Distributed Post-Quantum Signatures for Low-Energy IoT Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital signature technologies are inefficient and costly for resource-limited IoT devices, particularly when considering post-quantum security, and they often require expensive public key operations and management, which are prone to quantum computing attacks.
Innovation Solution
A lightweight quantum-safe digital signature scheme, called ANT, that uses a one-time lattice-based signature with distributed verification servers, eliminating the need for costly operations and public key generation on the signer side, and instead leveraging semi-honest servers for public key construction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional digital signature operations are used on IoT devices, then authentication security is provided, but computational cost and energy consumption increase significantly
Solution Approach 1:
The digital signature scheme is segmented into two distinct phases: an offline setup phase that performs computationally intensive operations (lattice parameter generation, secret key generation) and an online signing phase that performs lightweight operations (signature generation using pre-computed parameters). This segmentation allows heavy computation to be done once during setup, while IoT devices only need to execute lightweight signing operations, dramatically reducing their energy consumption while maintaining security.
Solution Approach 2:
The scheme performs preliminary actions during the offline setup phase by pre-generating lattice parameters, secret keys, and public keys before the actual signing operations on IoT devices. These pre-computed parameters are stored and reused during online signing, eliminating the need for repeated expensive cryptographic operations on resource-constrained devices, thus reducing their computational burden and energy usage.
2Reliability
If post-quantum secure digital signatures are implemented, then quantum safety is achieved, but computational complexity and operation cost increase
Solution Approach 1:
The post-quantum signature scheme is divided into complex offline setup operations and simple online signing operations. The computationally heavy lattice-based cryptographic operations (parameter generation, key pair generation) are performed offline during setup, while the online signing phase uses pre-computed parameters to generate signatures with minimal computation. This segmentation makes post-quantum security practical for IoT devices by isolating complexity to the setup phase.
Solution Approach 2:
The scheme uses disposable one-time signature keys generated during the offline setup phase. Each IoT device receives unique secret parameters that are used once for signing and then discarded or updated. This approach allows the use of complex post-quantum cryptography without requiring devices to maintain complex key management systems, as each signing operation uses fresh, pre-computed parameters that simplify the online operation.
3Ease of operation
If public key operations are performed on low-end devices, then digital signature functionality is provided, but processing time and resource usage increase
Solution Approach 1:
All time-consuming public key operations (lattice parameter generation, key pair generation, parameter validation) are performed as preliminary actions during the offline setup phase. IoT devices receive pre-computed, validated parameters that enable them to perform signing operations without executing complex cryptographic computations, significantly reducing their processing time and resource usage while maintaining full digital signature functionality.
Solution Approach 2:
The scheme introduces an offline setup system that acts as an intermediary, performing all complex public key operations and preparing optimized parameters before transferring them to IoT devices. This intermediary handles the computationally intensive tasks, allowing low-end devices to focus only on lightweight signing operations, thereby reducing their processing time and resource consumption while preserving complete signature functionality.
Data Source
AI summary
A method, system, or apparatus for generating and/or verifying a signature on a message is provided. The method, system, or apparatus at a signer may include receiving a message, generating a security parameter, generating at least two seeds corresponding to at least two servers based on the security parameter, transmitting the at least two seeds to each server of the at least two servers, determine a private key based on the security parameter or the at least two seeds, and generating, on the message, a signature based on the private key. The method, system, or apparatus at a verifier may include receiving, from a signer, a signature on a message, obtaining at least two partial public keys, determining a full public key based on the at least two partial public keys, and authenticating the signature on the message based on the full public key. Other aspects, embodiments, and features are also claimed and described.