Aggregate Attestation Signatures for Fast VNF-FGF Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attestation methods in virtualized computing platforms face challenges such as inability to identify invalid targets, lengthy verification times, and confidentiality issues, particularly in multi-proprietary environments, while existing solutions like ZK-SNARK algorithms are expensive.
Innovation Solution
A method and device using a zero-knowledge proof cryptographic protocol to generate synchronized aggregate signatures with constant-size verification, allowing local and global verification, and incorporating a pre-processing step for efficient batch verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional group attestation methods are used to verify multiple targets, then verification time becomes linear with the number of targets, but this leads to excessively long verification times for large groups
Solution Approach 1:
The patent combines multiple individual signatures into a single aggregate signature that represents the entire group of targets. The aggregation process merges n individual signatures into one compact representation, allowing the verifier to validate all targets simultaneously rather than sequentially, thus reducing verification time from linear to constant complexity.
Solution Approach 2:
The patent performs signature aggregation in advance before the verification phase. By pre-computing the aggregate signature from individual target signatures, the system prepares a condensed verification object that can be quickly validated, separating the time-consuming aggregation step from the critical verification step.
2Loss of time
If aggregated attestation is used to reduce verification time, then verification becomes faster, but it becomes impossible to identify which specific target provided an invalid attestation
Solution Approach 1:
The patent segments the verification process into two distinct phases: aggregate verification for rapid validation, and individual opening/identification for pinpointing invalid targets. The opening mechanism allows selective decomposition of the aggregate signature to reveal which specific target failed validation, maintaining both speed and identifiability.
Solution Approach 2:
The patent introduces an intermediary opening mechanism that acts as a bridge between aggregate verification and individual identification. This intermediary process allows the verifier to selectively open the aggregate signature for specific targets when needed, without compromising the overall aggregation structure or verification efficiency.
3Reliability
If ZK-SNARK algorithms are used to enable local verification of aggregate attestations, then verification becomes more flexible and secure, but the computational cost becomes extremely expensive
Solution Approach 1:
The patent employs computationally efficient signature schemes that are less expensive than ZK-SNARK but sufficient for the attestation purpose. The system uses standard cryptographic signatures that can be efficiently aggregated and verified, avoiding the extreme computational overhead of ZK-SNARK while maintaining adequate security for virtualized platform attestation.
Solution Approach 2:
The patent changes the cryptographic parameters from complex zero-knowledge proof systems to simpler signature schemes optimized for aggregation. By adjusting the cryptographic primitive parameters to match the specific needs of group attestation, the system achieves better performance without sacrificing essential security properties.
4Loss of information
If traditional encryption is used to protect target configuration confidentiality, then confidentiality is maintained, but it requires the target to trust the verifier
Solution Approach 1:
The patent enables targets to self-attest their own configuration validity through cryptographic signatures without requiring external trust in the verifier. Each target independently signs its configuration statement, and the aggregate signature mechanism allows verifiers to validate these self-attested claims without needing to trust the targets or vice versa, eliminating the trust requirement.
Solution Approach 2:
The patent introduces cryptographic signatures as an intermediary mechanism that mediates between target confidentiality and verifier validation needs. The signature system acts as a trusted intermediary that allows the verifier to confirm configuration validity without directly accessing or trusting the target's internal state, preserving confidentiality while enabling verification.
Data Source
Figure 1~3
Figure 4~6
Figure 7~9
AI summary
A method for signing a message mi, by a user device, from a cryptographic proof-of-knowledge protocol defined by an element g belonging to a group G1 of order p, with p denoting a prime integer, and elements u, v, r, s, t belonging to a group G2, a hash function H and a current time period w, comprising: a step of generating a private and public key pair, the private key having an element αi selected from the ring Z/pZ, the public key having a first element and a second element being a proof of possession with zero disclosure of knowledge generated from the cryptographic protocol, a step of generating a signature σi of the message mi from the private key and a random number σi, the signature having a first element σ1i and a second element σ2i.