Network coding-based secure communication

Abstract

The system and method provide a hybrid communication scheme that achieves high communication rates with post-quantum computational security guarantees. Messages to be communicated securely are first mixed using individually secure encodings, such as linear network codes, and a portion of the encoded messages is further encrypted. The encrypted and unencrypted messages are then transmitted over different communication channels. Because decoding any of the messages requires all messages, including the encrypted message, the pre-mixing makes each unencrypted message nearly as secure as the encrypted message. Thus, very few encrypted messages are used, and the rate of communication approaches unity as the number of channels increases. This is particularly beneficial in distributed data storage and other applications in the presence of noisy channels, where classical public-key cryptography systems can only be used for a portion of the transmitted or stored data.

Description

[Background technology]

[0001]

[0001] The relationship between information theory and cryptography can be traced back to Claude Shannon's research on security, which influenced his own advanced research on communications. There, Shannon defined the information-theoretic idea of ​​perfect secrecy when studying a scenario in which two users, Alice and Bob, want to communicate secretly in the presence of an eavesdropper, Eve. Under perfect secrecy, H(M|X)=H(M), where H is entropy, M is the private message, and X is the encrypted message transmitted over the communication network. If Eve can perfectly observe the encrypted message X (i.e., Eve is "strong"), then perfect secrecy can be achieved only if both Alice and Bob share a random key, i.e., a "one-time pad" R, with entropy equal to that of the message, i.e., H(R)≧H(M). Such a system is shown in Figure 1, where Alice sends two messages M1 and M2 to Bob via two different paths, and in the first path, a shared key

number

number

[0002]

[0002] The theoretical necessity for Alice and Bob to share a large secret key is often impractical, for example, if Alice and Bob are geographically separated. Therefore, considerable effort has been made to develop alternative solutions that relax the perfect secrecy requirement. One such relaxation derives from the assumption that the eavesdropper's computational power is limited. Such schemes, referred to in this disclosure as “computationally secure,” rely on the assumption that it is difficult to invert a particular one-way function. In such a scheme, Alice encrypts a private message using a one-way function before sending it to Bob. It should be difficult for Eve to invert this function, but it is not only possible for Bob to invert it, but also efficient if Bob possesses the appropriate key. One way to achieve this is by “public-key cryptography,” a phrase known in the art.

[0003]

[0003] A public-key cryptosystem consists of an encryption function Enc(·), a decryption function Dec(·), a private key s, and a public key p. The encryption function uses the public key to encrypt a private message M into Enc(M,p). The decryption function uses the private key to decrypt the encrypted message M=Dec[Enc(M,p),s]. An important theoretical property is that decrypting an encrypted message without the private key is computationally expensive. There are many ways to characterize this, but here we will focus on the concept of "security level". Generally speaking, the number of operations that are expected to be required to decode an encrypted message without knowing the private key is 2. b If the order is such that the public-key cryptosystem has a security level b, also known as "b-bit secure". An important practical property is that the entropy of the secret key s is much smaller than the message being communicated, which enables truly secure communication.

[0004]

[0004] One of the first and most widely used public-key cryptographic systems is the Rivest-Shamir-Adleman (RSA) cryptographic system. The security of RSA relies on the guescapability of two mathematical problems: integer factorization and the RSA problem. However, in 1994, Peter Shor published a polynomial-time algorithm for integer factorization known as Shor's algorithm, warning that the algorithm could be executed on a quantum computer. In other words, if a sufficiently large quantum computer is built, Shor's algorithm can be used to break the RSA cryptographic system. This development led to increased interest in cryptographic systems resistant to quantum attacks, a field that subsequently became known as "post-quantum cryptography."

[0005]

[0005] An early candidate for post-quantum cryptography, known as the "McEliece cryptosystem," was introduced in 1978, and its operation is shown in Figure 2. This cryptosystem uses a secret key p generated by Bob and given to Alice. This key can correct up to a certain number of errors, denoted by t, and specifies a particular linear code to be used by Bob. To send a message, Alice randomly generates a binary vector z and appends this vector to the message encoding according to a particular linear code specified by p, forming encrypted messages E(M1, z, p) and E(M2, z, p) as shown. The addition of vector z introduces t intentional "errors" that can be corrected by Bob if he knows the appropriate code, but are computationally difficult for Eve to correct.

[0006]

[0006] No attacks have been known against the MacLeese cryptosystem using Shor's algorithm. Aside from the lack of known quantum attacks, its encryption and decryption algorithms are faster than those of RSA. The main drawbacks of the MacLeese cryptosystem are two: 1) in typical applications, the public key size is much larger than that of RSA, and 2) there is significant communication overhead, with the communication rate being around 0.5 in the original paper. The exemplary MacLeese cryptosystem in Figure 2 has been improved since then to approximately 0.772 While this shows an increase in the rate, this increase still comes with a fairly significant penalty to the communication rate.

[0007]

[0007] The original McEliece scheme used binary Goppa codes. One might want to change the parameters of the Goppa code to increase the transmission rate. However, a key finding in the literature on transmission rates is that a polynomial-time algorithm is needed to distinguish high-rate Goppa code matrices from random matrices. Therefore, the security of high-rate Goppa codes may not be guaranteed. Another idea is to look for a coding scheme other than Goppa that produces a higher rate. However, most of the candidate coding schemes have already been broken.

[0008]

[0008] In parallel with advances in computational security, another relaxation of complete privacy has been explored in the literature, primarily by information theorists. Instead of limiting the computational power of the eavesdropper, the amount of information that the eavesdropper can obtain about the encrypted message is limited in "physical layer security," resulting in a so-called "weak eavesdropper." In such a paradigm, a weak eavesdropper E is shown in Figure 3 for contrast with a "strong eavesdropper." w It can be assumed that we can observe any set w of the total n symbols sent, where w is strictly less than n.

number

number

number

[0009]

[0009] However, complete secrecy using physical layer security comes at a considerable cost, namely a reduction in the rate of legitimate communication. This was demonstrated in Wyner's 1975 developmental study, in which Wyner introduced a non-constructive (NC) wire-tap channel, similar to the classic Alice, Bob, and Eve trio, as depicted in Figure 4, under the assumption of physical layer security.

[0010]

[0010] In efforts to improve efficiency with respect to rates, another relaxation of Shannon's complete secrecy, namely "individual secrecy," was introduced, as illustrated in Figure 5. This concept applies to the many messages Alice sends to Bob, for example M1, ..., M metc., and is best explained in a network setting where a weak Eve may observe any w of them. By increasing the rate beyond the limit imposed by the Wyner wiretap channel, information leakage is inevitable. Nevertheless, individual secrecy guarantees that no information about individual messages leaks. Thus, as shown in Figure 5, under the assumption that Eve can eavesdrop on and intercept all data through fewer paths than all paths (e.g., a single path 2 in Figure 5), Alice sends multiple different linear combinations of messages M1 and M2 to Bob over two different paths. Since Bob receives all messages, he can invert these linear combinations to recover the original messages M1 and M2. In the example of Figure 5, Bob recovers M2 by thinning out the message on path 1 from the message on path 2, and recovers M1 by thinning out M2 from the message on path 1. Generally, this process is realized by inverting a matrix. However, since Eve only receives a subset of the messages, she cannot solve the combination of the messages.

[0011]

[0011] The idea of individual secrecy embodies this concept by ensuring that, for all i = 1,..., m, H(M i |Y E,w ) = H(M i ). This situation is not for all messages, but for a subset of messages, perfect secrecy, i.e., H(M1,..., M m |Y E,w ) = H(M1,..., M mIt should be noted that this provides information about the combination of messages, not each individual message. In other words, the information Eve obtains from her observations helps her decipher information about the combination of messages, rather than each individual message. Individual anonymity is clearly a weak security idea, but as shown in Figure 5, system designers can often significantly increase the rate, and often even give the encryption process freedom in terms of rate. While there is no doubt that an efficient rate is beneficial, it is difficult to actually apply the assumption of physical layer security, namely the assumption that Eve will not experience a worse channel than Bob. [Overview of the project]

[0012]

[0012] Embodiments of the concepts, techniques, and structures disclosed herein provide a novel hybrid universal network coding cryptographic system (hereinafter, "HUNCC") for obtaining secure post-quantum cryptography at high communication rates. The secure network coding scheme is hybrid in the sense that it combines information theory security and cryptographic security, as can be provided by public-key cryptography, particularly post-quantum cryptography. In addition, the scheme is general and can be applied to any communication network and any public-key cryptographic system. From a computational standpoint, a coding scheme is constructed in which an arbitrary secure cryptographic system is used on a subset of the links and preprocessing similar to that for individual security is used. Under this scheme, 1) computational security guarantees against adversaries observing the entire link, 2) information-theoretic security guarantees against adversaries observing only a subset of the link, and 3) information rates approaching the network capacity are achieved.

[0013]

[0013] One advantage of our scheme is that it is sufficient to encrypt a single link or a small portion of the data being transmitted using a computational post-quantization scheme to guarantee any desired level of computational security. In other words, HUNCC can guarantee post-quantum security in networks where it is not possible to use public-key cryptography on all links in the network. In addition, as the number of communication links increases, the information rate approaches 1. As a concrete example, in a multipath network with three links, if a 128-bit computationally secure MacLeese cipher system is used on only one link, a computational security level of 128 bits is obtained on all paths, and the total information rate in the network becomes 0.91.

[0014]

[0014] Accordingly, the first embodiment is a method for securely communicating a plurality of data blocks. This method includes receiving a first message using a first data channel, which has an encryption of a first encoding of the plurality of data blocks. This method also includes receiving a second message using a second data channel, which has an unencrypted second encoding of the plurality of data blocks. This method further includes decrypting the first message in order to obtain the unencrypted first encoding of the plurality of data blocks. This method also includes recovering each message in the plurality of messages using the unencrypted first encoding and the unencrypted second encoding of the plurality of data blocks.

[0015]

[0015] In some embodiments, the first data channel and the second data channel are provided with different transmission media.

[0016]

[0016] In some embodiments, the first data channel and the second data channel have different usage times for a single transmission medium.

[0017]

[0017] In some embodiments, the encryption includes public-key cryptography.

[0018]

[0018] In some embodiments, the cryptography includes post-quantum cryptography.

[0019]

[0019] In some embodiments, decryption comprises decoding the unencrypted first and second encodings according to a linear network code.

[0020]

[0020] In some embodiments, decoding comprises decoding according to individual secure codes.

[0021]

[0021] In some embodiments, receiving a first message or a second message comprises correcting one or more errors.

[0022]

[0022] Another embodiment is a device for securely communicating a plurality of data blocks. The device includes a computing processor and a non-volatile memory that stores computer program code that, when executed by the computing processor, performs various processes. One of these processes includes receiving a first message using a first data channel, which has an encryption of a first encoding of the plurality of data blocks. Another of these processes includes receiving a second message using a second data channel, which has an unencrypted second encoding of the plurality of data blocks. Yet another of these processes includes decrypting the first message in order to obtain the unencrypted first encoding of the plurality of data blocks. Yet another of these processes includes recovering each message in the plurality of messages using the unencrypted first encoding and the unencrypted second encoding of the plurality of data blocks.

[0023]

[0023] In some embodiments, the first data channel and the second data channel are provided with different transmission media.

[0024]

[0024] In some embodiments, the first data channel and the second data channel have different utilization times of a single transmission medium.

[0025]

[0025] In some embodiments, the encryption includes public-key cryptography.

[0026]

[0026] In some embodiments, the cryptography includes post-quantum cryptography.

[0027]

[0027] In some embodiments, decryption comprises decoding the unencrypted first and second encodings according to a linear network code.

[0028]

[0028] In some embodiments, decoding comprises decoding according to individual secure codes.

[0029]

[0029] In some embodiments, receiving a first message or a second message comprises correcting one or more errors.

[0030]

[0030] It is recognized that the concepts, techniques, and structures disclosed herein can be embodied by those skilled in the art in other ways without departing from the teaching herein.

[0031]

[0031] The methods for creating and using the disclosed subject matter may be recognized by referring to the detailed descriptions associated with the drawings, where similar reference numbers identify similar elements. [Brief explanation of the drawing]

[0032] [Figure 1]

[0032] This figure shows an encryption system that uses a one-time pad for secure multipath communication between Alice and Bob, against Eve, a "strong" eavesdropper who can intercept and eavesdrop on all communication data. [Figure 2]

[0033] This figure shows a post-quantum MacLeese cryptosystem that uses [2960,2288]-Goppa codes, which is computationally secure against Strong Eve, which has access to a quantum computer. [Figure 3]

[0034] This diagram illustrates a modern multipath network for communication between Alice and Bob, illustrating both a "strong" eavesdropper, Eve, who can intercept and eavesdrop on all communication data, and a "weak" Eve, who can intercept and eavesdrop on only a portion of that data. [Figure 4]

[0035] This diagram shows a multipath network for communication between Alice and Bob that is informationally secure to weak Eve devices with network coding wire taps. [Figure 5]

[0036] This diagram illustrates a multipath network for communication between Alice and Bob, which is informationally secure to weaker Eve, using the individual security principles of the network. [Figure 6]

[0037] This figure shows a multipath network for communication between Alice and Bob using a Hybrid Universal Network-Coding Cryptosystem (HUNCC) according to embodiments of the concepts, techniques, and structures disclosed herein, which is computationally secure against strong Eve and informationally secure against weak Eve. [Figure 7]

[0038] Figure 6 shows the functional components of a hybrid, post-quantum, secure, multipath network scheme. [Figure 8]

[0039] This figure shows the process in a method for encoding, transmitting, and decoding data according to an embodiment of HUNCC. [Figure 9]

[0040] This figure shows the details of the encoding scheme performed by Alice according to the HUNCC embodiment. [Figure 10]

[0041] This figure shows the efficiency and trade-off between security level and communication rate in an embodiment of HUNCC, as a function of the number of encrypted links using McEliece code, which has an information rate of approximately 0.5 per encrypted link. [Figure 11]

[0042] This figure shows the efficiency and trade-offs between security level and communication rate in an embodiment of HUNCC as a function of the number of encrypted links, each using a different computationally intensive security code. [Figure 11-1] This figure shows the efficiency and trade-offs between security level and communication rate in an embodiment of HUNCC as a function of the number of encrypted links, each using a different computationally intensive security code. [Figure 12]

[0043] This figure shows the functional components of a hybrid, post-quantum, secure, single-path communication scheme according to an embodiment. [Figure 13]

[0044] This figure shows a myopic adversary model in an embodiment in which an eavesdropper can inject errors into packets sent from Alice to Bob. [Figure 14]

[0045] This figure shows an embodiment of an ultra-high reliability, low-latency communication system for video streaming. [Figure 15]

[0046] This diagram schematically illustrates the relevant physical components of a computer that may be used to embody the concepts, structures, and techniques disclosed herein. [Modes for carrying out the invention]

[0033]

[0047] The drawings are not necessarily to a fixed scale and do not include all elements of the system; instead, the emphasis is on illustrating the concepts, structures, and techniques that are intended to be protected herein.

[0034]

[0048] According to embodiments of the concepts, techniques, and structures disclosed herein, a Hybrid Universal Network Coding (HUNCC) cryptographic system achieves post-quantum cryptography at a high information rate. This secure network coding scheme combines computational security principles with primitives of physical layer security to introduce a hybrid system that relies on both individual confidentiality and a computationally secure cryptographic system.

[0035]

[0049] This concept is illustrated through a secure transmission scheme using parallel links for multiple paths (multipath) where multiple messages are sent between Alice and Bob. In doing so, one of the main shortcomings of physical layer security—the assumption that an eavesdropper cannot observe all messages sent between Alice and Bob—is addressed. In the system disclosed herein, Eve can indeed observe the entire transmission between Alice and Bob, meaning Eve has a strong potential for interception.

[0036]

[0050] However, as with any computationally secure system, we would make assumptions about Eve's computational power. Instead of encrypting the entire message from Alice using public-key cryptography, we encrypt only a portion of the communication link, in some embodiments, only one of the links. Assuming there are computational limitations, the encrypted link is analogous to Eve's loss, and therefore, conventional techniques from physical layer security codes can be employed here. In other words, as assuming there are computational limitations, we can force an eavesdropper to observe only a portion of the message via cryptography. This allows for an increase in the communication rate, similar to what is done with individual secrecy, and provides a computationally strong security guarantee. If Alice and Bob have more communication channels, the communication rate will increase even further. In fact, as the number of channels increases, the rate approaches 1.

[0037]

[0051] In many practical heterogeneous networks, it cannot be assumed that a public-key cryptographic system can be applied to all paths. The HUNCC coding scheme can guarantee post-quantum security across the entire network by using a public key for information transmitted through only one path. Furthermore, important applications where HUNCC may be used are discussed below. Specifically, in addition to multiplexed paths, we will also discuss single-pathed paths, distributed storage, ultra-high-reliability, low-latency streaming communications, and the case of myopic adversaries.

[0038]

[0052] Figure 6 shows a hybrid scheme for a network with two paths. Alice is using private messages.

number

[0039]

[0053] Alice and Bob agree on a public-key cryptography scheme (Enc,Dec,p,s). Alice first, for example,

number

[0040]

[0054] If Eve is a weak eavesdropper and observes only one communication channel, this scheme is information-theoretically secure on its own, regardless of Eve's computing power. i However, a single encoded X j This is because it is independent of the other. If Eve is a strong eavesdropper and is observing both communication channels, each message M i This would be computationally secure with almost the same security level as the cryptographic scheme (Enc,Dec,p,s). In fact, in Theory 1 of Alejandro Cohen et al.'s "Network Coding-Based Post-Quantum Cryptography" (September 3, 2020, https: / / arxiv.org / abs / 2009.01931) (hereinafter, "Cohen et al."), which is reproduced below, the most well-known attack against (Enc,Dec,p,s) would require 2 to break the encryption. b If multiple operations are required, Eve will send any message M i In order to determine,

number

[0041]

[0055] For individual secure codes G to function,

number

[0042]

[0056] Assume Alice and Bob agree to use a 128-bit MacLeese cipher system for the encrypted link. To be secure against modern computational security assumptions, Bob may choose the [2960,2288]-Goppa code with a 1,537,536-bit public key. In this case, the domain of the cryptographic function is:

number

number

number

number

[0043] Next, Alice sends log2|E(X1,p)|=2960 bits over link 1 and log2|X2|≈2287.1 bits over link 2. Thus, the total communication cost is approximately 5248 bits, and the communication rate is slightly greater than 0.87, as shown in Figure 6. According to Cohen et al.'s Theory 1, both messages on M1 and M2 are 128-bit secure. Below, we focus on an example in which Alice and Bob agree to use the RSA scheme, which is vulnerable to Shor's algorithm but is commonly used and has a low penalty to the information rate.

[0044]

[0057] Before moving on to the details of the reference implementation, we will provide some background information on the two main building blocks of our scheme: 1) a computationally secure cryptographic system, and 2) individual security based on information theory. While the focus is on the MacLeese cryptographic system, note that any computationally secure cryptographic system can be used.

[0045]

[0058] <Definition 1> Public-key cryptography uses a tuple (Enc, Dec, p, s, k b ,n b ) and here

number

number

number

number

[0046]

[0059] Public key cryptography (Enc, Dec, p, s, k b ,n b )teeth,

number

number

[0047]

[0060] McCrees' post-quantum public-key cryptography system works as follows: Bob has a public key p=(G pub Generate SGP(t). Here, the following applies:

number

[0048] Both Alice and Eve can access the public key. The private key is s=(S,D g It consists of ,P), where D g This is an efficient decoding algorithm for g.

number

number

number

number

[0049]

[0061] In contrast to computational security, individual security is weak against eavesdropping.

number

number

number

number

[0050]

[0062] Next, we will describe how to construct individual security codes from arbitrary linear codes. Therefore, u≧k u Length k in that case u and has dimension w

number

[0051]

number

number

number

number

number

number

[0052]

[0063] In public-key cryptography, it is important to note that, unlike the MacLeese cryptosystem, the generator matrix and the code are public in the physical layer security scheme. Therefore, it can be assumed that both Bob and Eve have access to all the matrices described above.

[0053]

[0064] Individual security codes can be used as follows: Alice, message

number

number

number

[0054]

[0065] Next, we define the security concepts and threat models used in the remainder of the disclosure. Throughout, we assume a ciphertext-only attack model. That is, Eve, as the adversary,

number

[0055]

[0066] <Definition 2> Assuming that the best known algorithms can decode M from observations of the ciphertext c(M) alone, there are at least 2 b If it is necessary to perform a certain number of operations, the cryptographic system having messages M and c(M) has a security level of b.

[0056]

[0067] It should be noted that this definition of security level implicitly imposes limitations on the size and distribution of the encoded message M. In fact, assuming a public-key cryptography system, an adversary could always use a brute-force attack by guessing potential message inputs until the correct message input is found. Generally, message M is,

number

[0057]

[0068] The computational security level of Definition 2 relates to a single link, or equivalently, a single message. When multiple messages are transmitted over each link, it is desirable to provide security guarantees that apply individually to each message. In the case of weak security, this can be achieved through information-theoretic individual concealment.

[0058]

[0069] <Definition 3> For all ω⊂[l] such that |ω|=w, H(M s |Y ω ) = H(M s ) If this is the case, then message M1, ..., M l A cryptographic system having (l,w) is secure individually, where,

number

[0059]

[0070] In the case of strong Eve, where the entire transmitted message can be observed, (l,w) individual security is not obtained. Instead, we describe the idea of ​​individual computational security. This involves decoding every message on every path, 2 b This indicates that multiple operations are required.

[0060]

[0071] <Definition 4 (Individual Computational Secrecy)> For i=1,...,l, messages M1,...,M l and ciphertext

number

[0061]

[0072] Individual computational secrecy is given by M=[M1,…,M l ] and c(M)=[c1(M1,…,M l ), ..., c l (M1,…,M l It should be noted that this is implied by computational security of cryptographic systems that have ). Therefore, this is a strictly strong security concept.

[0062]

[0073] Referring now to Figure 7, we will examine the system overview of an embodiment in a network 100 consisting of source nodes, Alice 110, connected to destination node, Bob 130, via l noise-free, independent communication links 122. The purpose of Alice 110 is that each of its lengths

number

number

[0063] It is assumed that Eve 120 has access to a quantum computer. Hereafter, each communication link 122 is a different transmission medium (some of which are shown in Figure 3, for example), and may be referred to herein as a “data channel” or “path.” However, it is recognized that the concepts, techniques, and structural embodiments herein may be used together with multiple data channels residing within a single path (i.e., as different utilization times of a single transmission medium), as will be discussed below in relation to Figure 12.

[0064]

[0074] The vector of messages that Alice 110 sends to Bob via each communication link 122 is Y = [Y l ;…;Y l This is represented by ]. These messages must be such that Bob 130 can decode M from the message. Therefore, if H(M|Y)=0, then Y can be said to be reliable. However, if message Y does not decode M itself, then message Y must satisfy certain properties. This depends on how strong Eve 120 is.

[0065]

[0075] We will consider two types of Eve 120. E is a strong Eve 120. s It observes all communication links and has access to the entire Y network. It also has weak E120. w This observes only a subset of communication link 122. Each observed quantity is

number

[0066]

[0076] At a high level, the cryptographic system works as follows: Alice 110 and Bob 130 use the public key p stored in the public directory 124, which Eve 120 can access, to perform a public-key cryptosystem (Enc,Dec,p,s,k) as defined in definition 1. b ,n b) agrees. Next, Alice 110 selects c of the l links 122 as encrypted links. In Figure 7, only a single message X1 is shown as encrypted by the cryptographic processor 114, and therefore c=1, but it is recognized that any number of links can be selected for encryption. Since the unencrypted lc links are not secure, this alone does not provide complete security. To solve this problem, an additional step is introduced before cryptography 114 in which messages are mixed (encoded) by a matrix multiplier 112 using individually secure linear codes, in particular linear network codes. This shows here that each message is computationally secure, according to Cohen et al.'s Theorem 1. The security performance and total communication rate of this scheme depend on the choice of c and the parameters of the public-key cryptographic system. Bob 130 extracts Y=[Y1;…;Y l The first c encrypted messages are decrypted using the decryption processor 132, then the first c messages are decoded using the matrix multiplier 134 by inversion of the mixing process 112, and the last lc messages are decoded using the matrix multiplier 136 to reconstruct the complete initial message M.

[0067]

[0077] Here, we will provide a more detailed explanation of HUNCC by referring again to the system shown in Figure 7, the entire algorithm 1 shown in Figure 8, and the encoding process performed by Alice 110 shown in Figure 9. (Enc,Dec,p,s,k b ,n b Let ) be a public-key cryptosystem with security level b, as described in Definition 1. As usual, the public key p is generated by Bob 130 and provided to Alice 110 via some public communication channel (e.g., public directory 124). Alice 110 selects a number c of paths 122 to be encrypted. Without loss of generality, the paths indexed by 1, ..., c are the encrypted paths. Let u ≥ l be fixed, and the message

number

number

number

number

number

[0068] Next, as explained above,

number

number

[0069]

[0078] Here, for all paths i∈[c], the symbol

number

number

number

number

number

number

number

number

[0070]

[0079] Here, we detail the decoding process in Bob 130. We assume that there are no errors in all paths. Therefore, Bob 130 receives all messages transmitted over communication link 122. For each of the c encrypted data channels, Bob 130 receives a message with a data block, encrypted with the cipher of the first unencrypted encoding, and decodes the message using the secret key s (see decryption processor 132 in Figure 7 and lines 17-20 in Figure 8).

[0071]

[0080] Therefore, Bob 130 is true for all i ∈ [c],

number

number

number

number

number

[0072]

[0081] Some advantages of using the HUNCC system and method described above are explained here. HUNCC is suitable for handling strong eavesdroppers who observe the entire communication link. In addition to being computationally secure, HUNCC is information-theoretically secure if the eavesdropper is a weak eavesdropper and observes only w paths. Also, the information rate R is the convergence rate.

number

[0073]

[0082] <Theorem 1> u≧l, c≧1 and (Enc,Dec,p,s,k b ,n b ) is a public-key cryptosystem with security level b. In this case, input

number

[0074]

[0083] <Theorem 2> The algorithm in Figure 8 is secure for each (l,w) individually.

[0075]

[0084] <Theorem 3> Public-key cryptography (Enc, Dec, p i ,s i ,k b ,n b Let 1 ≤ c ≤ l be the number of encrypted paths using ). In this case, the algorithm in Figure 8 is the information rate

number

[0076]

[0085] Here are some important points to note regarding HUNCC. First, it is essential to note that the public keys used in the c cryptographic paths of HUNCC are simply conventional public keys from the underlying cryptographic system (for example, those provided by the MacLeese cryptographic system). Therefore, this public key is transmitted through the multiplexed network. u This is unrelated to individual messages and can be provided to Alice in advance via a public channel.

[0077]

[0086] Furthermore, unlike information-theoretic security where a unique secret key is used for each message sent, as in the case of the one-time pad, the public key in HUNCC can be used for multiple messages. Similarly, the generator matrix G IS of an individual secure code is not confidential. Alice and Bob can agree on this matrix via a public channel, i.e., this matrix may be made public to Eve. Also, this matrix can be used indefinitely for all future transmissions.

[0078]

[0087] Another point is regarding the security level of HUNCC. As stated in Theorem 1, when the underlying public-key cryptosystem has a security level of b, HUNCC is individually computationally secure at least

Number

[0079]

[0088] Finally, although our main focus is on post-quantum cryptosystems, HUNCC can be used in any public-key cryptosystem, including those combined with symmetric-key cryptosystems.

[0080]

[0089] Figures 10 and 11 show the performance of HUNCC. Three measures are shown, namely, information rate, individual computational secrecy, and information-theoretic individual secrecy. In particular, the trade-off between these quantities can be seen when the number of encryption links, denoted by c, changes in Figures 7 - 9.

[0081]

[0090] We begin by considering the communication rate. See Theorem 3 above. Note that reducing the number of encrypted links c increases the rate. On the other hand, the computational security level remains substantially constant as long as at least one path is encrypted, i.e., as long as c ≥ 1. Therefore, the practical systems that embody the concepts, techniques, and structures disclosed herein can use only a single encrypted path, link, or data channel, or apply only to a portion of the data transmitted through them.

[0082]

[0091] In the case of a weak Eve, the individual security level increases proportionally to the number of links lw from which the weak Eve does not extract information. In other words, computational bit-level security remains constant, but the uncertainty of an adversary observing a subset of links increases.

[0083]

[0092] Therefore, Figure 10 shows each performance parameter versus the number of encryption links c for HUNCC using the original MacLeese cipher system with [1024,512]-Goppa coding. The information rate through each encryption path is k b / n b It is approximately 0.5. For explanation purposes, let's consider normalized security metrics, namely, 1) Normalized Computational Security Level

number

number

[0084]

[0093] In the example given in FIG. 10, the results are those when the same McEliece cryptosystem code with the same public key is used for all of the c encrypted links. Thus, the normalized computational security level is zero for c = 0 and one for c = 1. By Theorem 1, the computational security level for any 1 ≦ c < l is here, δ = O(l 3 ) and is bounded by b - δ / 2 δ . Note that this difference is very small and does not show up in the plot, which remains essentially constant and is equal to one for c ≧ 1.

[0085]

[0094] The embodiments disclosed herein are not limited to the original McEliece cryptosystem. Any cryptosystem can be utilized. To illustrate this, FIG. 11 shows the efficiency of the disclosed embodiments and the resulting trade-offs for other codes and systems for communication links with l = 3 and l = 10. First, the McEliece cryptosystem using the [1024, 524]-Goppa code that realizes the original parameter, i.e., a computational security of b = 58 bits, is shown. Next, the McEliece cryptosystems using the [2960, 2288]-Goppa code that realizes a computational security of b = 128 bits and the [6624, 5129]-Goppa code that realizes a computational security of b = 256 bits are shown. Both have an information rate of k b / n b ≈ 0.777. Also shown is the McEliece cryptosystem employing a QC-LDPC code. In this code system, the following parameters, k b = 16384 and n b , i.e., the rate k b / n bA code with a rate of 0.6667 is recommended. This code achieves computational security on b=75.8 bits. Next, we present the Reed-Solomon code with a rate of 0.57 proposed by Niederreiter (note that the generalized Reed-Solomon code has been broken in the literature). A Niederreiter-type system using the same Goppa code as used in the original MacLeese construction, with the same security level, is expected to be tested under state-of-the-art attacks on the MacLeese cryptosystem and thus achieve computational security on b=58 bits.

[0086]

[0095] In this comparison presented in Figure 11, the maximum computational security level obtained is 256 bits using the MacLeese cryptosystem with [6624,5129]-Goppa codes. Therefore, for each possible code, the results presented on the left side of Figure 11 are normalized by b_max=256. It should be remembered that the computational security level is one of the main parameters considered when selecting a cryptographic system, the other being the size of the public key. Also note that, for the reasons explained above, or by changing the total number of paths in the network, the computational security level of HUNCC remains essentially constant even when increasing the number of links using the cryptographic system.

[0087]

[0096] Next, we describe features and applications that exemplify the usefulness and performance of the disclosed HUNCC scheme. These applications include single-path communication (Figure 12), myopic adversarial systems (Figure 13), distributed storage and other cloud applications, highly reliable low-latency communication (Figure 14), and the use of RSA cryptographic systems other than post-quantum or other cryptographic systems.

[0088]

[0097] The network shown in Figure 7 uses multiplexed-path communication, but the secure coding scheme disclosed herein is universal in that it can be applied to any communication network. For example, it can be used not only in classic point-to-point single-path communication but also in heterogeneous mesh networks. Figure 12 illustrates how the disclosed secure scheme can be applied to classic point-to-point single-path communication. In this set 200, as in network 100 presented above, there is one source, Alice 210, one legitimate destination, Bob 230, and an eavesdropper, Eve 220. The main difference is that in set 200, there is only one path 222 for transmitting information between Alice 210 and Bob 230. Alice 210 is a finite field

number

number

[0089]

[0098] Another important scenario considered in the literature is the scenario where Eve is allowed not only to eavesdrop on or intercept information transmitted over the network, but also to corrupt encrypted packets. This scenario has been considered in the literature under different adversary models, such as passive attacks, myopic adversaries, man-in-the-middle attackers, Byzantine attacks, etc. A general depiction of packet corruption is illustrated in FIG. 13, where a myopic adversary corrupts data passing through a maximum of t paths.

[0090]

[0099] In the case of a weak eavesdropper who can only obtain information from a subset of w < l paths within the network, a linear individual security code can be extended to perform correction of up to t errors that may be injected by Eve. One solution is to generalize the code, but such an extension incurs a cost. To correct t injected errors, the rate needs to be reduced by 2t. However, note that in this set, the code can support the case where Eve may corrupt a subset of the messages transmitted over the network, regardless of whether they are on an encrypted path. In fact, the correction characteristics only depend on the decoding of the linear coding scheme and are independent of the decryption phase.

[0091]

[0100] In the case of a strong eavesdropper who can obtain information from all paths within the network, the same generalized code can be used to correct up to t errors that may be injected by Eve. However, in this case, to ensure security, Alice needs to encrypt at least 2t + 1 messages transmitted over different paths in the network. Therefore, an additional 2t messages transmitted for error correction need to be encrypted to prevent Eve from obtaining messages that are sufficiently encoded by the linear code, which may result in a matrix with the rank required to decode the total messages.

[0092]

[0101] Authentication between encoded messages can be used to reduce the overhead required to correct errors injected in the solutions disclosed above. Note that if Bob can identify the corrupted message, Alice only needs to include one additional symbol for each injected error, in contrast to the two messages in the model presented above. Furthermore, the generalized linear code described above supports the scenario that there are no errors in the path in the network. If the cryptographic system is based on error-correction codes, as in the MacLeese cryptographic system, instead of adding an error vector in the source, Alice can use channel errors to confuse Eve. In such cases, the code is designed to account for these errors so that it can be decoded by a valid decoder. Thus, Bob can decode the information. All these enhancements can increase the effective rate of these solutions.

[0093]

[0102] HUNCC can also be applied to distributed storage and other "cloud" applications. The goal of distributed storage systems is to provide reliable access to data distributed across unreliable storage nodes. Data center-related applications are everywhere today, including Google's GFS and BigTable, Amazon's Dynamo, Facebook's Apache Hadoop, Microsoft's WAS, and LinkedIn's Voldemort and SkyFlok.

[0094]

[0103] One of the main drawbacks of distributed storage is that as the number of locations where data is stored increases, the risks to data security and privacy potentially increase. One approach to address this problem is to reinterpret the problem as a multipath network. This is done by considering Alice and Bob as the same individual at different points in time, and the communication links as storage nodes. In this way, different privacy solutions for multipath networks, including HUNCC, can be easily applied to protect data in distributed storage systems. Both probabilistic and adversarial natures of erasure and error can be addressed using the error correction techniques introduced by the myopic adversarial described above, yielding similar results.

[0095]

[0104] HUNCC can also be used to provide ultra-high reliability, low-latency communication. Recently, the application of network coding in streaming communications requiring low latency has been explored, along with applications in audio / video streaming, smart city communications, Internet of Things (IoT) networks and control applications, and distributed computing. In this context, Figure 14 depicts a multiplexed, low-latency communication environment for video streaming, where Alice generates or receives digital video packets and streams them to Bob. Traditional coding solutions that achieve high throughput are generally not suitable for guaranteeing the sequential, low delivery latency required in these applications. This has led to a series of studies proposing methods for investigating the trade-off between high rate and low latency.

[0096]

[0105] However, when communication needs to be secure, HUNCC can be used in conjunction with various network coding schemes known in the art. In these coding schemes, the number of messages from Alice involved in the linear network encoding process depends on the desired rate / latency trade-off. However, in security applications using HUNCC, this number is further limited by the required security assurances. This can result in delays because more messages may need to be mixed together to provide secrecy.

[0097]

[0106] Finally, it should be noted that, with respect to HUNCC applications, any computationally secure cryptographic system can be used according to the embodiments of the concepts, techniques, and structures disclosed herein. In particular, RSA can be applied to the network coding solution in the context of a multiple path network with two paths, as shown in the example given in Figure 6. As the first step of encoding on the Alice side, the generation matrix of individual security codes is set such that X=MG=[M1+M2,M1+2M2].

number

number

[0098]

[0107] Figure 15 schematically shows the relevant physical components of computer 300 that may be used to embody the concepts, structures, and techniques disclosed herein. In particular, computer 300 may be used in whole or in part to implement environment 100 or any part thereof shown in Figure 7, in particular Alice's node 110 or Bob's node 130 or communication path 122 or public directory 124, or algorithm 1 or part thereof shown in Figure 8, or matrix and cryptographic operations shown in Figure 9, or environment 200 or any part thereof shown in Figure 12, in particular Alice's node 210 or Bob's node 230 or single communication path 222 or public director 224, or video streaming and playback functions shown in Figure 14. Generally, computer 300 has many functional components that communicate data with each other using a data bus. The functional components in Figure 3 are physically arranged based on the speed at which each must operate and the techniques used to communicate data using the bus at the speed required to enable such operation.

[0099]

[0108] Thus, the computer 300 is configured as high-speed components and buses 311-316 and low-speed components and buses 321-329. The high-speed components and buses 311-316 are connected for data communication using a high-speed bridge 310, also called the "northbridge," while the low-speed components and buses 321-329 are connected using a low-speed bridge 320, also called the "southbridge."

[0100]

[0109] The computer 300 includes a central processing unit ("CPU") 311 coupled to a high-speed bridge 310 via a bus 312. The CPU 311 is an electronic circuit configuration that executes instructions for a computer program. As is known in the art, the CPU 311 can be implemented as a microprocessor, i.e., an integrated circuit ("IC") (also called a "chip" or "microchip"). In some embodiments, the CPU 311 can be implemented as a microcontroller for embedded applications or according to other embodiments known in the art.

[0101]

[0110] Bus 312 may be implemented using any technique known in the art for the interconnection of CPUs (or, more specifically, microprocessors). For example, bus 312 may be implemented using the Hyper Transport architecture originally developed by AMD, Intel's QuickPath Interconnect ("QPI"), or a similar technique. In some embodiments, the functions of the high-speed bridge 310 may be implemented entirely or partially by the CPU 311, eliminating the need for bus 312.

[0102]

[0111] The computer 300 includes one or more graphics processing units (GPUs) 313 coupled to a high-speed bridge 310 via a graphics bus 314. Each GPU 313 is designed to process commands from the CPU 311 and convert them into image data to be displayed on a display screen (not shown). In some embodiments, the CPU 311 performs graphics processing directly, eliminating the need for a separate GPU 313 and graphics bus 314. In other embodiments, the GPU 313 is physically embodied as a separate integrated circuit from the CPU 311 and may be physically removable from the computer 300 if embodied on an expansion card such as a video card. The GPU 313 may store image data (or other data if the GPU 313 is used as an auxiliary computing processor) in a graphics buffer.

[0103]

[0112] The graphics bus 314 may be implemented using any technology known in the art for data communication between the CPU and the GPU. For example, the graphics bus 314 may be implemented using the Peripheral Component Interconnect Express ("PCI Express" or "PCIe") standard or similar technology.

[0104]

[0113] Computer 300 includes primary storage 315 coupled to a high-speed bridge 310 via a memory bus 316. Primary storage 315, which may be referred to herein as “main memory” or simply “memory”, includes computer program instructions, data, or both, used by the CPU 311. Primary storage 315 may include random access memory (“RAM”). RAM is “volatile” if data is lost when the power is cut off, and “non-volatile” if data is retained even when power is not supplied. Typically, volatile RAM is used when computer 300 is “started up” and running programs, and when computer 300 is temporarily “sleeping,” while non-volatile RAM (“NVRAM”) is used when computer 300 is “hibernating,” but embodiments may vary. Volatile RAM may be, for example, dynamic (“DRAM”), synchronous (“SDRAM”), and double data rate (“DDR SDRAM”). Non-volatile RAM may be, for example, solid-state flash memory. RAM may be provided physically as one or more dual inline memory modules ("DIMMs") or as other similar techniques known in the art.

[0105]

[0114] The memory bus 316 can be implemented using any technique known in the art for data communication between the CPU and primary storage. The memory bus 316 may comprise an address bus for electrically indicating storage addresses and a data bus for sending and receiving program instructions and data to and from the primary storage 315. For example, if 64 bits (8 bytes) of data are stored and retrieved at a time, the data bus has a width of 64 bits. Continuing this example, if the address bus has a width of 32 bits, then... 32 Because it can access the memory addresses of the computer 300, it can access up to 8*2 32 A primary storage 315 with 32 gigabytes (GB) of capacity may be used. In this example, the memory bus 316 has a total width of 64 + 32 = 96 bits. The computer 300 may also include a memory controller circuit (not shown) that converts electrical signals received from the memory bus 316 to electrical signals required by physical pins in the primary storage 315, and vice versa.

[0106]

[0115] Since computer memory can be organized hierarchically based on the trade-off between memory response time and memory size, descriptions and references to types of memory at specific physical locations herein are for illustrative purposes only. Accordingly, some embodiments (e.g., embedded systems) provide a CPU 311, graphics processing unit 313, primary storage 315, and high-speed bridge 310, or any combination thereof, as a single integrated circuit. In such embodiments, buses 312, 314, and 316 can form part of the same integrated circuit and do not need to be physically separated. Other designs for computer 300 may embody the functions of the CPU 311, graphics processing unit 313, and primary storage 315 in different configurations, eliminating the need for one or more of the buses 312, 314, and 316.

[0107]

[0116] The depiction of the high-speed bridge 310 coupled to the CPU 311, GPU 313, and primary storage 315 is merely illustrative, as other components can be coupled to the high-speed bridge 310 for communication. For example, a network interface controller ("NIC" or "network adapter") may be coupled to the high-speed bridge 310 to send and receive data using a data channel. The NIC may store data sent to and received from the data channel in a network data buffer.

[0108]

[0117] The high-speed bridge 310 is coupled to the low-speed bridge 320 for data communication using an internal data bus 330. Control circuit configurations (not shown) may be required to send and receive data at different speeds. The internal data bus 330 may be implemented using Intel's Direct Media Interface ("DMI") or a similar technology.

[0109]

[0118] Computer 300 includes secondary storage 321 coupled to a slow bridge 320 via a storage bus 322. Secondary storage 321, which may be referred to herein as “auxiliary memory,” “auxiliary storage,” or “external memory,” stores program instructions and data for relatively slow, relatively long-duration access. Because such durations may include power cut-off from computer 300, secondary storage 321 may include non-volatile memory (which may or may not be randomly accessible).

[0110]

[0119] Non-volatile memory may comprise solid-state memory that has no moving parts, such as a flash drive or solid-state drive. Alternatively, non-volatile memory may comprise a moving disk or tape for storing data and a device for reading (and possibly writing) data. Data may be stored optically, for example, on a compact disc ("CD"), digital video disc ("DVD"), or Blu-ray disc ("BD"), or magnetically on a disk in a hard disk drive ("HDD") or floppy disk, or on a digital audio tape ("DAT"). Non-volatile memory may be read-only ("ROM"), write-once read-only ("WORM"), programmable ("PROM"), erasable ("EPROM"), or electrically erasable ("EEPROM").

[0111]

[0120] The storage bus 322 may be implemented using any technology known in the art for data communication between the CPU and secondary storage, and may include a host adapter (not shown) for applying electrical signals from the slow bridge 320 to the format required by physical pins on the secondary storage 321 and vice versa. For example, the storage bus 322 may use the Universal Serial Bus ("USB") standard, the Serial AT Attachment ("SATA") standard, the Parallel AT Attachment ("PATA") standard such as Integrated Drive Electronics ("IDE"), Enhanced IDE ("EIDE"), ATA Packet Interface ("ATAPI"), or Ultra ATA, the Small Computer System Interface ("SCSI") standard, or similar technologies.

[0112]

[0121] The computer 300 also includes one or more expansion device adapters 323 coupled to the low-speed bridge 320 via one or more expansion buses 324. Each expansion device adapter 323 enables the computer 300 to communicate with expansion devices (not shown) that provide additional functionality. Such additional functionality may be provided by another removable expansion card, such as an additional graphics card, network card, host adapter, or dedicated processing card.

[0113]

[0122] Each expansion bus 324 may be implemented using any technique known in the art for data communication between the CPU and the expansion device adapter. For example, the expansion bus 324 may send and receive electrical signals using data networking standards such as the Peripheral Component Interconnect ("PCI") standard or the Ethernet standard, or similar techniques.

[0114]

[0123] The computer 300 includes a basic input / output system ("BIOS") 325 and a super I / O circuit 326 coupled to a slow bridge 320 via a bus 327. The BIOS 325 is non-volatile memory used to initialize the computer 300's hardware during the power-up process. The super I / O circuit 326 is an integrated circuit that combines input / output ("I / O") interfaces for slow input / output devices 328 such as a serial mouse or keyboard. In some embodiments, the BIOS functionality is directly incorporated into the super I / O circuit 326, avoiding the need for a separate BIOS 325.

[0115]

[0124] Bus 327 may be implemented using any technique known in the art for data communication between the CPU, BIOS (if present), and super I / O circuitry. For example, bus 327 may be implemented using a low-pin-count ("LPC") bus, an industry-standard architecture ("ISA") bus, or similar techniques. Super I / O circuitry 326 is coupled to I / O device 328 via one or more buses 329. Bus 329 may be a serial bus, a parallel bus, another bus known in the art, or a combination thereof, depending on the type of I / O device 328 coupled to computer 300.

[0116]

[0125] Any reference in this specification to “one embodiment” or “a particular embodiment” means that certain features, structures, or characteristics described in relation to an embodiment may be included in at least one embodiment of the claimed subject matter. The phrase “in one embodiment” appearing in various places in this specification does not necessarily refer to the same embodiment, nor is another or alternative embodiment necessarily mutually exclusive with any other embodiment. The same applies to the term “implementation.”

[0117]

[0126] As used in this application, the word “exemplary” is used herein to mean something that serves as an example, illustration, or reference. Any aspect or design described herein as “exemplary” should not necessarily be construed as being preferable or advantageous to any other aspect or design. Rather, the use of the word “exemplary” is intended to present the concept in a concrete manner.

[0118]

[0127] In addition, the term “or” is intended to mean an inclusive “or,” not an exclusive “or.” That is, unless otherwise specified or it is clear from the context, “X uses A or B” is intended to mean any of the natural inclusive permutations. That is, if X adopts A, X adopts B, or X adopts both A and B, then “X adopts A or B” is satisfied under any of the aforementioned cases. In addition, the articles “a” and “an” used in this application and the attached claims should generally be interpreted as meaning “one or more,” unless otherwise specified or it is clear from the context that they refer to a singular form.

[0119]

[0128] Furthermore, terms such as “system,” “component,” “module,” “interface,” and “model” are generally intended to refer to computer-related entities that are either hardware, a combination of hardware and software, software, or running software. For example, a component may be, but is not limited to, a process running on a processor, a processor, an object, an executable file, a thread of execution, a program, and / or a computer. As an example, both an application running on a controller and the controller itself can be components. One or more components may reside within a process and / or thread of execution, and a component may be localized to one computer and / or distributed across two or more computers.

[0120]

[0129] The subject matter described herein may be described in the context of exemplary implementations for processing one or more computing application functions / operations for computing applications having user-interactive components, but the subject matter is not limited to these specific embodiments. Rather, the techniques described herein are applicable to any suitable type of user-interactive component execution management method, system, platform, and / or apparatus.

[0121]

[0130] Some embodiments may be implemented in the form of methods and apparatus for implementing these methods. The described embodiments may also be implemented in the form of program code embodied on a tangible medium such as a magnetic recording medium, an optical recording medium, a solid-state memory, a floppy disk, a CD-ROM, a hard drive, or any other machine-readable storage medium, where the program code is loaded into a machine such as a computer and executed by the machine, the machine becomes an apparatus for implementing the claimed invention. The described embodiments may also be implemented in the form of program code, whether stored in a storage medium, loaded by a machine and / or executed by a machine, or transmitted via some transmitting medium or carrier such as electrical wiring or cables via optical fiber or electromagnetic radiation, where the program code is loaded into a machine such as a computer and executed by the machine, the machine becomes an apparatus for implementing the claimed invention. When implemented in a general-purpose processor, the program code segment, in conjunction with the processor, provides a unique device that operates similarly to a specific logic circuit. The described embodiments may be carried out in the form of a bitstream or other sequence of signal values ​​transmitted electrically or optically through a medium, generated using the method and / or apparatus of the claimed invention, or magnetic field fluctuations stored in a magnetic recording medium.

[0122]

[0131] The steps of the exemplary methods described herein do not necessarily have to be performed in the order described, and the order of the steps in such methods should be understood to be merely illustrative. Similarly, in methods consistent with various embodiments, additional steps may be included in such methods, and certain steps may be omitted or combined.

[0123]

[0132] It will be further understood that, in order to illustrate the essence of the claimed invention, various modifications to the details, materials, and arrangement of the described and illustrated parts can be made by those skilled in the art without departing from the scope of the appended claims.

Claims

1. A method of securely communicating messages to individuals, The steps include receiving first data using a first data channel, which comprises encryption of the first part of the encoding of the message using separate secure codes by a generator matrix, The steps include receiving a second data using a second data channel, comprising a second portion of the encoding of the message using the generator matrix, A step of decoding the first data in order to obtain the first portion of the encoding of the message, The steps include obtaining the message by multiplying the first part of the encoding and the second part of the encoding by the inverse of the generator matrix, The step of displaying the message to the individual, The first data channel and the second data channel are equipped with different transmission media. A method comprising the step of receiving the first data or the step of receiving the second data, wherein the step of correcting one or more errors.

2. The method according to claim 1, wherein the first data channel and the second data channel have different usage times for a single transmission medium.

3. The method according to claim 1, wherein the encryption comprises public-key cryptography.

4. The method according to claim 1, wherein the encryption comprises post-quantum cryptography.

5. The method according to claim 1, wherein the restoration step includes decoding the first portion of the decoded encoding and the second portion of the encoding according to individually secure linear codes.

6. The method according to claim 5, wherein the individually secure linear codes include linear network codes.

7. A device for securely communicating messages to individuals, Computing processors and Non-volatile memory for storing computer program code and Includes, When the aforementioned computer program code is executed by the computing processor, A process of receiving first data using a first data channel, comprising encryption of the first part of the encoding of the message using separate secure codes by a generator matrix, A process of receiving second data using a second data channel, comprising a second portion of the encoding of the message using the generator matrix, A process of decoding the first data in order to obtain the first portion of the encoding of the message, The steps include obtaining the message by multiplying the first part of the encoding and the second part of the encoding by the inverse of the generator matrix, The step of displaying the message to the individual, The first data channel and the second data channel are equipped with different transmission media. An apparatus in which the step of receiving the first data or the step of receiving the second data includes the step of correcting one or more errors.

8. The apparatus according to claim 7, wherein the first data channel and the second data channel have different usage times for a single transmission medium.

9. The apparatus according to claim 7, wherein the encryption comprises public-key cryptography.

10. The apparatus according to claim 7, wherein the encryption comprises post-quantum cryptography.

11. The apparatus according to claim 7, wherein the restoration step includes decoding the first portion of the decoded encoding and the second portion of the encoding according to individually secure linear codes.

12. The method according to claim 11, wherein the individually secure linear codes include linear network codes.

13. The method according to claim 1, wherein individually secure linear codes use a finite field having a property greater than 2.

14. The method according to claim 1, wherein each of the first portion of the encoding and the second portion of the encoding includes a linear combination of the messages using individually secure linear codes that use a finite field having a property greater than 2.

Images