Post-Quantum Signature Partitioning for Low-Overhead IoT Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital signature schemes are inefficient for resource-constrained IoT devices and vulnerable to quantum computers, failing to provide timely and secure authentication in time-sensitive applications like vehicular networks and smart grids.
Innovation Solution
A method involving probabilistic data structures and hash-based digital signatures, such as HORS, optimized for time-valid settings using One-Hash Bloom Filters and Merkle trees, ensures fast and secure digital signatures with post-quantum security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional digital signature schemes are used, then security is provided, but computational efficiency is poor and they are vulnerable to quantum computers
Solution Approach 1:
The signing private key is divided into a plurality of indexed values, and the hashing process is segmented into multiple rounds with counter values. This segmentation enables parallel processing and optimization of each component, improving computational efficiency while maintaining security through the structured combination of segments in the final signature.
Solution Approach 2:
The patent changes the parameters of the digital signature scheme by introducing probabilistic data structures (Bloom filters) with configurable false positive rates, variable counter values, and adjustable partitioning strategies. These parameter changes allow optimization for specific IoT device constraints while maintaining post-quantum security guarantees.
2Reliability
If digital signatures are used for authentication, then message integrity is ensured, but end-to-end delay increases
Solution Approach 1:
Bloom filters and Merkle trees are pre-computed and stored before authentication is needed. The signing private key is pre-divided into indexed values, and the public key structure is pre-established. This preliminary action eliminates the need for complex real-time computations during authentication, significantly reducing end-to-end delay while maintaining message integrity verification.
Solution Approach 2:
The patent uses Bloom filters which are probabilistic data structures that create a compact copy representation of the signing key material. This copying approach allows fast verification without requiring the full original key structure, reducing computational overhead and authentication delay while preserving security properties.
3Reliability
If secure authentication protocols are implemented, then quantum threats are resisted, but device overhead increases
Solution Approach 1:
The patent employs Bloom filters which are space-efficient, probabilistic data structures that use minimal memory resources. The filtered representation of the signing key can be discarded after use, and new instances can be generated efficiently. This disposable approach reduces device overhead while maintaining post-quantum security through the mathematical properties of the Bloom filter construction.
Solution Approach 2:
The patent introduces Bloom filters and Merkle trees as intermediary structures between the signing private key and the verification process. These intermediaries simplify the complexity by providing a compact, verifiable representation of the key material, reducing the computational and storage overhead on IoT devices while preserving quantum resistance through the underlying cryptographic hash functions.
Data Source
AI summary
A method for generating a digital signature for a message involves obtaining the message and a signing private key. The signing private key is divided into a plurality of indexed values. A counter value is identified to provide a set of partitions with unique integer interpretations through at least one round of combining the message with the counter value, hashing the combined message and counter value to generate a hash, reducing the hash to a predetermined length to generate a reduced hash, and partitioning the reduced hash into a plurality of partitions. If the partitions are not interpretable as a set of unique integers, the counter value is incremented for the next round. If the partitions are interpretable as a set of unique integers, the counter value is provided. A set of values from the signing key indexed by the unique integers is selected, and the digital signature comprising the selected set of values and the counter is outputted.