ^r v with r i =0 if w[i] is said special character and r i= r otherwise;- a second MD24 module for calculating a value D equal to Q^(1 / T), where T is an element of said trapdoor;- a third MD26 module for calculating a value H(D) where H is a function H with a value in a finite set;- a MD30 detection module configured to detect that the data (m) includes said pattern (w) if H(D) is equal to E s , where s is an integer included in said trapdoor.
Claims
Method for generating a trapdoor (TR(w)) in an encryption system, said trapdoor (TR(w)) being associated with a pattern w comprising elementary characters w[1, …w[v included in an alphabet (S) supplemented by a special character which can replace any character of said alphabet, said system defining a secret key (sk) parameterized by integers n and t and comprising:- an integer a c,i for any character c of the alphabet (S) and for any integer i between 1 and the integer n; and- an integer b k for any integer k between 1 and the integer t; the method comprising steps of:- selection (T22) of an integer s between 1 and the integer t; and- calculation (T24) of a value T = b s *(r1a w[1],1 + r2a w[2],2 +…+ r v has w[v],v ), r i =0 if w[i] is said special character and r i is equal to an integer r otherwise, said trapdoor comprising the elements s, r, and T. Encryption method implemented in an encryption system defining a public key (pk), to obtain a ciphertext (C) by encryption of data (m) comprising at least u elementary characters m[i, the public key pk comprising:- elements g c,i for any integer i between 1 and an integer u, the elements g c,i being of the form g^(a c,i ) where a c,i is an integer between 0 and an integer p-1 and g a generator of a group G of order p ;- elements h k , for any integer k between 1 and an integer t, the elements h k being of the form g^(1 / b k ) where b k is an integer between 0 and p-1.;- the generator g;- a description of the group G; and- a description of a function H with a value in a finite set,said method comprising steps of:- selection (C22) of an integer a between 0 and p-1;- calculation (C24) for any integer k between 1 and t, of a value E k = H(h k^(a)) ;- calculation (C26) for any integer i between 1 and u, of a value C i equal to g m[i],i ^a,- obtaining (C28) the ciphertext (C), said ciphertext being made up of the elements {E k , C i}. Method for detecting, in an encryption system, a pattern (w) in a cipher (C) obtained by encryption of data (m), said pattern (w) comprising elementary characters (w[1, …w[v) included in an alphabet (S) supplemented by a special character which can replace any character of said alphabet, the method comprising steps of: - obtaining (D20) a trapdoor (TR(w)) associated with said pattern; - calculating (D22) an element Q = C1^r1*…*C v ^r v with r i =0 if w[i] is said special character and r i= r otherwise;- calculation (D24) of a value D equal to Q^(1 / T), where T is an element of said trapdoor;- calculation (D26) of a value H(D) where H is a function H with a value in a finite set;- detection (D30) that the data (m) include said pattern (w) if H(D) is equal to E s , where s is an integer included in said trapdoor. Device (DG) for generating a trapdoor (TR(w)) in an encryption system, said trapdoor (TR(w)) being associated with a pattern (w) comprising elementary characters (w[1, …w[v) included in an alphabet (S) supplemented by a special character which can replace any character of said alphabet, said system defining a secret key (sk) parameterized by integers n and t and comprising:- an integer a c,i for any character c of the alphabet (S) and for any integer i between 1 and the integer n; and- an integer b kfor any integer k between 1 and the integer t; the device (DG) comprising:- a module (MT22) for selecting an integer s between 1 and t; and- a module (MT24) for calculating a value T = b s *(r1a w[1],1 + r2a w[2],2 +…+ r v has w[v],v ), r i =0 if w[i] is said special character and r i is equal to an integer r otherwise, said trapdoor (TR(w)) comprising the elements s, r, and T. A computer program for a trapdoor generating device in an encryption system, comprising program code instructions for controlling the execution of the steps of the trapdoor generating method according to claim 1, when the program is executed on said device. Encryption device (DC) implemented in an encryption system defining a public key (pk), the device being configured to obtain a ciphertext (C) by encryption of data (m), comprising at least u elementary characters m[i, the public key (pk) comprising:- elements g c,i for any integer i between 1 and an integer u, the elements g c,i being of the form g^(a c,i ) where a c,i is an integer between 0 and an integer p-1 and g a generator of a group G of order p ;- elements h k , for any integer k between 1 and an integer t, the elements h k being of the form g^(1 / b k ) where b kis an integer between 0 and p-1.;- the generator g of a group G;- a description of the group G; and- a description of a function H with a value in a finite set,said device comprising:- a module (MC22) for selecting an integer a between 0 and p-1;- a first module (MC24) for calculating for any integer k between 1 and t, a value E k = H(h k ^(a))- a second module (MC26) for calculating any integer i between 1 and u, of a value C i equal to g m[i],i ^a, and a module (MC28) for obtaining the ciphertext, said ciphertext being made up of the elements {E k , C i}. A program for an encryption device, comprising program code instructions for controlling the execution of the steps of the encryption method according to claim 2, when the program is executed on said device. Device (DD) for detecting, in an encryption system, the presence of a pattern (w) in a cipher (C) obtained by encryption of data (m), said pattern (w) comprising elementary characters (w[1, …w[v) included in an alphabet (S) supplemented by a special character which can replace any character of said alphabet, the device comprising:- a module (MD20) for obtaining a trapdoor (TR(w)) associated with said pattern;- a first module (MD22) for calculating an element Q = C1^r1*…*C v ^r v with r i =0 if w[i] is said special character and r i = r otherwise;- a second module (MD24) for calculating a value D equal to Q^(1 / T), where T is an element of said trapdoor;- a third module (MD26) for calculating a value H(D) where H is a function H with a value in a finite set;- a detection module (MD30) configured to detect that the data (m) includes said pattern (w) if H(D) is equal to E s, where s is an integer included in said trapdoor. Program for a device for detecting the presence of a pattern in a cipher, comprising program code instructions intended to control the execution of the steps of the method for detecting the presence of a pattern in a cipher according to claim 3, when the program is executed on said device. Method for decrypting a cipher (C) obtained by encryption of data (m) comprising at least u elementary characters m[i, the cipher being generated in accordance with the encryption method according to claim 2, the decryption method comprising:- obtaining a trapdoor associated with each of the distinct elementary data of the data stream, said trapdoor being generated in accordance with the trapdoor generation method according to claim 1,- detecting the presence of said trapdoor, in accordance with the pattern detection method according to claim 3. Encryption system comprising:- a trapdoor generation device (DG) according to claim 4,- an encryption device (DC) according to claim 6, and- a device (DD) for detecting the presence of a pattern in a cipher according to claim 8.