Secure sharing of secret information

Abstract

A first method comprises obtaining (101) a public key of an authority, obtaining (103) secret information of a secret-creator, obtaining (105) metadata which is expected to be unique for the secret information, deriving (107) an encryption key from the public key of the authority and the metadata, encrypting (109) the secret information with the encryption key, creating (111) a secret document which includes the metadata and the encrypted secret information, and transmitting (113) the secret document to a system of a secret-custodian. A second method comprises retrieving the secret document, transmitting the metadata to a system of the authority, receiving a decryption key in response to transmitting the metadata, and outputting or using the decryption key. The decryption key has been derived based on the metadata and a private key of the authority. The private key corresponds to the public key of the authority.

Description

[0001] SECURE SHARING OF SECRET INFORMATION

[0002] FIELD OF THE INVENTION

[0003] The invention relates to a method of encrypting secret information, a method of decrypting secret information, and a method of deriving a decryption key for decrypting secret information.

[0004] The invention also relates to computer program products enabling systems to perform such methods.

[0005] The invention further relates to a system for encrypting secret information, a system for decrypting secret information, and a system for deriving a decryption key for decrypting secret information.

[0006] BACKGROUND OF THE INVENTION

[0007] Custodianship of secrets is a well-known problem area. A secret-creator composes a secret and shares it with a secret-custodian. The secret -custodian is trusted to only release the secret to agreed other parties when an external condition is met. For example, a notary only releases a last will when its subject has died. For example, a telecom operator intercepts customer traffic (phone, data, ...) only when there is a subpoena for lawful interception. A bank releases only bank-account information when the tax office demands it.

[0008] Secrets have become more vulnerable in the digital age. Digitized personal data has already been leaked by criminals on such a large scale, both from companies and governmental organizations, that privacy authorities warn citizens to presume that all their personal information has already been leaked. Conversely, digital technologies enable such thorough protection of secrets that the release of the secret may become difficult, even when the external condition is met. End-to-end encrypted communication cannot meaningfully be lawfully intercepted. A password-protected last will is inaccessible if the password is lost. Advanced cryptocurrencies (e.g. Monero) provide such powerful shielding that nobody, not even tax offices, can get insight into the parties, balances or exchanged amounts.

[0009] There are instances where it is possible to have both a thorough protection of secrets as well as the possibility to share the secrets. This is often obtained by modifying software or hardware on the end-user devices. A highly controversial example is the unblessed European proposal to install backdoors into devices and software that provide end- to-end encryption. It has the same problem of relying on a single vulnerable secret -custodian that can be compromised or coerced, not to mention surveillance -state issues. In this case, the secret-custodian may e.g. hold a secret password or a private key that decrypts an encrypted secret.

[0010] US2008 / 0184334 describes a method of associating an access policy with protected (i.e. secret) content, which specifies at which access condition the recipient can decrypt this content. A trusted third party generates an encryption key, with which the content source encrypts the content. When an access condition is met, the trusted third party releases the right decryption key to the recipient, who then decrypts the content.

[0011] A drawback of the method disclosed in US2008 / 0184334 is that it not a scalable solution for the trusted third party (also referred to as authority) and requires the system of the trusted third party to have quite some resources available. The system of the trusted third party needs to create a new set of an encryption key, a decryption key, and an access policy with access conditions each time new secret information (content that needs to be protected in this case) is created and sealed (encrypted). This set needs to be stored, maintained and kept available for checking of the access policy during the full lifetime of the content, which may be indefinitely. This scalability issue puts a huge cost and operational burden on the trusted third party.

[0012] SUMMARY OF THE INVENTION

[0013] It is advantageous to provide methods and systems, which can be used to realize secure sharing of certain types of secret information in a manner that is scalable for the authority.

[0014] In a first aspect, a method of encrypting secret information comprises obtaining secret information of a secret-creator, obtaining metadata which is expected to be unique for the secret information, obtaining a public key of an authority, deriving an encryption key from the public key of the authority and the metadata, encrypting the secret information with the encryption key, creating a secret document, the secret document including the metadata and the encrypted secret information, and transmitting the secret document to a system of a secret-custodian. The method may be performed by software running on a programmable device. This software may be provided as a computer program product.

[0015] With this method, an encryption-protected last will would not be inaccessible if the password would be lost, as the authority is able to derive the decryption key, and the method does not rely on a single vulnerable secret -custodian that can be compromised or coerced. By encrypting the secret information with an encryption key which is derived from a public key of an authority and metadata, the secret information cannot be decrypted by the authority without access to the metadata and cannot be decrypted by anyone else, because this would require access to the corresponding private key of the authority. By using metadata which is expected to be unique for the secret information with a certain probability, the encryption and decryption keys are unique with this same probability.

[0016] Since the system of the authority only needs to get involved when the secret information needs to be decrypted and not when the secret information needs to be encrypted, this method is better scalable for the authority for types of secret information of which more information is sealed (encrypted) than ever unsealed (decrypted). For example, last wills are typically updated several times before its subject dies. For example, most bank account information is never subpoenaed by law enforcement. For example, most phone or internet connections are never lawfully intercepted. So, there may be millions to billions of sealed content, of which maybe only a few thousands may need to be unsealed at some time in the future.

[0017] The secret information may comprise one or more of text, audio, and video, for example. For instance, the secret information may comprise a last will in the form of text and recorded audio. The secret document may further comprise access conditions which specify when the secret information is allowed to be decrypted. The encryption key may be a further public key of the authority derived from the public key of the authority based on the metadata, for example. In this case, the decryption key would be a further private key which has been derived from the private key of the authority based on the same metadata. The private key of the authority corresponds to the public key from which the further public key has been derived.

[0018] The metadata may comprise a plaintext metadata part and / or an integrity - protection part, the integrity -protection part cryptographically protecting the secret document against modification or unauthorized replacement. These one or more parts are not sensitive (enough) to require encryption and may be expected to be unique for the secret information.

[0019] The plaintext metadata part may comprise one or more of an identity of the secret-creator, a current date and time, information indicating a nature of the secret information, an identity of the secret-custodian, an identity of the authority, and the public key of the authority. The combination of multiple of these options may be expected to be unique. For many use cases, it makes sense to include the identity of the secret-creator in the plaintext metadata part, as it identifies the origin of the secret. However, there may be use cases where this identity is not needed or included.

[0020] The method may further comprise applying a hash function to the metadata to obtain a hash. Deriving the encryption key from the public key of the authority and the metadata may comprise deriving the encryption key from the public key of the authority and the hash. This is an efficient way of deriving the encryption key based on the metadata. The authority uses the same hash function on the same metadata to derive the corresponding decryption key.

[0021] The method may further comprise obtaining one or more cryptographic signatures of the secret information and / or the metadata and including the one or more cryptographic signatures in the secret document, the one or more cryptographic signatures being created by at least one of the secret-creator, a witness, and another party. This may be used as additional safeguard. The metadata may specify that the secret information and / or the metadata needs to be signed by at least one of the secret -creator, the witness, and the other party. This can later be used by the system of the secret -custodian to verify the one or more signatures. Optionally, the secret -custodian informs the specified party of the (in)validity.

[0022] The encrypted secret information may be further encrypted with a cryptographic key of a witness to obtain further encrypted secret information and the further encrypted secret information is included in the secret document. This may be used as additional safeguard to ensure that the secret information cannot be released without permission of the witness.

[0023] In a second aspect, a method of decrypting or enabling decryption of secret information comprises retrieving a secret document, the secret document including metadata and encrypted secret information, the encrypted secret information having been encrypted with an encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, transmitting the metadata to a system of the authority, receiving a decryption key from the system of the authority in response to transmitting the metadata, the decryption key having been derived based on the metadata and a private key of the authority, the private key corresponding to the public key of the authority, outputting the decryption key or decrypting the encrypted secret information with the decryption key to obtain the secret information and outputting the secret information. The method may be performed by software running on a programmable device. This software may be provided as a computer program product. The decryption key may be a further private key, for example.

[0024] The method may further comprise receiving a decryption order from the system of the authority. The secret document may be retrieved and the metadata may be transmitted in response to receiving the decryption order. This may be beneficial if the authority is a government organization and the secret-custodian is a notary, for example.

[0025] The method may further comprise identifying a witness based on the decryption order and / or the secret document and transmitting a notification to a system of the witness notifying the witness that a decryption order has been sent to the secret-custodian. This allows the witness to serve for auditing purposes, e.g., keeping track how often the secret-reveal procedure is invoked.

[0026] In a third aspect of the invention, a method of deriving a decryption key for decrypting secret information comprises receiving metadata from a system of a secretcustodian, the metadata originating from a secret document which further included encrypted secret information encrypted with an encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, obtaining a private key of the authority, the private key corresponding to the public key of the authority, deriving the decryption key based on the metadata and the private key of the authority, and transmitting the decryption key to the system of the secretcustodian. The method may be performed by software running on a programmable device. This software may be provided as a computer program product. The decryption key may be a further private key derived from the private key of the authority based on the metadata, for example. In this case, the encryption key would be a further public key which has been derived from the public key of the authority based on the same metadata.

[0027] The method may further comprise confirming that the metadata is correct and deriving the decryption key only if the metadata is confirmed to be correct. This may be used as additional safeguard.

[0028] The method may further comprise obtaining identification information, identifying a secret-creator, creating a decryption order for the secret-creator, transmitting the decryption order to the system of the secret-custodian, and receiving the metadata in response to transmitting the decryption order. Confirming that the metadata is correct may comprise validating an identity of the secret-creator based on the metadata and the identification information. This may be used to ensure that the secret-custodian does not receive a decryption key that could be used to decrypt secret information from someone else than the secret-creator for which the decryption order was created .

[0029] The method may further comprise applying a hash function to the metadata to obtain a hash and the decryption key may be derived based on the metadata and the private key of the authority by deriving the decryption key from the private key of the authority and the hash.

[0030] In a fourth aspect of the invention, a system for encrypting secret information comprises at least one processor configured to obtain secret information of a secret -creator, obtain metadata which is expected to be unique for the secret information, obtain a public key of an authority, derive an encryption key from the public key of the authority and the metadata, encrypt the secret information with the encryption key, create a secret document, the secret document including the metadata and the encrypted secret information, and transmit the secret document to a system of a secret-custodian.

[0031] In a fifth aspect of the invention, a system for decrypting or enabling decryption of secret information comprises at least one processor configured to retrieve a secret document, the secret document including metadata and encrypted secret information, the encrypted secret information having been encrypted with an encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, transmit the metadata to a system of the authority, receive a decryption key from the system of the authority in response to transmitting the metadata, the decryption key having been derived based on the metadata and a private key of the authority, the private key corresponding to the public key of the authority, and output the decryption key or decrypting the encrypted secret information with the decryption key to obtain the secret information and outputting the secret information.

[0032] In a sixth aspect of the invention, a system for deriving a decryption key for decrypting secret information comprises at least one processor configured to receive metadata from a system of a secret-custodian, the metadata originating from a secret document which further included encrypted secret information encrypted with an encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, obtain a private key of the authority, the private key corresponding to the public key of the authority, derive the decryption key based on the metadata and the private key of the authority, and transmit the decryption key to the system of the secret-custodian.

[0033] Moreover, a computer program for carrying out the methods described herein, as well as a non -transitory computer readable storage -medium storing the computer program are provided. A computer program may, for example, be downloaded by or uploaded to an existing device or be stored upon manufacturing of these systems.

[0034] In a further aspect, a non-transitory computer-readable storage medium stores a software code portion, the software code portion, when executed or processed by a computer, being configured to perform at least one of the methods described above.

[0035] As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a device, a method or a computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit", "module" or "system." Functions described in this disclosure may be implemented as an algorithm executed by a processor / microprocessor of a computer. Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied, e.g., stored, thereon.

[0036] Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a computer readable storage medium may include, but are not limited to, the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of the present invention, a computer readable storage medium may be any tangible medium that can contain, or store, a program for use by or in connection with an instruction execution system, apparatus, or device.

[0037] A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro -magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0038] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber, cable, RF, etc., or any suitable combination of the foregoing. Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java(TM), Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0039] Aspects of the present invention are described below with reference to flowchart illustrations, sequence diagrams and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor, in particular a microprocessor or a central processing unit (CPU), of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer, other programmable data processing apparatus, or other devices create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0040] These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks.

[0041] The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0042] The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of devices, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s).

[0043] It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, can be implemented by special purpose hardware -based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[0044] BRIEF DESCRIPTION OF THE DRAWINGS

[0045] These and other aspects of the invention are apparent from and will be further elucidated, by way of example, with reference to the drawings, in which:

[0046] Fig. 1 is a sequence diagram of a first implementation of the method of encrypting secret information;

[0047] Fig. 2 is a sequence diagram of first implementations of the methods of deriving a decryption key and decrypting or enabling decryption of secret information ;

[0048] Figs. 3 and 4 illustrate implementations of the methods in which hierarchic deterministic cryptography is applied;

[0049] Fig. 5 is a sequence diagram of an implementation of a method of calculating the public key of the authority;

[0050] Fig. 6 is a sequence diagram of the second implementation of the method of encrypting secret information;

[0051] Fig. 7 is a sequence diagram of the second implementations of the methods of deriving a decryption key and decrypting or enabling decryption of secret information;

[0052] Fig. 8 is a block diagram of implementations of the systems; and

[0053] Fig. 9 is a block diagram of an exemplary data processing system for performing the methods of the invention.

[0054] Corresponding elements in the drawings are denoted by the same reference numeral.

[0055] DETAILED DESCRIPTION OF THE DRAWINGS

[0056] A first implementation of the method of encrypting secret information is shown in Fig. 1. A step 131 comprises a system of an authority, e.g., a system 21, distributing a public key of the authority. Step 131 may comprise sending this public directly to a system of a secret-creator, e.g., a system 1. A step 101 comprises obtaining the public key of the authority, e.g. from a public repository, through (pre)configuration, or as response to a request.

[0057] A step 103 comprises obtaining secret information of a secret -creator, e.g., a last will, a decryption key for legal intercept, or bank records. This secret information may be input on system 1, for example. The secret information may comprise one or more of text, audio, and video, for example. For instance, the secret information may comprise a last will in the form of text and recorded audio. The secret document may further comprise access conditions which specify when the secret information is allowed to be decrypted.

[0058] A step 105 comprises obtaining metadata which is expected to be unique for the secret information obtained in step 103. The metadata may comprise a plaintext metadata part and / or an integrity-protection part. The integrity -protection part cryptographically protects the secret document against modification or unauthorized replacement. These one or more parts are not sensitive (enough) to require encryption and may be expected to be unique for the secret information.

[0059] The plaintext metadata part may comprise an identity of the secret-creator, a current date and time, information indicating a nature of the secret information, an identity of the secret-custodian, an identity of the authority, and / or the public key of the authority, for example. The combination of multiple of these options may be expected to be unique. For many use cases, it makes sense to include the identity of the secret-creator in the plaintext metadata part, as it identifies the origin of the secret. However, there may be use cases where this identity is not needed or included.

[0060] A step 107 comprises deriving an encryption key from the public key of the authority obtained in step 101 and the metadata obtained in step 105. The encryption key may be a further public key of the authority derived from the public key of the authority based on the metadata, for example. In this case, the decryption key would be a further private key which has been derived from the private key of the authority based on the same metadata. The private key of the authority corresponds to the public key from which the further public key has been derived.

[0061] A step 109 comprises encrypting the secret information obtained in step 103 with the encryption key derived in step 107. A step 111 comprises creating a secret document which includes the metadata obtained in step 105 and the encrypted secret information generated in step 109. The secret document may also comprise further metadata from which the encryption key has not been derived.

[0062] A step 113 comprises transmitting the secret document created in step 111 to a system of a secret-custodian, e.g., a system 11. A step 121 comprises the system of the secret-custodian receiving the secret document, e.g., from system 1. A step 123 comprises the system of the secret -custodian storing the secret document received in step 121.

[0063] In the implementation of Fig. 1, the public key obtained in step 101 may be used in multiple iterations of steps 103, 105, 107, 109, 111, and 113. Alternatively, step 101 may be repeated each time. In the latter case, steps 101 and 103 may be performed in parallel, for example. First implementations of the methods of deriving a decryption key and decrypting or enabling decryption of secret information are shown in Fig. 2.

[0064] A step 141 comprises retrieving, at a system of a secret -custodian, a secret document which includes metadata and encrypted secret information. For example, system 11 may retrieve the secret document from its memory. The encrypted secret information has been encrypted with an encryption key derived from a public key of an authority and the metadata. The metadata is expected to be unique for the secret information. A step 143 comprises transmitting the metadata retrieved in step 141 to a system of the authority, e.g., system 21. A step 151 comprises receiving the metadata from the system of a secretcustodian, e.g., system 11.

[0065] A step 153 comprises obtaining a private key of the authority, e.g., by system 21 from its memory. The private key corresponds to the public key of the authority. A step 155 comprises deriving the decryption key based on the metadata received in step 151 and the private key of the authority, as obtained in step 153. A step 157 comprises transmitting the decryption key derived in step 155 to the system of the secret -custodian, e.g., system 11. A step 145 comprises receiving the decryption key from the system of the authority, e.g., system 21, in response to transmitting the metadata in step 143. If the decryption key is transmitted to the secret-custodian, it may be presumed to be trusted to perform its tasks.

[0066] A step 147 comprises outputting the decryption key received in step 145 or comprises decrypting the encrypted secret information with the decryption key received in step 145 to obtain the secret information and then outputting the secret information. As an example of the former, the system of the secret -custodian may hand the secret information and the decryption key over to a system of a trusted third party (e.g. law enforcement) when instructed by the authority, and it is the system of this trusted third party that decrypts the secret information. In an alternative implementation, the system of the secret-custodian hands over the secret information to the system of the authority and does not receive a decryption key, as the authority decrypts the secret information itself.

[0067] Figs. 3 and 4 illustrate implementations of the methods in which hierarchic deterministic cryptography is applied. Fig. 3 shows how a hierarchical deterministic scheme may be used to generate an encryption key EK and a decryption key DK . Function cp is used to convert a secret key S into a public key P. The function cp may be the key-derivation function in DSA, EC-DSA, El-Gamal signatures, Schnorr signatures, or EdDsa, for example.

[0068] Function <p may have the form <p(S) = gs, for example, where g is a generator of some group and secret key S an integer. Due to the group structure, the following property holds: <p(S + T) = gsgT. Function f(.,HASH) and h(.,HASH) are oneway functions to derive new secret -public key pairs, where HASH is the identifier for the new pair, the HASH being a hash of the metadata obtained in step 105 of Fig. 1. To create this HASH, a hash function like SHA-256, MD5, CRC-32, Keccak-512, or Shake-256 may be used.

[0069] The function f may make use of a hash function for the second time (the hash function may be different from the hash function used to create the hash HASH), the hash function is called H, which may also be one of the hash function types mentioned before (e.g., SHA-256, MD5, CRC-32, Keccak-512, or Shake-256, as mentioned before). Function f may have the form (P, HASH) = pH p'HASH) forexample.

[0070] Given cp and f, a suitable function h (S, HASH) -> DK can be found such that the diagram shown in Fig. 3 is commutative. With the above-mentioned functions (p and f, a suitable function h is: h(S, HASH) = S * H(<p(S), HASH). In this case, the commutation relation holds:

[0071] The benefit of this scheme is that untrusted third parties can derive new public keys from existing ones, whereas only the holder of the original secret key can derive the associated new secret keys. While the procedure of deriving the encryption key EK is generic and could be done by anyone, the input to derive the encryption key EK is initially only known to the secret -creator.

[0072] Fig. 4 shows how a hierarchical deterministic scheme may be used for the decryption and encryption of the secret part SP of the secret document, i.e., for the decryption and encryption of the secret information. As shown in Fig. 1, the secret document has been generated by the secret-creator and is guarded by the secret-custodian. Fig. 4 shows that SP is encrypted by the secret-creator with the derived encryption key EK of which the identifier is HASH to obtain the encrypted secret part ESP. Fig. 4 further shows that ESP is decrypted by the secret -custodian with a derived decryption key DK of which the index is the same hash to obtain the (decrypted) secret part (D)SP.

[0073] An implementation of a method of calculating the public key of the authority is shown in Fig. 5. Steps 161, 163, and 163 are performed by the system of the authority, e.g., system 21, before step 131 of Fig. 1 is performed.

[0074] Step 161 comprises generating a private key S (shown in Figs. 3 and 4). Step 163 comprises storing the private key S generated in step 161 such that it can be obtained in step 153 of Fig. 2. Step 165 comprises applying function <p to private key S generated in step 161 to calculate public key P, as shown in Figs. 3 and 4 (P = <p(s)). The public key P is then published in step 131, e.g., in such a way that it can be used by any potential secret -creator. A second implementation of the method of encrypting secret information is shown in Fig. 6. The implementation of Fig. 6 is an extension of the implementation of Fig. 1. In the implementation of Fig. 6, step 107 of Fig. 1 is implemented by a step 173 and a step 171 is performed between step 105 of Fig. 1 and step 173.

[0075] Step 171 comprises applying a hash function to the metadata obtained in step 105 to obtain a hash. The authority uses the same hash function on the same metadata to derive the corresponding decryption key. Step 173 comprises deriving the encryption key from the public key P of the authority, as obtained in step 101, and the hash obtained in step 171. As shown in Figs. 3 and 4, the hash may be used as index in step 173 to derive a new encryption key EK from the authority’s public key P. The encryption key may be a further public key, for example.

[0076] Second implementations of the methods of deriving a decryption key and decrypting or enabling decryption of secret information are shown in Fig. 7. The implementations of Fig. 7 are an extension of the implementations of Fig. 2.

[0077] An optional step 190 comprises obtaining identification information identifying a secret -creator. A step 191 comprises creating a decryption order for the secretcreator. This may be beneficial if the authority is a government organization and the secret - custodian is a notary, for example. This decryption order is created when the authority decides that the secret information needs to be revealed. A step 193 comprises transmitting the decryption order to the system of the secret-custodian, e.g., system 11. A step 181 comprises receiving the decryption order from the system of the authority, e.g., system 21.

[0078] The authority will become involved only when the time is there. It is presumed that, when the time is there, the authority knows who the relevant secret -custodian for the specific secret information or secret-creator is through well-known governance processes, e.g., a doctor registers a decease or law enforcement traces a suspect. Only at that time, the authority needs to know, for example, with which notary a now deceased person registered their last will, at which bank a suspect has its bank accounts, or with which telco a suspect has its phone subscription.

[0079] Step 141 is performed in response to receiving the decryption order, preferably after validation of the authenticity of the order. Step 141 comprises retrieving, at the system of a secret-custodian, a secret document which includes metadata and encrypted secret information. For example, system 11 may retrieve the secret document from its memory. The encrypted secret information has been encrypted with an encryption key derived from a public key of an authority and the metadata. The metadata is expected to be unique for the secret information. Step 143 comprises transmitting the metadata retrieved in step 141 to a system of the authority, e.g., system 21. Step 151 comprises receiving the metadata from the system of a secret-custodian, e.g., system 11.

[0080] A step 195 is performed after step 151. Step 195 comprises confirming whether the metadata received in step 151 is correct. If optional step 190 was performed, step 195 comprises validating an identity of the secret -creator based on the metadata received in step 151 and the identification information obtained in step 190. Step 153 is performed if the metadata is confirmed to be correct. A step 197 is performed if the metadata is not confirmed to be correct. Step 197 comprises generating an error message.

[0081] Step 153 comprises obtaining a private key S of the authority, e.g., by system 21 from its memory. The private key S corresponds to the public key P of the authority. A step 198 is performed after step 153. Step 198 comprises applying a hash function to the metadata received in step 151 to obtain a hash. Next, step 199 comprises deriving the decryption key based on the hash obtained in step 198 and the private key of the authority, as obtained in step 153. As shown in Figs. 3 and 4, the hash may be used as index to calculate the decryption key DK from its own private key S .

[0082] Step 157 comprises transmitting the decryption key derived in step 199 to the system of the secret -custodian, e.g., system 11. Step 145 comprises receiving the decryption key from the system of the authority, e.g., system 21, in response to transmitting the metadata in step 143. A step 181 comprises decrypting the encrypted secret information with the decryption key received in step 145 to obtain the secret information. Step 183 comprises outputting, e.g., delivering, the secret information obtained in step 181, e.g., as instructed by the decryption order.

[0083] The method of encrypting secret information may further comprise obtaining one or more cryptographic signatures of the secret information and / or the metadata, which are created by at least one of the secret-creator, a witness, and another party, and including the one or more cryptographic signatures in the secret document. These one or more cryptographic signatures may form the integrity -protection part of the metadata, for example. The plaintext metadata part or other metadata of the secret document may then specify that certain signatures are required on the secret information or on (a hash of) the metadata, e.g., with a flag that is protected against modification and removal.

[0084] The one or more cryptographic signatures may be obtained in step 105 of Fig. 6 (if the one or more cryptographic signatures form the integrity -protection part of the metadata) and included in the secret document in step 111 of Fig. 6, for example. The method of deriving a decryption key may then comprise informing the system of the secretcustodian which signatures are required, e.g., as part of step 157 of Fig. 7 or as part of a separate step. The method of decrypting or enabling decryption of secret information may then comprise verifying the one or more signatures, checking whether indeed the secret information and / or (the hash of) the metadata was signed by the appropriate parties and act upon the (in)validity of the required signatures by sending a notification to the appropriate parties (e.g. the authority and / or other parties specified in the metadata), e.g. in one or more additional steps between steps 181 and 183 of Fig. 7.

[0085] As indicated above, the role of witness may be introduced. The witness may not only create the one or more cryptographic signatures but may alternatively or additionally be alerted when the authority issues decryption orders and / or may further encrypt the encrypted secret information with a cryptographic key of the witness to obtain further encrypted secret information, which is then included in the secret document. The witness would then be either passively or actively involved to take some action.

[0086] In the former case, the method of decrypting or enabling decryption may comprise the system of the secret -custodian identifying a witness based on the decryption order and / or the secret document and transmitting a notification to a system of the witness notifying the witness that a decryption order has been sent to the secret-custodian, e.g., after step 181 or step 141 of Fig. 7 has been performed. The notification may contain information about who requested the decryption order and / or for what reason the request has been made, and possibly more information. In this case, the witness may be used for auditing purposes, e.g., keeping track how often a decryption order is issued.

[0087] In the latter case, the witness is involved in such a way that without its permission / action the secret information cannot be released. This could be implemented by: a) the system of the secret-creator obtaining a public key of the witness, e.g. in step 101 of Fig. 6 or in an additional step; b) the system of the secret-creator encrypting the encrypted secret information with the public key of the witness, e.g. in step 109 of Fig. 6 or in an additional step performed between steps 109 and 111; c) the system of the secret-creator specifying in the plaintext metadata part or in other metadata of the secret document that the secret information may not be released without the active permission of the witness, e.g., in step 105 or step 111 of Fig. 6; and d) the system of the secret-custodian sending a request to the system of the witness to decrypt the doubly encrypted secret information and return the encrypted information, e.g., between steps 141 and 143 of Fig. 7. If the witness decides not to comply with this request, the system of the secret-custodian could notify the system of the authority and abort the decryption-and-delivery process, e.g., instead of performing step 143 of Fig. 7. First implementations of the systems are shown in Fig. 8. A system 1 of a secret-creator encrypts secret information. A system 11 of a secret-custodian decrypts or enables decryption of secret information. A system 21 of an authority derives a decryption key for decrypting secret information. Systems 1, 11, and 21 are part of a communication system 31.

[0088] The system 1 comprises a receiver 3, a transmitter 4, a processor 5, and a memory 7. The processor 5 is configured to obtain secret information of a secret -creator, obtain metadata which is expected to be unique for the secret information, obtain a public key of an authority, derive an encryption key from the public key of the authority and the metadata, encrypt the secret information with the encryption key, create a secret document which includes the metadata and the encrypted secret information, and transmit the secret document to a system of a secret -custodian, e.g. system 11.

[0089] The system 11 comprises a receiver 13, a transmitter 14, a processor 15, and a memory 17. The processor 15 is configured to retrieve a secret document. The secret document includes metadata and encrypted secret information. The encrypted secret information has been encrypted with an encryption key derived from a public key of an authority and the metadata. The metadata is expected to be unique for the secret information.

[0090] The processor 15 is further configured to transmit the metadata to a system of the authority, e.g., system 21, receive a decryption key from the system of the authority, e.g., system 21, in response to transmitting the metadata, and output the decryption key or decrypting the encrypted secret information with the decryption key to obtain the secret information and outputting the secret information. The decryption key has been derived based on the metadata and a private key of the authority. The private key corresponds to the public key of the authority.

[0091] The system 21 comprises a receiver 23, a transmitter 24, a processor 25, and a memory 27. The processor 25 is configured to receive metadata from a system of a secretcustodian, e.g. system 11. The metadata originates from a secret document which further included encrypted secret information encrypted with an encryption key derived from a public key of an authority and the metadata. The metadata is expected to be unique for the secret information.

[0092] The processor 25 is further configured to obtain a private key of the authority, the private key corresponding to the public key of the authority, derive the decryption key based on the metadata and the private key of the authority, and transmit the decryption key to the system of the secret-custodian, e.g. system 11.

[0093] The system 21 of the authority need not be a system of a government agency, but may be the system of another trusted third party. For example, the authority may be the manufacturer of the system 1 on which the secret document is created, and the public key of the device manufacturer may have been pre -configured in the system 1. The public key of the device manufacturer may be a public key that is also used for verifying software updates, for example. A judge may then subpoena a decryption key from the device manufacturer, which the system 21 of the device manufacturer then derives.

[0094] In the implementations shown in Fig. 8, the systems 1, 11, and 21 comprise one processor 5, one processor 15, and one processor 25, respectively. In an alternative implementation, one or more of the systems 1, 11, and 21 comprise multiple processors. The processors 5, 15, and 25 may be general -purpose processors, e.g., ARM, Qualcomm, AMD, or Intel processors, or application-specific processors. The processors 5, 15, and 25 may run Google Android, Apple iOS, a Unix-based operating system or Windows as operating system, for example.

[0095] The receivers 3, 13, and 23 and the transmitters 4, 14, and 24 of the systems 1, 11, and 21, respectively, may use one or more wired or wireless communication technologies such as Ethernet, Wi-Fi, LTE, and / or 5G New Radio to communicate with other devices on the Internet (e.g. using the Internet Protocol) via an access point / base station, or they may use in-person communication like Bluetooth, Wi-Fi direct, QR-code, or a dead drop solution to communicate with other devices. The receiver and the transmitter of a system may be combined in a transceiver. The systems 1, 11, and 21 may comprise other components typical for a computer system.

[0096] Fig. 9 depicts a block diagram illustrating an exemplary data processing system that may perform the method as described with reference to the sequence diagrams.

[0097] As shown in Fig. 9, the data processing system 300 may include at least one processor 302 coupled to memory elements 304 through a system bus 306. As such, the data processing system may store program code within memory elements 304. Further, the processor 302 may execute the program code accessed from the memory elements 304 via a system bus 306. In one aspect, the data processing system may be implemented as a computer that is suitable for storing and / or executing program code. It should be appreciated, however, that the data processing system 300 may be implemented in the form of any system including a processor and a memory that is capable of performing the functions described within this specification.

[0098] The memory elements 304 may include one or more physical memory devices such as, for example, local memory 308 and one or more bulk storage devices 310. The local memory may refer to random access memory or other non-persistent memory device(s) generally used during actual execution of the program code. A bulk storage device may be implemented as a hard drive or other persistent data storage device. The processing system 300 may also include one or more cache memories (not shown) that provide temporary storage of at least some program code in order to reduce the number of times program code must be retrieved from the bulk storage device 310 during execution.

[0099] Input / output (I / O) devices depicted as an input device 312 and an output device 314 optionally can be coupled to the data processing system. Examples of input devices may include, but are not limited to, a keyboard, a pointing device such as a mouse, a camera, or the like. Examples of output devices may include, but are not limited to, a monitor or a display, speakers, or the like. Input and / or output devices may be coupled to the data processing system either directly or through intervening I / O controllers.

[0100] In an embodiment, the input and the output devices may be implemented as a combined input / output device (illustrated in Fig. 9 with a dashed line surrounding the input device 312 and the output device 314). An example of such a combined device is a touch sensitive display, also sometimes referred to as a “touch screen display” or simply “touch screen”. In such an embodiment, input to the device may be provided by a movement of a physical object, such as e.g. a stylus or a finger of a user, on or near the touch screen display.

[0101] A network adapter 316 may also be coupled to the data processing system to enable it to become coupled to other systems, computer systems, remote network devices, and / or remote storage devices through intervening private or public networks. The network adapter may comprise a data receiver for receiving data that is transmitted by said systems, devices and / or networks to the data processing system 300, and a data transmitter for transmitting data from the data processing system 300 to said systems, devices and / or networks. Modems, cable modems, and Ethernet cards are examples of different types of network adapter that may be used with the data processing system 300.

[0102] The network adapter 316 may allow the data processing system to connect to the Internet, e.g. via Wi-Fi or Ethernet, and / or directly to nearby devices, e.g. via Bluetooth, Wi-Fi-Direct or Ultrasound. Data may also be exchanged between other devices and the data processing system in another way, e.g. by enabling the data processing system to scan a QR code displayed on another device and / or by enabling the data processing system to display a QR code for scanning by another device.

[0103] As pictured in Fig. 9, the memory elements 304 may store an application 318. In various embodiments, the application 318 may be stored in the local memory 308, he one or more bulk storage devices 310, or separate from the local memory and the bulk storage devices. It should be appreciated that the data processing system 300 may further execute an operating system (not shown in Fig. 9) that can facilitate execution of the application 318. The application 318, being implemented in the form of executable program code, can be executed by the data processing system 300, e.g., by the processor 302. Responsive to executing the application, the data processing system 300 may be configured to perform one or more operations or method steps described herein.

[0104] Various embodiments of the invention may be implemented as a program product for use with a computer system, where the program(s) of the program product define functions of the embodiments (including the methods described herein). In one embodiment, the program(s) can be contained on a variety of non -transitory computer-readable storage media, where, as used herein, the expression “non-transitory computer readable storage media” comprises all computer-readable media, with the sole exception being a transitory, propagating signal. In another embodiment, the program(s) can be contained on a variety of transitory computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, ROM chips or any type of solid-state non-volatile semiconductor memory) on which information is permanently stored; and (ii) writable storage media (e.g., flash memory, floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory) on which alterable information is stored. The computer program may be run on the processor 302 described herein.

[0105] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0106] The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of embodiments of the present invention has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the implementations in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope of the present invention. The embodiments were chosen and described in order to best explain the principles and some practical applications of the present invention, and to enable others of ordinary skill in the art to understand the present invention for various embodiments with various modifications as are suited to the particular use contemplated.

Claims

CLAIMS:

1. A method of encrypting secret information, the method comprising obtaining (103) secret information of a secret-creator, obtaining (105) metadata which is expected to be unique for the secret information, obtaining (101) a public key of an authority, deriving (107) an encryption key from the public key of the authority and the metadata, encrypting ( 109) the secret information with the encryption key, creating (111) a secret document, the secret document including the metadata and the encrypted secret information, and transmitting (113) the secret document to a system of a secret-custodian.

2. A method as claimed in claim 1, wherein the metadata comprises a plaintext metadata part and / or an integrity-protection part, the integrity -protection part cryptographically protecting the secret document against modification or unauthorized replacement.

3. A method as claimed in claim 2, wherein the plaintext metadata part comprises at least one of an identity of the secret-creator, a current date and time, information indicating a nature of the secret information, an identity of the secret-custodian, an identity of the authority, and the public key of the authority.

4. A method as claimed in any one of claims 1-3, wherein the encryption key is a further public key.

5. A method as claimed in any one of claims 1-4, further comprising applying (171) a hash function to the metadata to obtain a hash, and wherein deriving (107) the encryption key from the public key of the authority and the metadata comprises deriving (173) the encryption key from the public key of the authority and the hash.

6. A method as claimed in any one of claims 1-5, further comprising obtaining one or more cryptographic signatures of the secret information and / or the metadata and including the oneor more cryptographic signatures in the secret document, the one or more cryptographic signatures being created by at least one of the secret-creator, a witness, and another party.

7. A method as claimed in any one of claims 1-5, wherein the encrypted secret information is further encrypted with a cryptographic key of a witness to obtain further encrypted secret information and the further encrypted secret information is included in the secret document.

8. A method of decrypting or enabling decryption of secret information, the method comprising retrieving (141) a secret document, the secret document including metadata and encrypted secret information, the encrypted secret information having been encrypted with an encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, transmitting (143) the metadata to a system of the authority, receiving (145) a decryption key from the system of the authority in response to transmitting the metadata, the decryption key having been derived based on the metadata and a private key of the authority, the private key corresponding to the public key of the authority, and outputting (147) the decryption key or decrypting the encrypted secret information with the decryption key to obtain the secret information and outputting the secret information.

9. A method as claimed in claim 8, further comprising receiving (181) a decryption order from the system of the authority, and wherein the secret document is retrieved and the metadata is transmitted in response to receiving the decryption order.

10. A method of deriving a decryption key for decrypting secret information, the method comprising receiving (151) metadata from a system of a secret-custodian, the metadata originating from a secret document which further included encrypted secret information encrypted with an encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, obtaining (153) a private key of the authority, the private key corresponding to the public key of the authority, deriving (155) the decryption key based on the metadata and the private key of the authority, andtransmitting (157) the decryption key to the system of the secret-custodian.

11. A method as claimed in claim 10, further comprising confirming (195) that the metadata is correct and deriving the decryption key only if the metadata is confirmed to be correct.

12. A method as claimed in claim 11, further comprising obtaining (190) identification information identifying a secret-creator, creating (191) a decryption order for the secret-creator, transmitting (193) the decryption order to the system of the secret-custodian, and receiving (151) the metadata in response to transmitting the decryption order, and wherein confirming (195) that the metadata is correct comprises validating an identity of the secret-creator based on the metadata and the identification information.

13. A computer program or suite of computer programs comprising at least one software code portion or a computer program product storing at least one software code portion, the software code portion, when run on a computer system, being configured for performing any one of the methods of claims 1 to 12.

14. A system (1) for encrypting secret information, the system comprising at least one processor (5) configured to obtain secret information of a secret-creator, obtain metadata which is expected to be unique for the secret information, obtain a public key of an authority, derive an encryption key from the public key of the authority and the metadata, encrypt the secret information with the encryption key, create a secret document, the secret document including the metadata and the encrypted secret information, and transmit the secret document to a system of a secret-custodian.

15. A system (11) for decrypting or enabling decryption of secret information, the system comprising at least one processor (15) configured to retrieve a secret document, the secret document including metadata and encrypted secret information, the encrypted secret information having been encrypted withan encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, transmit the metadata to a system of the authority, receive a decryption key from the system of the authority in response to transmitting the metadata, the decryption key having been derived based on the metadata and a private key of the authority, the private key corresponding to the public key of the authority, and output the decryption key or decrypting the encrypted secret information with the decryption key to obtain the secret information and outputting the secret information.

16. A system (21) for deriving a decryption key for decrypting secret information, the system comprising at least one processor (25) configured to receive metadata from a system of a secret-custodian, the metadata originating from a secret document which further included encrypted secret information encrypted with an encryption key derived from a public key of an authority and the metadata, the metadata being expected to be unique for the secret information, obtain a private key of the authority, the private key corresponding to the public key of the authority, derive the decryption key based on the metadata and the private key of the authority, and transmit the decryption key to the system of the secret-custodian.

Images