A cryptographic event to encrypt or decrypt data

Abstract

To provide a method and a device that provide a good compromise between the cryptographic security level and the performance.SOLUTION: A method includes: an initialization stage including a step of determining a temporary generation origin point G' which is equal to a first product such as G'=[d']G, d' is a first random scalar that forms an N-bit secret key, and G is the generation origin of an elliptic curve, and a step of determining a temporary key Q' equal to a second product such as Q'=[d']Q in which Q is a point of the elliptic curve forming a public key; and an encryption stage in which a second random scalar forms a second secret key k of M bits, M<N is satisfied, and a public key P is calculated as P=[k]G', coordinates of a midpoint SP1 of the elliptic curve are equal to a fourth product SP1=[k]Q', a derivation function (F1) is applied to derive at least one key, and data is encrypted on the basis of at least one key.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to the field of cryptography and, more particularly, to the execution of cryptographic processing events for encrypting data to be securely transmitted from a device to an external entity. The present invention is particularly concerned with encrypting an identifier of an embedded subscriber identity module and transmitting such an identifier in encrypted form for authenticating a communication terminal in a communication network. [Background technology]

[0002] In the communications field, "4G" refers to the fourth generation of mobile phone standards, equivalent to LTE-Advanced (IMT-Advanced). 4G networks include an IP-based network core and offer greater speeds and services than were possible with the previous 2G or 3G generations.

[0003] As is known, in order to access a mobile 4G network and to use the associated services, a communication terminal (such as a "smartphone" phone) must transmit identification data to be authenticated by the network. To achieve this, a subscriber identity module (such as a SIM card) is typically embedded in the terminal and transmits the subscriber's IMSI identifier (short for "International Mobile Subscriber identity") to the 4G network for authentication in the 4G network.

[0004] However, security issues and risks that infringe on private life have been pointed out regarding 4G. In particular, since there is no security when transmitting IMSI identifiers from terminals to the 4G network, subscribers are at risk of having their IMSI identifiers intercepted by malicious third parties called "IMSI interceptors" or "IMSI catchers". In fact, malicious third parties can remotely obtain confidential information (including IMSI) or track the movements of users of 4G terminals by using monitoring systems used to intercept mobile communication traffic. To achieve this, IMSI interceptors make themselves look like real ones by placing fake relay antennas between the telephone operator's network and the target client terminal.

[0005] The fifth generation of mobile phone standards, called 5G, is technically an evolution of LTE (short for Long Term Evolution) and offers better speeds and services. Currently, the 5G generation of communication networks introduces measures to enhance the security of users' private lives, in particular to counter unauthorized interception of subscriber identities when authenticating terminals with the 5G network.

[0006] 5G provides, inter alia, for cryptographic processing events performed by an embedded subscriber identity module (e.g. SIM, eSIM card type, short for "embedded SIM") to encrypt the subscriber's identifier (SUPI, short for "Subscription Permanent Identifier"), which is transmitted in encrypted form from the embedded subscriber identity module to the associated 5G network.

[0007] To achieve this, the embedded subscriber identity module includes cryptographic means capable of generating an encrypted identifier called "SUCI" (short for "Subscription Concealed Identifier") from the SUPI identifier and an encryption key. By providing the encrypted identifier SUCI, the terminal client can be securely authenticated in the network and receive a temporary identifier in place of the encrypted identifier SUCI, allowing it to be repeatedly authenticated in the network.

[0008] FIG. 1 shows diagrammatically a communications terminal 2 of a user UR, which can cooperate with a 5G mobile network (notation 6) via an access point 4 (or for example a relay antenna). In this example, the terminal, in response to the reception (S2) of a request RQ1 coming from the access point 4, generates (S4) an encrypted identifier SUCI by means of an embedded subscriber identity module 3. The encrypted identifier SUCI is transmitted (S6) in a message MSG1 to the access point 4, which determines (S8) from the SUCI that the network 6 is the network associated with the subscriber UR. It should be noted that the access point 4 usually does not have the necessary means to decrypt the identifier SUCI itself.

[0009] The access point 4 transmits (S10) the encrypted identifier SUCI (together with other relevant information) to the network 6, which then transmits the encrypted identifier SUCI as DecryptionThe network 6 then determines (S12) the SUPI identifier of the subscriber and deduces therefrom the SUPI identifier. Both the network 6 and the subscriber identity module 3 perform a mutual authentication procedure and set up a secure channel (step S14). Once this step S14 is completed, the network 6 transmits the SUPI identifier in decrypted form to the access point 4 (S16). From the SUPI, the access point determines (S18) a temporary identifier called "5G-GUTI" and records this together with the SUPI identifier of the subscriber UR. The access point 4 also transmits (S20) the temporary identifier 5G-GUTI to the embedded subscriber identity module 3, which records the temporary identifier 5G-GUTI locally (S22).

[0010] After this, the embedded subscriber identity module 3 can be repeatedly authenticated in the network 6 by means of its temporary identifier 5G-GUTI, which the network 6 sends to the access point 4. In this way, the user identifier SUPI is never communicated in decrypted form between the terminal 2 and the access point 4, thereby preventing any unauthorized interception of the SUPI by malicious third parties monitoring the communications. Also, the access point 4 can repeatedly update (S24) the temporary identifier 5G-GUTI assigned to the embedded subscriber identity module 3, limiting the risk of the terminal 2 being tracked by malicious third parties.

[0011] As shown in Figure 2, the embedded subscriber identity module 3 can then be authenticated again by sending its current temporary identifier 5G-GUTI to the access point 4 (S30), which then consults its database to retrieve the associated SUPI identifier (S32). The access point 4 then sends the SUPI identifier retrieved from its database to the network 6 (S34). The network 6 can now perform a new procedure for authentication and set up a secure channel from the SUPI (S36).

[0012] By the method mentioned above, Client TerminalThe subscriber's SUPI identifier is protected when authenticating with the 5G network, thereby limiting the risk of unauthorized interception by malicious third parties, and therefore better protecting users' personal information and private life.

[0013] However, the identifier SUPI encryption The cryptographic processing events required to do this are quite resource and processing time intensive. Client Terminal However, there is a problem that the performance will be reduced when accessing the 5G network and using related services.

[0014] Whether in 5G networks or other types of communication networks, there is currently no satisfactory cryptographic solution to obtain a good compromise between a high level of security of the subscriber's identifier and effective access to the communication network (fast and secure authentication). More generally, there is a need for an effective cryptographic process for encrypting or decrypting any data (whether this is a SUCI identifier or other data in another form) while providing a good compromise between the security level of the encryption and the performance of the encryption (consumption of resources, processing time, etc.). Summary of the Invention

[0015] To this end, the invention relates to a first cryptographic processing method executed by a first device, enabling the encryption of data. More particularly, the object of the invention is a first cryptographic processing method executed by a device interoperating with a second system, said method comprising the steps of: An initialization phase, determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits and G is a generator point of an elliptic curve; determining a pseudo-key Q', said pseudo-key Q' being equal to a second product such that Q'=[d']Q, where Q is a point on said elliptic curve that forms a public key associated with said second system; an initialization phase including The encryption step, Determining a second random scalar forming a second secret key k of M bits, <Nである、ステップと、 calculating a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; calculating at least one coordinate of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving at least one key by applying a key derivation function to the at least one coordinate of the intermediate point SP1; encrypting data using at least one of the keys derived in said derivation to obtain encrypted data; transmitting the public key P and the encrypted data to the second system for decryption by the second system; an encryption stage including Includes.

[0016] The invention implements a first cryptographic process based on an elliptic curve (for example of the Diffie-Hellman type), which generates a shared secret (or common secret) for securely encrypting data by achieving a good compromise between the level of security achieved and the necessary consumption of resources and processing time. To achieve this, the generator point G and the public key Q are used to calculate, respectively, the public key P and the intermediate point SP1 (or at least one coordinate of SP1), which are replaced, respectively, by a pseudo generator point G' and a pseudo key Q' obtained in an initialization phase, these parameters G' and Q' both depending on the same secret key d' coded on N bits.

[0017] A particularly high level of security is achieved by using a first private key d' coded on N bits to determine the pseudo origin point G' and the pseudo public key Q'. The pseudo origin point G' and the pseudo public key Q' appear in the calculation of the public key P and the coordinates of the midpoint SP1 in the encryption stage, enhancing the security of these calculations. In this way, the values ​​of the public key P and the coordinates of the midpoint SP1 depend not only on the second private key k (coded on M bits) but also on the first private key d' (coded on N bits).

[0018] Also, by dividing the calculation of the public key P and the coordinates of the midpoint SP1 into two stages, it is possible to limit the resources required by the device to determine the public key P and the coordinates of the midpoint SP1, or at least to improve the management of these resources. In the initialization stage, the device can obtain the provisional origin point G' and / or the provisional key Q' from outside, or can determine the provisional origin point G' and / or the provisional key Q' by calculation at the appropriate time, for example upstream of the encryption stage, for example during a period of inactivity, or at least when the necessary resources are available. Thus, the speed of encryption of data can be increased by pre-determining in the initialization stage the provisional origin point G' and the provisional key Q' that are immediately available when the encryption stage is started, regardless of the data to be encrypted.

[0019] The present invention performs the most expensive cryptographic calculations in terms of time and resources in an initialization phase before the encryption phase begins. The initialization phase is where the most expensive calculations are concentrated, since the first private key d' is coded with more bits than the second private key k. Therefore, the calculations in the encryption phase are less expensive, since k, which appears in the third and fourth products, is lower in resolution.

[0020] According to one embodiment, during the initialization phase, the provisional origin point G' and the provisional key Q' are received from outside the device. The provisional origin point G' and the provisional key Q' can be registered in the device, for example in a non-volatile memory of the device, so that they can be later retrieved and used during the encryption phase. Thus, according to this embodiment, the device does not need to calculate the provisional origin point G' and the provisional key Q'.

[0021] According to a particular example, the method comprises a step of obtaining the data to be encrypted (before said encryption step of said data). These data can be obtained or determined in any manner. According to a particular example, the determination of the private key k, the calculation of the public key P and the calculation of at least one coordinate of the intermediate point SP1 or the derivation of at least one key are performed in advance, i.e. before the step of obtaining the data to be encrypted.

[0022] According to one embodiment, said public key P enables said second system to recalculate said coordinates of at least one of said intermediate points SP1 from a scalar forming a private key (denoted a) of said second system, where SP1=[a]P, The coordinates of at least one of the intermediate points SP1 enable the second system to decrypt the encrypted data.

[0023] According to one embodiment, N=256 bits and M=32 bits, 48 ​​bits, 64 bits or 128 bits.

[0024] According to one embodiment, the initialization stage comprises: determining the first random scalar that forms the first private key d' of N bits; calculating the provisional origin point G', the provisional origin point G' being equal to the first product such that G'=[d']G; calculating a provisional key Q′, said provisional key Q′ being equal to said second product such that Q′=[d′]Q; Includes.

[0025] According to one embodiment, the method comprises, after the initialization stage, a step of registering said pseudo generator G' and said pseudo key Q' in a non-volatile memory of said device.

[0026] According to one embodiment, said encryption stage is initiated upon detection of at least one event, said initialization stage being performed prior to said detection.

[0027] According to one embodiment, in the derivation of at least one key, an encryption key, an initialization vector and a MAC key are generated by applying the key derivation function to the coordinates of at least one of the intermediate points SP1, The encryption is converting the encryption key and the initialization vector into the data encryption applying a cryptographic function to - calculating an authentication code MAC from the encrypted data and the MAC key; Including, Apart from the public key P and the encrypted data, the device transmits the authentication code MAC(MC1) to the second system for authentication by the second system. but Verify the integrity of the encrypted data to enable .

[0028] According to one embodiment, the device performs at least two successive iterations of the encryption step from the pseudo origin point G′ and the pseudo key Q′ determined during the initialization step to derive data to be sent to the second system for decryption. encryption do.

[0029] In other words, by using the same provisional origin point G' and the same provisional key Q' determined in the initialization stage, it is possible to perform multiple iterations of the encryption stage, which can further reduce the consumption of resources and processing time required to perform data encryption. Therefore, in the present invention, since there is no need to perform an initialization stage before each encryption stage, the processing performed by the device can be further accelerated.

[0030] According to one embodiment, for at least one iteration of the encryption stage, the pseudo generator G' and the pseudo key Q' used in the current iteration are equal to the public key P and the intermediate point SP1, respectively, calculated in the previous iteration of the encryption stage.

[0031] According to one embodiment, when it is detected from the pseudo origin point G′ and the pseudo key Q′ determined during the initialization phase that the device has performed at least X successive iterations of the encryption phase and transmitted encrypted data to the second system, the method also comprises the steps of: performing a new iteration of the initialization phase in order to update said provisional generator G' and said provisional key Q' from a new first secret random key d' different from the first random key determined in the previous iteration of the initialization phase; using the updated pseudo-generator G' and the updated pseudo-key Q' in at least one subsequent iteration of the encryption step to transmit new encrypted data to the second system; Including, X is an integer such that X≧1.

[0032] Thus, the device is Parameters G' and Q' can be periodically updated to enhance security while maintaining good processing performance., for example, the device can be authenticated in the network multiple times. In particular, by periodically updating the parameters G' and Q' (and therefore the first secret key d'), it is possible to prevent a malicious third party from tracking the device while it is registered as an embedded subscriber identity module in the communication network. In fact, it is difficult for a third party to track the user based on the public keys P exchanged in the encryption stages or in the various iterations of the method, because these keys are not only differentiated by this secret key k, but also by this secret key k and the pseudo origin point G'.

[0033] According to one embodiment, the first method comprises: the second system is a communications network; the device being an embedded subscriber identity module of the terminal for authenticating the terminal with the communications network; said data including an identifier of said embedded subscriber identity module; In said encrypting, said identifier is encrypted based on at least one of said keys derived in said derivation to obtain an encrypted identifier; In said transmission, said public key P and said encrypted identifier are transmitted to an access point of said communication network so that said embedded subscriber identity module is authenticated in said communication network. It is something like this.

[0034] According to one embodiment, said encryption stage is initiated upon detection of at least one event, said initialization stage being performed prior to said detection, At least one of the events includes receiving a request from the access point of the communications network to register the embedded subscriber identity module with the communications network.

[0035] According to one embodiment, the communication network is a 5G mobile network and the identifier of the embedded subscriber identity module is a SUPI identifier.

[0036] The invention improves in particular the cryptographic processing events performed by the embedded Subscriber Identity Module to encrypt the subscriber's SUPI identifier and achieves a good compromise between the level of security achieved and the necessary expenditure of resources and processing time.

[0037] In a particular embodiment, further steps of the first cryptographic processing method are determined by computer program instructions.

[0038] Consequently, another object of the invention is also a computer program on a data carrier (or recording medium), likely to be executed on a cryptographic processing device, or more generally on a computer (or any device including a processor, such as, for example, an embedded subscriber identity module), which program comprises instructions arranged to carry out the steps of the first cryptographic processing method as defined in the present specification.

[0039] Another object of the invention is a computer readable recording medium (or data carrier), comprising instructions of a computer program as described above.

[0040] Another object of the invention is a corresponding first cryptographic processing device arranged to carry out the first cryptographic processing method of the invention.

[0041] The present invention particularly relates to a cryptographic processing device capable of cooperating with a second system, The cryptographic processing device includes: an initialization module configured to perform an initialization phase, The initialization step comprises: determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits and G is a generator point of an elliptic curve; determining a pseudo-key Q', said pseudo-key Q' being equal to a second product such that Q'=[d']Q, where Q is a point on said elliptic curve that forms a public key associated with said second system; an initialization module including: An encryption module configured to perform an encryption step, The encryption step comprises: Determining a second random scalar forming a second secret key k of M bits, <Nである、ステップと、 calculating a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; calculating at least one coordinate of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving at least one key by applying a key derivation function to the at least one coordinate of the intermediate point SP1; encrypting data based on at least one of the keys derived in said derivation to obtain encrypted data; transmitting the public key P and the encrypted data to the second system for decryption by the second system; a cryptographic module including: Includes.

[0042] According to a particular embodiment, the first device includes a memory configured to store a provisional generator G' and a provisional key Q' determined by the initialization module.

[0043] It should be noted that the different embodiments described above (and the embodiments described below) in relation to the first cryptographic processing method of the present invention, and the associated advantages, apply equally to the first cryptographic processing device of the present invention.

[0044] For each step of the first cryptographic processing method, the first cryptographic processing device of the present invention may include a corresponding module configured to perform said step.

[0045] The invention also applies equally to the decryption of encrypted data. The object of the invention is in particular a second cryptographic processing method executed by a second cryptographic processing device, which performs the decryption of encrypted data according to the first cryptographic processing method defined above (and described below). method It is possible to decode the data based on a similar principle.

[0046] A particular object of the present invention is a second cryptographic processing method executed by a device associated with a second system, said method teeth, An initialization phase, determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits and G is a generator point of an elliptic curve; determining a pseudo-key Q', said pseudo-key Q' being equal to a second product such that Q'=[d']Q, where Q is a point on said elliptic curve that forms a public key associated with said second system; an initialization phase including A decoding step, Determining a second random scalar forming a second secret key k of M bits, <Nである、ステップと、 calculating a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; transmitting said public key P to a second system; receiving encrypted data originating from the second system; calculating at least one coordinate of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving at least one key by applying a key derivation function to the at least one coordinate of the intermediate point SP1; decrypting the encrypted data based on at least one of the keys derived in the derivation to obtain decrypted data; a decoding stage comprising: Includes.

[0047] It should be noted that the different embodiments described above (and below) in relation to the first cryptographic processing method of the present invention, and the associated advantages, apply equally to the second cryptographic processing method of the present invention.

[0048] More specifically, according to one embodiment, in the initialization phase, the provisional origin point G' and the provisional key Q' are received from outside the device. The provisional origin point G' and the provisional key Q' can also be registered in the device, for example in a non-volatile memory of the device, so that they can be later retrieved and used in the encryption phase. Thus, according to this embodiment, the device does not need to calculate the provisional origin point G' and the provisional key Q'.

[0049] According to a particular example, the calculation of at least one coordinate of the intermediate point SP1 or said derivation of at least one key is performed in advance, ie before the step of receiving the encrypted data.

[0050] According to a particular embodiment, the public key P is but Based on the scalar that forms the secret key of the second system (denoted as a), Before Calculate at least one of the coordinates of the intermediate point SP1. to make it possible , where SP1=[a]P, The coordinates of at least one of the intermediate points SP1 enable the second system to encrypt data and obtain the encrypted data. .

[0051] According to a particular embodiment, N=256 bits and M=32 bits, 48 ​​bits, 64 bits or 128 bits.

[0052] According to a particular embodiment, the initialization phase comprises: determining a first random scalar forming the first private key d' of N bits; calculating a provisional generator point G', where G' is equal to a first product such that G'=[d']G; calculating a provisional key Q′, where Q′ is equal to a second product such that Q′=[d′]Q; Includes.

[0053] According to a particular embodiment, method comprises, after an initialization phase, the step of registering a provisional generator G' and a provisional key Q' in a non-volatile memory of the device.

[0054] According to a particular embodiment, the decoding phase is initiated upon detection of at least one event, said initialization phase being performed prior to said detection.

[0055] According to a particular embodiment, in said derivation of at least one key, a decryption key, an initialization vector and a MAC key are generated by applying a key derivation function to said at least one coordinate of the intermediate point SP1, The decoding step comprises: applying a decryption function based on the decryption key and the initialization vector to decrypt the encrypted data; calculating an authentication code (MAC) based on the encrypted data and the MAC key to verify the integrity of the received encrypted data; Includes.

[0056] According to a particular embodiment, the device performs at least two successive iterations of the decryption step based on the provisional origin point G' and the provisional key Q' determined during the initialization step in order to decrypt the encrypted data received from the second system.

[0057] According to a particular embodiment, for at least one iteration of the decryption stage, the pseudo generator G' and the pseudo key Q' used in the current iteration are equal to the public key P and the intermediate point SP1, respectively, calculated in the previous iteration of the decryption stage.

[0058] According to a particular embodiment, when it is detected from the provisional origin point G' and the provisional key Q' determined during the initialization phase that the device has performed at least X successive iterations of the decryption phase to decrypt encrypted data received from the second system, method Also, performing a new iteration of the initialization phase in order to update said provisional generator G' and said provisional key Q' on the basis of a new first secret random key d' different from the first random key determined in the previous iteration of the initialization phase; the updated pseudo-generator G' and the updated pseudo-key Q' are used in at least one subsequent iteration of the decryption step to decrypt new encrypted data received from the second system; Including, X is an integer such that X≧1.

[0059] Consequently, another object of the invention is a computer program on a data carrier (or recording medium), likely to be executed on a cryptographic processing device, or more generally on a computer (or any device including a processor, such as, for example, an embedded subscriber identity module), which program comprises instructions arranged to carry out the steps of the second cryptographic processing method as defined in the present specification.

[0060] Another object of the invention is a computer readable recording medium (or data carrier), comprising instructions of a computer program as described above.

[0061] The computer programs described in this disclosure may be written in any programming language. Use It should be noted that the program may be in the form of source code, object code, or an intermediate code between source code and object code, such as a partially compiled form, or any other suitable form.

[0062] Another object of the invention is a data carrier (or recording medium) readable by an embedded subscriber identity module, or more generally by a computer, which contains instructions of a computer program as defined herein.

[0063] Moreover, the registration medium mentioned in this disclosure may be any entity or device capable of storing a program. For example, the medium may include a storage means such as a rewritable non-volatile memory or ROM, for example, a CD ROM, a ROM of a microelectronic circuit, or a magnetic registration means, for example, a disk (floppy disk) or a hard disk.

[0064] On the other hand, the data carrier may be a transmissible medium, such as an electrical or optical signal, which can be transmitted via electrical or optical cable, by radio or by other means. The program according to the invention may in particular be downloaded via a network of the Internet type.

[0065] Alternatively, the data carrier may be an integrated circuit having a program embedded therein, the circuit being adapted to method The present invention is configured to perform, or be used in performing,

[0066] Another object of the invention is a corresponding second cryptographic processing device arranged to carry out the second cryptographic processing method of the invention.

[0067] The present invention particularly relates to a cryptographic processing device capable of cooperating with a second system, The cryptographic processing device includes: an initialization module configured to perform an initialization phase, The initialization step comprises: determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits and G is a generator point of an elliptic curve; determining a pseudo-key Q', said pseudo-key Q' being equal to a second product such that Q'=[d']Q, where Q is a point on said elliptic curve that forms a public key associated with said second system; an initialization module including: a decoding module configured to perform a decoding step, The decoding step includes: Determining a second random scalar forming a second secret key k of M bits, <Nである、ステップと、 calculating a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; transmitting said public key P to a second system; receiving encrypted data transmitted from the second system; calculating at least one coordinate of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving at least one key by applying a key derivation function to the at least one coordinate of the intermediate point SP1; decrypting the encrypted data based on at least one of the keys derived in the derivation to obtain decrypted data; a decoding module including: Includes.

[0068] According to a particular embodiment, the second device includes a memory configured to store the provisional generator G' and the provisional key Q' determined by the initialization module.

[0069] It should be noted that the different embodiments described above (and the embodiments described below) in relation to the second cryptographic processing method of the present invention, and the associated advantages, apply equally to the second cryptographic processing device of the present invention.

[0070] For each step of the second cryptographic processing method, the second cryptographic processing device of the present invention may include a corresponding module configured to perform said step.

[0071] According to one embodiment, the present invention is implemented by software and / or hardware components, and in this respect the term "module" may correspond herein to both software and hardware components, or to a set of hardware and software components.

[0072] A software component corresponds to one or more computer programs, one or more subprograms of a program, or more generally, any element of a program or software capable of performing a function or set of functions according to what is described below for the module in question. Similarly, a hardware component corresponds to any element of a hardware assembly (or hardware) capable of performing a function or set of functions according to what is described herein for the module in question. A hardware component may be a programmable hardware component or may have an integrated processor for executing software, a hardware component may be, for example, an integrated circuit, a smart card, a memory card, a ,centre Firmware A and the electronic platform for executing it. [Brief description of the drawings]

[0073] Other characteristics and advantages of the invention will become apparent from the following description with reference to the attached drawings which show an embodiment with non-limiting characteristics.

[0074] [Figure 1] FIG. 1 is a diagram that illustrates a schematic diagram of a conventional authentication process for a communication terminal in a 5G network. [Diagram 2] FIG. 2 is a diagram that illustrates a conventional authentication update process for a communication terminal in a 5G network. [Diagram 3] FIG. 3 shows diagrammatically the steps of a method for encrypting a subscriber's identity for authentication in a 5G network. [Figure 4] FIG. 4 shows diagrammatically the steps of the method for decoding a subscriber's identifier performed by a 5G network. [Diagram 5] FIG. 5 illustrates a cryptographic processing apparatus for authenticating a user communications terminal in a communications network according to a particular embodiment of the present invention. [Figure 6] FIG. 6 illustrates functional modules performed by a cryptographic processor according to a particular embodiment of the present invention. [Figure 7-1] FIG. 7-1 illustrates diagrammatically the steps of a cryptographic method performed by a cryptographic processor in accordance with a particular embodiment of the present invention. [Figure 7-2] FIG. 7-2 illustrates diagrammatically the steps of a cryptographic method performed by a cryptographic processor in accordance with a particular embodiment of the present invention. [Figure 8] FIG. 8 shows diagrammatically the steps of a cryptographic method performed by a communications network according to a particular embodiment of the invention. [Figure 9] FIG. 9 illustrates diagrammatically the steps of a cryptographic method performed by a cryptographic processor according to a particular embodiment of the invention. [Figure 10] FIG. 10 illustrates diagrammatically the steps of a cryptographic method performed by a cryptographic processor in accordance with a particular embodiment of the present invention. [Figure 11] FIG. 11 illustrates diagrammatically the steps of a cryptographic method performed by a cryptographic processor according to a particular embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0075] The invention proposes to carry out cryptographic processing events in order to encrypt or decrypt data and to achieve a good compromise between security level and processing expenditure. The object of the invention is in particular, but not exclusively, to encrypt a subscriber's identifier for authenticating a user in a communication network (for example a SUPI identifier with a view to being authenticated in a 5G network). encryption However, the invention more generally encrypts or decrypts any data, whether that data is an identifier of a subscriber to a communications network, or any other suitable data.

[0076] In particular, the present invention establishes a common secret (or shared secret) for either transmitting encrypted data from the device to a third party entity, or for decrypting encrypted data received in encrypted form.

[0077] The invention provides, inter alia, a cryptographic processing method executed by a cryptographic processing device (hereafter also called "device" or "processing device"), which comprises an initialization phase during which the device determines a provisional origin point G' and a provisional key Q' of an elliptic curve, and an encryption phase during which the device determines a public key P based on the origin point G' and encrypts data based on the provisional key Q'. The device is thus able to transmit the public key P and the encrypted data to a system called "second system".

[0078] According to different of its embodiments, the invention more particularly provides a cryptographic processing method executed by a device associated with a second system, said method comprising: method teeth, An initialization phase, determining a provisional generator point G', where G' is equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits and G is a generator point of the elliptic curve; determining a pseudo-key Q', where Q' is equal to a second product such that Q'=[d']Q, where Q is a point on the elliptic curve that forms a public key associated with the second system; an initialization phase including The encryption step, Determining a second random scalar forming a second secret key k of M bits, <Nである、ステップと、 calculating a public key P associated with the device, where the public key P is equal to a third product such that P=[k]G′; calculating at least one coordinate of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving at least one key by applying a key derivation function to the at least one coordinate of the intermediate point SP1; encrypting data based on at least one of the keys derived in said derivation to obtain encrypted data; transmitting the public key P and the encrypted data to the second system for decryption by the second system; an encryption stage including Includes.

[0079] Another object of the invention is a corresponding device and a corresponding computer program.

[0080] Another object of the present invention is to provide a method for encrypting data based on the same principle as the encryption processing method of the present invention. Decryption In order to method Another object of the invention is a corresponding device and a corresponding computer program.

[0081] Other aspects and advantages of the present invention will be apparent from the following detailed description of the preferred embodiments with reference to the above-mentioned drawings.

[0082] An exemplary embodiment of the invention is described herein in the form of an embedded subscriber identity module arranged to authenticate a user of a communications terminal in a 5G type communications network. To achieve this, the embedded subscriber identity module (e.g. a SIM card or an eSIM module) performs a cryptographic process to encrypt the user's SUPI identifier.

[0083] The SUPI identifier may be in the form of a concatenation of decimal numbers (e.g., 15 digits), although there are various implementations possible. According to a particular example, the SUPI identifier is: A three-digit number representing the "Mobile Country Code" (MCC), - Another two or three digit number that constitutes the "Mobile Network Code" (MNC) identifying the operator network; and The remaining digits (9 or 10 digits) that make up the MSIN (Subscriber Identification Number), an identifier that identifies a user of the operator network, consecutively.

[0084] However, it should be noted that the invention is not limited to this particular example, but applies more generally to the encryption or decryption of any data by the cryptographic processing device of the invention. The data to be encrypted (or decrypted) may be or include, for example, an identifier of a subscriber of a communication network (5G type or other), or other data, such as personal data or sensitive data. The invention also applies to encryption or decryption of data in forms other than authentication in a communication network.

[0085] It should be noted that the subscriber identity module embedded in the communication terminal can take several forms, in particular elements of different formats. Thus, the embedded subscriber identity module can take the form of a SIM card (or UICC, short for "Universal Integrated Circuit Card") or an eSIM card, also called eUICC. Another example of a secure element is the embedded secure element, called eSE (short for "embedded Secure Element"), which is typically soldered to the host terminal. The principles of the invention are therefore applicable to different types of secure elements (e.g. a combination of SIM, eSIM card, eUICC, SE, eSE or secure element).

[0086] Unless otherwise stated, elements that are common or similar among the several figures are given the same reference numbers and indicate the same or similar features, and therefore these common elements will generally not be described again for the sake of simplicity.

[0087] In order to more clearly understand the invention described below in one of its specific embodiments, the encryption of the SUPI identifier method and decoding of the identifier SUCI method 3 and 4 according to specific examples not embodying the inventive concepts, in which subscriber authentication in a 5G network is described.

[0088] More precisely, as shown in Fig. 3, it is envisaged that the communication terminal 2 incorporates a subscriber identity module 3, which for example takes the form of a SIM card. This SIM3 card in particular authenticates the user UR in a 5G communication network (notation 6) via an access point 4 of said network. To achieve this, the SIM3 card comprises means for carrying out various processes of cryptographic processing events based on an elliptic curve ε appropriately selected by the person skilled in the art. The SIM3 card in particular comprises in its memory a generator point G of the elliptic curve ε, a public key Q of the network 6, a SUPI identifier, a key derivation function F1 and an encryption function F2.

[0089] In a generation step S40, the SIM3 card randomly generates a scalar forming a private key k. This key k is assumed to be coded on M bits, where M is equal to 256. The SIM3 card then calculates (S42) a public key P associated with the SIM3 card based on the private key k and an origin point G. To achieve this, the SIM3 card calculates (S42) the product of k and G such that

[0090] [Number 1] P = [k] G

[0091] It should be noted that, in this document, this notation denotes the product (or multiplication) of a scalar (denoted between "[ ]") and an elliptic curve point (denoted without brackets). Thus, according to an equivalent notation (interchangeable in this document), a public key P can also be written as:

[0092] [Number 2] P = k G

[0093] Next, the SIM3 card calculates (S44) at least one coordinate CD1 (for example a coordinate in direction x and / or direction y) of a point SP1 (called midpoint) of the elliptic curve ε. This midpoint SP1 is equal to the product of the private key k and the public key Q of the network 6, which is given by:

[0094] [Number 3] SP1=[k]Q

[0095] In this example, it is assumed that the SIM3 card determines only a single coordinate CD1 (eg a coordinate in the x or y direction) of the intermediate point SP1.

[0096] therefore, In step S46, the SIM3 card derives a key (or a parameter) by applying a key derivation function F1 to the coordinate CD1 of the midpoint SP1. and In this example, the SIM3 card derives an encryption key KY1, an initialization vector V1, and optionally a MAC key ("message authentication code") (noted KMAC1).

[0097] By way of example, the function F1 may be the derivation function provided in the standard "ANSI X9.63 Key Derivation Function, §5.6.3", but it could also be any other function.

[0098] The SIM3 card can then cipher or encrypt (S48) the SUPI identifier based on the key (or data) obtained in the derivation step S46 to obtain an encrypted identifier SUCI which is equal to the SUPI identifier in encrypted form. More precisely, the SIM3 card determines the encrypted identifier SUCI by encrypting the subscriber SUPI identifier (or a subpart of the subscriber SUPI identifier). To achieve this, the SIM3 card applies an encryption function F2 to the SUPI identifier (or a subpart of the SUPI identifier) ​​by using the encryption key KY1 and the initialization vector V1 to obtain the encrypted identifier SUCI. The SIM3 card also calculates an authentication code MAC (notation MC1) of the encrypted identifier SUCI based on the key KMAC1, for example by applying a MAC calculation function. The MAC calculation function used may for example be HMAC (FIPS 198-1, July 2008) with SHA-256 (FIPS 180-4 §6.2, August 2015).

[0099] By way of example, the function F2 may be the encryption function AES (FIPS 197) in counter mode as provided in the standard "SP800-38a §6.5".

[0100] Then, via its access point 4, the SIM3 card transmits the public key P and the encrypted identifier SUCI with the authentication code MAC MC1 to the network 6 (S50). The SIM3 card transmits, for example, the encrypted identifier SUCI with the authentication code MC1 inserted. The public key P is, for example, integrated into the encrypted identifier SUCI, but other implementations are also possible.

[0101] The public key P enables the network 6 to decrypt the identifier SUCI to obtain the SUPI identifier in decrypted form, while the authentication code MAC MC1 enables the network 6 to verify the integrity of the encrypted identifier SUCI received from the SIM3 card, as will be described below.

[0102] More precisely, as shown in FIG. 4, originating from the SIM card 3 and via an access point 4, the network 6 receives (S60) the public key P of the SIM card and the encrypted identifier SUCI accompanied by an authentication code MAC (MC1).

[0103] Network 6 stores in memory a private key (denoted a) associated with said network 6, a derivation function F1, and a decryption function F3.

[0104] In a calculation step S62, the network 6 calculates at least one of said coordinates CD1 of a midpoint SP1 of the elliptic curve ε. In this example, the network 6 therefore calculates a single coordinate CD1 (for example a coordinate in the x or y direction) used by the SIM3 card to encrypt the SUPI identifier. To achieve this, the network 6 determines the coordinate CD1 of the midpoint SP1. This midpoint is equal to the product of the private key a and the public key P, as defined below.

[0105] [Number 4] [a]P=[a][k]G=[k][a]G=[k]Q=SP1

[0106] Here, the public key Q of the network 6 is equal to the product of the private key a and the generator point G, as defined below.

[0107] [Number 5] Q=[a]G

[0108] As described above, the network 6 stores the secret key a in its memory, which allows the network 6 to obtain the coordinate CD1 of the waypoint SP1 by calculation, even without knowing the secret key k.

[0109] Next, as shown in figure 4, the network 6 derives (S64) an encryption key KY1, an initialization vector V1 and, if necessary, a MAC key (denoted KMAC1) by applying a key derivation function F1, similar to the derivation step S46 previously performed by the SIM3 card. To achieve this, the network 6 applies the key derivation function F1 to the coordinates CD1 of the waypoint SP1 obtained in S62. The key KY1 now serves as a decryption key for decrypting the encrypted identifier SUCI.

[0110] As mentioned above, the function F1 may be, for example, the derivation function provided in the standard "ANSI X9.63 Key Derivation Function, §5.6.3", but it can also be another function.

[0111] In a verification step S66, the network 6 verifies the integrity of the encrypted identifier SUCI received in S60 from the SIM3 card. To achieve this, the network 6 calculates an authentication code MAC (noted MC2) of the encrypted identifier SUCI provided by the SIM3 card on the basis of the MAC key KMAC1 obtained in S64. The network then 6compares (S70) the authentication code MC2 calculated in S68 with the authentication code MC1 received from the SIM3 card in S60. If the authentication codes MC1 and MC2 match, the network 6 deduces from this that the encrypted identifier SUCI received in S60 is complete. If not, the encrypted identifier SUCI provided by the SIM3 card is not complete.

[0112] If the encrypted identifier SUCI received in S60 is found to be intact (unaltered), the network 6 encrypts the encrypted identifier SUCI according to the reverse principle of the encryption step S48 previously performed by the SIM3 card. Decryption (S72). More specifically, 6 SIM3 card 3 decrypts or decrypts the encrypted identifier SUCI (or a subpart of the encrypted identifier SUCI) based on the decryption key KY1 and the initialization vector V1 obtained in the derivation step S64 (S72) to obtain the SUPI identifier in decrypted form. The network 6 applies a decryption function F3 (the inverse function of the encryption function F2 used in S48 by the SIM3 card) using the decryption key KY1 and the initialization vector V1, in particular to the encrypted identifier SUCI (or a subpart of the encrypted identifier SUCI) to obtain the SUPI identifier.

[0113] By way of example, the function F3 may be the decryption function AES (FIPS 197) in counter mode as provided in the standard "SP800-38a §6.5".

[0114] Based on the SUPI identifier obtained in S72, the network 6 can perform authentication (S74) of the subscriber as already described above with reference to Figs.

[0115] As mentioned above, the encryption and decryption cryptographic events performed by the SIM3 card and the network 6, respectively, allow the SIM3 card to be securely authenticated on the network 6 without providing its SUPI identifier in decrypted form. These cryptographic events are advantageous in that they are particularly resistant to unauthorized interception of the identifier SUPI by malicious third parties.

[0116] However, these cryptographic processing events can be particularly consuming in terms of resources and processing time, with the drawback that these consumptions are not always being compatible with the available resources and applicable time constraints. More specifically, the calculation of the public key P (S42, FIG. 3), where P=[k]G, and the calculation of at least one coordinate CD1 of the intermediate point SP1 (S44), where SP1=[k]Q, are particularly consuming in terms of resources and processing time. The complexity of these two calculations is due in particular to the fact that the private key k is coded in a relatively large number of bits, in particular 256 bits (M=256), although M can also be of other values.

[0117] The object of the present invention is therefore, inter alia, to provide a method for identifying a subscriber's SUPI identifier. encryption The objective of the present invention is to improve the cryptographic processing events performed by the embedded subscriber identity module in order to provide a good compromise between the level of security achieved and the necessary expenditure in resources and processing time. As mentioned above, the invention applies more generally to the efficient and secure encryption or decryption of any data, whether these are subscriber identifiers (SUCI in 5G or other forms) or other data that should be securely protected and distributed.

[0118] The principles of the present invention will now be described in specific embodiments.

[0119] 5 shows a schematic representation of a cryptographic processing device DV1 (hereinafter also simply referred to as "device") that can cooperate with a communication network HN1 via an access point AP1. Here, it is assumed that the device DV1 is an embedded subscriber identity module in a communication terminal T1, and that the communication network HN1 is a 5G mobile network. The device DV1 is therefore here intended in particular to authenticate subscribers in the network HN1.

[0120] The device DV1 communicates with the network HN1 by means of a communication terminal T1 which includes suitable communication means.

[0121] The subscriber identity module DV1 may take various forms, for example a SIM card or an eSIM card, etc. The device DV1 may in particular be a removable card or a device soldered to the terminal T1. The device DV1 is here integrated in the terminal T1, but there are also variants in which the device DV1 is not integrated in the terminal T1 but is associated remotely with the terminal T1.

[0122] In this example, the terminal T1 is any 5G-enabled device such as a mobile phone (smartphone), tablet, etc. Client Terminal may be also possible.

[0123] More precisely, in this example, device DV1 includes at least one processor 20, a volatile memory (RAM) 22, a communication interface 24 and a non-volatile memory MR1.

[0124] In this example, the memory MR1 is a rewritable non-volatile memory or a read-only memory (ROM, EEPROM or FLASH), which constitutes a recording medium (or data carrier) readable by the device DV1 according to a particular embodiment, in which a computer program PG1 according to a particular embodiment is registered. This computer program PG1 includes instructions for carrying out the steps of a cryptographic processing method according to a particular embodiment. methodThe steps are described in detail below in specific embodiments.

[0125] The memory MR1 can in particular store data DT1 to be encrypted according to the principles of the invention. As will be explained later, it is assumed here that these data DT1 are or at least include a subscriber identifier of the SUPI type (or a subpart of a subscriber identifier of the SUPI type) allowing authentication of the subscriber in the 5G network. However, other types of subscriber identifiers are also possible. The principles of the invention can be applied to the encryption of any data to be protected. These data DT1 may be obtained (received, determined, etc.) by the device DV1 in any way.

[0126] The memory MR1 can also store data (or parameters) used in the cryptographic method of the invention for encrypting these data DT1. In the example considered here, the memory MR1 can in particular store the generating point G, the public key Q related to the network HN1, the derivation function F1 and the encryption function F2. The memory MR1 can also store data determined in the cryptographic method, in particular the provisional generating point G' and the provisional key Q'. The nature and use of these different parameters will be explained in more detail below.

[0127] The communication interface 24 is arranged for the device DV1 to cooperate with the terminal T1 in which it is embedded, by means of which the device DV1 communicates with the remote network HN1. The nature of this interface 24 may vary depending on the embodiment.

[0128] It should also be noted that the network HN1 includes in its memory a secret key (denoted a), a derivation function F1, and a decryption function F3 that corresponds to the inverse function of the encryption function F2 used by the device DV1 to encrypt the data DT1.

[0129] It will be apparent that some elements typically implemented in a communications terminal 5G and an embedded subscriber identity module have been intentionally omitted, as they are not necessary for the understanding of the invention.

[0130] It should also be noted that the device DV1 shown in Fig. 5 constitutes just one embodiment, and other embodiments are possible within the scope of the present invention. Those skilled in the art will particularly appreciate that some elements of the device DV1 are described herein only to facilitate understanding of the present invention, and that these elements are not essential for carrying out the present invention.

[0131] As shown in FIG. 6 according to a particular embodiment, here a processor 20 controlled by a computer program PG1 implements an initialization module MD1 and an encryption module MD7.

[0132] According to a particular example, the initialization module MD1 is configured to execute an initialization phase, said initialization phase comprising: determining a provisional generator point G', where G' is equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits, and G is a generator point of the elliptic curve ε; determining a pseudo-key Q', where Q' is equal to a second product such that Q'=[d']Q, where Q is a point on the elliptic curve ε that forms a public key associated with the second system; Includes.

[0133] The elliptic curve ε used and the positive integer N can be selected by a person skilled in the art according to the application under consideration. The value of N may be selected according to, among other things, the desired security level and according to resource and processing time consumption constraints. As will be explained below, N can for example be equal to 256, so that the first private key d′ is coded in 256 bits (although other values ​​are also possible).

[0134] A person skilled in the art can appropriately adapt the value of N. The magnitude of N may be selected according to, in particular, the magnitude of the elliptic curve ε used (i.e., the magnitude of the order of the group of points generated by the generator point G). For example, when using a 384-bit elliptic curve ε, the number of bits N is 384 bits selected here. Thus, the value of N may be selected from one of the following values, for example, N = 192, 224, 256, 384, 521, or 512 bits. The value of N may be selected according to the elliptic curve ε used (according to its size). Also, when M < N, the value of M may be selected according to the elliptic curve ε used.

[0135] As described later, there can be several implementations of the initialization module MD1. The initialization module MD1 can be configured to obtain or determine the temporary generator point G’ and the temporary key Q’ in the initialization stage according to all appropriate methods. According to a specific example, the initialization module MD1 is configured to receive the temporary generator point G’ and the temporary key Q’ from outside the device DV1. The temporary generator point G’ and the temporary key Q’ can be registered in the non-volatile memory MR1 so that they can be obtained and used later in the encryption stage described later.

[0136] According to a specific example, the initialization module MD1 determines G’ and Q’ by calculation based on a scalar (denoted as d’). To achieve this, the initialization module MD1 may include, for example, as shown in FIG. 6, a first determination module MD2 and a first calculation module MD4, but other implementations are also possible.

[0137] The first determination module MD2 is configured to determine a first scalar that forms a first secret key d’ of N bits.

[0138] The first calculation module MD4 is a calculation of the temporary generator point G’, where the temporary generator point G’ is equal to a first product such as G’ = [d’]G, and Calculating a pseudo-key Q′, where Q′ is equal to a second product such that Q′=[d′]Q; and The device is configured to:

[0139] The results obtained for G' and Q' may then be stored in a memory within device DV1 (live memory 22 or non-volatile memory MR1).

[0140] It should be remembered that an embodiment may not have an initialization module that performs modules MD2 and MD4 as described above. The initialization module MD1 may obtain G' and Q' in any way.

[0141] The encryption module MD7 is also configured to carry out an encryption stage including the steps of: Determining a second random scalar forming a second secret key k of M bits, <Nである、ステップと、 Calculating a public key P associated with said device DV1, where the public key P is equal to a third product such that P=[k]G′; calculating at least one coordinate CD1 of a midpoint SP1 of said elliptic curve ε, said midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving at least one key by applying a key derivation function to the at least one coordinate of the intermediate point SP1; encrypting data based on at least one of the keys derived in said derivation to obtain encrypted data; transmitting the public key P and the encrypted data to a second system for decryption by the second system; Includes.

[0142] A person skilled in the art can appropriately select a positive integer M according to the target application (on the premise that M < N), particularly according to the preferred security level, and according to the constraints on resource and processing time consumption. For example, M can be 32, 48, 64, or 128 bits, and N is considered to be 256 bits (however, other combinations of values (N, M) are also possible).

[0143] In the embodiments described below, the "second system" in the present invention is considered to be the communication network HN1, more generally the network HN1 including its access point AP1.

[0144] As shown in FIG. 6 according to a specific example, the encryption module MD7 may include a second determination module MD6, a second calculation module MD8, a key derivation module MD10, an encryption module MD12, and a transmission module MD14, but other implementations are also possible.

[0145] More specifically, the second determination module MD6 is configured to determine a second random scalar that forms an M-bit second secret key k where M < N.

[0146] The second calculation module MD8 is a calculation of the public key P related to the device DV1, where P is equal to a third product such as P = [k]G’, and is a calculation of at least one coordinate CD1 of the intermediate point SP1 of the elliptic curve ε, where this intermediate point SP1 is equal to a fourth product such as SP1 = [k]Q’, and is configured to perform.

[0147] The key derivation module MD10 is configured to derive at least one key by applying a key derivation function to at least one of the coordinates CD1 of the intermediate point SP1 calculated by the second calculation module MD8.

[0148] The data encryption module MD12 is configured to encrypt based on at least one of the keys derived by the key derivation module MD10 in order to obtain the encrypted data.

[0149] The transmission module MD14 is configured to transmit the public key P and the encrypted data to the second system (i.e., to the network HN1 in this example) for decryption by the second system.

[0150] The configuration and functions of the modules MD1 - MD14 of the device DV1 will be accurately described from the embodiments described later. It should be noted that the modules MD1 - MD14 as shown in FIG. 6 only show a non - limiting embodiment of the present invention. Generally, for each step of the encryption processing method of the present invention, the encryption processing device of the present invention can include corresponding modules configured to execute the step.

[0151] Generally, the concept of the present invention is that, in particular, on the one hand, the generator point G used in step S42 (FIG. 3) to calculate the public key P, and on the other hand, the public key Q used in step S44 (FIG. 3) to determine at least one coordinate CD1 of the intermediate point SP1, as described above, are respectively replaced by the pseudo - generator point G' and the pseudo - key Q' in the encryption stage. The pseudo - generator point G' and the pseudo - key Q' are both generated based on a secret key d' which is a random scalar encoded with a number of bits N higher than the number of bits M in which the secret key k used in the encryption stage is encoded. By selecting a relatively large number N (e.g., N = 256) to maintain a high security level and restricting the number M (M < N), it is possible to reduce the consumption of calculations performed in the encryption stage. As described above, the number N (larger than M) can be selected according to the elliptic curve ε used. The number N can correspond, for example, to the maximum security provided by the elliptic curve ε used.

[0152] To the extent that the private key k is coded with a number M of bits lower than N, a good compromise is achieved between the encryption security level and the consumption of resources and processing time, while reducing the complexity of the calculations performed to determine the public key P and the at least one coordinate CD1 of the midpoint SP1. This compromise can be adapted accordingly by adjusting the values ​​of N and M according to the respective situation.

[0153] As will be described below, the provisional origin point G' and the provisional key Q' may be determined in an initialization phase preceding the encryption phase, thereby advantageously obtaining G' and Q' upstream, and thus accelerating cryptographic processing events as the cryptographic processing device enters the encryption phase. Also, the same values ​​of G' and Q' obtained in the initialization phase may be used multiple times in the encryption phase (e.g., in multiple iterations), thereby further accelerating the processing performed by the device since it is not necessary to perform an initialization phase before each encryption phase.

[0154] Next, a specific embodiment of the present invention will be described with reference to Fig. 7. More specifically, the cryptographic processing device DV1 executes a program PG1 according to the specific embodiment, thereby executing the cryptographic processing method of the present invention.

[0155] In this example, it is assumed that a device DV1 constituting an embedded subscriber identity module in the terminal T1 performs a cryptographic process aimed in particular at encrypting data DT1 and then transmits the encrypted data thus obtained (notation DTC1) to the communication network HN1. In this example, the data DT1 to be encrypted is or contains the SUPI identifier (or a subpart of the SUPI identifier) ​​of the subscriber UR for the network HN1. As is well known to those skilled in the art, the SUPI identifier is what identifies a user in the 5G network to which the user subscribes. These data DT1 may be obtained (received, determined, etc.) by the device DV1 in any way.

[0156] As will be explained below, the cryptographic operations performed by device DV1 are based in particular on the use of an elliptic curve ε, chosen by those skilled in the art depending on the case at hand.

[0157] More specifically, the device DV1 executes an initialization step S100, during which it determines a provisional origin point G' and a provisional key Q'.

[0158] The provisional origin point G' is equal to the first product:

[0159] [Number 6] G'=[d']G

[0160] where d' is a first random scalar forming a first N-bit private key, and G is a generator point of the elliptic curve ε.

[0161] Also, the pseudo key Q′ is equal to the second product as follows:

[0162] [Number 7] Q'=[d']Q

[0163] Here, Q is the point of the elliptic curve ε that forms the public key associated with the second system from the point of view of the present invention, specifically the network HN1 in this example.

[0164] The level N of coding in bits of the private key d' is fixed, for example 256 bits, or may be higher if a higher security level is required.

[0165] As mentioned before, there are various possible ways to obtain G' and Q'. According to a first embodiment, the device DV1 does not itself calculate G' and Q' but receives them later from outside. The parameters G' and Q' are for example loaded into the device DV1 at the initial personalization of the device DV1 or loaded later during the period when the device DV1 is already in use in the terminal T1.

[0166] According to another example shown in Fig. 7, the device DV1 itself calculates the parameters G' and Q' based on a first random scalar d'. This particular example is explained in more detail below. The initialization stage S100 can be considered to include steps S101, S102 and S104, which are described below.

[0167] In a determination step S101, the device DV1 determines a first random scalar d' forming a first secret key of N bits. As mentioned before, N is assumed to be fixed at 256, or it may be a larger value if necessary. In the present example, the device DV1 itself randomly generates the scalar d'. According to a variant, the device DV1 can receive this random scalar d' from outside (for example read it during or after the personalization).

[0168] The device DV1 calculates a provisional generator point G′ of the elliptic curve ε (S102), and this provisional generator point G′ is equal to the following first product:

[0169] [Number 8] G'=[d']G

[0170] where d' is the first random scalar determined in determining step S101.

[0171] Device DV1 also calculates (S104) a provisional key Q′, which is equal to a second product:

[0172] [Number 7] Q'=[d']Q

[0173] Here, Q is the point on the elliptic curve ε that forms the public key associated with the second system, specifically the network HN1 in this example.

[0174] To achieve this, device DV1 extracts parameters G and Q previously stored in its memory MR1. The calculation steps S102 and S104 can be performed simultaneously or according to any order.

[0175] When the temporary generator point G' and the temporary key Q' are determined by S100, the device DV1 stores these parameters G' and Q' in its memory MR1 (S106, FIG. 7) so that they can be used in the next encryption stage S107.

[0176] In the encryption stage S107 (FIG. 7), the device DV1 decrypts the above data DT1 by using the temporary generator point G' and the temporary key Q' obtained in the initialization stage S100. As described above, in this example, these data DT1 are assumed to be the SUPI identifier (or a sub-part of the SUPI identifier) of the subscriber UR for the network HN1 (FIG. 5) or to include it. As will be described in detail below, in this example, the encryption stage S107 includes steps S108, S110, S112, S114, S116, and S118.

[0177] In the determination step S108, the device DV1 determines a second random scalar that forms a second secret key k of M bits where M < N. The number of bits M of the encoding of the second secret key k is selected according to the compromise point that a person skilled in the art wants to achieve in each form between the security level and the consumption of encryption processing in terms of resources and processing time. The higher the number of bits M of the encoding, the stronger the security, but more resources are required and the impact on the processing event speed in the encryption stage becomes greater.

[0178] According to a specific example, N and M are selected such that N is 256 bits and M is 32, 48, 64, or 128 bits, but there can also be other combinations (N, M) as long as the relationship of the condition M < N is maintained.

[0179] One of the principles of the present invention is that the first secret key d' involved in the cryptographic calculation in the initialization stage S100 is encrypted with more bits (N bits) than the second secret key k involved in the cryptographic calculation in the encryption stage S107, and this second secret key k is encoded with only M bits where M < N. The difference between M and N can be adjusted as appropriate. This is consumed more in the processing based on the initialization stage S100 than in the encryption stage S107, which is important and generally needs to be executed quickly at any moment. Note that, as will be described later, since the encryption stage S107 can be repeatedly performed a plurality of times by using the same parameters G' and Q' obtained in the initialization stage S100, the consumption of resources and processing time can be further limited.

[0180] Next, the device DV1 calculates the public key P related to the device DV1 (S110), and P is equal to the following third product.

[0181] [Equation 8] P = [k]G' = [k][d']G

[0182] Therefore, the secrecy of the discrete logarithm of this public key P ([k][d']) depends on the number of bits N of the first secret key d' and the number of bits M of the second secret key k.

[0183] In the calculation step S112, the device DV1 calculates at least one coordinate CD1 of the intermediate point SP1, and the intermediate point SP1 is equal to the following fourth product.

[0184] [Equation 9] SP1 = [k]Q' = [k][d']Q

[0185] This is possible, but it is not necessary for the device DV1 to determine all the coordinates of the intermediate point SP1 on the elliptic curve ε. The device DV1 can calculate the coordinate CD1 according to the direction x and / or the direction y, and these directions x and direction y define the space in which the elliptic curve ε extends. For simplicity later, it is assumed that the device DV1 determines a single coordinate CD1 of the intermediate point SP1 in step S112.

[0186] In a derivation step S114, the device DV1 derives at least one key by applying a key derivation function F1 to the coordinates CD1 of the midpoint SP1. In other words, the device DV1 executes the key derivation function F1 to determine at least one key based on the coordinates CD1 of the midpoint SP1. The nature and number of the keys may vary depending on the form used, in particular depending on the type of encryption and the function F1 considered. In step S114, the device DV1 may generate a single key or multiple keys, which are used in the following encryption step S116 to decrypt the data DT1.

[0187] In this example, it is assumed that by applying a derivation function F1 taking into account a coordinate CD1, separate parameters (or components) are generated, in particular an encryption key KY1, an initialization vector V1, and a MAC key (noted KMAC1). As will be described below, there are also variants in which the key KMAC1 is not involved.

[0188] It should be noted that part of the encryption stage S107 can be performed in advance, i.e. before the data DT1 to be encrypted is determined or obtained by the device DV1, or before the device DV1 decides that it needs to encrypt the data DT1.

[0189] According to a particular example, before the encryption step S116, which has not yet been performed, methodcomprises a step (not shown) for obtaining data DT1 to be encrypted and / or a step for determining that data DT1 need to be encrypted. These data DT1 can be received or determined in any manner. According to a particular example, the step S108 for determining the private key k, the step S110 for calculating the public key P and the step S112 for calculating at least one coordinate CD1 of the intermediate point SP1 or even the derivation step S114 (or at least a part of these steps) can be performed in advance, i.e. before the device DV1 obtains the data DT1 to be encrypted or before the device DV1 determines that the data DT1 needs to be encrypted, to further accelerate the encryption method.

[0190] In an encryption step S116, the device DV1 encrypts the data DT1 based on the encryption key KY1 and the initialization vector V1 previously derived in the derivation step S114 to obtain encrypted data DTC1. In the example considered here, the device DV1 applies an encryption function F2 to encrypt the data DT1 based on the encryption key KY1 and the initialization vector V1. As mentioned above, the encryption function F2 is stored in the memory MR1 of the device DV1 in this example. The encryption step S116 encrypts the subscriber SUPI identifier (or a subpart of the subscriber SUPI identifier) ​​contained in the data DT1 to generate encrypted data DTC1 including an encrypted identifier SUCI (or a subpart of the SUCI) corresponding to the encrypted form of the SUPI.

[0191] In this example, it is also considered that in the encryption step S116, the device DV1 calculates an authentication code MAC, denoted MC1, based on the encrypted data DTC1 and the key KMAC1. The authentication code MAC is calculated based on the encrypted data DTC1 according to any suitable method. As is well known to those skilled in the art, a code MAC is a code that accompanies data to ensure the integrity of the data by allowing the code MAC to be verified later after the distribution or processing of the data in question. Thus, in this embodiment, the authentication code MC1 allows the network HN1 to verify later that the received encrypted data DTC1 is complete (unmodified).

[0192] Then, in a sending step S118, the device DV1 sends the public key P calculated in S110 and the encrypted data DTC1 to the network HN1 (the second system) for decryption by the network HN1. In this example, the device DV1 performs the sending S118 via the access point AP1 of the network HN1. The network HN1 can then decrypt the received encrypted data TDC1, as will be described later.

[0193] More specifically, public key P teeth , Network HN1 but Based on the scalar that forms the private key (denoted a) of network HN1, In Recalculate the coordinate CD1 of point SP1 to enable .

[0194] [Number 10] SP1=[a]P

[0195] The coordinates CD1 of the midpoint SP1 then enable the network HN1 to decrypt the data DTC1 that was encrypted without knowledge of the private keys k and d', as will be described later.

[0196] In the example considered here, apart from the public key P and the encrypted data DTC1, in step S118 the device DV1 transmits the authentication code MC1 calculated in S116 to the network HN1 to allow the latter to subsequently verify the integrity of the received encrypted data DTC1. The device DV1 can insert the authentication code MC1 in the encrypted data DTC1 before the transmission step S118 for transmission to the network HN1. As a variant, the authentication code MC1 is transmitted accompanying the encrypted data DTC1 (S118).

[0197] It should be noted that the principles of the invention can be implemented without using or transmitting a code MAC, but using a code MAC is advantageous in that it allows the receiving entity (network HN1 in this example) to verify the integrity of the received encrypted data DTC1.

[0198] The invention implements cryptographic processes based on elliptic curves (for example of the Diffie-Hellman type) that encrypt (or, as described below, decrypt) data by achieving a good compromise between the level of security achieved and the necessary expenditure of resources and processing time. To achieve this, the generating point G and the public key Q are used to calculate the public key P and the intermediate point SP1 (or at least one coordinate CD1 of SP1), respectively, in steps S42 and S44 described above with reference to Fig. 3, and are replaced by a provisional generating point G' and a provisional key Q', respectively, obtained in an initialization phase, these parameters G' and Q' both depending on the same secret key d' coded on N bits.

[0199] In particular, a high level of security is achieved by determining the pseudo origin point G' and the pseudo public key Q' using the first private key d' coded on N bits. The pseudo origin point G' and the pseudo public key Q' appear during the calculation of the public key P and the coordinate CD1 of the midpoint SP1 in the encryption stage, enhancing the security of these calculations. In this way, the values ​​of the public key P and the coordinate CD1 depend not only on the second private key k (coded on M bits) but also on the first private key d' (coded on N bits).

[0200] Also, by dividing the calculation of the public key P and the coordinates CD1 into two stages, it is possible to limit the resources required by the device DV1 to determine the public key P and the coordinates, or at least to improve the management of these resources. In the initialization stage S100, the device DV1 can obtain the provisional origin point G' and / or the provisional key Q' from outside, or can determine the provisional origin point G' and / or the provisional key Q' by calculation at the right time, for example upstream of the encryption stage S107, for example in a period of inactivity or at least when the necessary resources are available. Thus, the speed of encryption of the data DT1 can be increased by pre-determining in the initialization stage the provisional origin point G' and the provisional key Q' that are immediately available when the encryption stage is started, regardless of the data to be encrypted.

[0201] The present invention performs the most time and resource intensive cryptographic calculations in the initialization stage S100 before starting the encryption stage S107. The initialization stage S100 is where the most intensive calculations are concentrated since the first private key d' is coded with more bits than the second private key k. Therefore, the calculations in the encryption stage S107 are less intensive since the k appearing in the third and fourth products (S110 and S112) is smaller than that involved in the decomposition.

[0202] According to a particular example, the encryption stage S107 (FIG. 7) is initiated upon detection of at least one event, and the initialization stage S100 is performed before the detection of said at least one event.

[0203] The encryption step S107 (Figure 7) of the data DT1 comprising the SUPI identifier (or a sub-part of the SUPI identifier) ​​is started in response to receiving, for example, a request from the access point AP1 to register the device DV1 in the network HN1 (for example a "registration request" or "identification request" as specified in the standard ETSI TS 133 501, e.g. Version 15.3.1 Release 15).

[0204] According to a particular example, the initialization stage S100 is executed only once, for example at the initial start-up of the device DV1 or at the manufacture of the device DV1 (for example at the pre-personalization or personalization thereof).

[0205] As will be described later in a specific example, the initialization stage S100 preferably includes: This type of processing It may also be performed multiple times during a given period of time that contributes to the

[0206] Also, the network HN1 transmits the encrypted data DTC1 provided by the device DV1 in S118 (FIG. 7). Decryption The method of decrypting the data DTC1 provided by the device DV1 in S118 (FIG. 7) is not modified by the encryption method performed by the device DV1. In other words, the network HN1 is able to decrypt the data DTC1 provided by the device DV1 in S118 (FIG. 7) according to the same method as described above with reference to FIG.

[0207] Now, with reference to FIG. 8, a processing method according to the principles of the invention executed by the network HN1 for decrypting data DTC1 previously encrypted by the device DV1 will be described below.

[0208] In a receiving step S130, the network HN1 receives, via its access point AP1, the encrypted data DTC1 and the public key P provided by the device DV1. It is assumed here that an authentication code MC1 is included in the encrypted data DTC1.

[0209] In a calculation step S132, similar to the above calculation step S62 (FIG. 4), the network HN1 calculates at least one of said coordinates CD1 of the midpoint SP1 of the elliptic curve ε, i.e. in this example the coordinate CD1 determined in S112 (FIG. 7) by the device DV1. Thus, in this example, the network 6 calculates a single coordinate CD1 (for example a coordinate in the x or y direction) used by the device DV1 and the data DT1. encryption do.

[0210] The midpoint SP1 is equal to the product of the private key (denoted a) of the network HN1 and the public key P, as defined below.

[0211] [Number 11] [a]P=[a][k][d']G=[k][d'][a]G=[k][d']Q=[k]Q'=SP1

[0212] Here, the public key Q of the network HN1 is equal to the product of the private key a and the generator point G, as defined below.

[0213] [Number 12] Q=[a]G

[0214] As mentioned above, network HN1 stores its private key a To memory Therefore, the network HN1 can obtain the coordinate CD1 of the midpoint SP1 by calculation without knowing the first private key d' or the second private key k.

[0215] Thereafter, as shown in FIG. 8, the network HN1 executes steps S134, S136, S138, S140, S142 and S144 which are identical to steps S64, S66, S68, S70, S72 and S74 respectively as already described above with reference to FIG.

[0216] More specifically, the network HN1 then derives (S134) the encryption key KY1, the initialization vector V1 and, if necessary, the MAC key (denoted KMAC1) by applying a key derivation function F1, similar to the derivation step S114 previously performed by the device DV1. To achieve this, the network HN1 applies the key derivation function F1 to the coordinates CD1 of the waypoint SP1 obtained in S132. The key KY1 now serves as a decryption key for decrypting the encrypted data DTC1 including the encrypted identifier SUCI.

[0217] In a verification step S136, the network HN1 verifies the integrity of the encrypted data DTC1 received in S130 from the device DV1. To achieve this, the network HN1 calculates an authentication code MAC (noted MC2) for the encrypted data DTC1 provided by the device DV1 on the basis of the MAC key KMAC1 obtained in S134. The network HN1 then compares (S140) the authentication code MC2 calculated in S138 with the authentication code MC1 originating from the device DV1 and received in S130. If the authentication codes MC1 and MC2 match, the network HN1 deduces from this that the encrypted data DTC1 received in S130 is intact and the method then performs an encryption step S142. Otherwise, the encrypted data DTC1 received is not complete and the decryption method ends.

[0218] In a decryption step S142, the network HN1 decrypts the encrypted data DTC1 (including the encrypted identifier SUCI or a part of the encrypted identifier SUCI) according to the reverse principle of the encryption step S116 (FIG. 7) previously performed by the device DV1. More specifically, the network HN1 decrypts or decrypts the encrypted data DTC1 based on the decryption key KY1 and the initialization vector V1 obtained in the derivation step S134 in order to obtain the data DT1 including the subscriber's identifier SUPI (or a subpart of the subscriber's identifier SUPI) in decrypted form (S142). To achieve this, the network HN1 applies, using the decryption key KY1 and the initialization vector V1, in particular the decryption function F3 (where F3 is the inverse function of the encryption function F2 used in S116 by the device DV1) to the encrypted data DTC1 to obtain the decrypted data DT1.

[0219] Based on the SUPI identifier contained in the data DT1 determined in S142, the network HN1 can carry out authentication of the subscriber (S144), as already described above with reference to FIGS.

[0220] As mentioned above, in this particular embodiment, the encryption and decryption cryptographic events performed by the device DV1 and the network HN1, respectively, allow the device DV1 to be later securely authenticated with the network HN1 without providing the subscriber's SUPI identifier in a decrypted form. These cryptographic events are advantageous in that they are particularly resistant to unauthorized interception of the SUPI identifier by a malicious third party; Therefore It increases the security of users' personal data and private life.

[0221] According to a particular example, the sequence of steps S100-S118 described above with reference to figure 7 is performed multiple times to encrypt the data DT1 and to transmit the data DT1 in encrypted form to one or more second systems. The initialization stage S100 can be repeated before each iteration of the encryption stage S107.

[0222] The present invention is also advantageous in that it is possible to perform multiple iterations of the encryption step S107 by using the same provisional origin point G' and the same provisional key Q' determined in the initialization step S100, further reducing the consumption of resources and processing time required to perform the encryption of the data DT1. It is not necessary to perform the initialization step S100 before each encryption step S107.

[0223] Thus, in a particular embodiment, as shown in FIG. 9, the device DV1 performs an initialization step S100 as described above and then performs at least two successive iterations of an encryption step S107 based on the provisional origin point G′ and the provisional key Q′ determined in the initialization step S100 to generate data DT1 to be sent to the second system (network HN1) for decryption. Encrypt It should be noted that the data DT1 encrypted in each iteration of the encryption step S107, and the second system to which these encrypted data DT1 are transmitted, can vary.

[0224] In this way, the keys G' and Q' resulting from the first product of S102 and the second product of S104 in the initialization step S100 can be used multiple times in multiple successive iterations of the encryption step S107 to communicate with one or more second systems, for example to authenticate the subscriber UR multiple times over time in one or more communication networks. It is not necessary to perform an initialization step before each encryption step. The initialization step S100 can for example be performed every X steps of encryption S107 (or X is an integer greater than or equal to 2).

[0225] This limits the processing time for the cryptographic calculations performed by device DV1. On the one hand, a high level of security is achieved, since in the encryption step S107, not only the private key k but also the private key d' affects the product. .

[0226] Also, data DT1 encryptionIt is possible to perform multiple iterations of the initialization step S100 to update (modify) the pseudo generator G' and the pseudo key Q' used in different iterations of the encryption step S107 in order to obtain the pseudo generator G' and the pseudo key Q'.

[0227] According to a particular embodiment, the device DV1 monitors the number of successive iterations of the encryption step S107 performed with the same pseudo origin point G' and the same pseudo key Q' determined in the initialization step S100. Upon detecting that at least X successive iterations of the encryption step S107 have been performed based on the same pseudo origin point G' and the same pseudo key Q' determined in the initialization step S100 for transmitting the encrypted data DTC1 to the second system (in this example, specifically the network HN1), the device DV1 performs a new iteration of the initialization step S100 to update (and therefore change) the pseudo origin G' and the pseudo key Q' based on a new first secret random key d' different from the first secret random key d' determined in the previous iteration of the initialization step S100. The updated pseudo origin G' and the updated pseudo key Q' are used in at least one subsequent iteration of the encryption step S107 to generate new data DT1. encryption and transmits these new encrypted data DTC1 to the second system (specifically the network HN1 in this example).

[0228] The number X is an integer such that X >= 1. According to a particular example, X >= 2, which means that the device performs at least two successive iterations of the encryption step S107 with identical values ​​of G' and Q' before updating these values ​​in the light of performing a new encryption.

[0229] Therefore, the device DV1 can periodically update the parameters G' and Q' to enhance security and also maintain good processing performance, for example to authenticate the device DV1 in the network HN1 multiple times. In particular, periodically updating the parameters G' and Q' (and therefore the first secret key d') can prevent a malicious third party from tracking the device DV1 while the device DV1 is registered as an embedded subscriber identity module in the communication network. In fact, it is difficult for a third party to track the user based on the public key P exchanged in the encryption phase or in the various iterations of the method. This is because these keys are not only distinguished by this secret key k, but by this secret key k and the pseudo origin point G'.

[0230] To achieve this, device DV1 may utilize a counter CT that monitors the number of times the same combination (G', Q') has been used to authenticate in the network.

[0231] A particular embodiment will now be described with reference to figure 10. It is assumed that the device DV1 is performing the encryption stage S107, as already described above. Upon detecting that this encryption stage S107 has been performed (or started or is being performed), the device DV1 also updates (S162) a counter CT1. In this example, the counter CT1 is increased by one with each new iteration of the encryption stage S107.

[0232] Then, when detecting that a new encryption needs to be performed, the device DV1 determines (S164) based on the current value of its counter CT1 whether at least X successive iterations of the encryption stage S107 have been performed with identical values ​​of G' and Q'. To achieve this, the device DV1 determines whether the counter CT1 is greater than or equal to a threshold X. If so, the method continues with S100 and updates the parameters G' and Q' in a new iteration of the initialization stage S100 and reinitializes the counter CT1. If not, the device DV1 performs a new iteration of the encryption stage S107 without changing the parameters G' and Q'.

[0233] Thus, in a new iteration of the initialization stage S100, the device DV1 updates (changes) the provisional generator G' and the provisional key Q'. Then, the device DV1 executes a new iteration of the encryption stage S107 using the updated values ​​of G' and Q' obtained in S100.

[0234] According to the particular embodiment shown in FIG. 11, in each iteration of the encryption stage S107, the provisional generator G′ and the provisional key Q′ used in the current iteration of the encryption stage S107 are equal to the public key P and the intermediate point SP1, respectively, calculated in the previous iteration of the encryption stage S107.

[0235] More generally, in at least one iteration of the encryption step S107, the provisional generator G' and the provisional key Q' used in the current iteration of the encryption step S107 may be equal to the public key P and the intermediate point SP1, respectively, calculated in the previous iteration of the encryption step S107.

[0236] In other words, the parameters G' and Q' of the current iteration are replaced by the values ​​[k]G' and [k]Q' of the previous iteration of the encryption step S107, thereby enhancing security to the extent that it becomes more difficult for a malicious third party (an eavesdropper on the identifier) ​​to trace the embedded subscriber identity module based on successive SUCIs generated by the embedded subscriber identity module for authentication in the communication network.

[0237] However, it should be noted that even though this is possible, it is not necessary to use the same value of the private key k in each iteration of the encryption step S107.

[0238] As shown in Figure 11, A private key k1 in an iterative process I1 (S180) such that P=[k1]G′ and SP1=[k1]Q; A secret key k2 in an iterative process I2 (S182) such that P=[k1][k2]G' and SP1=[k1][k2]Q'; A private key k3 in an iterative process I3 (S182) such that P=[k1][k2][k3]G' and SP1=[k1][k2][k3]Q'; etc. can be used.

[0239] In this way, we perform iteration I where R is an integer at least equal to 2. R In (S186), P and SP1 are P = [k1][k2]...[k R ]G' and SP1 = [k1][k2]...[k R ]Q' It becomes.

[0240] In a particular embodiment, the same value of the secret key k is used for each iteration. R In (S186), P and SP1 are P = [k] R G' and SP1 = [k] R Q' It becomes.

[0241] In the above embodiment, the present invention is applied to the form of data encryption. However, as mentioned above, the present invention is not limited to this specific form, and is also applied to the decryption of encrypted data. To achieve this, the present invention also provides a second encryption processing method based on the same principle as the above first encryption processing method.

[0242] Thus, according to a particular embodiment, the device DV1 is adapted to perform a second cryptographic operation. According to this particular aspect, the device DV1 cooperates with an optional second system (notation HN1), and the method comprises the steps of: An initialization phase, determining a provisional generator point G', where G' is equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits and G is a generator point of the elliptic curve; determining a pseudo-key Q', where Q' is equal to a second product such that Q'=[d']Q, where Q is a point on the elliptic curve that forms a public key associated with the second system; an initialization phase including A decoding step, Determining a second random scalar forming a second secret key k of M bits, <Nである、ステップと、 calculating a public key P associated with the device, where the public key P is equal to a third product such that P=[k]G′; transmitting the public key P to a second system; receiving the encrypted data transmitted from the second system; calculating at least one coordinate of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving at least one key by applying a key derivation function to the at least one coordinate of the intermediate point SP1; decrypting the encrypted data based on the at least one key derived in said derivation to obtain decrypted data; a decoding stage comprising: Includes.

[0243] The initialization stage may be performed similarly to the initialization stage S100 described above (FIG. 7). In particular, the determination of the random key d′ and the calculation of the first key G′ and the temporary public key Q′ may be performed similarly to steps S101, S102, and S104, respectively, described above.

[0244] Also, the decryption step can be performed similarly to the encryption step S107 (FIG. 7) described above. In particular, the determination of the second private key k and the calculation of the public key P can be performed similarly to the above-mentioned steps S108 and S110, respectively. Similarly, the calculation of the at least one coordinate of the midpoint SP1 and the derivation of the at least one key by applying a key derivation function can be performed similarly to the above-mentioned steps S112 and S114, respectively. Finally, the decryption of the encrypted data can be performed similarly to the above-mentioned encryption step S116.

[0245] It should be noted that the order of linking the steps of the encryption processing method es of the present invention as in the above embodiment constitutes merely one embodiment, and other variations are possible.

[0246] Those skilled in the art can understand that the above-described embodiments and modifications constitute non-limiting examples of embodiments of the present invention, and in particular, those skilled in the art can envision any adaptation or combination of the above-described embodiments and modifications to meet their particular needs.

Claims

1. A cryptographic processing method executed by a device (DV1) associated with a second system (HN1), the method comprising: An initialization stage (S100), a step (S101) of determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits, and G is a generator point of an elliptic curve (ε); a step (S104) of determining a provisional key Q′, said provisional key Q′ being equal to a second product such that Q′=[d′]Q, where Q is a point on said elliptic curve (ε) that forms a public key associated with said second system; An initialization step (S100) including: An encryption step (S107), determining a second random scalar forming a second private key k of M bits (S108), where M<N; Calculating (S110) a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; A step (S112) of calculating at least one coordinate (CD1) of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; Deriving (S114) at least one key (KY1, V1, KMAC1) by applying a key derivation function (F1) to at least one of the coordinates (CD1) of the intermediate point SP1; - encrypting data (SUPI) based on at least one of the keys derived in said derivation (S116) to obtain encrypted data; transmitting (S118) the public key P and the encrypted data to the second system for decryption by the second system; an encryption step (S107) including A method comprising:

2. The public key P allows the second system to recalculate the coordinates of at least one of the intermediate points SP1 based on a scalar forming the private key of the second system, denoted a, where SP1=[a]P, The method of claim 1 , wherein the coordinates of at least one of the intermediate points SP1 enable the second system to decrypt the encrypted data.

3. The initialization step comprises: Determining the first random scalar forming the first private key d′ of N bits (S101); a step (S102) of calculating the provisional origin point G′, the provisional origin point G′ being equal to the first product such that G′=[d′]G; a step (S104) of calculating said provisional key Q′, said provisional key Q′ being equal to said second product such that Q′=[d′]Q; The method of claim 1 or 2, comprising:

4. The method according to claim 1 , further comprising, after said initialization stage, registering said provisional origin point G′ and said provisional key Q′ in a non-volatile memory of said device.

5. 5. The method according to claim 1, wherein the encryption step is initiated upon detection of at least one event, and the initialization step is performed prior to said detection.

6. In the derivation of at least one key, an encryption key (KY1), an initialization vector (V1), and a MAC key (KMAC1) are generated by applying the key derivation function (F1) to at least one of the coordinates of the midpoint SP1; The encryption is - applying an encryption function (F2) for encrypting said data based on said encryption key and said initialization vector; - calculating an authentication code MAC(MC1) based on the encrypted data and the MAC key; Including, 6. The method according to claim 1, wherein apart from the public key P and the encrypted data, the device transmits the authentication code MAC(MC1) to the second system to allow the second system to verify the integrity of the encrypted data.

7. 7. The method according to claim 1, wherein the device performs at least two successive iterations of the encryption step based on the provisional origin point G' and the provisional key Q' determined in the initialization step to encrypt data to be sent to the second system for decryption.

8. 8. The method according to claim 1, wherein for at least one iteration of the encryption stage, the provisional origin point G′ and the provisional key Q′ used in the current iteration are equal to the public key P and the intermediate point SP1, respectively, calculated in a previous iteration of the encryption stage.

9. When it is detected that the device has performed at least X successive iterations of the encryption step and transmitted encrypted data to the second system based on the pseudo origin point G′ and the pseudo key Q′ determined during the initialization step, the method also comprises: performing a new iteration of the initialization phase to update the provisional origin point G′ and the provisional key Q′ based on a new first secret random key d′ different from the first random key determined in the previous iteration of the initialization phase; the updated pseudo origin point G′ and the updated pseudo key Q′ are used in at least one subsequent iteration of the encryption step to transmit new encrypted data to the second system; Including, 9. The method of claim 1, wherein X is an integer such that X > 1.

10. the second system is a communications network; the device is an embedded subscriber identity module of the terminal for authenticating the terminal with the communications network; The data includes an identifier (SUPI) of the embedded subscriber identity module; In said encryption, said identifier is encrypted based on at least one of said keys derived in said derivation to obtain an encrypted identifier (SUCI); A method according to any one of claims 1 to 9, wherein in said transmitting, said public key P and said encrypted identifier are transmitted to an access point of said communications network in order to enable said embedded subscriber identity module to be authenticated in said communications network.

11. said encryption step being initiated upon detection of at least one event, said initialization step being performed prior to said detection; The method of claim 10 , wherein at least one of the events comprises receiving a request from the access point of the communication network to register the embedded subscriber identity module with the communication network.

12. 12. The method according to claim 10 or 11, wherein the communication network is a 5G mobile network and the identifier of the embedded subscriber identity module is a SUPI identifier.

13. A cryptographic processing method executed by a device (DV1) associated with a second system (HN1), the method comprising: An initialization phase, determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits, and G is a generator point of an elliptic curve (ε); determining a pseudo-key Q′, said pseudo-key Q′ being equal to a second product such that Q′=[d′]Q, where Q is a point on said elliptic curve (ε) that forms a public key associated with said second system; an initialization phase including A decoding stage, determining a second random scalar that forms a second secret key k of M bits, where M<N; Calculating a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; transmitting said public key P to a second system; receiving encrypted data transmitted from the second system; Calculating at least one coordinate (CD1) of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; deriving at least one key (KY1, V1, KMAC1) by applying a key derivation function (F1) to at least one of said coordinates (CD1) of said intermediate point SP1; decrypting the encrypted data based on the at least one key derived in the derivation to obtain decrypted data; a decoding stage comprising: A method comprising:

14. A cryptographic processing device capable of cooperating with a second system, The cryptographic processing device includes: an initialization module configured to perform an initialization phase, The initialization step comprises: determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits, and G is a generator point of an elliptic curve (ε); determining a pseudo-key Q′, said pseudo-key Q′ being equal to a second product such that Q′=[d′]Q, where Q is a point on said elliptic curve (ε) that forms a public key associated with said second system; an initialization module including: An encryption module configured to perform an encryption step, The encryption step comprises: determining a second random scalar that forms a second secret key k of M bits, where M<N; Calculating a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; calculating at least one coordinate of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; deriving at least one key (KY1, V1, KMAC1) by applying a key derivation function (F1) to at least one of the coordinates of the intermediate point SP1; encrypting data (SUPI) based on at least one of the keys derived in said derivation to obtain encrypted data; transmitting the public key P and the encrypted data to the second system for decryption by the second system; a cryptographic module including: A cryptographic processing device comprising:

15. A cryptographic processing device capable of cooperating with a second system, The cryptographic processing device includes: an initialization module configured to perform an initialization phase, The initialization step comprises: determining a provisional generator point G', said provisional generator point G' being equal to a first product such that G'=[d']G, where d' is a first random scalar forming a first private key of N bits, and G is a generator point of an elliptic curve (ε); determining a pseudo-key Q′, said pseudo-key Q′ being equal to a second product such that Q′=[d′]Q, where Q is a point on said elliptic curve (ε) that forms a public key associated with said second system; an initialization module including: a decoding module configured to perform a decoding step, The decoding step includes: determining a second random scalar that forms a second secret key k of M bits, where M<N; Calculating a public key P associated with the device, the public key P being equal to a third product such that P=[k]G′; transmitting said public key P to a second system; receiving encrypted data transmitted from the second system; Calculating at least one coordinate (CD1) of a midpoint SP1 of the elliptic curve, the midpoint SP1 being equal to a fourth product such that SP1=[k]Q′; deriving at least one key (KY1, V1, KMAC1) by applying a key derivation function (F1) to at least one of said coordinates (CD1) of said intermediate point SP1; decrypting the encrypted data based on the at least one key derived in the derivation to obtain decrypted data; a decoding module including: A cryptographic processing device comprising:

Images