RU2693192C1 - Computer-implemented method of providing secure group communications with failure properties, perfect direct privacy and correspondence of text of correspondence - Google Patents

Abstract

FIELD: cryptography.

SUBSTANCE: invention relates to provision of cryptographically protected group communications. Method of secure group communication between three and more network subscribers, in which search and reception by one of subscribers of IP-addresses of other subscribers involved in communication, sending, by one of the subscribers, a message to the other subscribers on the beginning of authentication with subsequent execution by all subscribers of the authentication procedure with formation of a packet of keys, including a group session key for encrypting messages and individual ephemeral private keys of subscribers for signing messages, communication between all subscribers is realized by means of messaging using a group key and individual keys and upon reaching a predetermined number of messages, initiating the group key change with negotiation of the new group key using the key material automatic movement procedure, output of one of subscribers from group in process of communication is carried out by sending message to other subscribers on beginning of procedure of session termination, thereafter, each user device is sent to the rest of the user equipment of the group with its own ephemeral private key for signing messages in clear form and deleting from each device a group session key for encrypting messages.

EFFECT: high level of communication security and reduced risks when compromising long-term key material.

7 cl, 8 dwg

Description

Technical field

The invention relates to information technologies, namely, to computer-implemented methods for providing cryptographically protected group communications with the properties of perfect forward secrecy and failure.

The level of technology

When communicating through various communication channels, including using the public Internet, confidential information can be transmitted. To protect such information, as a rule, use a secure transmission connection provided by the encryption system. However, conventional encryption systems are often difficult to use. Known methods of asymmetric encryption, which are based on complex mathematics used for private and public keys, and are inherently ineffective. Symmetric encryption methods are known that are much more efficient, but use secret information (for example, a password, passphrase, or private key), which must be kept confidential between all persons or devices with authorized access to encrypted data. However, these methods also do not provide adequate protection of the transmitted information in the case when the entire encryption system becomes compromised, for example, in connection with the publication of passwords, passphrases, private keys, etc.

In particular, the prior art describes a method of using group communication (US 20160197895 A1), which includes generating fail-keys, downloading an encrypted binary data array from a server, which includes symmetric encryption keys stored on the server side, encrypted with a user password, decrypting an encrypted binary data array stored by a locally symmetric user key and password. Server-side symmetric encryption keys are used to encrypt a message before transmitting it to the intended recipient and decrypting the received message. The failover key is used for encryption before transferring it to the intended recipient. Messages and denied messages are transmitted to the intended recipient in a random order.

However, this method is focused on the secure communication of two users and does not support communication between a group of users. Also, the operation of the method is described in terms of the client-server model without indicating the possibility of decentralized communications. Also in the description of the method there are no references to the presence of the properties of perfect Forward Secrecy and denied authentication.

The prior art also known method of fast encryption and decryption of data to provide secure communication, performed on a computing device, US 9621521B2. According to this method:

- the computing device determines the first encryption key (shared between the sender and the recipient secret) and the second encryption key (fake key) to encrypt the message when the computing device intends to transfer the first and second message to another computing device over the communication channel;

- if the length of the first message and the length of the second message are different, the length of one of these messages changes so as to be equal to the other;

- the first message is encrypted with the first encryption key to generate the first ciphertext, the second message is encrypted with the second encryption key to generate the second ciphertext, while the second ciphertext coincides with the first;

- the encrypted first message (which coincides with the encrypted second message) is transmitted to another computing device through the communication interface of the sending computer device.

This method allows you to encrypt several different messages and receive the same ciphertext. The sender and the recipient of the message may deny the fact that this sequence of bytes is encrypted by them, that they can decrypt it, moreover, it is possible to choose the key in such a way that the ciphertext is decoded into some meaningful text that is different from the original.

However, this method does not support the properties of perfect forward secrecy. This method also does not support denied authentication, that is, the communication participants cannot be sure of the authenticity and integrity of the received message. Finally, for the case of group communications with the number of subscribers 3 or more, the method does not ensure consistency of the text of the correspondence.

It should be noted that the principles of traditional cryptography were laid in those times when wearable electronics and mobile equipment were not common. The protocols of secure communications were subject to slightly different requirements, which today are considered classical: ensuring confidentiality, authenticity and integrity. That is, the transmitted data had to be protected from unauthorized reading, modification and forgery. Based on traditional cryptographic primitives, many software and hardware encryption tools were created, including PGP and SSL / TLS (see, for example, https://tools.ietf.org/html/rfc4880 - RFC OpenPGP, https: // tools.ietf.org/html/rfc5246 - RFC TLS 1.2).

However, this approach was not without flaws.

Firstly, the privacy feature relies heavily on the secure storage of the private key. If long-term key material is lost, for example, in the case of theft of a phone, laptop or information system hacking, all messages encrypted with their help become compromised. A cryptographic protocol capable of ensuring the confidentiality of data in the event of a compromised private key has the Perfect Forward Secrecy feature.

Secondly, ensuring the authenticity of transmitted messages using a PGP digital signature and similar means carries an architectural flaw: any third party can verify the authorship of the message, which is not always desirable. It is possible that the author may be interested in the fact that his participation in the correspondence could not be proved mathematically. That is, it is necessary that the protocol have the property of failure (eng. Deniability, as well as Repudiation).

In this regard, it becomes apparent the need to develop and use new cryptographic protocols that support the properties of perfect forward secrecy and failure. The first successful attempt to create such a protocol was the creation of the Off-the-record messaging (OTR) protocol, but its essential limitation was the ability to communicate only two participants. The main problem was the complexity of the denied mutual authentication of users: in the original OTR, users have the ability to forge each other's messages, which, with an increase in the number of users to three or more, can lead to the fact that during communication the first participant cannot reliably distinguish between themselves the second and third.

Known software for denied communication, such as Open Whisper Systems' Signal protocol, uses pairwise connections between users to organize group communication, which creates unnecessary overhead and limits the scalability of such solutions. Also, most similar solutions do not support consistent messaging in group communications. In other words, different users can see a significantly different sequence of messages in the text of the correspondence. This is due to the fact that traditional ways of ensuring the consistency of the text of correspondence in a decentralized environment have an exponential increase in the number of messages.

DISCLOSURE OF INVENTION

The claimed invention overcomes the disadvantages listed above.

The task to which this invention is directed is to ensure a high level of security of group communications in the context of recording traffic of communication by third parties over the long term, as well as the possible compromise of the long-term key material.

The technical result is to ensure increased communication security and reduce risks when compromising long-term key material by using the protocol of denied group mutual authentication and developing a common group secret separately for encryption and separately for message authentication, with the implementation of coordinated transmission of user messages.

The task is solved by the fact that a computer-implemented method of secure group communication between three or more Internet subscribers using electronic devices includes the steps of initiating communication, direct implementation of communication and its completion, where

the stage of initiation of communication is carried out through the implementation of the following steps:

1. search and receipt by one of the subscribers of the IP addresses of the remaining subscribers involved in communication on the Internet using known identifiers, followed by the establishment of pairwise connections between all subscribers;

2. sending by one of the subscribers a message to the rest of the subscribers about the beginning of authentication, followed by all subscribers conducting an authentication procedure with the formation of a key package, including a group session key for encrypting messages and individual ephemeral private keys of subscribers for signing messages;

the stage of direct communication is carried out through the following steps:

3. implementation of communication between all subscribers through the exchange of messages using a group key and individual keys, while in the process of exchanging messages they ensure synchronization of messages in the order in which they are followed with ensuring causal consistency

4. upon reaching a specified number of messages, initiate a group key change with the approval of a new group key using the automatic promotion procedure for key material;

the stage of direct completion of communication is carried out through the implementation of the following steps:

5. exit of one of the subscribers from the group in the process of communication is carried out by sending a message to other subscribers about the beginning of the session termination procedure, after which each subscriber device sends to the other subscriber devices of the group its own ephemeral private key to sign messages in an unencrypted form (publishes individual keys ) and delete the group session key from each device to encrypt messages, the remaining group members repeat the step of forming The new key package is a group session key for encryption and individual ephemeral private keys for signing messages with the subsequent stages of implementing and terminating communication in accordance with steps 2-5.

At the stage of initiating communication, one of the subscribers is searched for and obtains the IP addresses of other subscribers on the Internet using an IP address using the server tracker or using the DHT protocol; the authentication procedure by generating a group session encryption key and ephemeral private keys for signing messages for this communication is carried out in accordance with the IDSKE protocol; the connection between the subscribers of the group is established directly or through the use of a centralized server.

At the stage of direct communication, synchronization of messages in the order of their sequence is carried out using the OldBlue protocol; The reconciliation of the new group key using the procedure for the automatic promotion of key material is carried out through the use of the Burmester-Desmedt protocol.

At the stage of completion of communication, the removal of a group session key for encrypting messages at the end of communication is performed by removing the key from the subscriber’s memory and overwriting it as a sequence of zeros.

Brief Description of the Drawings

The invention is illustrated by drawings.

FIG. 1 illustrates the operation of the authentication procedure. Each participant performs the procedure described in the diagram, interrupting it in case of an error.

FIG. 2 illustrates a user connection scheme in the case of a distributed hash table (DHT). Users send messages to each other directly, the connection occurs using some DHT algorithm.

FIG. 3 illustrates a user connection scheme in the case of using a server tracker to establish a primary connection between users.

FIG. 4-7 illustrate the operation of the OldBlue protocol, which ensures causal consistency in data transfer. OldBlue describes the basic procedures for consistent messaging: sending, requesting a lost message, processing a request to receive a lost message.

FIG. 8 illustrates the completion phase of a cryptographic protocol. Due to the publication of ephemeral private keys for signing messages in this phase, failure is ensured.

The implementation of the invention

A computer-implemented method for implementing grouped secure communications with failover properties and perfect forward secrecy consists of initiating communication, direct communication and its completion, and can be implemented by subscribers using various electronic devices - phones, tablets, smartphones, laptops, desktops, Internet of Things devices, etc. At the same time, the number of subscribers may be three or more.

The stage of initiating communication includes the initial mutual recognition of users, the generation of a group session encryption key, and ensuring the refusal of participation in communication, which can be implemented, for example, based on IDSKE Denied Group Authentication Protocol [Van Gundy M. . http://matt.singlethink.net/projects/mpotr/improved-dske. pdf. - 2013.].

Under the group session encryption key (group session key for encrypting messages) in the framework of the present invention understand the key that subscribers (users) receive during IDSKE for symmetric encryption, which is automatically promoted during the implementation of communication (protocol operation).

At the stage of direct implementation of communication, provision of secure group communication can be implemented using the promotion of a group session encryption key to provide improved properties of perfect forward secrecy based on the Burstere-Desmedt protocol [Burmester M., Desmedt Y. A secure and scalable group key exchange system // Information Processing Letters. - 2005. - T. 94. - №. 3. - C. 137-143.]. In addition, in the implementation of group communication, consistency of the transmitted messages is carried out by synchronizing the messages in order of their sequence, which can be implemented, for example, based on the OldBlue protocol [Van Gundy M.D., Chen H. OldBlue: Causal Broadcast In A Mutually Suspicious Environment (Working Draft). - 2012.].

Failure of the transmitted messages is ensured by publishing ephemeral private keys for signing messages at the end of a communication session.

Under the ephemeral private key for signing messages in the framework of the present invention understand the key that the subscriber uses to sign their messages during communication.

The inventive method can have several different versions.

Below is described the implementation of the invention on the example of three subscribers - A, B and B.

Option 1. This option describes the actions of the participants of the system (subscribers or users) A, B, and C to accomplish secure group communication with failover properties.

1. User A wants to establish a connection with users B and B. To do this, user A requests from the tracker server IP addresses of users B and C by identifiers known to user A.

2. User A establishes a direct connection with users B and C, using the IP addresses obtained in step 1.

3. When establishing a connection with participant B, participant A informs him about the need to add participant B. Participant B adds participant B.

4. User A initiates the authentication phase, sending a message to the participants B and C about its beginning.

5. Participants A, B, and C perform an authentication procedure, during which, according to the IDSKE protocol, a group session encryption key and ephemeral private keys are generated to sign messages for this communication.

6. Participants exchange encrypted instant messages. After the total number of sent messages reaches a predetermined number, for example, 100, participants A, B and C send each other their parts to carry out the promotion of key material according to the Bourmester-Desmedt protocol.

7. One of the participants initiates the end of communication by sending to the participants a message about the beginning of the completion procedure. In the course of the completion procedure, group session encryption keys are automatically erased from the device’s memory and ephemeral private keys for signing messages are published, providing the properties of perfect forward secrecy.

Option 2. This option differs from option 1 in that in step 1 the participants A and B get the IP addresses of participants B and B using the DHT protocol.

Option 3. This option differs from option 1 in that instead of a direct connection between participants using a connection using a centralized server.

Option 4. This option differs from option 1 in that in step 6 the promotion of the key material comes after 10 minutes have passed since the last generation of the group encryption key.

Option 5. This option describes the case when participants A, B and C are already in the communication phase. A development scenario is possible in which the consistency of the text of the correspondence could be broken, however, the OldBlue protocol allows displaying messages in the required order:

1. Member A sends a message to the chat, sending it to the participants B and B.

2. Participant B receives a message from participant A, it is displayed in the interface of participant B, he reads this message and sends a reply message.

3. Participant C receives a message from Participant B earlier than a message from Participant A. In this case, the message from Participant B is not displayed, because the message from Participant A has not yet been received.

4. Participant C receives a message from Participant A. Now Participant C displays messages from Participants A and B in the original order: first from Participant A, then from Participant B.

Below is an example embodiment of the invention, which demonstrates the possibility of achieving the claimed technical result and does not limit the essence presented in the independent claim.

The inventive method can be implemented using a computer program, implemented, for example, in JavaScript, and designed to operate in a web browser environment on any platform (electronic device) that supports WebRTC, including mobile. The program is placed at the address known to subscribers. For connection between subscribers, use the WebRTC browser technology [https://www.w3.org/TR/webrtc/]. Further, in the text of the description, the term "application" is used to refer to an individual instance of the program running on the subscriber device. Also, this term is also used to clarify the fact that actions that implement the claimed method (algorithm) are not performed by the subscriber (user) manually, but automatically.

Below is a description of the implementation of secure group communication between the three Internet subscribers A, B and C with a detailed description of the implementation of each of the stages - initiation, direct implementation of communication and its completion.

The initiation stage is carried out by implementing the following steps:

1. Subscribers A, B and C open in the web browser a page with the described application, where they are invited to enter their own identifier.

2. Subscribers A, B and C enter and confirm their identifiers, after which this information is sent to the tracker server to register the correspondence between the identifiers and the user. The result is an established connection between subscribers and the tracker server.

3. Subscriber A wants to add subscriber B. To do this, he presses the appropriate button in the application's graphical interface, after which the application automatically sends the information on subscriber A to the tracker server that is required to establish a direct connection via WebRTC (SDP Offer). The tracker server, in turn, forwards this information to subscriber B.

4. Subscriber B receives SDP Offer of subscriber A from the server-tracker, the application automatically sends the same information about subscriber B (SDP Answer) to the tracker server.

5. The tracker server sends SDP Answers from subscriber B to subscriber A. Then, in automatic mode, using WebRTC using the Interactive Connectivity Establishment [https://tools.ietf.org/html/rfc5245] protocol, subscribers A and B establish direct communication with each other. compound.

6. Then subscriber A repeats steps 3-5 for subscriber B, and subscriber B repeats steps 3-5 for subscriber B, as a result of which all three subscribers establish a direct connection with each other. In case the number of subscribers is more than three, steps 3-5 are performed by each of the subscribers participating in the communication. As a result, subscribers are lined up in the topology shown in FIG. 3: there are direct connections between subscribers, which are then used to exchange data between subscribers. The connection with the tracker server is used exclusively for establishing a direct connection and is not involved in the transfer of subscriber data.

7. Subscriber A, using the graphical interface of the application, initiates the beginning of the authentication procedure. At the same time, the application sends a message about the beginning of authentication to subscribers B and C, followed by all subscribers conducting the IDSKE protocol authentication procedure (Fig. 1), during which participants generate a group session encryption key and ephemeral private keys for signing messages. As a type of message encryption algorithm, the application uses the AES-128 symmetric cipher [https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.197.pdf] with a group encryption session key. To sign subscriber messages, the application uses the RSA algorithm with a key size of 2048 bits [Rivest R.L., Shamir A., Adleman L.] Communications of the ACM, method of learning digital signatures and public-key cryptosystems. - 1978. - V. 21. - No. 2. - C. 120-126.], As an RSA key, the application uses the ephemeral private key to sign messages.

Further, the communication of subscribers is carried out through the implementation of the following steps:

8. Sending messages between subscribers. If you want to send a message, the subscriber dials its text in the user interface and confirms the sending. Further, the application sends messages to other subscribers by group broadcasting using direct connections established at the initiation stage. It uses the procedures of the OldBlue algorithm for sending and receiving messages (Fig. 4 - actions when receiving a message, Fig. 7 - actions when sending a message), ensuring synchronization of the order of messages with ensuring causal consistency. Messages that, according to OldBlue, will be marked as delivered will be displayed in the user interface.

9. Sending requests for lost messages. If the application of subscriber A detects that one of the messages was not received by him, then it automatically requests this message from subscribers B and C by sending them a request to forward the lost message. The sequence of actions of subscriber A is shown in FIG. 5. Upon receipt of this request, applications B and C automatically search for the requested message and, if there is one, send it to subscriber A (Fig. 6).

10. Upon reaching a specified number of messages (in particular, the implementation uses a 100 message constant), the application of one of the subscribers (anyone, even subscriber A) initiates the key promotion procedure in order to update the group session encryption key according to the Bourmester-Desmedt protocol. Subscriber A application sends its part of the key to subscribers B and C, subscriber B to subscribers A and B, and subscriber B to subscribers A and B. Then applications of all subscribers calculate intermediate values to form the key by mixing their part and the subscriber's left and subscriber's right. When determining the order, the subscriber A will consider the subscriber on the left of subscriber B, and the subscriber on the right B; for subscriber B, subscriber A is on the left, subscriber B is on the right; for subscriber B, subscriber B is on the left, subscriber A is on the right. After receiving intermediate values, each application generates a new session group encryption key, which is the same for all subscribers, which allows for improved properties of perfect forward secrecy. The distribution of messages and the processing of loss of the application message are carried out in accordance with paragraphs. 8-9.

Finally, the communication completion phase is carried out by implementing the following steps:

11. Subscriber A wishes to complete communication. For this, he uses the corresponding element of the user interface of the application, after which the application sends a message to subscribers B and C about the beginning of the session termination procedure. Upon receiving this message, subscriber B's application sends a similar message to subscribers A and B, and subscriber B's application to subscribers A and B. Upon receiving messages about the beginning of the session termination procedure from all other subscribers, the application automatically sends the rest of its own ephemeral private key to sign messages of its subscriber to unencrypted to ensure communication failure and removes the group session encryption key from memory to ensure perfect forward secrecy (Fig. 8). The distribution of messages and the processing of loss of the application message are carried out in accordance with paragraphs. 8-9.

12. After the completion of the communication, subscribers transfer their applications to the standby mode, or take steps from paragraph 1 to add other subscribers, if necessary, or from paragraph 7, if the subscribers want to communicate with the current list of participants.

Thus, the claimed method provides improved failure properties (English deniability, also repudiation) with group communication and perfect forward secrecy (Perfect Forward Secrecy), incl. by using the Denied Signature Key Exchange (IDSKE) Denied Group Authentication Protocol in conjunction with the Bourmester-Desmedt protocol, while synchronizing the order of messages to ensure causal consistency. In addition, the use of decentralized data transmission allows you to minimize the use of intermediate servers in the communication process, eliminating the possible risk of their compromise.

Claims (15)

1. A computer-implemented method of secure group communication between three or more Internet subscribers using electronic devices, including the steps of initiating communication, direct implementation of communication and its completion, where at the stage of initiating communication, carry out: 1) search and receive one of the subscribers IP addresses of the other subscribers involved in communication on the Internet using known identifiers and then establishing pairwise connections between all subscribers; 2) sending by one of the subscribers a message to the rest of the subscribers about the beginning of authentication followed by all subscribers conducting an authentication procedure with the formation of a key package, including a group session key for encrypting messages and individual ephemeral private keys of subscribers for signing messages, at the stage of direct communication: 3) implement communication between all subscribers by exchanging messages using a group key and individual keys, while in the process of exchanging messages they ensure synchronization of messages in the order in which they follow, ensuring causal consistency, 4) and upon reaching a specified number of messages, initiate a change of the group key with the approval of a new group key using the procedure for automatically promoting key material; at the stage of completion of communication 5) exit of one of the subscribers from the group in the process of communication is carried out by sending a message to the other subscribers about the beginning of the session termination procedure, after which each subscriber device sends to the other subscriber devices of the group its own ephemeral private key to sign messages in an unencrypted form and delete from each device a group session key to encrypt messages; the remaining members of the group repeat the step of forming a new key package - group session and ndividualnyh ephemeral private key for signing messages with the subsequent phases of implementation and completion of communication according to steps 2-5. 2. The method according to claim 1, characterized in that at the stage of initiating communication, searching and receiving one of the subscribers IP addresses of other subscribers on the Internet is performed using the server tracker IP address or using the DHT protocol. 3. The method according to claim 1, characterized in that at the stage of initiating communication, the authentication procedure by forming a group session encryption key and ephemeral private keys for signing messages for this communication is carried out in accordance with the IDSKE protocol. 4. The method according to claim 1, characterized in that at the stage of initiating communication, the connection between the subscribers of the group is established directly or by using a centralized server. 5. The method according to p. 1, characterized in that the synchronization of messages in the order they are carried out using the OldBlue protocol. 6. The method according to claim 1, characterized in that the negotiation of a new group key using the procedure for the automatic promotion of key material is carried out using the Bourmester-Desmedt protocol. 7. A method according to claim 1, characterized in that deleting a group session key for encrypting messages at the end of communication is performed by removing the key from the subscriber’s memory and rewriting it as a sequence of zeros.

Images