WO2014196850A1

WO2014196850A1 - Non-repudiable log entries for file retrieval with semi-trusted server

Info

Publication number: WO2014196850A1
Application number: PCT/MY2014/000068
Authority: WO
Inventors: Moesfa Soeheila MOHAMAD; Geong Sen POH
Original assignee: Mimos Bhd
Current assignee: Mimos Bhd
Priority date: 2013-06-05
Filing date: 2014-04-22
Publication date: 2014-12-11
Anticipated expiration: 2015-12-05
Also published as: MY166590A

Abstract

Non-repudiable log entries for file retrieval with semi-trusted server is provided by coercing user to digitally sign the log entry on the event that the user retrieves a file from the server which prevents user or server from independently forging or modifying a log entry. The system (100) comprising a user interface module (102a), a server interface module (104a), an asymmetric encryption module (102c), a symmetric encryption module (102e), a digital signature module (102b), a combiner module (102d), a registration module (104d) and a log file (104g). The asymmetric encryption module (102c) exploits key dualities properties by encrypting messages using public key and combined public key; and decrypting messages using decryption key which includes one signature or a combination of signatures. The method of file retrieval is constructed such that the user must submit the first signature to the server; the user must sign the correct log entry recording the file retrieval. Further, when the server combines the first signature with its own signature, the combination forms only part of the decryption key. The decryption key can be completed only by using the user's second signing key whereby the server cannot decrypt the file at any time. The method of protection of the present invention lies in the combination of server's and user's digital signatures on every log entry to protect against recipient or user who denies from retrieving a file.

Description

NON-REPUDIABLE LOG ENTRIES FOR FILE RETRIEVAL WITH SEMI-TRUSTED

SERVER

FIELD OF INVENTION

The present invention relates to a system and method for non-repudiable log entries for file retrieval with a semi-trusted server. In particular, the invention relates to systems and methods that exploit key dualities properties wherein users are required to digitally sign the log entry on the event that the user retrieves a file from the server which prevents user or server from independently modifying a log entry.

BACKGROUND ART

Current log files in any systems protect its integrity only and not from non-repudiation by users involved in the logged event. For file systems, the log files or audit trail mainly focus on non-repudiation of authorship of documents and integrity of documents. Log files or audit trail may be modified by the server or other adversaries in the server. A user who has retrieved a file may deny the fact. There are existing mechanisms which protects log files against modification or record deletion. However, existing mechanism does not include signature of user in an event of user retrieving a document. Therefore, any attacker with access to the server may add a forge entry into the system.

One example of protection of audit trail of document creation and changes was proposed in United States Patent Publication No. US 2005/0086472 A1 hereby denoted as the US 472 Publication, which provides a method and apparatus for verifying transactions specifically for verifying electronic transactions. The US 472 Publication provides protection for non-repudiation by author and integrity of document as compared to the present invention which provides protection against recipient or user who denies from retrieving a file. Protection of log entry is based on hash of documents which contains digital signature of author appended with timestamp. In contrast, the method of protection as provided in the present invention is based on combination of server's and user's digital signatures on every log entry to protect against recipient or user who denies from retrieving a file. Another mechanism was proposed in United States Patent Publication No. US 2005/0234909 A1, hereby denoted as US 909 Publication. It relates generally to data processing system and in particular to a data processing system and method for generating source verifiable audit logs. The US 909 Publication provides a processing routine for logging a sequence of audit records in a plurality of log files as a source verifiable contiguous sequence of audit records. Method of protection is provided by calculating a respective first hash value of each audit record, second hash value is calculated from the first hash value and a value of a register associated with the data processing system as compared to the present invention wherein method of protection is based on combination of server's and user's digital signatures on every log entry to protect against recipient or user who denies from retrieving a file.

A general scheme that allows keeping an audit log on an insecure machine to ensure that log entries are protected even if the machine is compromised was proposed in an IEEE paper entitled "Cryptographic Support for Secure Logs on Untrusted Machines" authored by Bruce Schneier and John Kelsey. In the said paper, protection for log file is provided wherein all log entries generated prior to the logging machine's compromise is made impossible for the attacker to read and also impossible to undetectably modify or destroy. In brief, the said paper provides protection by hash chain wherein the log's authentication key is hashed using a one-way hash function, immediately after a log entry is written as compared to the present invention wherein method of protection is based on combination of server's and user's digital signatures on every log entry to protect against recipient or user who denies from retrieving a file. The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that operate only in environments such as those described above. Rather, this background is only provided to illustrate one exemplary technology area where some embodiments described herein may be practice. SUMMARY OF INVENTION

The present invention relates to a system and method for non-repudiable log entries for file retrieval with a semi-trusted server wherein users are required to digitally sign the log entry on the event that the user retrieves a file from the server which prevents user or server from independently modifying a log entry.

One aspect of the present invention provides a system (100) for non-repudiable log entries for file retrieval with a semi-trusted server. The system comprising at least one user interface module (102a) for sending request and interacting with at least one server interface (104a); at least one server interface module (104a) for receiving request and interacting with at least one user interface; at least one asymmetric encryption module (102c) for exploiting key dualities properties; at least one symmetric encryption module (102e) for encrypting message and decrypting encrypted message; at least one digital signature module (102b) for digitally signing message using signing key and verifying signature using public key and verifying combined signature using combined public key; at least one combiner module (102d) for combining any number of public keys and any number of signatures; at least one registration module (104d) for registering user with server; and at least one log file (104g) for recording log entries. The asymmetric encryption module (102c) further having means for encrypting messages using public key and combined public key; and decrypting messages using decryption key which includes at least one signature or a combination of signatures.

Another aspect of the invention provides a method (200) for non-repudiable log entries for file retrieval with a semi-trusted server. The method comprising steps of registering at least one user with at least one server (202); storing at least one file at server side (204); and retrieving at least one file at server side (206) wherein combination of public keys verifies combined signatures and combined signature is construed as decryption key for any message encrypted with combined public keys.The method for storing and retrieving at least one file at server side further comprises forming log entry by recording request message and combined signature at server's log.

In another aspect of the invention there is provided the step for registering at least one user with at least one server which further comprises steps of forwarding user's identifier, public key of user's first key pair and combination of user's at least two public keys to said server (202a); and storing user's identifier, public key of user's first key pair and combination of user's at least two public keys with server for signature verification and file encryption (202b).

In yet another aspect of the invention is the step for storing at least one file at server. The said step further comprises steps of creating at least one request message (302); signing said request message by the user using user's first signing key and forwarding user's signature and said request message to server side (306); verifying user's signature at server side (314); signing said request message using server's signing key to produce server's signature upon successful verification of user's signature and combining user's signature with server's signature (316); forming log entry by recording said request message and combined signature at server's log (318); generating first encryption key by combining server's public key and recipient's combined public key (320); forwarding said first encryption key from server to user (322); generating second encryption key by user and encrypting said second encryption key using first encryption key (308); encrypting said file using second encryption key (310); and forwarding said encrypted file and said encrypted key for storage at server side (312, 324). In a further aspect of the invention there is provided that the request message consist of at least one user identifier, at least one recipient identifier, file name, file digest and timestamp.

In still another aspect of the invention there is provided with the step for retrieving at least one file at server. The said step further comprises creating at least one request message (402); signing said request message by the user using user's first signing key to obtain user's first signature (402) and forwarding user's first signature and said request message to server side (406); verifying user's first signature at server side using user's first public key (408); signing said request message using server's signing key to produce server's signature upon successful verification of user's signature (410) and combining user's first signature with server's signature to produce first signature combination (412); forming log entry by recording said request message and first signature combination at server's log (414); extracting from storage at server side requested encrypted file and encrypted symmetric key (416); forwarding encrypted file, encrypted symmetric key, file digest and first signature combination from server to user (418); signing said request message by user using user's second signing key upon successful verification of first signature combination received from server by user to obtain user's second signature (420); combining first signature combination and user's second signature to produce second signature combination (422); combining server public key with user's first public key and user's second public key to produce common public key (424); obtaining symmetric key by decrypting encrypted key using second signature combination and common public key (426); decrypting encrypted file to view file using said symmetric key (428); and verifying decrypted file against file digest (430).

In a further aspect of the invention there is provided with the step for forming log entry by recording said request message and signature combination in server's log. The said step further comprises creating at least one request message by user, said request message consisting at least one user identifier, event parameters and timestamp (502); signing said request message by user to obtain user's signature (504); forwarding said request message and user's signature from user to server (506); verifying user's signature by server and signing said request message by server to produce server's signature (508); combining user's signature with server's signature to produce combined signature (510); and recording said request message and combined signature in log file (512).

In another aspect of the invention there is provided with the step that forming log entry by recording said request message and signature combination in server's log further comprising the step of verifying log entry. The step of verifying log entry further comprises steps of parsing log entry into message stream and signature stream (602); combining user public key and server public key (604); and verifying signature against message and combined public key to obtain result of log entry verification (606).

The present invention consists of features and a combination of parts hereinafter fully described and illustrated in the accompanying drawings, it being understood that various changes in the details may be made without departing from the scope of the invention or sacrificing any of the advantages of the present invention. BRIEF DESCRIPTION OF ACCOMPANYING DRAWINGS

To further clarify various aspects of some embodiments of the present invention, a more particular description of the invention will be rendered by references to specific embodiments thereof, which are illustrated in the appended drawings. It is appreciated that these drawings depict only typical embodiments of the invention and are therefore not to be considered limiting of its scope. The invention will be described and explained with additional specificity and detail through the accompanying drawings in which: FIG. 1.0 illustrates the architecture of the present invention.

FIG. 2.0 illustrates the overview of the present invention.

FIG. 3.0 is a flowchart illustrating the methodology of storing at least one file at server side of the present invention.

FIG. 4.0 is a flowchart illustrating the methodology of retrieving at least one file at server side of the present invention. FIG. 5.0 is a flowchart illustrating the methodology of forming log entry by recording said request message and signature combination in server's log of the present invention.

FIG. 6.0 is a flowchart illustrating the methodology of verifying log entry of the present invention.

FIG. 7.0 is a protocol diagram on setup of the present invention.

FIG. 8.0 is a protocol diagram on registration of user to the server in accordance to present invention.

FIG. 9.0 is a protocol diagram for storing at least one file at server. FIG. 10.0 is a protocol diagram for retrieving at least one file at server. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Hereinafter, this specification will describe the present invention according to the preferred embodiments. It is to be understood that limiting the description to the preferred embodiments of the invention is merely to facilitate discussion of the present invention and it is envisioned without departing from the scope of the appended claims.

Referring to FIG. 1.0, the system (100) according to the present invention is illustrated. The system (100) comprising a user interface module (102a), a server interface module (104a), an asymmetric encryption module (102c), a symmetric encryption module (102e), a digital signature module (102b), a combiner module (102d), a registration module (104d) and a log file (104g). The user interface module (102a) sends request and interacts with server interface (104a) while the server interface module (104a) receives request and interacts with the user interface. Further, the asymmetric encryption module (102c) exploits key dualities properties by encrypting messages using public key and combined public key; and decrypting messages using decryption key which includes one signature or a combination of signatures. The symmetric encryption module (102e) encrypts message and decrypts encrypted message while the digital signature module (102b) digitally signs message using signing key and verifies signature using public key and further verifies combined signature using combined public key. The combiner module (102d) combines any number of public keys and any number of signatures while the registration module (104d) registers user with server and the log file (104g) records log entries.

Referring to FIGs. 2.0, 7.0 and 8.0, the overview of the present invention which includes the setup of the system and user registration is described. The core-enabler of the present invention is an asymmetric scheme which exploits the key-duality properties wherein a combination of corresponding public keys successfully verifies the combined signatures in a combination of valid signatures over the same string. The combined signature and the string is part of the decryption key for any message encrypted with the combined public keys. The present invention implements aggregatable signature-based broadcast (ASBB) encryption scheme wherein the cryptosystem consists of six algorithms, namely system parameter generation, users' key generation, signing, verifying, encrypt and decrypt algorithms. Every user has its own identity; the user identifier (ID_U), two pairs of keys; each pair consisting of a signing key and a public key ((sk1_u, pk1_u), (sk1_u, pk2_u). The server must have a pair of keys, a signing key and a public key (sk_s, pk_s). The interaction between a user and the server is through an authenticated channel. In the protocol diagrams of the present invention, the user and server shares a common key used as the Message Authentication Code (MAC) key for messages transmitted between user and server.

The methodology of the present invention comprising steps of registering a user with a server (202); storing a file at server side (204); and retrieving a file at server side (206) wherein combination of public keys verifies combined signatures and combined signature is construed as decryption key for any message encrypted with combined public keys. As illustrated in the protocol diagram of FIG. 8.0, a user is registered with a server by forwarding user's identifier (1D_U), public key of user's first key pair (pklj and combination of user's at least two public keys (pk_u =pk1_u + pk2_u) to said server (202a). Thereafter, the server stores the said user's identifier (ID_U), public key of user's first key pair (pk1_u) and combination of user's at least two public keys (pk_u =pk1_u + pk2_u) with server for signature verification and file encryption (202b). Further, the method for storing and retrieving a file at server side further comprises forming log entry by recording said request message and combined signature at server's log.

A more detailed description of file storing is illustrated in FIGs. 3.0 and 9.0. Storing of a file at a server side begins when a user creates a request message (302). The user contacts the server for authentication and upon authentication by the server, the user forwards the identifiers of users authorized to view the file and the filename to the server. The file request message consists of at least one user identifier, at least one recipient identifier, file name, file digest and timestamp. The user first signs the request message using user's first signing key (sk1_u) and forwards user's signature and said request message to server side (306). Upon successful verification of user's signature at server side (314), the server signs said request message using server's signing key (sk_s) to produce server's signature. Thereafter, user's signature is combined with server's signature (316). The file request message and the combined signature forms the log entry by recording said request message and combined signature at server's log (318). A first encryption key is generated by combining server's public key (pk_s) and recipient's combined public key (pk_r) (320). The server replies to the user by forwarding said first encryption key from the server to the user (322). Further, a second encryption key is generated by the user and the second encryption key is encrypted using the first encryption key (308). The file is encrypted using the second encryption key (310); and said encrypted file and encrypted key is forwarded for storage at the server side (312, 324).

The methodology for retrieval of a file is described in detail in FIGs. 4.0 and 10.0. Retrieval of file by a user begins by creating a request message (402) by the user. The request message is formed to contain the user identifier, filename and timestamp and the said request message is signed by the user using user's first signing key (sk1_u) to obtain user's first signature (402) and user's first signature and said request message is forwarded to server side (406). User's first signature is verified at the server side using user's first public key (pku^ (408) and said request message is signed using server's signing key (sk_s) to produce server's signature upon successful verification of user's signature (410). The user's first signature is combined with server's signature to produce first signature combination (412). Log entry is formed by recording said request message and first signature combination at server's log (414). The requested encrypted file and encrypted symmetric key (416) is extracted from storage at the server side and said encrypted file, encrypted symmetric key, file digest and first signature combination is accordingly forwarded from the server to the user (418).

The user signs the said request message using user's second signing key (sku₂) upon successful verification of first signature combination received from server to obtain user's second signature (420). Upon obtaining user's second signature, the first signature combination and user's second signature is combined to produce second signature combination (422). Thereafter, server public key (pk_s) is combined with user's first public key (pku and user's second public key (pku₂) to produce common public key (424). Further, a symmetric key is obtained by decrypting encrypted key using second signature combination and common public key (426). The encrypted file is decrypted using said symmetric key (428) for the user can view the requested file and thereafter said decrypted file is verified against file digest (430). Another required protection on log files is the mechanism to protect its integrity. The formation of log entry during the file storing phase and the file retrieval phase is further described in FIGs. 5.0 and 6.0 respectively. A request message is created by the user, wherein said request message consist of a user identifier, event parameters and timestamp (502). The said request message is signed by the user to obtain user's signature (504) and the said request message and user's signature is forwarded from the user to the server (506). Thereafter, the user's signature is verified by the server and said request message is signed by the server to produce the server's signature (508). The user's signature is combined with the server's signature to produce a combined signature (510) and said request message and combined signature is recorded in a log file (512). The log entry is verified by parsing the log entry into message stream and signature stream (602). Thereafter, the user public key (pk_u) is combined with the server public key (pk_s) (604) and signature is verified against the message and combined public key to obtain the result of log entry verification (606). The result of log entry verification is the result of signature verification.

The present invention addresses a secure file storage system, where stored files are encrypted. Documents are encrypted by combination of public keys, specifically public keys of server and users. The decryption key is the combination of the server's signature and two user's signatures on the log entry which contains the user's identifier, the name of the file being retrieved and, the correct date and time (i.e. the timestamp) of retrieval request. The method of retrieval is constructed such that the user must submit the first signature to the server; the user must sign the correct log entry recording the file retrieval. Further, when the server combines the first signature with its own signature, the combination form only part of the decryption key. The decryption key can be completed only by using the user's second signing key whereby the server cannot decrypt the file at any time. The method of protection of the present invention lies in the combination of server's and user's digital signatures on every log entry to protect against recipient or user who denies from retrieving a file. Unless the context requires otherwise or specifically stated to the contrary, integers, steps or elements of the invention recited herein as singular integers, steps or elements clearly encompass both singular and plural forms of the recited integers, steps or elements.

Throughout this specification, unless the context requires otherwise, the word "comprise", or variations such as "comprises" or "comprising", will be understood to imply the inclusion of a stated step or element or integer or group of steps or elements or integers, but not the exclusion of any other step or element or integer or group of steps, elements or integers. Thus, in the context of this specification, the term "comprising" is used in an inclusive sense and thus should be understood as meaning "including principally, but not necessarily solely".

It will be appreciated that the foregoing description has been given by way of illustrative example of the invention and that all such modifications and variations thereto as would be apparent to persons of skill in the art are deemed to fall within the broad scope and ambit of the invention as herein set forth.

Claims

1. A system (100) for non-repudiable log entries for file retrieval with a semi-trusted server comprising:

at least one user interface module (102a) for sending request and interacting with at least one server interface (104a);

at least one server interface module (104a) for receiving request and interacting with at least one user interface;

at least one asymmetric encryption module (102c);

at least one symmetric encryption module (102e) for encrypting message and decrypting encrypted message;

at least one digital signature module (102b) for digitally signing message using signing key and verifying signature using public key and verifying combined signature using combined public key;

at least one combiner module (102d) for combining any number of public keys and any number of signatures;

at least one registration module (104d) for registering user with server; and

at least one log file (104g) for recording log entries

characterized in that

the asymmetric encryption module (102c) having means for exploiting key dualities properties by:

encrypting messages using public key and combined public key; and

decrypting messages using decryption key which includes at least one signature or a combination of signatures.

2. A method (200) for non-repudiable log entries for file retrieval with a semi-trusted server comprising steps of:

registering at least one user with at least one server (202); storing at least one file at server side (204); and

retrieving at least one file at server side (206)

characterized in that retrieving at least one file at server side wherein combination of public keys verifies combined signatures and combined signature is construed as decryption key for any message encrypted with combined public keys.

A method (200) according to Claim 2, wherein storing (204) and retrieving (206) at least one file at server side further comprises forming log entry by recording request message and combined signature at server's log.

A method (200) according to Claim 2, wherein registering at least one user with at least one server (202) further comprises steps of:

forwarding user's identifier, public key of user's first key pair and combination of user's at least two public keys to said server (202a); and storing user's identifier, public key of user's first key pair and combination of user's at least two public keys with server for signature verification and file encryption (202b).

A method (300) according to Claim 2, wherein storing at least one file at server side (204) further comprises steps of:

creating at least one request message (302);

signing said request message by the user using user's first signing key and forwarding user's signature and said request message to server side (306);

verifying user's signature at server side (314);

signing said request message using server's signing key to produce server's signature upon successful verification of user's signature and combining user's signature with server's signature (316);

forming log entry by recording said request message and combined signature at server's log (318);

generating first encryption key by combining server's public key and recipient's combined public key (320);

forwarding said first encryption key from server to user (322);

generating second encryption key by user and encrypting said second encryption key using first encryption key (308);

encrypting said file using second encryption key (310); and forwarding said encrypted file and said encrypted key for storage at server side (312, 324).

A method according to Claim 4, wherein said request message consist of at least one user identifier, at least one recipient identifier, file name, file digest and timestamp.

A method (400) according to Claim 2, wherein retrieving at least one file at server side (206) further comprises steps of:

creating at least one request message (402);

signing said request message by the user using user's first signing key to obtain user's first signature (404) and forwarding user's first signature and said request message to server side (406);

verifying user's first signature at server side using user's first public key (408);

signing said request message using server's signing key to produce server's signature upon successful verification of user's signature (410) and combining user's first signature with server's signature to produce first signature combination (412);

forming log entry by recording said request message and first signature combination at server's log (414);

extracting from storage at server side requested encrypted file and encrypted symmetric key (416);

forwarding encrypted file, encrypted symmetric key, file digest and first signature combination from server to user (418);

signing said request message by user using user's second signing key upon successful verification of first signature combination received from server by user to obtain user's second signature (420);

combining first signature combination and user's second signature to produce second signature combination (422);

combining server public key with user's first public key and user's second public key to produce combined public key (424);

obtaining symmetric key by decrypting encrypted key using second signature combination and combined public key (426); decrypting encrypted file to view file using said symmetric key (428);and verifying decrypted file against file digest (430).

8. A method according to Claim 6, wherein said request message consist of at least one user identifier, filename and timestamp.

9. A method (500) according to Claim 3, wherein forming log entry by recording said request message and combined signature at server's log further comprises steps of:

creating at least one request message by user, said request message consisting at least one user identifier, event parameters and timestamp (502);

signing said request message by user to obtain user's signature (504); forwarding said request message and user's signature from user to server (506);

verifying user's signature by server and signing said request message by server to produce server's signature (508);

combining user's signature with server's signature to produce combined signature (510); and

recording said request message and combined signature in log file (512).

10. A method (600) according to Claim 3, wherein forming log entry by recording said request message and combined signature at server's log further comprising step of verifying log entry which further comprises steps of:

parsing log entry into message stream and signature stream (602);

combining user public key and server public key (604); and

verifying signature against message and combined public key to obtain result of log entry verification (606).

11. A method according to Claim 10, wherein said result of log entry verification is the result of signature verification.