Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
  • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Definitions

• the present invention relates to the field of confidentiality of data in asymmetric cryptography. It relates more particularly to a method of recovering one or more outdated decryption keys to decrypt data which has been encrypted by means of an expired encryption key associated with such an expired decryption key.
• the fundamental object of trust is the certificate.
• This certificate notably includes the following data: the public key to be certified, an identity of the owner of the public key, a period of validity, a list of attributes corresponding to the rights to use the key, for example a signature key of message, and a cryptographic signature of the previous data by an encryption key from a certificate authority issuing the certificate.
• the certification authority also called PKI (Public Key Infrastructure), is responsible in particular for generating certificates and the associated private keys.
• the certificates and private keys are stored either in software on a hard disk, a private key can be encrypted by a respective password, or in a physical device which is generally a secure microcontroller integrated in a smart card or USB dongle.
• the invention relates more particularly to a storage of the certificate and of the associated private key in a physical device, in order to ensure better security. Indeed, the decryptions are done (at least partially) directly in the physical device, so that the private key never leaves said physical device.
• the user of the certificate and the private key revokes the certificate which becomes expired, and by association the private key also becomes expired.
• the certification authority assigns the user a new certificate and a new private key. However, the user cannot decrypt with the new private key the data previously encrypted with the public key contained in the expired certificate.
• the certification authority provides the user with the expired private key.
• the expired private key is provided in software form, the expired key possibly being encrypted by a password. This security is not reliable enough. The expired private key can be easily decrypted by a malicious person since the expired key is no longer stored in a secure physical device. In a second case, the expired private key is provided in another physical device. Security is preserved at the expense of practical and ergonomic aspects when the user has already made several renewals of private key and certificate and is, therefore, in possession of several physical devices.
• the expired private key is provided in another physical device which then contains several successively expired private keys in addition to the current private key and the current certificate.
• the storage capacity of the physical device is limited and it cannot indefinitely receive private keys and certificates.
• the certification authority provides the encrypted data in clear, either by decrypting them with a copy of the expired private key, or by a direct recovery mechanism which does not require the use of said expired private key. . It is then essential that the data be encrypted again but with the public key included in the new certificate. This is called transciphering, and must be applied to all encrypted data. The user is therefore forced to transmit all encrypted data to the certification authority without forgetting any.
• the user may have several types of data which have been encrypted by different applications, such as emails and encrypted hard disk partitions. The encryption and decryption of this data strongly depend on the data storage format which can be different from an application to another.
• a method according to the invention for recovering at least one expired decryption key intended to be used for asymmetric decryption of encrypted data in a terminal, after generation of a cryptographic pair of encryption key / decryption key, of which the decryption key is intended to be used for asymmetric decryption of other data in the terminal is characterized in that it comprises a decryption of an expired decryption key encrypted as a function of the generated decryption key, executed at least partially in a cryptographic medium, connected to the terminal, to obtain said expired decryption key.
• the invention advantageously provides a recovery of private key for simple, economical and secure decryption.
• the decryption of the encrypted data both as a function of a so-called current encryption key generated and as a function of an expired encryption key is advantageously carried out transparently for an application of the terminal and therefore for a terminal user. No transcryption operation of this data previously encrypted as a function of an expired encryption key is necessary since said data is decrypted directly in the user's terminal, with the expired decryption key corresponding to the encryption key.
• the decryption of the encrypted expired decryption key is preceded by memorization of the cryptographic pair encryption key / generated decryption key, in the cryptographic medium, and storing the encrypted expired decryption key as a function of the generated encryption key, in the database accessible to said user of the terminal.
• the expired decryption key encrypted as a function of the encryption key of the generated cryptographic pair stored in the cryptographic support, is accessible to a user of the terminal without being stored in the cryptographic support, so that the memory of said support may be of low capacity.
• the storage of the expired decryption key is preceded by the following steps executed in a certification authority device:
• This characteristic advantageously provides high protection against access to the expired decryption key by an unauthorized third party without having to protect the transmission of said encrypted expired decryption key from the certification authority device to the user. from the terminal.
• the decryption of the encrypted expired decryption key comprises:
• a command to decrypt the encrypted expired decryption key executed at least partially in the cryptographic medium, connected to the terminal, according to the generated decryption key stored in the cryptographic medium, in order to obtain the expired decryption key for decryption encrypted data.
• Expired decryption keys are advantageously transmitted securely to the terminal since they are encrypted with the current encryption key and are decrypted as a function of the current decryption key, stored in the cryptographic medium.
• the cryptographic medium can conveniently be in the form of a smart card.
• the invention also relates to a system for recovering at least one expired decryption key intended to be used for asymmetric decryption of encrypted data in a terminal, after a generation of a cryptographic pair encryption key / decryption key whose decryption key is intended to be used for asymmetric decryption of other data in the terminal, characterized in that it comprises:
• a decryption management module for obtaining the expired decryption key by controlling the decryption of the encrypted expired decryption key as a function of the generated decryption key, executed at least partially in the cryptographic medium, connected to the terminal.
• Another subject of the invention is a decryption management module for recovering at least one expired decryption key intended to be used for asymmetric decryption of encrypted data in a terminal, after generation of a cryptographic pair of encryption key / decryption key whose decryption key is intended to be used for asymmetric decryption of other data in the terminal.
• This decryption management module is characterized in that it comprises means for obtaining said expired decryption key by controlling the decryption of an encrypted expired decryption key, executed at least partially in a cryptographic medium connected to the terminal, depending of the decryption key generated, stored in said cryptographic medium.
• the invention also relates to a computer terminal comprising a decryption management module according to the invention.
• the invention relates to a computer program capable of being implemented in the expired decryption key recovery system according to the invention.
• the program comprising instructions which, when the program is executed in said system, carry out the steps according to the method of the invention.
• FIG. 1 is a schematic block diagram of means of an outdated decryption key recovery system according to the invention, used for renewal of user certificate;
• FIG. 2 is a block diagram of means of the system for recovering an outdated decryption key according to the invention, used for decrypting data;
• FIG. 3 is an algorithm for renewing a user certificate included in a method for recovering an expired decryption key according to the invention
• - Figure 4 is a data decryption algorithm included in the method of recovering expired decryption key according to the invention.
• the certificate CN-I contains, among other things, a common public encryption key PN-I-
• the user also has old outdated cryptographic pairs Co / So to CN-2 / SN-2 respectively, each expired certificate Co to CN-2 containing a public key Po to PN-2 respectively. Then the user deteriorates or loses the current private key SN-I, OR undergoes a normal renewal of the current cryptographic couple CN-I / SN-I, after a predetermined period of use.
• the user then revokes the current cryptographic pair CN-I / SN-1 with a certification authority in order to obtain another cryptographic pair CN / SN, the other CN certificate containing another public key PN-
• the CN certificate -I and the revoked SN-I private key are deemed to have expired.
• the objective of the invention is to recover at least one S n of the expired private decryption keys So to SN-I, with 0 ⁇ n ⁇ NI, in order to decrypt transparently for the user and directly in the terminal T of the user of the data previously encrypted in a terminal of a second user according to an asymmetric cryptography algorithm according to a public key of expired encryption P n associated with the expired private key S n to be recovered.
• the method for recovering an expired decryption key according to the invention is implemented in a system for recovering an expired decryption key.
• the method comprises a phase of establishing recovery in a certification authority device, belonging to the certification authority, during the generation of another CN / SN cryptographic pair intended for the "first" user of the terminal T ( Figures 1 and 3), and a phase of application of the recovery in the terminal of the first user when decrypting data from the terminal of the second user ( Figures 2 and 4).
• the establishment of recovery according to the invention is implemented by the certification authority in a CA certification authority device connected with or without contact to a portable cryptographic support of the smart card type. CP or USB dongle.
• the portable cryptographic support is assumed to be the smart card CP which is intended to contain the other cryptographic pair CN / SN, after establishment of the recovery.
• the certification authority device AC and the smart card CP are represented, in FIG. 1, in the form of functional blocks, most of which perform functions related to the invention and can correspond to software modules and / or materials.
• the certification authority device AC comprises a certification manager GC for generating at least one CN / SN cryptographic pair, MAC memories and an IAC interface connected with or without contact to the smart card CP.
• the various elements of the certification authority device AC are linked together by a bidirectional bus BA.
• the MAC memories comprise a volatile memory MRAM used more particularly for data processing and an administrator memory MAdm comprising a private encryption key PAdm, a public decryption key SAdm and an asymmetric cryptography algorithm Adm.
• the private administrator key SAdm is also stored in a cryptographic medium.
• the certification authority device AC comprises or is linked to a recovery base BR which contains all the expired and current private keys encrypted by the users who have made at least one request from a cryptographic couple.
• the recovery base comprises, as shown in FIG. 1, the encrypted private keys SRo to SRN-I grouped under an identifier ID of the user of the terminal T having revoked for the Nth time a cryptographic pair.
• the private keys SRo to SRN-I are asymmetrically encrypted as a function of the public administrator key PAdm stored in the memory MAdm.
• the MRAM memory comprises, after establishment of recovery, the expired private keys S'o to S'N-1 of the user, asymmetrically encrypted as a function of the recent current public key PN-
• the CP chip card includes, in addition to a memory
• a PC processor for recording in the MCP memory the CN / SN cryptographic couple generated and an asymmetric cryptography algorithm A when the card is connected to the AC device, and for decrypting expired data or private keys encrypted as a function of the public key PN stored in the memory MCP of the smart card, when the card is connected to the user's terminal T.
• the MCP memory is a non-volatile memory, for example of the EEPROM or flash type.
• the smart card can also include a volatile memory, not shown, of RAM type used more particularly for data processing.
• the different elements of the smart card CP are linked together by a bidirectional bus BC.
• the smart card CP containing the other cryptographic pair has already contained the old pair certificate CN-I / private key SN-I deleted before the registration of the new pair certificate Cu / private key SN-
• the smart card can be new if, for example, the user has lost the old smart card.
• the user's terminal T is connected by contact or without contact to the chip card CP which contains the cryptographic pair CN / SN newly generated by the device.
• CA certification authority The terminal is connected to an RC communication network and receives via the RC network at least one TD data frame coming from a second user terminal also connected to the RC network.
• the data frame TD contains encrypted data D f and the public key P Q , OR an identifier thereof, used during the asymmetric encryption of the data D 'in the terminal of the second user.
• the public key P Q is either an expired public key Po to PN-I, or the current key PN-
• the communication network can for example be a packet network of the internet type, or a cellular radiocommunication network of the GSM type ("Global System for Mobile communications" in English), GPRS ("General Packet Radio Service” in English) or UMTS (“Universal Mobile Telecommunications System” in English).
• GSM Global System for Mobile communications
• GPRS General Packet Radio Service
• UMTS Universal Mobile Telecommunications System
• the data D ' contains a pair associating an encrypted session key K3' and encrypted data D ".
• the data D " is obtained by encryption of data D of any length according to a symmetric cryptography algorithm B having a random session key K3.
• the random session key K3 is encrypted into an encrypted session key K3 'by the asymmetric cryptography algorithm A with the public key P Q known to the terminal of the second user.
• the data D is therefore not encrypted directly as a function of the public key P Q , an asymmetric cryptography algorithm processing data only of size smaller than the public encryption key.
• the terminal T is represented, in FIG. 2, in the form of functional blocks, most of which provide functions related to the invention. and can correspond to software and / or hardware modules.
• the terminal comprises a processor PT, memories MT, an interface IT connected with or without contact to the interface IC of the smart card CP and an interface of communication ICT to receive the data frame TD transmitted from the second terminal of user through the RC communication network.
• the various elements of the terminal T are interconnected by a bidirectional bus BT.
• the memories MT include a local base BL which contains all the obsolete cryptographic pairs including the expired keys S'o to S'N-1 which are encrypted asymmetrically as a function of the recent public key PN-
• the expired keys encrypted S'o to S 'N-1 have been transmitted, after establishment of recovery, from the certification authority device AC to terminal T either via a physical device containing said keys, or directly by a communication network such as the Internet connecting a communication interface of the certification authority device AC to the ICT communication interface of the terminal T or to a server viewable by the terminal T.
• the memories MT also include one or more data processing applications AP, such as an e-mail management application and an internet browser, which require the decryption of encrypted data received.
• a MGD decryption management module is contained in the memories MT and includes so-called low-level operations such as electronic signature, electronic signature verification, and data encryption and decryption.
• the management module decryption comprises an asymmetric cryptography algorithm A and a reverse symmetric cryptography algorithm B used for decryption of the data D ".
• the decryption management module is a software interface between the physical interface IT connected to the smart card CP and the AP applications.
• the MGD module is of type PKCS # 11
• the terminal T can be a personal computer, or any other electronic device or telecommunications object personal to the user of the method, such as a personal digital assistant communicating PDA. It can also be a portable or non-portable home terminal such as a video game console or a smart television receiver.
• the recovery establishment phase of the recovery process for expired private keys includes steps EO to E6.
• Step EO refers to the initial state before revocation of the cryptographic pair CN-I / SN-1 included in the smart card CP of the user of the terminal T.
• the recovery base BR connected to the authority device of certification AC includes all encrypted, expired and current private keys SRo to SRN-I belonging to the user and grouped in the BR database under the identifier ID of the user.
• the user When the user revokes the CN-I / SN-1 cryptographic pair with a certification authority, this pair is deemed to be out of date.
• the user identifies himself to the certification authority, for example by entering the identifier ID on a keyboard connected or integrated with the CA certification authority device.
• the certification manager GC of the certification authority device AC After identifying the user, the certification manager GC of the certification authority device AC generates, in step E1, another cryptographic pair CN / SN, called in the following description "current pair", associating the current certificate CN and the current private key SN-
• the certificate CN and the private key SN are transmitted to the smart card CP connected to the device AC via the interface IAC of the device AC and the interface IC of the CP smart card, and are saved by the card's PC processor in the MCP memory of the CP card.
• the card CP contains the former couple revoked CN-I / SN-I
• I e PC processor card removes outdated torque CN-I / SN-I of the MCP card memory before recording the '' other current couple CN / SN-
• the smart card is then given to the user who connects it to the IT interface of the terminal T in order to operate, in the smart card, data decryptions as a function of the private key SN.
• the CN / SN cryptographic pair generated by the certification authority device AC is transmitted, for example, by post or by hand, to the user of the terminal who enters the cryptographic pair on a keyboard of the terminal in order to store it via the terminal in the PC chip card connected to terminal T.
• the certification authority device discloses the current PN encryption public key to other users likely to transmit via their terminals, encrypted data at the terminal T of the user having the smart card CP containing the other cryptographic pair CN / SN.
• the disclosure is established, for example, by memorizing the public key PN in a directory accessible to, or broadcast to, user terminals transmitting encrypted data.
• step E2 the certification manager GC encrypts the current private key SN by applying an asymmetric cryptography algorithm with the public administrator key PAdm to obtain a current encrypted private key SRN to be stored in the recovery database BR under the user ID.
• the current private key is not encrypted directly as a function of the public administrator key PAdm.
• the private key SN of any length is encrypted by applying a symmetric cryptographic algorithm B with a first random session key K1, which produces an encrypted private key SRN '.
• the first random session key K1 is encrypted into a first encrypted session key K1 'by application of an asymmetric cryptography algorithm Adm with the public key PAdm.
• Adm an asymmetric cryptography algorithm
• Steps E3 and E4 correspond to the processing of an expired private key SR n , with the index n between 0 and NI, stored in the recovery base BR under the identifier ID in order to recover the corresponding expired private key S n .
• Steps E3 and E4 are repeated N times as long as all encrypted expired private keys stored in the recovery database BR are not processed.
• step E3 the certification manager
• GC searches the recovery database BR for the encrypted private key SR n and decrypts it as a function of the administrator private key SAdm in order to obtain the corresponding expired private key S n decrypted.
• the decryption of the expired key SR n (Kl '; SR n 1 J is carried out indirectly by decryption of the keys Kl' and SR n '.
• the first key of session Kl is obtained by decryption of the first encrypted key Kl 'by applying the asymmetric cryptography algorithm Adm with the private administrator key SAdm.
• the expired private key S n is obtained by decryption of the encrypted key SR n by applying the reverse symmetric cryptographic algorithm B with the first decrypted session key Kl.
• step E4 the certification manager GC encrypts the key S n previously decrypted, by an asymmetric cryptography algorithm A with the current public key PN newly generated in step El.
• the expired private key S n is not encrypted directly as a function of the current public key PN -
• the private key S n of any length is encrypted by applying a symmetric cryptography algorithm B with a second random session key K2, which produces an encrypted private key S n "
• the second random session key K2 is encrypted into a second encrypted session key K2 'by application of an asymmetric cryptography algorithm A with the current public key PN-
• the pair associating the second encrypted session key K2 'and the encrypted private key S n corresponds to the private key S n ' ⁇ K2 '; S n " ⁇ .
• step E5 The encrypted expired private key S n ' ⁇ K2 f ; S n 11 J obtained is stored in the memory MRAM of the certification authority device AC.
• step E5 as long as all the encrypted expired private keys SRo to SRN-I stored in the recovery base BR are not processed, the certification manager GC executes steps E3 and E4.
• step E6 once all the encrypted expired private keys SRo to SRN-I stored in the recovery database are processed, the certification manager GC puts the newly encrypted expired private keys S'o to S'N-1 at the disposal of the user's terminal T in the local base BL in correspondence with the respective certificates associated Co to CN-I, by overwriting old expired private keys asymmetrically encrypted as a function of the last expired public key PN-I-
• the certification authority device AC directly transmits the keys S'o to S'N-1 to the terminal T via the communication network RC, such as the internet, which connects a communication interface of the device d CA certification authority, represented by dotted lines in FIG. 2, at the ICT communication interface of the terminal T.
• the communication network RC such as the internet
• the transmission is carried out by registering the keys S'o to S'N-1 in a removable physical device connected to the IAC interface of the certification authority device AC, the physical device then being given to the user who connects it to the interface IT of the terminal in order to store the keys S'o to S'N-1 in the local base BL.
• the physical device is the smart card CP and the expired private keys S'o to S'N-1 are stored in the memory MCP of the card.
• the outdated private keys S O to S'N-1 are recorded in a non-modifiable database of a server accessible in read-only mode.
• the user accesses, for example, the database via an internet-type radio network.
• the recovery application phase of the recovery process for expired private keys in the terminal T connected to the smart card CP comprises the steps E10 to E18.
• the step E10 corresponds to the encryption of the data D in the terminal of the second user before being transmitted in the form of a data frame TD to the terminal of the first user through the network RC.
• the data frame TD contains the public key P Q OR an identifier of the public key, and the pair D ' ⁇ K3', D " ⁇ containing the encrypted session key K3 'obtained by asymmetric encryption of the session key K3 in function of the public key P Q , and the data D "obtained by symmetric encryption of the data D as a function of the unencrypted session key K3.
• the application AP activated by the processor PT processes the frame TD and activates the decryption management module MGD by the transmission of a decryption request in view decryption of data D ', the request containing the public key issued P Q OR its identifier.
• the module MGD receives the decryption request and compares, in step E11, the public key P Q to the public key PN contained in the certificate CN stored in the smart card connected to the IT interface of the terminal, then possibly to step E14, at the public keys Po to PN-I in the local base BL.
• the decryption management module MGD manages the decryption in a known manner in order to supply the decrypted data D.
• the MGD module activates the decryption in the smart card by sending a decryption command including the session key K3 'to the processor PC which makes the asymmetric cryptographic algorithm A apply to the session key K3' with the private key SN included in the MCP memory of the smart card. Step E12 is thus executed in the smart card CP. Then the smart card transmits the decrypted session key K3 to the decryption management module MGD.
• step E13 the decryption management module MGD decrypts the encrypted data D "by applying to them the reverse symmetric cryptography algorithm B with the decrypted session key K3 and transmits the decrypted data D obtained to the application AP.
• step E13 is executed by the application AP.
• step E13 is executed in the smart card CP which acts as a hardware security module HSM ("Hardware Security Module” in English) and contains in the MCP memory the reverse symmetric cryptography algorithm B
• the decryption management module MGD searches for the encrypted private key S ' n corresponding to the public key P n with 0 ⁇ n ⁇ NI, in comparing, in step E14, the public key P Q to all the expired public keys Po to PN-I successively extracted from the expired certificates Co to CN-I stored in the local base BL. As soon as a public key P n is found identical to the public key received P Q , the module MGD takes the encrypted private key S ' n ⁇ K2'; S n " ⁇ corresponding to the public key P n in the local base BL .
• step E15 the module MGD sends a decryption command including the second session key K2 'to the processor PC in the smart card which makes the asymmetric cryptographic algorithm A apply with the key to the session key K2' private SN included in the memory MCP of the smart card, in order to obtain the decrypted session key K2.
• Step E15 is thus executed in the smart card CP.
• the smart card transmits the second decrypted session key K2 to the decryption management module MGD.
• step E16 the decryption management module MGD decrypts the encrypted expired private key S n "by applying to it the reverse symmetric cryptography algorithm B with the second decrypted session key K2 to obtain the decrypted expired private key S n .
• step E17 the module MGD decrypts the third encrypted session key K3 ′ by application of the asymmetric cryptography algorithm A with the expired private key S n previously decrypted to obtain the third decrypted session key K3.
• step E18 the decryption management module MGD decrypts the encrypted data D "by applying to them the reverse symmetric cryptography algorithm B with the third session key K3 previously decrypted and transmits the decrypted data D to the application AP
• steps E15 to E17 are executed by the processor PC of the chip card, the memory MCP of the card containing the reverse symmetric cryptography algorithm B.
• the chip card plays the role of HSM hardware security module.
• the invention described here relates to a method and a system for recovering expired decryption keys.
• the steps of the method of the invention are determined by the instructions of a computer program incorporated in the system.
• the program includes program instructions which, when said program is executed in the system, the operation of which is then controlled by the execution of the program, carry out the steps of the method according to the invention.
• the invention also applies to a computer program, in particular a computer program on or in an information medium, suitable for implementing the invention.
• This program can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code such as in a form partially compiled, or in any other desirable form for implementing the method according to the invention.
• the information medium can be any entity or device capable of storing the program.
• the support may include a storage means or recording medium on which the computer program according to the invention is stored, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or else a USB key, or a magnetic recording medium, for example a floppy disk or a hard disk.
• the information medium can be a transmissible medium such as an electrical or optical signal, which can be routed via an electrical or optical cable, by radio or by other means.
• the program according to the invention can in particular be downloaded from an internet type network.
• the information medium can be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method according to the invention.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)
• Signal Processing For Digital Recording And Reproducing (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=36636253

Family Applications (1)

Country Status (4)

Families Citing this family (7)

Family Cites Families (6)

• 2005
  • 2005-12-07 FR FR0512473A patent/FR2894417A1/fr active Pending
• 2006
  • 2006-12-05 WO PCT/FR2006/051284 patent/WO2007066039A2/fr active Application Filing
  • 2006-12-05 US US12/096,426 patent/US8670567B2/en not_active Expired - Fee Related
  • 2006-12-05 EP EP06842095A patent/EP1958371A2/de not_active Withdrawn

Non-Patent Citations (2)

Also Published As

Similar Documents

Legal Events