Device and method for generating locally verifiable aggregated signatures for generating attestations in a VNF-FG architecture platform

Abstract

A method for signing a message mi, by a user device, using a cryptographic proof-of-knowledge protocol defined by an element g belonging to a group G1 of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a group G2, a hash function H and a current time period w, comprising: a step of generating a private and public key pair, the private key having an element αi selected from the ring Z / pZ, the public key having a first element and a second element being a proof-of-knowledge zero-disclosure proof of possession generated from the cryptographic protocol, a step of generating a signature σi of the message mi from the private key and a random number ϐ, the signature having a first element σ1i and a second element σ2i. Fig. 1.

Description

Title of the invention: Device and method for generating locally verifiable aggregated signatures for generating attestations in a VNF-FG architecture platform. Technical field

[0001] The invention relates to the general field of cryptography and more particularly to methods and devices for digital authentication by electronic signature. In particular, this description concerns the provision of collective attestations in virtualized computing platforms. Previous technique

[0002] It is known to use attestation mechanisms allowing a target to authenticate itself to a verifier by demonstrating that it satisfies certain properties.

[0003] Classically, attestation mechanisms take the form of a so-called "challenge-response" protocol in which the verifier sends a challenge to a target accompanied by a random number generator, called a nonce. The target generates proofs in response to this challenge and sends them to the verifier. Generally, the proof is based on the target's root of trust. The proof typically consists of demonstrating, by providing attestations, that the target is in a particular configuration, notably an uncorrupted configuration.

[0004] Such a mechanism is also known to attest that a group of targets is in a particular, trustworthy, and uncorrupted configuration. Typically, the messages from said targets are aggregated, thus forming a single message proving the state of a set of targets.

[0005] In the particular case of virtualized computer platforms comprising among other things a plurality of virtual machines and a hypervisor, not only the virtual machines but also the infrastructure of these virtual machines must be attested.

[0006] To achieve this, methods are known for providing a group attestation for all virtual machines and their infrastructure. Typically, these methods rely on assigning a map linking the virtual machines and their hypervisors in the form of a tree connecting child nodes to parent nodes. Upon receiving an attestation request, or "challenge," the child nodes generate an attestation and transmit it to their parent node.

[0007] Some methods include the generation of attestation reports in the form of a boolean, by the parent nodes, in addition to their own attestation, indicating The report indicates whether the child node attestations are valid (Boolean: 1) or if at least one child node attestation is invalid (Boolean: 0). This allows the verifier to quickly obtain an overall attestation for the entire system. This advantageously distributes computing resources by parallelizing attestation checks. However, in the case of an invalid attestation, it is not possible to identify the target(s) that provided the invalid attestation; in other words, to identify the target(s) that are not in a valid, i.e., trustworthy, configuration. Furthermore, this requires, among other things, that the parent nodes be able to verify the attestation and therefore know what constitutes a valid attestation for the child node, i.e., what constitutes a valid configuration for that virtual machine and its hypervisor.This knowledge can be contested, particularly in the context of a virtualized IT platform whose resources are owned by a plurality of proprietary entities, who do not wish to share the internal infrastructures of their virtual machines among themselves.

[0008] Other alternative methods involve aggregating the individual attestations generated by the targets to obtain an aggregated attestation. This aggregated attestation is verified by the verifier at the top of the graph. However, the verification time for such methods is particularly long, being linear with the number of attestations, and therefore targets, contained in the aggregated attestation. Even though optimization techniques exist and can reduce these verification times in some cases, these improvements unfortunately offer limited time savings.

[0009] In general, it is advantageous to be able to verify an aggregate signature at a particular position, in other words, to be able to verify the attestation of a specific target. This is referred to as "local verification," as opposed to "global verification," which aims to verify whether the aggregate attestation is valid as a whole. The least expensive methods rely on generating attestations whose messages have been signed with a single key. Other methods, exploiting the ZK-SNARK ("Zero-Knowledge Succinct Non-interactive ARgument of Knowledge") algorithm, allow the local verification of aggregate attestations formed from messages signed by a plurality of keys; however, these methods are extremely expensive.

[0010] Furthermore, as mentioned previously, there is a need to ensure the confidentiality of target configurations while allowing them to attest to a valid configuration to the verifier. Traditional methods, such as encryption, can be used to protect the exchanged information. However, this presupposes that the target can trust the verifier. More recent approaches, such as the ZK-SNARK algorithm, These methods allow the generation of so-called zero-knowledge proofs. The idea behind these methods is that the target does not send its exact configuration as proof, but rather sends proof that it is in a valid configuration from among a set of possible valid configurations, without revealing the configuration in which it is located.

[0011] There is therefore a real need to provide attestations that are free, at least in part, from the drawbacks inherent in the aforementioned known methods. In particular, there is a need for attestations that allow for the rapid verification of the validity status of multiple targets in a virtualized computing platform, both collectively and individually. There is also a need to improve confidentiality in attestation exchanges, especially in the context of a virtualized computing platform whose resources are owned by multiple proprietary entities. More generally, there is a need to provide secure attestations that are generated quickly and can be verified quickly while minimizing the required bandwidth.

[0012] The invention aims to meet all or part of these needs. Description of the invention

[0013] The invention relates to a method for signing a message m, by a user device, using a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the method comprising: - a step of generating a private and public key pair, the private key containing an element ai selected from the ring Z / pZ, the public key containing a first element g and a second element pi, a zero-knowledge proof of possession generated from the cryptographic protocol, - a step of generating a signature o of the message m; from the private key and a random number B, the signature containing - a first element 0n = (vuH(m))^(rlls(w)lswt)6, and - a second element o2i = g6-

[0014] The user device can advantageously be included in a virtualized computer platform, including in particular a root of trust (RoT).

[0015] Conventionally, a root of trust is configured to perform one or more specific functions for securing the virtualized computing platform.

[0016] The virtualized computing platform can be used to provide the functionalities of a mobile network or to implement a VNF-FG (Virtual Network Functions-Forwarding Graph) architecture platform. The invention also relates to a method for signing a set of messages m0,mn, implemented in a virtualized computing platform comprising a plurality of user devices, based on a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H, and a current time period w, the method comprising: - for each message m; of the set of messages, i belonging to the interval [0, n], with n a natural number greater than or equal to 1, the signature of the message m; by a user device of the plurality of user devices, by means of a signature generation process as described above so as to generate a signature for said message m, called individual signature; - an aggregation step of all or part of the individual signatures previously generated during said current time period w so as to generate an aggregate signature comprising a first element and a second element.

[0017] The aggregation step may include the aggregation of individual signatures with each other and / or of previously generated aggregated signatures.

[0018] The aggregation step may include an interpolation of the first elements of the signatures to be aggregated, and an interpolation of the second elements of the signatures to be aggregated.

[0019] The aggregation step can be implemented by calculating the first element #i and the second element #2 using the following formulas: 100201 9.=11^ «2=n^

[0021] Correspondingly, the invention relates to a user device capable of signing a message m; from a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the user device comprising: - a generation module configured to generate a private and public key pair, the private key having an element ai selected from the Z / pZ ring, the public key having a first element g“ and a second element p” a zero-knowledge proof of possession generated from the cryptographic protocol, - a generation module capable of generating a signature o, of the message m; from the private key and a random number B, said signature comprising a first element Oh = (vuH(m))“. ^riig(w)isw^e, and a second element o2i = g6-

[0022] The invention also relates to a group of user devices as described above, of which all or part of the user devices further comprise: - an aggregation module capable of aggregating all or part of the signatures generated by said user devices during the current time period w so as to generate an aggregate signature comprising a first element and a second element.

[0023] By "aggregated signature" is meant a signature comprising several individual signatures of different messages from different user devices aggregated together in such a way that the resulting signature has a constant size, which is preferably the same size as an individual signature, and can be verified from knowledge of the different messages and associated public keys.

[0024] The aggregate signature obtained by means of the invention also allows the generation of so-called synchronized aggregate signatures. A "synchronized aggregate signature" is understood to be an aggregate signature composed of individual signatures generated for the same current time period. This advantageously prevents so-called replay attacks.

[0025] Thus, and in general, the invention proposes a method for generating signatures that can be generated from different public-private key pairs, allowing not only the preservation of the security of exchanges within a group of user devices but also the local verification of a signature in the aggregated signature.

[0026] Furthermore, the signature scheme allows for so-called "multi-hop" aggregation, making it possible to aggregate individual signatures sequentially and not necessarily all at once. In other words, the aggregation can be performed on individual signatures exclusively, on aggregated signatures exclusively, or on both individual and aggregated signatures. This can advantageously allow the aggregation step to be performed within a graph.

[0027] The virtualized computing platform may have a VNF-FG type architecture, an acronym for "Virtual Network Functions-Forwarding Graph," where the user devices can be virtual machines, each hosting a virtual network function (VNF for "Virtual Network Function"). Such a graph has an entry point and an exit point. Such an architecture is represented in [Fig. 1].

[0028] The method may include a step of determining a tree, commonly called a "spanning tree" in English, on said virtualized computing platform, connecting user devices together, for example by implementing a "Spanning Tree Protocol" algorithm.

[0029] The method may further include a step of receiving, by said user device(s), an attestation request from a verifier, for example transmitted via the entry point. The signing of a message by a user device following receipt of this attestation request by said user device provides proof of a valid configuration of said user device.

[0030] After the signature has been generated following the receipt of an attestation request, a user device can transmit said signature to another user device.

[0031] The invention also relates to a method for verifying, by a verification device, an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn using a method for generating a signature according to the invention, from a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the method comprising: - a step for verifying equality:

[0032] [Math. 2] e (g, 0]) = e (v) £ (u) £ ('°where e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group Gt, - If the said equality is verified, a validation step of the said aggregated signature.

[0033] Preferably, the verification method according to the invention includes a preliminary step of generating a key-message aggregate from the messages me,..., mn, the public keys g“0,..., g“nissues of the key pairs generated for the signing of said messages, and the hash function H.

[0034] The preliminary step of generating the key-message aggregate can advantageously be carried out upstream and only once, thereby accelerating, by contrast, the verification step.

[0035] The key-message aggregate may include a first element apkml and a second element apkm2. The first element may be equal to the product of the first elements of the public keys g“0,..., g“n. The second element may be equal to the product of g“H (m i’ for i ranging from 0 to n..

[0036] The equality verification step may consist of verifying equality:

[0037] e(g, 0j) -e{apkmt v)£(apknïl, u)£( 02'

[0038] Such a step can enable batch verification at a constant time. This is made possible in particular by the absence of a nonce in the generation of individual signatures, without this absence affecting the security of the exchanges. Indeed, using a current time period for aggregation ensures the freshness of the signatures.

[0039] Constant-time batch verification allows control of the verification time, independent of the number of individual signatures forming said aggregated signature. Such verification presupposes prior knowledge, by the verification device, of the expected messages of the batch as well as the public keys associated with said messages.

[0040] The invention also relates to a method for verifying an individual signature of a message m; included in an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn, i belonging to the interval [0,n] using a method of generation of a signature according to the invention, from a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a function of hashing H and a current time period w, the process comprising: - a step to verify equality:

[0041] [Math. 4] e(g,0]) = e(vHu).e(02,^swt), where e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group GT, - If the said equality is verified, a validation step of the said individual signature.

[0042] Preferably, said method for verifying an individual signature comprises a pre-processing step during which at least one first auxiliary piece of information is entered, for example auxl= A second auxiliary piece of information aux2, for example aux2=JJ $ ^gakH(mk- ct a third auxiliary information aux3, for example aux3 = with ^zk a proof that the proofs of possessions public keys are valid, are determined from the public keys g“0 ,..., g“nissues of the key pairs generated for the signing of said messages m0,..., mnet of said messages so as to precalculate terms of equality of the verification step.

[0043] This pre-processing step can advantageously be carried out upstream and only once, thereby accelerating, by contrast, the equality verification step.

[0044] Correspondingly, the invention relates to a verification device for an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn using a signature generation method according to the invention, from a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the verification device comprising: - a verification module capable of verifying the equality:

[0045] [Math. 5] e ( g, ) = e ( v ) £ ( u ) £ ( 02, ' ° where e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group Gt, and - a module for validating the aggregated signature is activated if said equality is verified.

[0046] The invention also relates to an opening device comprising a generation module capable of generating, from the messages m0,..., mn, public keys g“0,..., g“ nissues of the key pairs generated for the signing of said messages, and of the hash function H, a key-message aggregate, so as to allow the verification module to perform a batch verification.

[0047] In particular embodiments of the invention, the opening device is included in the verification device.

[0048] The invention also relates to a verification device capable of verifying an individual signature of a message m; included in an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn, i belonging to the interval [0,n] using a signature generation method according to the invention, from a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the method comprising: - an equality verification module:

[0049] [Math. 6] e(g, 0i) u)£('oû e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group GT, and - an individual signature validation module activated if said equality is verified.

[0050] Preferably, said device for verifying an individual signature may include a pre-processing module capable of determining at least a first auxiliary information aux1, a second auxiliary information aux2 and a third auxiliary information aux3 are determined from the public keys g“0,..., g“ nissues of the key pairs generated for the signing of said messages m0,mnet of said messages.

[0051] In particular embodiments of the invention, the pre-treatment module is integrated into an opening device according to the invention, separate from the verification device.

[0052] Auxiliary information can advantageously enable faster calculation of equality. Furthermore, it can be calculated in advance, as the verification device knows the expected messages and the public keys of the user devices whose signature it wants to verify.

[0053] Finally, the invention relates to a communication system comprising: - a group of user devices according to the invention, and - one or more verification devices according to the invention.

[0054] In particular, the communication system comprises user devices owned by a plurality of owner entities. Preferably, the communication system then comprises a verification device for each owner entity capable of verifying individual and / or aggregated signatures relating exclusively to the user devices owned by said owner entity, and a verification device capable of verifying signatures generated by all the user devices.

[0055] In some embodiments, the cryptographic protocol is based on the ZK-SNARK algorithm.

[0056] Although calculating the ZK-SNARK proof of possession can be very expensive, the pre-processing step of determining auxiliary information from public data, combined with the fact that the verification device knows the expected signed messages, allows the auxiliary information to be calculated in advance only once and reused each time. Thus, even when the ZK-SNARK algorithm is used, implementing the process of verifying an individual signature is efficient and practical.

[0057] In general, the invention thus enables the generation of a batch-verifiable, multi-signatory, synchronized aggregate signature scheme that can be verified locally and globally.

[0058] In addition, the preliminary generation step of the key-message aggregates allows in particular the implementation of a constant time batch verification, by a global verifier.

[0059] The invention thus makes it possible to control attestations, in particular in a virtualized computer platform of the VNF-FG type, which are generated and verified, both locally and globally, efficiently while using less bandwidth than known methods.

[0060] In particular embodiments, all or part of the steps of a process according to the invention, preferably all the steps, are implemented by computer program instructions.

[0061] Thus, the invention also relates to a computer program comprising code instructions, which when executed by means of a computer enable the implementation of a process according to the invention, as well as a computer-readable recording medium on which is recorded a computer program comprising instructions for the execution of the steps of a process according to the invention.

[0062] The aforementioned features and advantages, as well as others, will become apparent from the detailed description that follows. This detailed description refers to the accompanying drawings. Brief description of the drawings

[0063] The attached drawings are schematic and are intended primarily to illustrate the principles of the exposition.

[0064] On these drawings, from one figure to another, identical elements (or parts of elements) are identified by the same reference signs.

[0065] [Fig.1] The [Fig.1] is a virtualized computer platform according to the invention.

[0066] [Fig.2] Fig.2 illustrates the steps of an example of the implementation of a process of individual signature by a user device according to the invention,

[0067] [Fig. 3] Fig. 3 represents an example of the functional architecture of a device user according to the invention,

[0068] [Fig.4] Figure 4 illustrates the steps of an example of the implementation of a process of aggregated signature implemented by a group of user devices according to the invention,

[0069] [Fig. 5] Fig. 5 represents an example of the functional architecture of a device user according to the invention,

[0070] [Fig.6] Figure [Fig.6] illustrates the steps of an example of implementing a method for verifying a signature using a verification device according to the invention,

[0071] [Fig.7] Figure [Fig.7] represents an example of the functional architecture of a verification device according to the invention,

[0072] [Fig.8] Figure [Fig.8] illustrates the steps of an example of implementing another method for verifying a signature by a verification device according to the invention,

[0073] [Fig.9] Figure [Fig.9] represents an example of the functional architecture of a verification device according to the invention,

[0074] [Fig. 10] The [Fig. 10] illustrates an example of the hardware architecture of a user device and / or a verification device and / or a virtualized computing platform according to the invention. Description of the implementation methods

[0075] To make the explanation more concrete, an example of a virtualized computer platform 1 comprising a plurality of user devices U and a plurality of verification devices V, VI, V2, V3 is shown in [Fig. 1] and is described in detail below, with reference to the accompanying drawings. It should be noted that the invention is not limited to this example.

[0076] In the illustrated example, the virtualized computing platform 1 has a VNF-FG type architecture, comprising among other things an entry point E, an exit point S and a management device 2.

[0077] The user devices U may be virtual network functions, for example hosted in virtual machines. This example, although preferred, is not limiting.

[0078] User devices may be owned by different owning entities. For example, user devices in the GUI group of user devices may be owned by a first owning entity, user devices in the GU2 group of user devices may be owned by a second owning entity, and user devices in the GU3 group of user devices may be owned by a third owning entity.

[0079] For each owning entity, the virtualized computer platform may include a local VI, V2, V3 verification device capable of verifying an aggregated or individual signature of one or more user devices owned by said owning entity.

[0080] The virtualized computer platform 1 preferably includes at least one verification device V, called global, capable of verifying an aggregated signature of all user devices of the virtualized computer platform.

[0081] Each user device U is able to sign a message m thanks to the invention.

[0082] In general, the invention makes it possible to provide attestations intended to prove that user devices are in a configuration corresponding to a valid state with a verification device.

[0083] To this end, an attestation request is sent, via a verification device, to the user devices of the virtualized computing platform. The request can be transmitted to the user devices via the entry point E and then propagated to the exit point S, via connections linking the user devices U together. In particular, the request is propagated along a tree, commonly called a "spanning tree." The method may include a step of determining such a tree on said virtualized computing platform, for example by implementing a "Spanning Tree Protocol" algorithm.

[0084] Figure 1 represents a virtualized computing platform of the VNF-FG type architecture on which an example of a spanning tree implementation has been calculated. The solid and dashed lines represent connections between the elements of the virtualized computing platform. However, the dashed lines are not used by the tree calculated by the spanning tree, unlike the solid lines. Thus, in the example in Figure 1, the request is propagated along the solid lines. Similarly, messages signed by user devices are advantageously forwarded and progressively aggregated up to the entry point E along the solid lines.

[0085] Upon receipt of the request by a user device U, the latter generates an attestation in response to this request intended to prove that it is in a configuration corresponding to a valid state.

[0086] The generation of the attestation consists of signing a message m. The message m being a carrier of proof that the said user device is in one of the configurations among a set of valid configurations indicated in the said message m.

[0087] To enable such a signature, a cryptographic protocol is defined.

[0088] The cryptographic protocol can be determined by the management device 2. Preferably, the management device controls the infrastructure of the virtualized computing platform.

[0089] The cryptographic protocol is a zero-knowledge proof protocol. In particular, the cryptographic protocol is a ZK-SNARK type algorithm.

[0090] The cryptographic protocol is defined, among other things, by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and some elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w.

[0091] Preferably, a common clock is shared by the user devices and the verification device(s) so that the current time period is common.

[0092] In particular, the clock can be positioned in the root of trust (RoT) of each of the user devices. Alternatively, the clock can be contained in the manager device 2.

[0093] In order to provide the attestation in response to said request, each user device U implements a method 200 for signing a message m according to the invention, as illustrated in [Fig.2].

[0094] The method 200 of signing a message m is carried out using the cryptographic zero-knowledge proof protocol defined previously.

[0095] Said method 200 comprises a step E210 of generating a private and public key pair, the private key comprising an element a selected from the ring Z / pZ, the public key comprising a first element g and a second element ir being a zero-knowledge proof of possession generated from the cryptographic protocol, and a step E220 of generating a signature o of the message m from the private key and a random number B, the signature comprising a first element Oi = (vuH (m)).(rlls (w)lswt)6, and a second element o2 = g6-

[0096] Proof of possession is proof that the user device is in possession of the private key associated with the public key (g“, jt). Such proof of possession can, in particular, help prevent "rogue key attack" type attacks during a local opening and / or verification step.

[0097] Each user device U includes modules configured to implement a 200 signature generation process comprising at least one M210 generation module configured to implement an E210 step for generating a private and public key pair, and an M220 generation module configured to implement an E220 step for generating a signature of the message m.

[0098] Figure 4 shows a method 300 for signing a set of messages m0,..., mn, implemented in a virtualized computer platform comprising a plurality of user devices Uo,..., Un, based on the cryptographic zero-knowledge proof protocol.

[0099] The method 300 comprises: for each message m; of the set of messages, i belonging to the interval [0, n], the signature of the message m; by the corresponding user device U; of the plurality of user devices, by means of implementing the method 200 for generating a signature as described above so as to generate a signature for said message m, called individual signature; then an aggregation step E320 of all or part of the individual signatures previously generated during said current time period w so as to generate an aggregate signature comprising a first element and a second element.

[0100] Preferably, the parent UP user devices also include an M330 module for aggregating signatures generated by means of a signature generation process 200 according to the invention, as illustrated in [Fig.5].

[0101] Parent user devices are user devices not directly connected to the output point S.

[0102] Aggregation can be performed from individual signatures generated by the implementation of a process 200 and / or from aggregated signatures generated by the implementation of a process 300.

[0103] Individual signatures are progressively propagated from user devices to entry point E.

[0104] This aggregated signature formed from individual signatures generated by means of a process 300 according to the invention is intended to be verified by a verification device V.

[0105] We will now describe, with reference to [Fig. 6], a method 400 for verifying an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn using a method for generating a signature according to the invention, from a cryptographic proof protocol with zero disclosure of knowledge, the method comprising a step E420 for verifying equality:

[0106] [Math. 7] (E1): e (g,) = e ().e (u) £ (02, 'where e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group GT, and - if said equality is verified, an E430 validation step of said aggregated signature.

[0107] The process 400 may further include a preliminary step E410 of generating a key-message aggregate from the messages m0,..., mn, the public keys g“0, ..., g“n from the key pairs generated for the individual signing of said messages, and the hash function H.

[0108] The key-message aggregate may include a first element apkml equal to the product of the first elements of the public keys g“0,..., g“n, and a second element apkm2 equal to the product of the g“H for i from 0 to n. Such a step E410 allows for constant-time batch verification.

[0109] The verification device V comprises modules configured to implement a 400 method for verifying an aggregated signature, comprising at least one M420 verification module configured to implement a 420 equality verification step as described above, and an M430 validation module configured to implement an E430 signature validation step. Such a device is illustrated in [Fig. 7].

[0110] Preferably, the verification device V further comprises a key-message aggregate generation module M410 configured to implement a step 410 of generating a key-message aggregate from the messages m0,..., mn, the public keys g“0,..., g“nissues of the key pairs generated for the signing of said messages, and the hash function H.

[0111] Alternatively, the M410 module for generating a key-message aggregate can be included in an opening device (not shown), separate from the verification device V.

[0112] In addition to the global verification described above, the invention also relates to local verification. In other words, the invention allows the verification of individual signatures of a subset of devices on the virtualized computing platform.

[0113] In particular, the invention makes it possible to verify individual signatures signed by user devices from a group of user devices owned by a particular proprietary entity. For example, the verification device V1 can be configured to implement a method for verifying an individual signature generated by one of the devices in the GUI device subgroup.

[0114] With reference to [Fig. 8], a method 500 for verifying an individual signature of a message m; included in an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn, i belonging to the interval [0,n] using a method for generating a signature according to the invention, based on the zero-knowledge proof cryptographic protocol. The method 500 includes an equality verification step E520:

[0115] [Math. 8] (El): e(g, ) = e(v)£(u).e{ 02, , where e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group GT, and - if said equality is verified, an E530 validation step of said individual signature o,.

[0116] Said method 500 for verifying an individual signature o, preferably comprises a pre-processing step E510 during which at least one first auxiliary information auxlh a second auxiliary information auxi2 and a third auxiliary information auxi3 are determined from the public keys g“0 ,g“nissues of the key pairs generated for the signing of said messages m0,mn and of said messages.

[0117] The first auxiliary information may be equal to

[0118] [Math.9] ^1=11^1,^ , with i being the index of the message to be checked locally.

[0119] The second auxiliary information may be equal to

[0120] [Math. 10] ailX^ ' with * the in(^ce of the message to be checked locally.

[0121] The third piece of information may be equal to

[0122] [Math. 11] au# — (j ttzk^ avcc * the index of the message to be checked locally and irZK a proof that the proofs of possession of the public keys are valid.

[0123] The verification device VI, V2, V3 includes modules configured to implement a 500 process for verifying an individual signature comprising at least one M520 verification module configured to implement a 520 equality verification step above, and an M530 validation module configured to implement an E530 validation step of an individual signature.

[0124] Preferably, the verification device VI, V2, V3 further includes a pre-processing module M510 to implement a step 510 of determination of auxiliary information during which at least a first auxiliary information aux1h a second auxiliary information auxi2 and a third auxiliary information auxi3 are determined from the public keys g“0,..., g“nissues of the key pairs generated for the signing of said messages m0,..., mnet of said messages.

[0125] Alternatively, the M510 pre-processing module can be included in an opening device (not shown), separate from the verification device VI, V2, V3.

[0126] In a particular embodiment, the different steps of the processes according to the invention are determined by computer program instructions.

[0127] Accordingly, the invention also relates to a computer program on an information medium, this program being capable of being implemented in a user device, and / or a verification device according to the invention or more generally in a computer, this program comprising instructions adapted to the implementation of the steps of a process according to the invention as described above.

[0128] Thus, in particular embodiments, the virtualized computing platform 1 has the hardware architecture of a computer, as shown in [Fig. 10]. It should be noted that some elements of this architecture may be confused with existing devices.

[0129] More specifically, the virtualized signature computing platform 1 may include a PC processor, a ROM read-only memory, a RAM random-access memory, a RoT root of trust and means of communication.

[0130] It should be noted that the root of trust may consist of software elements but is preferably implemented in the form of a hardware module.

[0131] The root of trust provides platform security services. In particular, it is used to store and protect the platform's keys, which cannot be used by other resources without this root of trust.

[0132] This root of trust is for example constituted by a trust module conforming to ISO / IEC standard standards.

[0133] The read-only memory of the virtualized computer platform 1 constitutes a storage medium readable by the processor and on which is stored a computer program according to the invention, comprising instructions for the execution of the steps of a process according to the invention detailed above.

[0134] This computer program equivalently defines functional modules (software) of the virtualized computer platform 1.

[0135] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0136] Equivalently, in particular embodiments, the user devices U and / or the verification devices have the hardware architecture of a computer, as shown in [Fig. 10]. It should be noted that certain elements of this / these architectures may be confused with existing devices.

[0137] The invention also relates to a computer-readable information or recording medium, comprising instructions for a computer program as mentioned above.

[0138] The information or recording medium can be any entity or device capable of storing the program. For example, the medium can include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a floppy disk or a hard disk.

[0139] On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The program according to the invention can, in particular, be downloaded onto an Internet-type network.

[0140] Alternatively, the information or recording medium may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.

[0141] Although the present invention has been described with reference to specific embodiments, it is evident that modifications and changes can be made to these examples without departing from the general scope of the invention as defined by the claims. In particular, individual features of the various embodiments illustrated / mentioned can be combined in additional embodiments. Therefore, the description and drawings should be considered in an illustrative rather than a restrictive sense.

[0142] It is also evident that all the characteristics described with reference to a process are transposable, alone or in combination, to a device, and conversely, all the characteristics described with reference to a device are transposable, alone or in combination, to a process.

Claims

Demands

1. A method for signing a message m, by a user device, using a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, where p is a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H, and a current time period w, the method comprising: - a step of generating a private and public key pair, the private key comprising an element ai selected from the ring Z / pZ, the public key comprising a first element g and a second element p, a zero-knowledge proof of possession generated from the cryptographic protocol, - a step of generating a signature o of the message m, from the private key and a random number B, the signature comprising - a first element oH = (vuH(m))^(rllg(w)lswt)6, and - a second element o2i = g6--

2. A method for signing a set of messages m0,..., mn, implemented in a virtualized computer platform comprising a plurality of user devices, from a cryptographic proof-zero-knowledge protocol defined by an element g belonging to a cyclic group G1 of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the method comprising: - for each message mi of the message set, i belonging to the interval [0, n], the signature of the message mi by a user device of the plurality of user devices, by means of a method for generating a signature according to claim 1 so as to generate a signature for said message mi, called individual signature;- an aggregation step of all or part of the individual signatures previously generated during the said current time period w so as to generate an aggregated signature comprising a first element and a second element.;

3. Signature method according to claim 2, wherein the aggregation step comprises aggregating individual signatures together and / or previously generated aggregated signatures.

4. A signature method according to any one of claims 2 or 3, wherein the virtualized computing platform has a VNF-FG (Virtual Network Functions-Forwarding Graph) type architecture.

5. A method for verifying, by a verification device, an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn using a method for generating a signature according to any one of claims 2 to 4, from a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H, and a current time period w, the method comprising: - a step of verifying the equality: e(g, 0i) = e(nV) e(U) ≤ (02, where e denotes a bilinear matching defined on the groups Gi and G2 and taking values ​​in a cyclic group GT, - if said equality is verified, a step of validating said aggregate signature.

6. A verification method according to claim 5, comprising a preliminary step of generating a key-message aggregate from the messages m0,..., mn, the public keys g“0,..., g“nissues of the key pairs generated for the signing of said messages, and the hash function H.

7. A method for verifying an individual signature of a message m; included in an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn, i belonging to the interval [0,n] using a method for generating a signature according to any one of claims 2 to 4, from a zero-knowledge proof cryptographic protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the process comprising: - a step of verifying the equality: e(g, ) = e(r)£(u)je( ), where e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group GT, - If said equality is verified a step of validating said individual signature.

8. Method according to claim 7 comprising a preprocessing step during which at least a first auxiliary information aux1, a second auxiliary information aux2 and a third auxiliary information aux3 are determined from the public keys g“0,g“nissues of the key pairs generated for the signing of said messages m0,mnet of said messages so as to precalculate equality terms of the verification step.

9. User device capable of signing a message m; from a cryptographic proof-of-knowledge protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the user device comprising: - a generation module configured to generate a private and public key pair, the private key comprising an element ai selected from the ring Z / pZ, the public key comprising a first element g and a second element pa, a proof-of-knowledge zero-disclosure proof of possession generated from the cryptographic protocol, - a generation module capable of generating a signature o of the message m; from the private key and a random number B, said signature comprising a first element oH = (vuH(m)).(rlls(w)lswt)6, and a second element 6 O2i = g.

10. A device for verifying an aggregated signature comprising a first element #i and a second element #2 and generated for a set of messages m0,..., mn using a method for generating a signature according to any one of claims 2 to 4, to starting from a cryptographic proof protocol with zero disclosure of knowledge defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the verification device comprising: - a verification module capable of verifying the equality: e(g, 0j) = e(v)£( u).e( 02, 'where e denotes a bilinear coupling defined on the groups Gi and G2 and with values ​​in a cyclic group GT, and - a validation module of the aggregate signature activated if said equality is verified.

11. Verification device capable of verifying an individual signature of a message m;included in an aggregate signature comprising a first element #i and a second element #2 and generated for a set of messages m0,mn, i belonging to the interval [0,n] using a method for generating a signature according to any one of claims 2 to 4, from a cryptographic zero-knowledge proof protocol defined by an element g belonging to a cyclic group Gi of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a cyclic group G2 of order p, a hash function H and a current time period w, the method comprising: - an equality verification module: e(g, ©J = ^(^-11^^(^, where e denotes a bilinear matching defined on the groups Gi and G2 and with values ​​in a cyclic group GT, and - an individual signature validation module activated if said equality is verified.;

12. A communication system comprising: - a group of user devices according to claim 9, wherein all or part of the user devices further comprise an aggregation module capable of aggregating all or part of the signatures generated by said user devices during the current time period w so as to generate an aggregated signature comprising a first element and a second element, and - one or more verification devices according to any one of claims 10 or 11.

13. A computer program comprising code instructions which, when executed by means of a computer, enable the implementation of a method according to any one of claims 1 to 8.

14. Computer-readable recording medium on which is recorded a computer program comprising instructions for carrying out the steps of a process according to any one of claims 1 to 8.

Images