Secure Communication

Abstract

A method is disclosed for deriving a shared secret between a first device (A) and a second device (B). The method comprises: A and by device B, data set D B Then, D A and D B Each of the N subsets D A i and D B i For each of (i=1,2,...,N;N>1), device A generates D A i Based on the first value V A i =M A (D A i ), wherein M A a step of determining by device B, B i Based on the second value V B i =M B (D B i ), wherein M B wherein V includes an entropy reduction function and / or a statistical function; and determining the first and second values V A i and V B i and exchanging one or more messages between devices A and B to determine whether a condition based on A i Based on the reduced data set D A ' and by device B, the condition is met by subset D. B i Based on the reduced data set D BThe method may further include repeating the determining, replacing, and obtaining a reduced dataset one or more times until one or more termination criteria are met, wherein the dataset used in an iteration includes the reduced dataset obtained in a previous iteration.

Description

[Technical Field]

[0001] Certain examples of the present disclosure provide one or more techniques for deriving a shared secret between two or more devices, and for performing secure operations, e.g., secure communications, using the shared secret. [Background technology]

[0002] A fundamental problem in communications theory is how to transmit a message M between two parties in such a way that no third party can obtain the message. For example, in the field of electronic financial transactions, maintaining confidentiality in communications between two parties is very important.

[0003] Traditionally, two parties wishing to exchange messages are called Alice (A) and Bob (B), respectively, and an eavesdropper attempting to gain unauthorized access to message M is called Eve (E).

[0004] Many communication techniques have been developed to solve this problem. One class of techniques relies on computational limitations on Eve that prevent her from performing certain mathematical operations in a reasonable amount of time. For example, the security of RSA public-key cryptography relies heavily on the computational difficulty of factoring very large integers. This type of technique is known as "conditionally secure" or "computationally secure."

[0005] One problem with conditionally secure technologies is that confidence in their security depends on mathematical results in the field of complexity theory that have yet to be proven. Therefore, at present, we cannot be certain that such technologies will not be broken in the future using only the resources of classical computers, provided we can develop the appropriate mathematical tools to do so. Furthermore, developments in quantum computing may enable quantum computers to perform certain mathematical operations, including those on which computationally secure technologies rely, much faster than classical computers, making conditionally secure technologies vulnerable.

[0006] Therefore, there is great interest in developing a class of communication techniques that make no assumptions about Eve's computational capabilities. This type of technology is known as "unconditionally secure."

[0007] One example of an unconditionally secure data transmission scheme is known as the "one-time pad". According to this technique, Alice performs a bitwise modulo-2 addition (i.e., XOR) of a binary plaintext string (message M) with a secret random binary string (one-time pad) of the same length as the message. The resulting binary cipher string (encrypted message M) ε ) is sent to Bob instead of the original message M. To recover the original message M, Bob must reconstruct the received encrypted message M ε Eve performs a bitwise modulo-2 addition of the local copy of the one-time pad to the encrypted message M ε Even if Eve intercepts M, it is impossible for her to recover the original message M without knowing the one-time pad. The one-time pad, as its name suggests, is used only once to aid in preserving security.

[0008] A basic requirement of a secure communication scheme is that Alice and / or Bob must have some secret information that is not known to Eve. This secret information is used as the basis for encrypting and / or subsequently decrypting messages. Some schemes require both Alice and Bob to have at least some secret information that is at least partially shared between them. For example, the secret information could be in the form of a random binary string in the one-time pad scheme mentioned above. In this case, the secret information is completely shared between Alice and Bob.

[0009] In various techniques, the shared secret is first distributed between Alice and Bob using a first mechanism, and then Alice and Bob exchange messages using a second mechanism that contain the shared secret. One reason this two-step approach is used, rather than simply exchanging messages directly using the first mechanism, is that mechanisms suitable for allowing Alice and Bob to obtain the shared secret without prior sharing may in some cases be inappropriate or impractical for message exchange. For example, some mechanisms allow Alice and Bob to obtain the shared secret, but Alice and Bob have no control over the exact content of the shared secret.

[0010] One problem with secure communication techniques that require a shared secret is how to distribute the secret between Alice and Bob without Eve knowing it. This problem can be particularly severe for techniques such as one-time pad, where the amount of secret information required is comparable to the amount of plaintext message data. What is desired, therefore, is a technique that allows Alice and Bob to obtain the shared secret.

[0011] The above information is presented solely as background information to aid in understanding the present disclosure, and no determination or assertion is being made as to whether any of the above may be applicable as prior art with respect to the present disclosure. Summary of the Invention

[0012] It is an object of certain examples of the present disclosure to at least partially address, solve, mitigate, or prevent at least one of the problems and / or disadvantages associated with the related art, e.g., at least one of the problems and / or disadvantages described herein. Certain examples of the present disclosure are intended to provide at least one advantage over the related art, e.g., at least one of the advantages described herein.

[0013] The invention is defined in the independent claims. Advantageous features are defined in the dependent claims.

[0014] Any embodiments, aspects or examples disclosed in the specification and / or drawings that fall outside the scope of the claims should be understood as examples useful for understanding the present invention.

[0015] Other aspects, advantages and salient features of the present disclosure will become apparent to those skilled in the art from the following detailed description, which, taken in conjunction with the accompany drawings, discloses examples of the present disclosure. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 illustrates the relationships between various quantities associated with three random variables X, Y, and Z. [Figure 2] 1 is a flowchart of an example method for deriving a shared secret between a first device (Device A) and a second device (Device B). [Figure 3] FIG. 1 illustrates an example of deriving a reduced dataset based on a dataset. [Figure 4] 4 is a message flow diagram of a first exemplary technique for deriving shared secret information. [Figure 5] FIG. 10 is a message flow diagram of a second exemplary technique for deriving shared secret information. [Figure 6]1 is a block diagram of an example device for deriving secret information to be shared with other devices. DETAILED DESCRIPTION OF THE INVENTION

[0017] The following description of examples of the present disclosure, with reference to the accompanying drawings, is provided to aid in a comprehensive understanding of the present invention as defined by the claims. While the description includes numerous specific details to aid in understanding, these should be considered merely as examples. Thus, those skilled in the art will recognize that various changes and modifications to the examples described herein are possible.

[0018] Certain examples of the present disclosure provide one or more techniques for deriving a shared secret between two or more devices (or apparatuses). Certain examples of the present disclosure provide one or more techniques for performing secure operations, e.g., secure communications, using the shared secret.

[0019] A device in which one or more of the techniques described herein can be embedded may be of any suitable type, such as a mobile device (such as a mobile phone), a computer terminal, a relay device, a server, a node in a network (such as the Internet or a private network), or any other suitable type of communication device. Furthermore, such a device may be a manually operated device (e.g., operated by a user) or a partially or fully automated device. In certain examples, one or more of the techniques described herein may be applied to communications between internal components of one or more devices. Thus, a reference herein to a "device" that communicates with other devices may also include a reference to internal components of a device that communicate with other internal components of the same device or different devices.

[0020] The techniques described herein may be used in a wide variety of different applications, including, but not limited to, financial transactions, law enforcement, military, government, mobile data, mobile voice, navigation and location (such as GPS), financial services, banking, maritime communications, subscriber services, mobile security services, distributed networking, remote access, Internet communications, virtual private networks, satellite communications, remote command and control systems, aircraft (such as drone aircraft), remote control, data storage and archiving, and identity management and security. Those skilled in the art will understand that shared secret information obtained using one or more techniques described herein may be used in any suitable type of secure operation, including but not limited to secure communications.

[0021] Those skilled in the art will understand that the techniques described herein can be used to enable a set of two or more devices to obtain shared secret information (i.e., obtain information known to those devices but not to any other entity). In a particular example, the techniques can be used by devices A and B to obtain a first shared secret information (shared between A and B). In a particular example, the techniques can also be used by devices A and C to obtain a second shared secret information (shared between A and C). In a particular example, the techniques can be used by a set of three or more devices {A, B, C, ...} to obtain a third shared secret information (shared between {A, B, C, ...}).

[0022] Before proceeding, we will now briefly discuss certain useful concepts in the field of information theory.

[0023] Probability distribution function P X Consider a discrete random variable X characterized by the following. The entropy H of X is defined as follows:

[0024]

number

[0025] In Equation 1, x represents a specific result of X, and P X where (x) is the probability of outcome x, and b is an arbitrary logarithm base that determines the units of entropy. Often, the base b is chosen to be 2, in which case the units of entropy are "bits." The entropy of X can be seen as a measure of the uncertainty about the outcome of X. One interpretation is that the entropy (in bits) indicates the average number of yes / no type questions required to estimate the outcome of X using an optimal estimation strategy, and is the average number of bits per outcome required to encode the sequence of outcomes of X.

[0026] The conditional entropy H(X|Y) of discrete random variables X and Y is defined as follows:

[0027]

number

[0028] In Equation 2, x and y represent the specific results of X and Y, respectively, and P X (x) and P Y (y) are the probabilities of outcomes x and y, respectively, and P X|Y (x|y) is the conditional probability of outcome x given outcome y, and P XY where (x,y) is the joint probability distribution of X and Y, and b is an arbitrary logarithm base. The conditional entropy H(X|Y) can be interpreted as a measure of the uncertainty of X after observing Y.

[0029] The mutual information I(X;Y) of discrete random variables X and Y is defined as follows:

[0030]

number

[0031] In Equation 3, x and y represent the specific results of X and Y, respectively, and P X (x) and P Y (y) are the probabilities of outcomes x and y, respectively, and P XY (x,y) is the joint probability distribution of X and Y, and b is an arbitrary logarithm base.

[0032] From Equation 3, we can see that the mutual information I(X;Y) can be interpreted as the reduction in uncertainty of X after observing Y. Similarly, the mutual information I(X;Y) can be interpreted as the amount of information gained about X after observing Y, or the amount of information shared between X and Y. If the correlation between X and Y is relatively high, the mutual information I(X;Y) will be relatively high. Conversely, if the correlation between X and Y is relatively low, the mutual information I(X;Y) will be relatively low. If X and Y are completely uncorrelated, I(X;Y) = 0, and if X = Y, then I(X;Y) = H(X). Mutual information is symmetric with respect to its argument, I(X;Y) = I(Y;X).

[0033] As an example, in the one-time pad method mentioned above, a message M and an encrypted message M ε The mutual information between is equal to 0, i.e., I(M;M ε )=0. Therefore, Eve can send the encrypted message M ε does not reveal any information about the message M. It is this property that makes the above one-time pad scheme unconditionally secure as long as the one-time pad remains secret.

[0034] The above definitions of conditional entropy and mutual information can be extended to consider more than two discrete random variables. For example, for three discrete random variables X, Y, and Z, the conditional entropy H(X|YZ) can be interpreted as the uncertainty of X after observing Y and Z. The mutual information I(X;Y;Z) can be interpreted as the information shared between X, Y, and Z. The mutual information I(X;Y|Z) can be interpreted as the information shared between X and Y that is not shared with Z.

[0035] The relationships between various quantities associated with random variables can be schematically represented by a Venn diagram. For example, Figure 1 shows the relationships between various quantities associated with three random variables X, Y, and Z. The three overlapping circles represent H(X), H(Y), and H(Z), respectively. The quantities I(X;Y), H(Y|X), H(Z|XY), I(X;Y|Z), and I(X;Y;Z) are shown as shaded regions. Regions representing the conditional entropy and mutual information of other combinations of variables in Figure 1 can be inferred by symmetry.

[0036] Various exemplary techniques for deriving a shared secret between a first device and a second device will now be described. In the following examples, the first device may be referred to as Device A (Alice) and the second device may be referred to as Device B (Bob). However, those skilled in the art will understand that these labels are merely exemplary.

[0037] Figure 2 is a flowchart of an exemplary technique for deriving a shared secret between device A and device B. The left-hand side of Figure 2 shows operations performed by device A, and the right-hand side of Figure 2 shows operations performed by device B.

[0038] In this technique, devices A and B separately obtain their respective non-identical data sets (e.g., bit sequences). Then, through various operations and message exchanges, each device derives a respective reduced data set, such as by selectively discarding and retaining certain elements of the original data set, such that the reduced data sets tend to have a higher proportion of matching elements (e.g., matching bits) than the original data sets. The decision about which elements to discard and retain is made based on computing an entropy reduction function or statistical function (e.g., a parity function) of a subset of the data sets.

[0039] Statistical functions may include functions whose output includes statistical information based on the input. For example, statistical functions may be considered functions whose output "summarizes" the input in some respect. Entropy reduction functions may include functions that reduce the information content or entropy of the input to generate an output. For example, information content or entropy may be defined according to any known appropriate definition used in information theory. Entropy reduction functions may be considered functions whose output has lower complexity than the input. In certain examples, statistical functions may be considered a type of entropy reduction function. However, in other examples, the output of a statistical function does not necessarily have lower entropy than the input, depending on the definition used. The use of entropy reduction or statistical functions reduces the amount of information about a dataset revealed to a potential eavesdropper.

[0040] FIG. 3 shows an example of deriving a reduced dataset from a dataset.

[0041] These steps will now be described in more detail with reference to FIGS.

[0042] In step 201A, device A receives a first data set D A Get.

[0043] In a corresponding step 201B, device B receives a second data set D B Get.

[0044] Dataset D A and D B Each dataset D may contain a set of indexable elements, each of which may take on one of two or more values. For example, A and D B may each include a data sequence (e.g., a bit sequence).

[0045] Dataset D A and D Bmay each comprise a random data set. However, in other examples, the data sets may be non-random.

[0046] Dataset D A and D B However, the datasets contain at least some matching elements (e.g., D A At least some elements of D at the same index value B For example, if a data set contains a sequence of bits, then D A and D B The bit values of I(D A ;D B )>0. Certain techniques described herein aim to increase the redundancy of information, for example, until the data sets are identical or differ by less than a certain threshold.

[0047] Dataset D A and D B must remain secret (i.e., must remain unknown to unauthorized parties, such as potential eavesdroppers).

[0048] Devices A and B may use any suitable technique to generate data set D A and D BFor example, a random data set may be generated based on a pseudorandom number generator. In other examples, a random data set may be obtained based on one or more natural sources of randomness. For example, a known data set may be encoded into a signal, which may then be transmitted to a device over a noisy communication channel. The device may then compare the known data set with the data set obtained from the received signal to obtain an error signal, which forms the data set. Alternatively or additionally, a random data set may be obtained by sampling random noise in an electronic component. In certain examples, a non-random data set may be obtained by sampling an audio signal (e.g., obtained using a microphone) and / or an image signal (e.g., obtained using an imaging device). In other examples, a non-random data set may include a predetermined data set.

[0049] In the following, we consider dataset D A and D B Assume that x contains a sequence of bits. However, those skilled in the art will understand that the techniques described herein also apply to other types of data sets.

[0050] FIG. 3 shows an exemplary data set D containing the 16-bit sequence [0101 1100 0111 0010]. A 301A and an exemplary data set D containing the 16-bit sequence [0101 1111 1001 0010] B It shows 301B.

[0051] Following steps 201A and 201B, various steps described below are performed to generate data set D A and D B From dataset D A and D B Each reduced dataset D has a higher percentage of matching elements (e.g., matching bits) than A ' and D BSpecifically, D A A subset of and D B The corresponding subsets of are considered separately. An entropy reduction function or statistical function is calculated based on each subset, and based on the results, D A and D B The elements of are either discarded or kept. These steps are now explained in more detail.

[0052] D A and D B Each of the N subsets D A i and D B i For each i=1, 2,...,N; N>1, the following steps 203A, 203B, 205A (including 205'A), and 205B (including 205'B) are performed. This iteration is shown in Figure 2 as the dotted loops "for i=1 to N" and "next i". Each iteration of the loop finds a corresponding subset D with a particular index value i (i=1, 2,...,N; N>1). A i and D B i corresponds to the processing of a single pair of

[0053] N subsets D A i and D B i Each of these is D A and D B For example, N subsets D A i and D B i Each of these is D A and D B It may include a set of n (e.g., n=4) data elements (e.g., consecutive bits) of D A and D B Corresponding subsets of may contain elements of the respective data sets with the same index. For example, a first corresponding subset may beA and D B and the second corresponding subset may include the first 4 bits (or any other suitable number of bits) of D A and D B , and so on. In other examples, the bits in the subsets need not comprise a contiguous set of bits. The subsets may include the same number of bits. However, in other examples, at least some of the subsets may be of different sizes.

[0054] FIG. 3 shows each data set D divided into four exemplary subsets of four consecutive bits each. A 301A and D B In this example, D A 1 =

[0101] , D A 2 =

[1100] , D A 3 =

[0111] and D A 4 =

[0010] , and D B 1 =

[0101] , D B 2 =

[1111] , D B 3 =

[1001] and D B 4 =

[0010] .

[0055] In step 203A, device A A i Based on the first value V A i =M A (D A i ) is determined. In the specific example, M A may include an entropy reduction function or a statistical function. In a particular example, M A may include a filtering function.

[0056] In a corresponding step 203B, device B B i Based on the second value VB i =M B (D B i ) is determined. In the specific example, M B may include an entropy reduction function or a statistical function. In a particular example, M B may include a filtering function.

[0057] M A is M B For example, M A and / or M B may include one or more of a parity function, a Hamming distance function, a mean function, and a variance function. These functions, when applied to a bit sequence, may be defined as follows: i-th subset D A i =[a0,a1,…,a j ,…,a n ], a j Given ∈{0,1}, D A i The parity value of may be defined as follows:

number

number

number

number

[0058] In each of the above examples, the function M B (D B i ) can be defined similarly.

[0059] Figure 3 shows how the parity function can be used to calculate the value V A i 303A is subset D A i 301A, and the value V B i 303B is subset D B i Here is an example derived from 301B, for example: D A 1=

[0101] →V A 1 =[0] D B 1 =

[0101] →V B 1 =[0] D A 2 =

[1100] →V A 2 =[0] D B 2 =

[1111] →V B 2 =[0] D A 3 =

[0111] →V A 3 =[1] D B 3 =

[1001] →V B 3 =[0] D A 4 =

[0010] →V A 4 =[1] D B 4 =

[0010] →V B 4 =[1]

[0060] Function M A and M B can be chosen so that the input value cannot be determined from the output value. A (D A i ) to D A i It is not possible to determine M B (D B i ) to D B i For example, M A and M B Each of M can be defined such that multiple inputs map to the same output. This property allows a potential eavesdropper to A (D A i ) and M B (D B i ) based on DA i and D B i This allows confidentiality to be maintained since complete knowledge of the

[0061] Furthermore, these functions are A (D A i )≠M B (D B i ) in case of D A i ≠D B i That is, if the output values based on the two subsets are different, this means that the two subsets are not identical. For example, M A and M B Each of the subsets D can be defined such that two different outputs cannot be mapped to the same input. This property allows devices A and B to have corresponding subsets D that are definitely not matched. A i and D B i Such subsets may then be discarded to increase the probability of a match between the remaining subsets.

[0062] In steps 205A and 205B, devices A and B receive first and second values V A i and V B i For example, one or more messages are exchanged to determine whether a condition based on the function M A and M B If the same, the condition is V A i =V B i (shown separately as steps 205'A and 205'B in FIG. 2). A and M B If M is different, the conditions may be modified accordingly. Ais defined as the number of ones in the subset, and M B If is defined as "the number of 0s in the subset", then the condition is V A i =size-V B i where "size" is the number of bits in the subset.

[0063] In one example, the exchange of messages and the determination of whether the condition is met may include the following steps: First, device A receives a first value V A i may transmit a second value V to device B, which may then transmit a second value V B i may be sent to device A. Then, each of devices A and B may receive V A i and V B i Since devices A and B know both the first and second values V A i and V B i Based on the comparison, it may be determined whether the condition is met.

[0064] In another example, the exchange of messages and the determination of whether the condition is met may include the following steps: First, one of devices A and B (device X) sends a value V X i Then, V X i and V Y i Device Y knows both the value V and the X i and V Y i Device Y may then compare a value C i (For example, C for "mismatch" i =0 or C for "match" i =1) can be sent to device X.

[0065] In the example in Figure 2, each iteration of the loop selects the corresponding subset D A i and D B i In this case, the steps are {203A / B, then 205A / B} i where {X} i represents repeating X i times. Here, step 205'A / B is considered to be part of step 205A / B. Figure 4 is a message flow diagram corresponding to this case.

[0066] In certain alternatives, the steps may be performed in a different order. For example, steps 203A / B may be performed in a different order to select the corresponding subset D A i and D B i , and then steps 205A / B may be performed repeatedly for all pairs of the corresponding subset. In this case, steps {203A / B} i , then {205A / B} i In this case, the information about the different subsets communicated in steps 205A / B can be combined in a single message. For example, V for all values of i A i The values of i can be sent from device A to device B in a single message in the form of a list, and V for all values of i B i The values of i can be sent from device B to device A in a single message in the form of a list, and / or C for all values of i i The values of , can be sent in the form of a list in a single message from device Y to device X. Figure 5 is a message flow diagram corresponding to this case.

[0067] Following the steps above, devices A and B determine which corresponding subset D A i and D B iWe have obtained information that allows us to determine whether M is definitely not a match (i.e., whether the probability of a match is zero). For example, A and M B If are the same function, then the subsets that do not match exactly are V A i ≠V B i On the other hand, V A i =V B i The corresponding subset D of A i and D B i Although the ,may not match, the probability of a match is non-zero. By discarding corresponding subsets that definitely do not match while retaining corresponding subsets that have a non-zero probability of matching, the overall probability of a match between datasets increases, and the information overlap between datasets correspondingly increases (i.e., I(D A ;D B ) tends to increase.

[0068] As shown in FIG. 3, in step 305, V A i and V B i The values of V A i and V B i Depending on whether the values of A i and D B i In the example in Figure 3, the value V A i and V B i does not match at i=3, so there is a value mismatch (i.e., V A 3 = [1] and V B 3 =[0]) to the corresponding subset (i.e., D A 3 =

[0111] and D B 3=

[1001] ) are definitely not identical, so the subset D of i=3 A i and D B i is rejected. On the other hand, the value V A i and V B i matches for i=1, 2, 4, so the subset D for i=1, 2, 4 A i and D B i is retained because the matching value V A i and V B i is the corresponding subset D A i and D B i This is because the probability of a match is not zero. A i and V B i Among the subsets that match, for i=1 and 4, the corresponding subset D A i and D B i are consistent, but not consistent for i = 2. The inconsistent subset pair (i.e., i = 2) is retained, but rejecting the definitely inconsistent subset pair (i.e., i = 3) tends to increase the overall information overlap between the retained subsets.

[0069] Steps 203A, 203B, 205A, and 205B generate N subsets D A i and D B i , steps 207A and 207B are performed.

[0070] In step 207A, device A selects a subset D for which the above conditions are met. A i (i.e., the retained subset) based on the reduced dataset D A' to get.

[0071] In a corresponding step 207B, device B selects a subset D for which the above conditions are met. B i (i.e., the retained subset) based on the reduced dataset D B ' to get.

[0072] Reduced Dataset D A Obtaining ' may include the following steps: First, for each subset D X i About D X i Based on the corresponding subset D X i ' can be obtained. Then, the corresponding subset D X i ' to create a reduced dataset D X ' can be generated.

[0073] In the specific example, the corresponding dataset D X i 'D X i For example, D X i ' is D X i can be the same as

[0074] In the specific example, the corresponding dataset D X i 'D X i For example, the elements of D at predetermined bit positions may be included. X i Certain bits of ' can be discarded and the remaining bits are X i ' can be formed.

[0075] In the specific example, the corresponding dataset D X i 'D X iFor example, the function S may include a parity function. For example, X i The parity of a set of bits in can be calculated and the resulting single parity bit is D X i ' can be formed.

[0076] In the specific example, the corresponding dataset D X i 'D X i For example, the function S of a predetermined subset of elements of D at a predetermined bit position (e.g., a parity function) may be included. X i Certain bits of ' may be discarded and the parity of the remaining bits may be calculated, with a single parity bit being D X i ' can be formed.

[0077] However, D X i ' is D X i The obtained D is derived from X i ' may be combined in any suitable manner, for example by concatenation, interleaving, or any other suitable technique, to form D X ' can be formed.

[0078] Figure 3 shows subset D held by device A. A i 307A and subset D held by device B B i 3A and 3B. Figure 3 also shows an example where a reduced dataset may be obtained by retaining the first two bits of each retained subset, discarding the other bits, and concatenating the retained bits to form a reduced dataset. Reduced dataset D for device A A ' is shown in 309A, and the reduced data set D of device B is shown in B' is shown at 309B. In other examples, the reduced dataset may simply comprise the concatenation of the retained subsets shown at 307A and 307B.

[0079] As above, the reduced dataset D A ' and D B 'D A and D B is derived by excluding the subset of D that does not match A ' and D B ' and there is overlap of information between D A and D B the overlap of information between the A ';D B ')>I(D A ;D B ) tends to be. However, M(D A i )=M(D B i ) is D A i =D B i Since there is no guarantee, D A ' and D B ' may still have one or more non-matching subsets.

[0080] Therefore, in certain examples, the above process may be repeated to further increase the likelihood of information duplication. In particular, the determining steps (steps 203A and 203B), the exchanging steps (steps 205A and 205B), and the obtaining a reduced data set (steps 207A and 207B) may be repeated one or more times until one or more termination criteria 209A and 209B are met. Repeating these steps may result in a data set D used in a given iteration. A , D B is the reduced dataset D obtained in the previous iteration. A ' and D BAs shown in FIG. 2, in step 209A / B, if one or more termination criteria are not met, the method returns to step 203A / B; otherwise, the method ends.

[0081] The termination criteria 209A, 209B may be chosen so that, after the process is completed, the data sets (e.g., bit sequences) of devices A and B match or are likely to match (e.g., the probability of a match is greater than a particular threshold). For example, one or more termination criteria may include the number of iterations reaching a predetermined threshold. In this case, the threshold may be determined based on theoretical calculations, experiments, and / or simulations. For example, in a particular example, a threshold of 3 or 4 may be used.

[0082] Certain applications may require perfect agreement between the resulting data sets (e.g., bit sequences) of devices A and B, while other applications may not require perfect agreement. For example, if the data sets of devices A and B are used as a one-time pad for subsequent data communication, errors between the data sets will lead to errors in the data. However, in some applications, some errors may be tolerable, for example, if the data includes error-correcting codes.

[0083] Once the data sets (e.g., bit sequences) are obtained using the above techniques, they may be used to perform secure operations, e.g., secure communications, between devices A and B. For example, the data sets may be used as a one-time pad for transmitting data. In certain examples, if an error is detected in the transmitted data, this may be interpreted as an indication that the data sets did not match perfectly. In this case, the above process may be repeated. In some cases, further iterations of the method may be performed based on the existing data sets. However, in other examples, the entire process may be repeated from the beginning.

[0084] The above technique allows two devices to derive a shared secret between them. However, the technique can be extended to allow three or more devices to derive a shared secret between them. For example, as with two devices, in the case of three devices, each device obtains its own data set. Then, considering a subset of the data set, the three devices exchange messages with each other to identify and discard subsets that do not reliably match among all three devices. Then, as with two devices, each of the three devices derives a reduced data set based on the remaining subset. As with the two-device case, this process can be repeated until one or more termination criteria are met.

[0085] A particular example of the present disclosure may obtain a shared dataset based on processing an abstract dataset. In a particular example, a dataset (e.g., a binary data sequence) may be obtained based on one or more signals (e.g., physical signals), such as audio signals and / or light / image signals. A signal (e.g., an audio signal and / or a light / image signal) obtained by device A (e.g., via a user uttering a predetermined phrase and / or capturing an image of a predetermined object) may be divided into packets (corresponding to the above-mentioned subset), and each packet may be filtered to generate a filtered signal (corresponding to an entropy reduction function or statistical function applied to the packet). For example, an averaging filter may be applied to the packet. A similar process may be performed by device B. A comparison may then be performed between the filtered packets of devices A and B, and the filtered packets may be selectively discarded or retained based on the comparison to obtain a “reduced signal” (e.g., an audio signal and / or a light / image signal). This process may then be repeated as described above. The signal processing may be performed digitally or through analog processing, for example, using any suitable electronic components.

[0086] FIG. 6 illustrates an exemplary device (or apparatus) for deriving shared secret information and / or communicating with other devices. For example, the techniques disclosed in connection with FIGS. 2-5 may be implemented using the device disclosed in connection with FIG. 6. For example, device A and device B may include the device disclosed in connection with FIG. 6. Device 600 includes a processor (or controller) 601 for controlling the overall operation of device 600. For example, processor 601 may be configured to perform the operations described above for deriving shared secret information. Device 600 also includes memory 603 for storing information and data necessary for the operations described above. Device 600 also includes an external interface 605 for communicating with other devices via any suitable communication link (e.g., wired or wireless). For example, under the control of processor 601, external interface 605 may be configured to send and receive messages as described above.

[0087] In certain examples, device 600 may also include a user input / output (I / O) unit 607 to enable a user to interact with device 600. For example, user I / O unit 607 may include one or more input devices (e.g., a keyboard, a touchscreen, etc.) for inputting commands to device 600. User I / O unit 607 may include one or more output devices (e.g., a display, LEDs, a speaker, etc.) for outputting information (e.g., status information) to a user. In certain examples, if device 600 is configured to operate autonomously, user I / O unit 607 may be omitted. In some examples, device 600 may be configured to interface with other devices in close proximity. In this case, the interface between device 600 and the other devices may be a wired link or a relatively short-range communication link, such as a Bluetooth or NFC link. In other examples, device 600 may be configured to interface with other devices located remotely. In this case, device 600 may communicate with the other devices via a network such as the Internet.

[0088] The terms and words used in this specification are not limited to their bibliographic meaning, but are used solely to enable a clear and consistent understanding of the present disclosure.

[0089] The same or similar components may be shown in different drawings but may be designated with the same or similar reference numbers.

[0090] Detailed descriptions of elements, features, components, structures, configurations, functions, operations, processes, properties, characteristics, integers and steps known in the art may be omitted for clarity and conciseness and to avoid obscuring the subject matter of the present disclosure.

[0091] Throughout this specification, the words "comprises," "includes," "contains," and "has," as well as variations of these words, such as "comprise" and "comprising," mean "including but not limited to," and are not intended to (and do not) exclude other elements, features, components, structures, configurations, functions, operations, processes, properties, qualities, integers, steps, and / or groups thereof.

[0092] Throughout this specification, the singular forms "a," "an," and "the" include plural referents unless the context dictates otherwise. For example, a reference to an "object" includes a reference to one or more of such objects.

[0093] The term "substantially" means that the stated characteristic, parameter or value need not be achieved exactly, but that deviations or variations, including, for example, tolerances, measurement errors, limitations in measurement accuracy, and other factors known to those skilled in the art, may occur in an amount that does not interfere with the effect that the characteristic, parameter or value was intended to provide.

[0094] Throughout this specification, phrases of the general form "X for Y" (where Y is some action, process, function, activity, operation or step and X is some means for performing that action, process, function, activity, operation or step) encompass means X that is specially, but not exclusively, adapted, configured or arranged to perform Y.

[0095] It should be understood that any element, feature, component, structure, configuration, function, operation, process, property, nature, integer, step, and / or group thereof described herein in conjunction with a particular aspect, embodiment, example, or claim is applicable to any other aspect, embodiment, example, or claim disclosed herein, except where incompatible.

[0096] It will be understood that examples of the present disclosure may be realized in the form of hardware, software, or any combination of hardware and software. Any such software may be stored in any suitable form of volatile or non-volatile storage device or medium, such as, for example, ROM, RAM, memory chips, integrated circuits, or optical or magnetic readable media (e.g., CD, DVD, magnetic disk, or magnetic tape).

[0097] Particular examples of the present disclosure provide a computer program comprising instructions that, when the program is executed by a computer or processor, cause the computer or processor to perform a method according to any example, embodiment, aspect and / or claim disclosed herein. Particular examples of the present disclosure provide a computer or processor readable data carrier having stored thereon such a computer program.

[0098] The techniques described herein may be implemented using any suitably configured apparatus and / or system. Such an apparatus and / or system may be configured to perform a method according to any aspect, embodiment, example, or claim disclosed herein. Such an apparatus may include one or more elements, e.g., one or more of a receiver, transmitter, transceiver, processor, controller, module, unit, etc., each configured to perform one or more corresponding processes, operations, and / or method steps for implementing the techniques described herein. For example, an operation / function of X may be performed by a module configured to perform X (or an X module). An apparatus and / or one or more elements thereof may be implemented in hardware, software, virtualization functions instantiated on a suitable platform (e.g., on a cloud infrastructure), or any combination thereof.

[0099] While the present invention has been illustrated and described with reference to particular examples, it will be understood by those skilled in the art that various changes in form and details can be made therein without departing from the scope of the invention as defined by the appended claims.

Claims

1. A method for deriving a shared secret between a first device (A) and a second device (B), comprising: Data set D is generated by device A. Ａ and Device B creates dataset D Ｂ and D Ａ and D Ｂ Each of the N subsets D Ａ ｉ and D Ｂ ｉ For each of (i=1, 2, . . . , N; N>1), Device A Ａ ｉ Based on the first value V Ａ ｉ =M Ａ (D Ａ ｉ ), wherein M Ａ includes an entropy reduction function and / or a statistical function; Device B Ｂ ｉ Based on the second value V Ｂ ｉ =M Ｂ (D Ｂ ｉ ), wherein M Ｂ includes an entropy reduction function and / or a statistical function; The first and second values V Ａ ｉ and V Ｂ ｉ exchanging one or more messages between devices A and B to determine whether a condition based on Subset D for which the condition is satisfied by device A Ａ ｉ Based on this, the reduced data set D Ａ ' and Subset D for which the condition is satisfied by device B Ｂ ｉ Based on this, the reduced data set D Ｂ ' and A method comprising:

2. The first value V is then increased until one or more termination criteria are met. Ａ ｉ =M Ａ (D Ａ ｉ ) and said second value V Ｂ ｉ =M Ｂ (D Ｂ ｉ ), the step of exchanging one or more messages, and the step of determining the reduced data set D Ａ ' and the reduced data set D Ｂ Repeating the two steps of obtaining ' one or more times, further comprising the dataset used in a given iteration includes the reduced dataset obtained in a previous iteration; The method of claim 1.

3. The method of claim 2 , wherein the one or more termination criteria include a number of iterations reaching a predetermined threshold.

4. The data set D Ａ and D Ｂ 4. The method of claim 1, wherein each of the data sequences (e.g., bit sequences) comprises a data sequence.

5. The N subsets D Ａ ｉ and D Ｂ ｉ Each of these is D Ａ and D Ｂ 5. The method of claim 1, wherein the plurality of vertices comprises a mutually exclusive subset of:

6. The N subsets D Ａ ｉ and D Ｂ ｉ Each of these is D Ａ and D Ｂ 6. The method of claim 1, wherein the data element comprises a set of n (e.g., n=4) data elements (e.g., consecutive bits).

7. M Ａ is M Ｂ 7. The method of claim 1, wherein the function is the same as

8. M Ａ and M Ｂ The method of claim 1 , wherein {overscore (x)} comprises one or more of a parity function, a Hamming distance function, a mean function, and a variance function.

9. The exchanging of messages and determining whether the condition is met may include: Device A sends the first value V Ａ ｉ and Device B sends the second value V Ｂ ｉ and The first and second values V Ａ ｉ and V Ｂ ｉ determining whether the condition is met based on a comparison of 9. The method of claim 1, comprising:

10. The exchanging of messages and determining whether the condition is met may include: The value V is transmitted by one of the devices A and B (device X) to the other of the devices A and B (device Y). Ｘ ｉ and By device Y, the value V Ｘ ｉ and V Ｙ ｉ By comparing sending by device Y to device X a message indicating the result of said comparison; 8. The method of claim 1, comprising:

11. The reduced data set D Ａ 'Getting Each subset D for which the condition is satisfied Ｘ ｉ About D Ｘ ｉ The corresponding subset D based on Ｘ ｉ ' and The reduced data set D Ｘ ' to generate the corresponding subset D Ｘ ｉ ' and 11. The method of any one of claims 1 to 10, comprising:

12. The corresponding subset D Ｘ ｉ 'teeth, D Ｘ ｉ All elements of D Ｘ ｉ a given subset of elements of D Ｘ ｉ a function S of all elements of D Ｘ ｉ A function S of a given subset of elements of The method of claim 11 , comprising one of:

13. The method of claim 12 , wherein the function S comprises a parity function.

14. The data set D Ａ and D Ｂ 14. The method of claim 1, wherein each comprises a random data set.

15. A computer program comprising instructions which, when said program is executed by a computer or processor, cause said computer or processor to carry out a method according to any one of claims 1 to 14.

16. 16. A computer or processor readable data carrier having stored thereon a computer program according to claim 15.

Images