KR20090008162A - An apparatus and method for direct anonymous attestation from bilinear maps - Google Patents

Abstract

An apparatus and a method for direct anonymous attestation from bilinear maps are provided to verify a group digital signature of a member by using a public key of a reliable membership group, thereby verifying that a verifier of a digital signature is an actual member of the reliable membership group. A reliable membership group includes at least one reliable hardware device. The reliable membership group is generated as a member device(310). A group public/private key pair about a platform group including one or more public parameters of a process block are generated(320). An issuer generates a group membership certificate including security-related information and the public parameters(340). When the group public/private keys are generated, each member device of a reliable group is verified(350).

Description

Apparatus and Method for Direct Anonymous Proof from Bilinear Maps {AN APPARATUS AND METHOD FOR DIRECT ANONYMOUS ATTESTATION FROM BILINEAR MAPS}

One or more embodiments of the present invention generally relate to the field of cryptography. More specifically, one or more embodiments of the present invention relate to methods and apparatuses for direct anonymous proof from bilinear maps.

In many modern communication systems, the reliability and security of the exchanged information is an important concern. To address this concern, the Trusted Computing Platform Alliance (TCPA) has developed security solutions for the platforms. In accordance with the TCPA specification entitled "Main Specification Version 1.1b" published on or near February 22, 2002, each personal computer (PC) is a trusted platform module (TPM). It is implemented using a trusted hardware device referred to as.

During operation, an outside party (referred to as "verifier") may request authentication of the TPM. This creates two opposing security concerns. First, the prover needs to ensure that the requested authentication information actually comes from a valid TPM. Second, the owner of the PC, including the TPM, wants to maintain privacy as much as possible. In particular, the owner of the PC wants to be able to provide authentication information to different attestors without such attestors who can determine that the authentication information comes from the same TPM.

The REAL ID ACT of 2005 was issued in Pub. L. No. 109-13, 119 Stat.231, Emergency Supplementary Appropriations for Defense, International War on Terrorism, and Tsunami Relief (Emergency Supplemental Appropriations Act for Defense, the Global War on Terror, and Tsunami Relief, 2005, Pub.L. Division B of Congress Act, titled No. 109-13, 119 Stat. 231. The Real ID Act of 2005 creates a standard for issuance of state driver's licenses. The Real ID Act enforces federal technical standards and verification procedures for state driver's license and identification cards, the majority of which exceed the current capabilities of the federal government, and state compliance by May 2008. How to order

One attempt to implement Real ID law for state driver's licenses generally exposes personal sensitive information of the card's holder. Unfortunately, such security information is often sold without the owner's consent, but used to perform fraudulent transactions without the owner's consent. Such behavior is generally known as identity theft, a widely known phenomenon that undermines the credibility of innocent victims every day.

A method and apparatus for direct anonymous proof from bilinear maps is described. In one embodiment, the method includes generating a public / private key pair for a trusted membership group defined by the issuer; And assigning a unique secret signature key to at least one anonymous member device of the trusted membership group defined by the issuer. In one embodiment, using the assigned signature key, the member may sign a message received as an authentication request to form a group digital signature. In one embodiment, the group digital signature of the member may be verified using the public key of the trusted membership group.

As a result, the prover of the group digital signature does not require the disclosure of any unique identification information or unique private or public member key of the member, such that the member can remain anonymous to the prover, You can authenticate that you are a real (trusted) member of a trusted membership group.

In one embodiment, the anonymous hardware device participates in the attestation (combination) procedure such that the issuer forming the secret (private) signing key is a member of the trusted membership group. In one embodiment, the member device includes a Trusted Platform Module (TPM) to digitally sign a message with a private signature key. For one embodiment, the TPM's ability to form a private signing key and digitally sign a message is deployed as firmware. However, it is contemplated that such functionality may be deployed as dedicated hardware or software. Instructions or code that form firmware or software are stored on a machine-readable medium.

Here, "machine-readable media" includes floppy diskettes, hard disks, optical disks (eg, CD-ROMs, DVDs, mini-DVDs, etc.), magnetic-optical disks, read-only (ROM) menory), semiconductor memory such as read access momory (RAM), any type of programmable ROM (e.g., "programmable ROM" (PROM), "erasable programmable ROM" (EPROM), "electrically erasable programmable ROM" ) Or flash)), magnetic or optical cards, and the like. It is contemplated that the signal itself and / or the communication link may be considered as a machine-readable medium, as the software may be stored temporarily as part of the downloaded signal or during propagation over the communication link.

In the following description, certain terminology is used to describe certain features of one or more embodiments of the invention. By way of example, “platform” is defined as any type of communication device configured to transmit and receive information. Examples of various platforms include computers, personal digital assistants, cellular telephones, set top boxes, facsimile machines, printers, modems, routers, smart cards, USB tokens, identity cards, licenses , Other similar form element devices including credit cards or integrated circuits, and the like. A "communication link" is broadly defined as one or more information-transmission media applied to a platform. Examples of various types of communication links include, but are not limited to, electrical wire (s), optical fiber (s), cable (s), bus trace (s), or wireless signal technology.

"Verifier" refers to any entity (eg, person, platform, system, software and / or device) that requests some proof of authorization or authorization from another entity. Typically, this is done before describing or providing the requested information. "Prover" refers to any entity that is required to provide some proof of its authority, validity, and / or identity. A "certifier" can be considered a "signer" when the prover responds to the authentication request by signing a message using a private signature key. An "issuer" defines a trusted membership group and uses it to join hardware devices to the trusted membership group. A “device manufacturer”, which may be used interchangeably with a “certifying manufacturer,” refers to any entity that manufactures or configures a platform or device (eg, a TPM). The issuer may be a device / certification manufacturer.

As used herein, an attestor “proving” or “confirming” a prover having the ownership or knowledge of some cryptographic information is based on the information and proof disclosed to the attestor. It means that there is a high probability of having self password information. Proving it with or without "exposing" cryptographic information to the prover means that it is computationally impossible for the prover to determine the cryptographic information based on the information disclosed to the prover. do. In the following, these evidences are referred to as direct evidence.

Throughout the description and illumination of the various embodiments described below, coefficients, variables, and other symbols (eg, “h”) are referenced as the same label or name. Thus, when a symbol appears in different parts of the equation as well as in different equations or functional descriptions, the same symbol is referenced.

1 illustrates a system 100 featuring a platform implemented as a trusted hardware device (referred to as a "trusted platform module" or "TPM"), according to one embodiment. The first platform 102 (certifier) sends an authentication request 106 to the second platform 200 (certifier) via the network 120. In response to the request 106, the second platform 200 provides the authentication information 108. In one embodiment, network 120 forms part of a local or broadband network, such as a corporate intranet, the Internet, or other similar network, and / or a conventional network infrastructure.

Additionally, for emphasized security, the first platform 102 refers to the authenticator platform 200 as the selected device manufacturer or selected device manufacturers (hereafter referred to as "device manufacturer (s) (issuer) 110"). It may be necessary to demonstrate that it is produced by any one of In one embodiment, the first platform 102 requires the second platform 200 to indicate that the second platform has cryptographic information (eg, a personal signature key) generated by the issuer 110. do. The second platform 200 does not reveal any cryptographic information or any device / platform identification information, referred to herein as “unique, device identification information,” in the form of a response, wherein the second platform 200 is a publisher. In order to assure the first platform 102 that it has cryptographic information generated by 110, in response to the request by providing authentication information, the trusted member device may remain anonymous to the prover. do.

2 shows a TPM 220 having a group membership certificate common to both the TPM 220 and TPMs in the same group, and a personal memory providing digital signatures that can be verified using the group membership certificate. A block diagram further illustrates an embodiment of an anonymous platform 200 that includes a key. In one embodiment, the TPM 220 coupled to the platform 200 may include any unique device that includes a private unique signature key so that the trusted platform 200 can remain anonymous to the attestor 102. Without unique disclosure of identity information, the private signing key 230 is used to prove to the prover that the platform 200 is a member of a trusted membership group defined by the issuer 110 (eg, device manufacturer). Generate authentication information using (FIG. 1). Representatively, computer system 200 includes a processor system bus (front side bud (FSB) 204) for communicating information between processor (CPU) 202 and chipset 210. As described herein, the term “chipset” is used in a manner to collectively describe the various devices connected to the CPU 202 to perform the desired system functions.

Representatively, graphics block 218 as well as hard drive devices (HDD) 214 and main memory 212 are connected to chipset 210. In one embodiment, graphics block 218 may include a graphics chipset, or optionally, chipset 210 may include graphics block 218 to operate as a graphics memory controller hub (GMCH). In one embodiment, chipset 210 is configured to communicate with I / O devices 216 (216-1, ..., 216-N), including a memory controller and / or an input / output (I / O) controller. do. In one embodiment, main memory 212 includes RAM, DRAM, static RAM (SRAM), synchronous DRAM (SDRAM), double data rate (DDR) SDRAM (DDR-SDRAM), Rambus DRAM (RDRAM), or high-speed buffering of data. It may include any device that can support, but is not limited to these.

3 further illustrates a trusted platform module (TPM) 220 of the second platform 200, according to one embodiment. TPM 220 is a cryptographic device manufactured by a device manufacturer. In one embodiment, the TPM 220 includes a processor unit 222 having a small amount of on-chip memory encapsulated in a package. In one embodiment, the encapsulated memory may be used to store the personal unique membership key 230 generated during the association procedure with the issuer 110. The TPM 220 is configured to provide authentication information to the first platform 102 that can determine that authentication information is to be sent from a valid TPM. The authentication information used is randomized data that is configured such that the identification of the TPM or the second platform can be very easily determined.

In one embodiment, TPM 220 further includes non-volatile memory 224 (eg, flash) that allows storage of cryptographic information, such as one or more keys, hash values, signatures, certificates, and the like. do. In one embodiment, the cryptographic information is a personal signature key received from an issuer 110, such as, for example, a proof manufacturer. As shown below, the hash value of "X" may be represented as "Hash (X)". Of course, it is contemplated that such information may be stored in the external memory 280 of the platform 200 instead of the flash memory 224. Cryptographic information may be encrypted, especially if stored outside the TPM 220.

In one embodiment, TPM 220 includes authentication logic 240 that responds to an authentication request from an attestor platform. In one embodiment, the authentication logic 240 computes the digital signature according to the received message using the private signature key 230 so that the TPM 220 may generate any unique device / platform identification information. Convince or prove to the prover platform that it does not expose and stores cryptographic information generated by the issuer of the trusted membership group. As a result, the authentication logic 240 performs the requested authentication while preserving the identity of the prover platform to maintain the anonymity of the platform 200. Authentication logic 240 is further illustrated with reference to FIG. 4.

In one embodiment, certification logic 250 forms personal signature key 230 during a one-round verification procedure with issuer of personal signature key 230. In one embodiment, signature logic 260 may sign the received message as part of an authentication request from an attestor. Typically, revoked key logic 270 indicates that the private member key component of the private signature key 230 held by the platform 200 is not a revoked (compromised) private member key. Convince or prove the prover platform. In an alternative embodiment, verification is performed by the verifier that the private signature key is not a revoked signature key. It is understood that a computer having fewer or more than described above may be desirable for certain implementations.

In one embodiment, each hardware device that is a member of a trusted membership group is assigned a unique private signature key by the issuer. Typically, a trusted member device with an assigned personal signature key can sign a received message as part of an authentication request from an attestor. However, in contrast to conventional digital signature systems, the verification of a group digital signature generated using the unique private signature key of the member device is verified using the group public key for the trusted membership group defined by the issuer. A member device of a trusted membership group, using its private signature key, restricts the disclosure of unique device identification information to an indication that the device is a member of a trusted membership group of trusted hardware devices that can be defined as an attestation manufacturer. do.

In one embodiment, authentication logic 240 allows him to prove that he is a member of the group without revealing any information about his identification. Members of a group have a credential ("group membership certificate") that can be used to prove the group's membership. In one embodiment, the credentials consist of a private member key and a group membership certificate. The private signature key is unique for different members of the group, and each member selects a secret random value as the member's private member key unknown to the issuer. However, the group public key of the trusted membership group is the same for all members of the group.

As described herein, an issuer, such as issuer 110, establishes that a person (or entity) is a member of a group and then issues a credential to the member that is used to form the member's private signature key. It is an entity. As further described herein, an attestor is a person or entity who strives to prove membership in a group. If the prover is a real member of the group and has valid credentials, the proof will be successful. As further described herein, an attestor is an entity that strives to verify whether the attestor is a member of a group. Therefore, the prover tries to prove membership to the prover.

As shown in FIG. 4, to prove membership, an attestor requests that the attestor digitally sign some messages, eg, in digital signature logic 260. If the prover needs to know if the message is currently signed, then the prover generates a random value (temporary) given to the prover and includes it in the signature. The prover signs the message using the private signature key and sends the signature to the prover. As described herein, such a signature is referred to as a group digital signature as it is verified as a public, group public key of a trusted membership group.

In one embodiment, the attestor can verify the signature using the group public key, and if the attestation is successful, the attestor knows that the attestor is a member of a trusted group. If any value is used, the verifier knows whether the group signature was generated between when he sent the random value and when the signature was received. Thus, the prover does not know which member generates the group digital signature in order to maintain the anonymity of the trusted members of the group.

In one embodiment, TPM 220 may be included on a smart card that includes a form factor of a PCMCIA card for insertion into a PCMCIA slot, or may be a driver's license, identification card, credit card or standard driver's license / credit. It may be included on an identification device such as another similar configuration that includes a form factor of the card and includes an integrated circuit that performs one or more cryptographic procedures as described herein. However, it should be understood that certain cryptographic functions may be computed by an attached host, such as platform 200. According to such a configuration, for example, the use of the TPM 220 for a driver's license may be consistent with the Real ID Act of 2005, as mentioned above, without the disclosure of personally sensitive information.

According to such a configuration, the Department of Motor Vehicles or DMV is an issuer and is used in the set up procedure for generating a group public key and a group issued private key. The issuer publishes a public key and maintains a group issued private key. According to such a procedure, a general procedure is followed for each issued driver's license to provide a user private signature key from the issuer that includes a private member key component unknown to the issuer. Thus, in addition to the group public key, the user private signature key is the user's credentials to this group.

According to such an embodiment, as shown in FIG. 4, in addition to the authentication logic, the TPM 220 may be configured on a card having a form factor such as a standard driver's license, a credit card or other similar smart card device for accessing bank machines. Is included in the card, and the owner of the card, for example, does not request the issuer (DMV) to have a copy of the compromised private keys, but is used in the verification process to prove that the owner of the card is not a retired member. Can be.

5 is a flow diagram illustrating a method 400 of forming a trusted membership group public key according to one embodiment. A "trusted membership group" can be defined by an issuer to include types of one or more platforms or devices. By way of example, a trusted membership group may be a set of all platforms (members) that have a common element of security related information, such as a group public key. Such security related information may include the model number and manufacturer of the particular platform or device. For each trusted membership group, the issuer creates cryptographic parameters used for that trusted membership group. The issuer generates a private signing key during the joining procedure used to sign messages received by member devices (eg, platform 200 or TPM 220), so that the device is a member of a trusted membership group. To the prover.

In one embodiment, the publisher creates a trusted membership group that includes at least one trusted hardware device as a member device (block 310). In one embodiment, the issuer uses a public key cryptography function (eg, elliptic curve cryptography) to generate a group public / private key pair. This is done by Bruce Schneier, John Wiley &Sons; ISBN: 0471117099; It may be generated using well known methods such as those described in the second edition (1996), Applied Cryptography.

The issuer generates a group membership certificate containing public parameters, security related information of the trusted membership group. Once the platform group public / private key is generated, an attestation procedure for each member device of the trusted group is performed (block 350). As part of the attestation process, the issuer provides group membership credentials to members or devices of the trusted group. The distribution of cryptographic parameters associated with the group membership credential from the prover (eg, the second platform 200 of FIG. 1) to the prover can be accomplished in a number of ways. However, these cryptographic parameters should be distributed to the prover in such a way that the prover is assured that the group membership certificate was generated by the issuer.

As an example, one recognized method is to distribute the parameters directly to the prover. Another accepted method is, by way of example, by the issuer distributing a group membership statement signed by the attestation authority. In this last method, the public key of the proof authority must be distributed to the prover, and a signed group membership certificate can be given to each member of the trusted group (certifier platform). The prover platform may then provide the prover with the signed group membership certificate.

FIG. 6 is a flowchart illustrating a method 322 of generating a group public / private key pair for a platform group that includes one or more public parameters of process block 320 of FIG. 5, in accordance with the present invention. The generation of platform parameters for the public / private key pair and platform group allows member devices to identify themselves as trusted member devices without revealing any unique device identification information. In one embodiment, as described with respect to FIG. 6, generation of group disclosure parameters is referred to herein as a setup protocol.

In one embodiment, the public / private required by the manufacturer to generate a unique private signature key for each member device of the trusted group defined by the issuer, using the setup protocol by the hardware manufacturer (issuer). Prove member devices by generating key pairs and other cryptographic parameters.

Referring back to FIG. 6, in process block 324, the publisher produces (q, G, g, G _T , g _T , e), where q is the prime number, G and G _T are q groups of order q, e: GxG → G _T is a bilinear map function that can be efficiently computed, g is the generator of group G, and g _T is the generator of group G _T. In one embodiment, the group digital signature is generated using a private signature key to enable attestation based on bilinear maps. For example, assume that there are two groups G = <g> and G _T = <g _T >, with prime q. An efficient non-degenerate bilinear map e , e : GxG → G _T is a function defined as

1. For all P, Q∈G, for all a, b∈Z, e (P ^a , Q ^b ) = e (P, Q) ^ab .

2. Some P, Q∈G is present such that e (P, Q) ≠ 1, where 1 is equal to G _T.

3. There is an effective algorithm for computing e .

Referring again to FIG. 6, at process block 326, the publisher selects random values x and y. If x and y are selected, at process block 328, the publisher computes X = g ^X and Y = g ^y . In process block 330, the group public key is (q, G, g, G _T , g _T , e, X, Y) and the public key for the issuer is the (x, y) output by the issuer. In one embodiment, a random selection of platform parameters x and y is performed by picking a random seed value and generating x and y values using a pseudo random number generator. In one embodiment, the issuer's secret key is (x, y).

Once the platform group public / private key has been formed, the issuer may prove each member of the platform group according to the association procedure, as further shown for FIG. Representatively, FIG. 7 is a flowchart illustrating a method 352 of proving member devices of the defined trusted membership group of process block 350 of FIG. 5, according to one embodiment.

Typically, the platform interacts with the publisher to join the groups. In process block 354, the TPM derives the private member key f from its DAA seed that has not been exposed to the issuer and sets F = g ^f . At process block 356, the TPM sends F to the issuer to prove knowledge of the log _g F to the issuer. At process block 358, the publisher verifies the proof of knowledge performed by the TPM. At process block 360, the publisher selects random r to compute a = g ^r , b = a ^y , and c = a ^X F ^rxy . In process block 362, the issuer sends (a, b, c) back to the host as the platform's membership certificate. At process block 364, the host passes (a, b, c) to the TPM. In one embodiment, the private signature key of the member device is (f, a, b, c), which includes the private member key f as well as the membership certificate (a, b, c).

In one embodiment, the TPM also performs a signature proof of knowledge (SPK) to the issuer (corresponding to process blocks 356 and 358) as follows:

SPK {(f): F = g ^f }.

1. TPM selects random r∈Z _q and computes T = g ^r .

을 연산한다.2. TPM

Calculate

을 연산한다.3. TPM

Calculate

4. The TPM sends (F, c, s) to the issuer.

을 연산한다.5. The issuer

Calculate

임을 증명한다.6. Issuer

Prove it is.

8 is a flow diagram illustrating a method 400 for computing a private signature key by a member device of a platform group, according to one embodiment. At process block 410, the TPM selects reference B. To sign message m, the TPM has (f, a, b, c) as the secret signing key and the host has (a, b, c). In a random base option, the TPM randomly selects B from group G _T. In the named-base option, the TPM derives B from the prover base name. The TPM then computes the pseudonym K = B ^f . At process block 420, the TPM selects two random numbers r and r 'and sends them to the host. In process block 430, the host computes a '= a ^r' , b '= b ^r' and c = c ^r'r , and then v _x = e (X, a '), v _xy = e Compute (X, b ') and v _s = e (g, c'). At process block 440, the host sends (a ', b', c ', v _x , v _xy , v _s ) back to the TPM. In process block 450, the TPM is zero-knowledge proof of knowledge of (ri, f), so that the TPM is v _s ^ri = v _x v _xy ^f and K = B ^f without exposing ri and f. , Where ri is the inverse of r modulo q. Use ∑ to indicate the signature of the knowledge for the proof. In process block 460, the generated signature is then (a ', b', c ', B, K, Σ).

In one embodiment, the TPM may select B from any group G, and the critical Diffie-Hellman problem of G is hard. Revocation checks on G may be performed instead of G _T.

In one embodiment, the TPM pre-computes e (X, a), e (X, b), e (g, c '). The TPM selects two random numbers r and r 'and sends them to the host. The host only computes a '= a ^r' , b '= b ^r' and c '= c ^r'r . The TPM then computes v _x = e (X, a) ^{r '} , v _xy = e (X, b) ^r' and v _s = e (g, c) ^r'r . The host sends (a ', b', c ') back to the TPM.

In one embodiment, the TPM computes the "signature of knowledge" as follows.

(a) is TPM to select two of the random integer rr, rf∈Z _q T _{s 1} = v ^rr v _xy ^{- rf,} calculates the T ₂ = B ^rf.

을 연산한다.(b) the TPM is

Calculate

을 연산한다.TPM is

Calculate

The TPM sends (c, sr, sf) to the host.

The host sends the signature σ = (B, K, a ', b', c ', sr, sf) to the prover, where ∑ = (sr, sf).

Thus, a trusted hardware device, using a private signature key (f, a, b, c), is a device that is a group of trusted anonymous hardware devices defined by the proof manufacturer, for example, referred to herein as an issuer. By indicating that you are a member, you identify yourself as a trusted hardware device. In one embodiment, each hardware device is a member of a platform group and is assigned a unique private signature key. Typically, a trusted hardware device with an assigned private signature key can sign a received message as part of an authentication request from an attestor. However, in contrast to conventional digital signature systems, the verification of the digital signature generated using the unique private signature key of the member device is verified using the group public key for the platform group defined by the issuer.

9 is a flowchart illustrating a method 500 of a verification algorithm for checking signatures for validity with respect to a group public key, according to one embodiment. The group signature consists of (a ', b', c ', B, K, ∑). In process block 510, the prover first computes v _x = e (X, a '), v _xy = e (X, b'), v _s = e (g, c '). In process block 520, the prover verifies the accuracy of the signature? Of the knowledge; Otherwise, the verification fails at process block 522. If the signature is verified, at process block 530, the verifier checks whether e (a 'Y) = e (g, b') is kept; Otherwise, the verification fails at process block 532. At process block 540, the verifier checks whether the signature has been revoked, i.e., for each revoked member key of the rogue list, whether the verifier is K ≠ B ^fi .

For example, perform a group signature σ = (B, K, a ', b', c ', sr, sf) to the authentication, demonstrated the following steps for the m:

1. The prover proves that e (a ', Y) = e (g, b') and B∈G _T.

2. The prover computes v _x = e (X, a ') v _xy = e (X, b') v _s = e (g, c ').

Calculates a _{^{- 'sf v x -c T 1}} = v s sr v xy' 2 = B sf K -c 3. The demonstrated T.

을 입증한다.4. The prover

Prove that.

For each fi in the rogue-list, the verifier checks whether K ≠ B ^fi , as shown in FIG. 10. If a matching discarded member key is detected, attestation fails at process block 560; Otherwise, attestation succeeds at process block 570.

10 is a flowchart illustrating a method 542 of assuring that a member device's private signature key is a private signature key that has not been revoked, according to one embodiment. Thus, at process block 544 it is determined whether a rogue-key list has been received. If so, at process block 546, the discarded member key is selected from the log key list. At process block 548, it is determined whether the alias value K received as part of the digital signature is not equal to an equation of the form K = B ^fi . If the pseudonym value K is equal to the equation, the signature is rejected at process block 552. Otherwise, at process block 550, process blocks 546-548 are repeated for each discarded member key of the discarded key list until each key of the discarded key list is processed. Thus, assuming that the value K of the group signature does not match B ^fi , the digital signature received from the member device is received.

In one embodiment, the member or trusted hardware device may generate a standard public / private key pair using conventional cryptographic protocols such as ECC. Thus, in one embodiment, the member device's private signature key can be used to sign the public ECC key to show that the public key was generated by a trusted hardware device. Thus, consecutive transactions can be performed using a conventional public / private key ECC pair that follows the initial authentication of the member device as a trusted hardware device of the platform group.

While various features and advantages of the various embodiments of the present invention have been described in the foregoing description with details of the structure and function of the various embodiments of the present invention, it will be understood that the present application is by way of example only. In some cases, certain subassemblies are described in detail in only one such embodiment. Nevertheless, it is understood and understood that such subassemblies may be used in other embodiments of the present invention. Changes may be made in detail to the entire scope of the appended claims in their broad general sense, in particular the principles of the embodiments of the invention, in particular in terms of the management and structure of parts.

As defined by the following claims, modifications and variations having the described exemplary embodiments and optimal modes, while remaining within the scope of embodiments of the present invention, are made to the described embodiments. Can be.

Various embodiments of the invention are shown by way of example only and not as a limitation of the accompanying drawings.

1 is a block diagram illustrating a system featuring a platform implemented with a TPM, according to one embodiment.

2 is a block diagram further illustrating the platform of FIG. 1, according to one embodiment.

3 is a block diagram further illustrating the TPM of FIGS. 1 and 2, according to one embodiment.

4 is a block diagram further illustrating the authentication logic of FIG. 3, according to one embodiment.

5 is a flow diagram illustrating a method of establishing a trusted membership group of trusted member devices, according to one embodiment.

6 is a flow diagram illustrating a method of generating a group public / private key pair and one or more public parameters, according to one embodiment.

7 is a flow diagram illustrating a method for a association protocol for authenticating member devices of a trusted membership group, according to one embodiment.

8 is a flow diagram illustrating a method of generating a personal signature key in response to a received attestation request, according to one embodiment.

9 is a flow diagram illustrating a method of verifying a group digital signature of a device to authenticate the device as a trusted member of a trusted membership group, according to one embodiment.

10 is a flow diagram illustrating a method for verifying that a private signature key used to generate a received signature includes a non-revoked private member key, according to one embodiment.

<Explanation of symbols for the main parts of the drawings>

102: first platform (provider)

106: Authentication request

108: authentication information

110: publisher

120: network

200: second platform (certifier)

220: TPM

Claims (25)

As a method for anonymous attestation using elliptic curve computation, Requesting verification that the anonymous hardware device is a trusted member device of a trusted membership group; Authenticating attestation received from the anonymous hardware device according to published cryptographic information from the trusted membership group; And Without determining any unique device identification information or private member key of the hardware device such that a trusted member device may be anonymous to a prover, the anonymous hardware device is a private device of the hardware device. Proving that it is a trusted member device of the trusted platform group according to the private member key component of the signing key and the rogue list of corrupted member keys. Anonymous proof method using an elliptic curve operation, including. The method of claim 1, Requesting the attestation, Issuing a message to the anonymous hardware device to request verification that the anonymous hardware device is a trusted member device of the trusted membership group; And Receiving a group digital signature from the anonymous hardware device More, To sign the issued message, the group digital signature is generated by the anonymous hardware device using the private signature key of the anonymous hardware device, the private signature key being the personal member of the anonymous hardware device. An anonymous proof method using elliptic curve operations, including key and group membership certificates. The method of claim 1, Authenticating the received attestation, Identifying a group public key of the trusted membership group; And Authenticating a received group digital signature according to the group public key of the trusted membership group More, To sign a message issued to the anonymous hardware device, the group digital signature is generated by the anonymous hardware device using the private signature key of the anonymous hardware device, the private signature key being the anonymous signature. An anonymous proof method using an elliptic curve operation comprising said private member key and a group membership certificate of a hardware device. The method of claim 1, If the private member key component of the private signature key of the hardware device matches a revoked private member key from the log list of compromised member keys, rejecting authentication of the anonymous hardware device step Anonymous authentication method using an elliptic curve operation further comprising. The method of claim 4, wherein Rejecting the authentication, Determining if the group digital signature of the hardware device was generated using a private signature key having a revoked member key component; And If the group digital signature was generated using a revoked member key, identifying the hardware device as an untrusted hardware device Anonymous authentication method using an elliptic curve operation further comprising. The method of claim 4, wherein Rejecting the authentication, (a) selecting a revoked member key from the log list; (b) K ≠ B ^fi Where fi is the selected discarded member key, B is the cryptographic parameter of the group digital signature of the hardware device, i is an integer from 1 to n, n is an integer greater than 1, and K is K = B has the form ^f , where f is the private member key of the hardware device, wherein the pseudonym, cryptographic parameter, K of the group digital signature of the hardware device uses the selected discarded member key. Proving that it was not produced by; (c) repeating steps (a) and (b) for each discarded member key, fi, listed in the log list; And (d) if the group digital signature was generated using a revoked member key from the log list, identifying the hardware device as an untrusted hardware device Anonymous authentication method using an elliptic curve operation further comprising. An anonymous proof method using elliptic curve operations, Generating a group public / private key pair for a trusted membership group defined by an issuer; Verifying that an anonymous hardware device has generated a secret member key component of a secret signing key without revealing the secret member key of the hardware device to the issuer; Assigning a unique group membership certificate to the hardware device to render the hardware device a trusted member device of the trusted membership group, wherein the private signature key is the anonymous hardware device. The private member key of the and the group membership certificate; And Publishing the group public key such that an attestor can prove that the anonymous hardware device is a trusted member device of the trusted membership group, wherein the group public key is determined by a trusted member device for the attestor. To verify group digital signatures generated using a secret signing key so that they can be anonymous- Anonymous proof method using elliptic curve operations, comprising. The method of claim 7, wherein And the issuer is a certifying manufacturer of the trusted hardware device. The method of claim 7, wherein Proving the step, Receiving an alias of the form F = g ^f , where F is the private member key and g is an encryption parameter of the group public key; And Receiving proof from the hardware device to verify that the private member key is stored in the hardware device, the evidence comprising a proof of knowledge in the form of log _g F- Further comprising, an anonymous verification method using elliptic curve operations. The method of claim 9, Selecting, by the issuer, a random value, r; And Computing, by the issuer, a = g ^r , b = a ^y and c = a ^x F ^rxy , where (x, y) is the issuer's private key and (a, b, c) is the above Certificate of group membership- Further comprising, an anonymous verification method using elliptic curve operations. The method of claim 7, wherein Assigning the group membership certificate, if a = g ^r , b = a ^y and c = a ^x F ^rxy , sending (a, b, c) by the issuer to the host of the trusted member device as the group membership certificate-( x, y) is the issuer's private key, F is a pseudonym of the form F = g ^f , f is the private member key, and g is an encryption parameter of the group public key; And Delivering, by the host, the group membership certificate (a, b, c) to the trusted member device, where (f, a, b, c) is the secret signing key of the trusted member device Anonymous proof method using elliptic curve operations, comprising. An anonymous proof method using elliptic curve operations, Signing, by an anonymous hardware device, a message received from an attestor, wherein the message is signed using the private signature key of the anonymous hardware device; Sending a digitally signed message to a prover, the digitally signed message comprising a group digital signature of the anonymous hardware device, wherein the prover is trusted by the anonymous hardware device using a group public key of a trusted platform group. Verify the group digital signature to prove that it is a trusted member device of a membership group; And Of the private signature key of the anonymous hardware device without revealing any unique device identification information or the private member key of the anonymous hardware device, such that a trusted membership device may be anonymous to the attestor. If the private member key component does not match any discarded member keys from the log list of corrupted member keys, receiving a denial of revocation Anonymous proof method using elliptic curve operations, comprising. The method of claim 12, Prior to the signing step, the method If the private member key of the anonymous hardware device matches a revoked member key from the log list of compromised member keys, receiving a denial of attestation. The method of claim 12, Prior to the signing step, the method Deriving a random secret value, f, in accordance with an attestation seed; Computing a value F of the form F = g ^{f, where} g is the cryptographic parameter of the group public key of the trusted membership group; Sending a value, F, to a publisher of the trusted platform group as a request to join the trusted platform group; Sending evidence to the issuer to verify that a private member key is stored in the hardware device, the evidence comprising a proof of knowledge in the form of log _g F; And If the issuer verifies the accuracy of the proof of knowledge, receiving a group membership certificate (a, b, c), wherein the random secret value, f is the private signature key (f, a) of the trusted member device; , a private member key component of b, c), and verified according to the group public key such that the trusted member device can be anonymous to any attestor- Further comprising, an anonymous verification method using elliptic curve operations. The method of claim 12, The signing step, Selecting a base value, B, by a trusted platform module (TPM) of the anonymous hardware device; Computing, by the TPM, an alias of the form K = B ^f , K, where f is the private member key of the anonymous hardware device; Sending, by a TPM, two random numbers r and r 'to a host of the anonymous hardware device; ^Computing , by the host, a '= a ^r' , b '= b ^r' , and c '= c ^r'r , where a, b, and c are ciphers of the group membership certificate of the trusted membership group Parameters-; And Computing, by the host, v _x = e (X, a '), v _xy = e (X, b'), and v _s = e (g, c '), where X and Y are trusted Are cryptographic parameters of the group public key of the membership group, q is a prime number, G and G _T are groups of order q, e: GxG → G _T is a bilinear map function that can be efficiently computed, g is the generator of group G and g _T is the generator of group G _T- Further comprising, an anonymous verification method using elliptic curve operations. The method of claim 15, Receiving (a ', b', c ', v _x , v _xy , v _s ) from the host; computing, by the TPM, a zero-knowledge proof of knowledge of (ri, f) such that v _s ^ri = v _x v _xy ^f and K = B ^f without exposing ri and f ri is the role of r modulo q; And Sending (a ', b', c ', B, K, ∑) to the attestor as the digital signature of the anonymous hardware device, where Σ represents the zero-knowledge proof Further comprising, an anonymous verification method using elliptic curve operations. Flash memory for storing a private signature key assigned to the device by the issuer; And Trusted platform module to sign messages received from attestors Including, The message is signed using the private signature key, and sends a digitally signed message to the attestor, the digital signature of the device including the group digital signature of the device, the attestor being trusted by a membership group in which an anonymous hardware device is trusted. Authenticate the group digital signature to prove that it is a receiving member device, and use elliptic curve operations to identify any unique device identity of the anonymous hardware device so that a trusted member device can be anonymous to the attestor. And refusing to revoke according to a log list of compromised member keys and a private member key component of the private signature key of the anonymous hardware device without disclosing information or the private member key. The method of claim 17, And an identification card having an integrated circuit comprising a TPM. The method of claim 18, Wherein the identification card is a state driver's license and the issuer is the state of department of motor vehicles. A prover platform connected to the network; And Anonymous prover platform connected to the network Including, The anonymous prover platform, Bus, A processor coupled to the bus, A chipset coupled to the bus, the trusted platform module comprising a trusted platform module, the trusted platform module signs a message received from the attester platform, the message being signed using a private signature key of the attester platform and Send a digitally signed message to the attestor platform, the digitally signed message including the group digital signature of the child platform, wherein the attestor is the group digital signature to verify that the anonymous prover platform is a trusted member device of the trusted membership group. Verified- Including, The prover platform does not use elliptic curve operations to determine any unique device identification information or the private member key of the prover platform such that a trusted member device can be anonymous to the prover, And verify, according to the log list of private member key components and corrupted member keys of the private signing key of the prover platform, a trusted member device of the trusted membership group. The method of claim 20, The prover platform, An authentication that determines if the group digital signature of the prover platform was generated using a revoked member key and identifies the hardware device as an untrusted hardware device if the group digital signature was generated using the revoked member key System containing logic. The method of claim 20, The prover platform does not disclose any unique device identification information or the private member key of the anonymous prover platform so that a trusted member device can be anonymous to the prover, If the private member key of the hardware device does not match any discarded private member keys from the log list of corrupted member keys, receive a denial of revocation from the attestor. The method of claim 20, The prover platform, Key logic for generating a secret member key, f, in accordance with a predetermined seed value; And Join logic to compute cryptographic parameters to receive the group membership certificate (a, b, c) of the prover platform Including, The private signing key (f, a, b, c) of the prover platform comprises a secret member key f and a cryptographic parameter (a, b, c) of the group membership certificate of the prover platform. The method of claim 20, The chipset includes a graphics controller. The method of claim 20, The network includes a broadband network.

Images