WO2019210706A1

WO2019210706A1 - Systems, devices, and methods for hybrid secret sharing

Info

Publication number: WO2019210706A1
Application number: PCT/CN2019/070689
Authority: WO
Inventors: Amirhossein VAKILI; Yin TAN
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2018-05-01
Filing date: 2019-01-07
Publication date: 2019-11-07
Also published as: US11063754B2; CN111448779A; EP3692682A1; US20190342080A1; CN111448779B; EP3692682A4

Abstract

Systems, devices, and methods for hybrid secret sharing are disclosed. In accordance with embodiments, a computing device may encrypt the secret message using a first encryption key to generate an encrypted secret message. The computing device may also split a second encryption key into a plurality of key shares in accordance with a threshold number. The threshold number is less than or equal to the number of the plurality of key shares. Then, the computing device may transmit a plurality of messages. Each message of the plurality of messages comprises the encrypted secret message and one of the plurality of key shares.

Description

Systems, Devices, and Methods for Hybrid Secret Sharing

CROSS REFERENCE TO RELATED APPLICATIONS

This patent application claims priority to U.S. Patent Application No. 15/968,430 filed on May 1, 2018 and entitled “Systems, Devices, and Methods for Hybrid Secret Sharing” , which is incorporated by reference herein as if reproduced in its entirety.

TECHNICAL FIELD

The present disclosure relates generally to cryptography, and in particular embodiments, to techniques and mechanism for systems, devices, and methods for secret sharing of confidential information.

BACKGROUND

Secret sharing (also called secret splitting) refers to an approach for splitting and distributing a secret message amongst a group of participants. Each of the participants is allocated a share of the secret message. The secret message can be reconstructed only when a sufficient number of shares are combined together. Each individual share is of no use on its own for reconstruction of the secret.

In secret sharing, given a secret message (S) , a number of needed shares (N) , and a threshold number (T) , the secret message (S) is split into N shares. The original secret message can be reconstructed from any T number of different shares. Less than the T number of shares does not allow one to gain access to the secret message S. For example, a secret password might be split into three shares (N=3) with a threshold number of two (T=2) . The three shares may be distributed among 3 administrators, and each administrator has a different share. Since the threshold number is 2, no single administrator can reconstruct the secret password. At least two administrators are needed to reconstruct the original password from two respective shares distributed to these two administrators.

SUMMARY OF THE INVENTION

Technical advantages are generally achieved by embodiments of this disclosure which describe systems, devices, and methods for hybrid secret sharing of confidential information.

In accordance with an aspect of the present invention, methods for encrypting a secret message are disclosed. A computing device may encrypt the secret message using a first encryption key to generate an encrypted secret message. The computing device may also split a second encryption key into a plurality of key shares in accordance with a threshold number. The threshold number is less than or equal to the number of the plurality of key shares. Then, the computing device may transmit a plurality of messages. Each message of the transmitted plurality of messages comprises the encrypted secret message and one of the plurality of key shares.

In accordance with any preceding aspect of the present invention, at least the threshold number of the plurality of key shares are required to reconstruct the second encryption key.

In accordance with any preceding aspect of the present invention, the first encryption key is a symmetric encryption key, and the second encryption key is identical to the first encryption key.

In accordance with the preceding aspect of the present invention, the computing device encrypts the secret message using an authenticated encryption algorithm and the first encryption key to generate the encrypted secret message.

In accordance with the preceding aspect of the present invention, the authenticated encryption algorithm is an Advanced Encryption Standard with a Galois/Counter Mode (AES-GCM) encryption algorithm or an Advance Encryption Standard with CBC-MAC Mode (AES-CCM) encryption algorithm.

In accordance with any preceding aspect of the present invention, the first encryption key is a public key of a key pair for asymmetric encryption, and the second encryption key is a private key of the key pair.

In accordance with the preceding aspect of the present invention, the method further comprises: generating, by the computing device, a second key pair comprising a second private key and a second public key; and for each respective message of the plurality of messages: generating, by the computing device, a digital signature using the second private key of the second key pair; and including, by the computing device, the generated digital signature in the respective message for authenticating the respective message.

In accordance with any preceding aspect of the present invention, the splitting comprises splitting the second encryption key, using a Shamir secret sharing scheme splitting function, into the plurality of key shares.

In accordance with any preceding aspect of the present invention, the secret message is generated in a secure memory of the computing device.

In accordance another aspect of the present invention, methods for decrypting an encrypted secret message are disclosed. A computing device may receive a plurality of messages. Each message of the received plurality of messages comprises the encrypted secret message and a different key share of a plurality of key shares. The computing device may determine that at least a threshold number of different key shares required to reconstruct an encryption key are received. Afterwards, the computing device may combine the different key share in each message of the received plurality of messages to reconstruct an encryption key. Then, the computing device decrypt the encrypted secret message using the reconstructed encryption key to generate the secret message.

In accordance with any preceding aspect of the present invention, the method for decrypting an encrypted secret message further comprises, prior to the decrypting, authenticating each message of the received plurality of messages.

In accordance with the preceding aspect of the present invention, the authenticating comprises: for each message of the received plurality of messages, reporting, by the computing device, tampering of the received plurality of messages when at least one of the received plurality of messages is not authenticated.

In accordance with the preceding aspect of the present invention, the authenticating comprises: for each message of the received plurality of messages, reporting, by the computing device, tampering of the received plurality of messages when a digital signature included in at least one of the received plurality of messages is not authenticated.

In accordance with any preceding aspect of the present invention, the reconstructed encryption key is a symmetric encryption key for encrypting the secret message using an authenticated encryption algorithm.

In accordance with the preceding aspects of the present invention, the method decrypting an encrypted secret message further comprises detecting tampering based on a result of the decrypting of the encrypted secret message.

In accordance with any of the preceding aspects of the present invention, the decrypting comprises decrypting the encrypted secret message using the reconstructed encryption key and one of an Advanced Encryption Standard with a Galois/Counter Mode (AES-GCM) decryption algorithm or an Advance Encryption Standard with CBC-MAC Mode (AES-CCM) decryption algorithm to generate the secret message.

In accordance with any of the preceding aspects of the present invention, the reconstructed encryption key is a private key of a key pair for asymmetric encryption, and the key pair comprises the private key and a public key.

In accordance with any of the preceding aspects of the present invention, the combining comprises combining, using a Shamir secret sharing scheme combining function, the different key share in each of the plurality of messages to generate the encryption key.

Computing devices, as well as computer program products, for performing the methods are also provided.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of the present invention, and the advantages thereof, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

FIG. 1 is a diagram of a conventional secret sharing technique;

FIG. 2 is a diagram of a hybrid secret sharing technique, according to some embodiments;

FIG. 3 is a diagram of a hybrid secret sharing technique to reconstruct a secret message, according to some embodiments;

FIG. 4 is a flowchart of a method for an encryption computing device to perform hybrid secret sharing of a secret message, according to some embodiments;

FIG. 5 is a flowchart of a method for a decryption computing device to perform hybrid secret sharing and reconstruct an encrypted secret message, according to some embodiments;

FIG. 6 is a flowchart of a method for a decryption computing device to detect message tampering, according to some embodiments;

FIG. 7 is a graph illustrating how the performance of one embodiment implementation of hybrid secret sharing is compared to the performance of a conventional approach of splitting the secret message using the Shamir secret sharing scheme;

FIG. 8 is a diagram of an embodiment processing system; and

Corresponding numerals and symbols in the different figures generally refer to corresponding parts unless otherwise indicated. The figures are drawn to clearly illustrate the relevant aspects of the embodiments and are not necessarily drawn to scale.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

The making and using of embodiments of this disclosure are discussed in detail below. It should be appreciated, however, that the present invention provides many applicable inventive concepts that can be embodied in a wide variety of specific contexts. The specific embodiments discussed are merely illustrative of specific ways to make and use the invention, and do not limit the scope of the invention. These and other inventive aspects are described in greater detail below.

The operating of the current example embodiments and the structure thereof are discussed in detail below. It should be appreciated, however, that the present disclosure provides many applicable inventive concepts that can be embodied in a wide variety of specific contexts. The specific embodiments discussed are merely illustrative of specific structures of the embodiments and ways to operate the embodiments disclosed herein, and do not limit the scope of the disclosure.

Secret sharing is ideal for storing confidential information that is highly sensitive and highly important. Examples of confidential information include confidential documents, encryption keys, missile launch codes, and bank account numbers. Each of these pieces of information must be kept highly confidential, as their exposure could be disastrous. Also, it is critical that these pieces of information should not be lost. Conventional secret sharing splits a secret message (S) into an N number of needed shares, with a threshold number (T) and distributing one or more shares of the secret message to a different participant’s computing device for storage thereon. The threshold number (T) is the minimum number of different shares required to reconstruct the original secret message. On the other hand, less than the threshold number (T) of shares are insufficient to reconstruct the original secret message.

FIG. 1 illustrates a diagram of a conventional secret sharing technique. In FIG. 1, splitting operation 104 splits secret message S 102 into N shares 106 (s ₁, s ₂, s ₃, …, s _N) , with T being the threshold number. Here, secret message S 102 may be a sequence of unencrypted bytes (e.g., clear text) representing confidential information. N may be a positive integer greater than or equal to two. T may be a positive integer greater than or equal to two, and T is less than N. The N shares 106 may be distributed amongst a number of participants in such a way that the only way to reconstruct the secret message S 102 is to have access to at least some number of shares. This number is called the threshold number (T) . The secret message S 102 cannot be reconstructed by having access to the number of shares that is less than the threshold number T.

For example, splitting operation 104 may split the secret message S 102 into 4 shares (s ₁, s ₂, s _3, s ₄) with 3 being the threshold number (N=4, T=3) . At least 3 different shares are required to reconstruct the secret message S 102. The shares may be distributed to 3 administrators (i.e.,

participants

108, 110, and 112) . The shares may be distributed by transmitting, through a network (not shown in FIG. 1) , the respective shares to corresponding computing devices used by the 3 administrators. The shares may also be stored in portable persistent storage, such as a portable hard disk drive, a USB thumb drive, and distributed to the 3 other administrators by using the portable persistent storage to transfer the respective shares to corresponding computing devices used by the 3 administrators.

In the example in FIG. 1,

administrators

108, 110, and 112 may be assigned different levels of privileges. For example, administrator 108 may only receive share s ₁, administrator 110 may receive shares s ₁ and s ₂, and administrator 112 may receive shares s ₃ and s ₄, as illustrated in FIG. 1. Here, the computing device used by each individual administrator does not have enough shares to reconstruct the secret message S 102 because none of the computing devices used by administrators has the threshold number (T=3) of the shares. But, the computing device used by

administrators

108 and 112 can combine their respective shares (s ₁, s ₃, s ₄) to reconstruct the original secret message S 102 _. Likewise, the computing device used by

administrators

110 and 112 can combine their respective shares (s ₁, s ₂, s ₃, s ₄) to reconstruct the secret message S 102. However, the computing device used by

administrators

108 and 110 cannot combine their respective shares to reconstruct the secret message S 102 because the total number of different shares from administrators 108 and 110 (s ₁, s ₂) is still less than the required threshold number (T=3) .

Splitting operation 104 may use a splitting function of the Shamir secret sharing scheme (S4) to split the original secret message S 102. For example, splitting operation104, running on a splitting computing device, may call an s4_split (S, T, N) function which uses the Shamir secret sharing algorithm to split secret message S 102 into N shares with the threshold number being T. When the original secret message S 102 needs be reconstructed by a reconstruction computing device, a combining operation (not shown in FIG. 1) may call an s4_combine ( {s ₁, s ₂, s ₃, …, s _T} ) function to combine shares (s ₁, s ₂, s ₃, …, s _T) using the Shamir secret sharing algorithm. Here, (s ₁, s ₂, s ₃, …, s _T) is an example of shares sufficient to reconstruct the original secret message S 102. In general, any T number of different shares from the generated shares (s ₁, s ₂, s ₃, …, s _N) is sufficient to reconstruct the original secret message S 102. In the example in FIG. 1, the computing devices used by

administrators

108 and 112 can combine their respective shares (s ₁, s ₃, s ₄) , and the combining operation on the reconstruction computing device may call the s4_combine ( {s ₁, s ₃, s ₄} ) function to reconstruct the secret message S 102. The details of the Shamir secret sharing scheme are described in the paper by Adi Shamir, How to share a secret, Communications of the ACM, v. 22 n. 11, p. 612-613, Nov. 1979, the entirety of which is hereby incorporated by reference.

Running secret sharing operations of the secret sharing technique described in FIG. 1can be computationally expensive. Particularly, when the data size of the secret sharing message S 102 becomes large (e.g., number of unencrypted bytes that represent the confidential information becomes large) , running a secret sharing operation on the secret message S 102 (e.g., a splitting operation that splits the secret message S 102 into a number of shares) may significantly hinder the performance (e.g., the number of splitting operations per second) of the computing device. Similar computer performance (e.g., the number of combining operations per second) issues could also occur when running a secret sharing operation (e.g., a combining operation) that combines at least T shares to reconstruct the secret message S102, when the data size of the secret message S 102 is large.

Another technical issue related to conventional secret sharing technique is tampering detection. It is possible that a participant’s computing device which has received a share of the secret message, may cheat and try to fool the computing devices of the other share-receiving participants. Currently, there is no technique for tamper detection by accessing only a T number of shares. It is possible that an administrator using its corresponding computing device may tamper a share received by the administrator. When the administrator present their respective shares in the secret message reconstruction phase, the computing device of a dishonest participant (i.e., the cheater) can always exclusively derive the secret message, by presenting the tampered share (s) . Thus the other honest participants’ computing devices get nothing but a faked secret message. In conventional approaches to detect whether cheating has occurred, access to more than T number of shares is required for tampering detection. For example, in their paper titled “Detection and Identification of Cheaters in (t, n) Secret Sharing, ” Harn and Lin presented an approach to detect share tampering. The technique proposed by Harn and Lin requires more than a T number of shares to detect that cheating has occurred. So, even though the secret message is split with the intent of T shares being sufficient for reconstructing the secret message, a more than T shares are required for detecting tampering during the reconstruction phase (i.e., message combination operation) , creating efficiency problems.

Accordingly, improved secret sharing is needed to enhance the performance of the computing device and efficiently detect possible share tampering without having to access a more than necessary threshold number of shares during the secret reconstruction phase.

To solve the above technical problems, embodiments of this disclosure provide a technical solution that uses an encryption key to encrypt the secret message into an encrypted secret message. The encryption key may be a randomly generated symmetric encryption key that provides authentication. The encryption key may also be a public key of a key pair used for asymmetric encryption. With asymmetric encryption, digital signatures may be used to provide authentication. Rather than splitting the original secret message, embodiments of this disclosure split the encryption key to generate N key shares, with the threshold number being T. Each key share of the generated key shares and the encrypted secret message are included in a respective output message for distribution. On the message reconstruction side, at least T output messages are received, and the corresponding at least T key shares in the received output messages are combined to reconstruct the encryption key. The reconstructed encryption key is then used to decrypt the encrypted message to generate the original secret message. In so doing, the performance of computer operations is improved. Particularly, for secret messages with very large data sizes, the disclosed solution runs faster than conventional secret sharing techniques (e.g. a number of splitting per second and a number of combining operations per second is increased relative to the conventional secret sharing techniques) . In addition, as long as less than T shares are modified, the disclosed solution only needs to examine the threshold number (T) of received shares to detect whether a particularly participant has tampered the participant’s respective secret share.

FIG. 2 illustrates a diagram of a hybrid secret sharing technique performed by an encryption computing device, according to some embodiments. The encryption computing device may generate a symmetric encryption key K (206) inside a secure memory environment. For example, the encryption computing device may use a pseudo random number generator (PRNG) to generate the symmetric encryption key K 206. Next, encryption operation 210 uses the symmetric encryption key K 206 to encrypt the secret message S (202) to generate the encrypted secret message C (212) . Examples of secret message S (202) may include confidential documents, encryption keys, missile launch codes, and bank account numbers.

Encryption operation 210 may use an authenticated encryption algorithm and the symmetric encryption key K 206 to generate the encrypted secret message C 212. The authenticated encryption algorithm may be an Advanced Encryption Standard with a Galois/Counter Mode (AES-GCM) encryption algorithm or an Advance Encryption Standard with CBC-MAC Mode (AES-CCM) encryption algorithm. For example, encryption operation 210 may call an enc_aes_gcm_256 (data, key, iv, tagSize) function to encrypt the secret message S 202. Here in the function, “data” is the secret message S 202 in plain text (e.g., the data is the unencrypted secret message) , “key” is a 256-bit AES key (e.g., the symmetric encryption key K 206) , “iv” is an initialization vector, and “tagSize” is the tag size for the AES GCM mode. The output of the function enc_aes_gcm_256 (data, key, iv, tagSize) is the encrypted secret message C 212.

In one example embodiment, in contrast to the conventional secret sharing technique described with respect to FIG. 1, the hybrid secret sharing technique in FIG. 2 does not split the secret message S 202 (or the encrypted secret message C 212) . Rather, splitting operation 204 splits the symmetric encryption key K 206 into an N number of key shares 208 (k ₁, k ₂, k ₃, …, k _N) , with T being the threshold number. Here, N is a positive number greater than or equal to 2. T is a positive integer greater than or equal to 2, and T is less than N.

Splitting operation 204 may split the symmetric encryption key K 206 in such a way that the only way to reconstruct the symmetric encryption key K 206 is to have access to at least the threshold number (T) of key shares 208. The symmetric encryption key K 206 cannot be reconstructed by having access to the number of shares that is less than the threshold number T. In some embodiments, splitting operation 204 may use a splitting function of the Shamir secret sharing scheme (S4) to split the symmetric encryption key K 206. For example, splitting operation 204 may call an s4_split (K, T, N) function which uses Shamir secret sharing algorithm, as described above, to split the symmetric encryption key K 206 into an N number of key shares 214 with the threshold number being T.

For distribution, the encryption computing device generates N messages 214 (M ₁, M ₂, M ₃, …, M _N) . Each message of (M ₁, M ₂, M ₃, …, M _N) includes the encrypted secret message C 212 and a different key share from the N key shares (k ₁, k ₂, k ₃, …, k _N) . For example, message M ₁ includes the encrypted secret message C 212 and key share k ₁. Message M ₂ includes encrypted the secret message C 212 and key share k ₂. Message M _N includes the encrypted secret message C 212 and key share k _N.

In general, message M _i may include the encrypted secret message C 212 and key share k _i. In one embodiment, each message M _i may include the initialization vector “iv” described above, in addition to the encrypted secret message C 212 and the respective key share k _i.. To prevent a replay attack, a new “iv” and the encryption key is generated for each sharing. So, the previous shares cannot be re-used.

In FIG. 2, the secret message S 202 is provisioned in a secure memory accessible by a trusted execution environment of the encryption computing device so that the data in secret message S 202 is not leaked. The trusted execution environment may be provided by a trusted computing platform, such as a platform with Intel Software Guard Extensions (SGX) , a platform with the AMD Secure Execution Environment, or a platform with TrustZone ^TM. In addition, generation of the symmetric encryption key K 206, the key shares 208, the encrypted secret message 212, and the messages 214 is performed by local function calls in the secure memory. In so doing, there would be no man-in-the-middle attack to the local function calls in the secure memory.

For example, if splitting operation 204 splits symmetric encryption key K 206 into 4 key shares (k ₁, k ₂, k _3, k ₄) with 3 being the threshold number (N=4, T=3) . At least 3 different key shares are required to reconstruct the symmetric encryption key K 206. The messages 214 may be distributed to 3

administrators

108, 110, and 112 (not shown in FIG. 2) . The messages 214 may be distributed by transmitting, through a network (not shown in FIG. 2) , the respective messages to corresponding computing devices used by the 3 administrators. The messages 214 may be distributed by using persistent storage devices, such as for example USB thumb drives to carry or distribute the respective messages to corresponding computers used by the 3 administrators.

In this example with respect to FIG. 2,

administrators

108, 110, and 112 may have been assigned different levels of privileges. For example, the computing device used by administrator 108 may only receive message M ₁, the computing device used by administrator 110 may receive messages M ₁ and M ₂, and the computing device used by administrator 112 may receive messages M ₃ and M ₄. Here, the computing device used by each

individual administrator

108, 110, and 112 does not have enough key shares to reconstruct the symmetric encryption key K 206 because none of the computing device used by

administrators

108, 110, and 112 has the threshold number (T=3) of the key shares. But, the computing device used by

administrators

108 and 112 can combine their respective key shares (k ₁, k ₃, k ₄) to reconstruct the symmetric encryption key K 206 _. Likewise, the computing device used by

administrators

110 and 112 can combine their respective shares (k ₁, k ₂, k ₃, k ₄) to reconstruct the symmetric encryption key K 206. However, the computing device used by

administrators

108 and 110 cannot combine their respective key shares to reconstruct the symmetric encryption key K 206 because the total number of different key shares received by the computing device used by administrators 108 and 110 (k ₁, k ₂) is still less than the required threshold number (T=3) .

FIG. 3 illustrates a diagram of a hybrid secret sharing technique performed by a decryption computing device to reconstruct the secret message 202, according to some embodiments. The decryption computing device may receive at least a threshold number (T) of messages 302. For simplicity of explanation, FIG. 3 shows a non-limiting example of the decryption computing device receiving messages (M ₁, M ₂, M ₃, …, M _T) . In other examples, any T number (or more) of different messages from messages 208 (M ₁, M ₂, M ₃, …, M _N) would be sufficient for reconstructing the secret message 202. For example, when N=4 and T=3, the decryption computing device may receive message (M ₁) and messages (M ₃, M ₄) from

administrators

108 and 112, respectively, to reconstruct the secret message 202.

The decryption computing device may receive messages 302 via a network from the computers used by the administrators. The decryption computing device may also receive messages 302 from persistent storage devices, such as for example USB thumb drives carrying messages 302.

Each message of the received messages 302 (M ₁, M ₂, M ₃, …, M _T) includes the encrypted secret message C 212 and a different key share from the T key shares 302 (k ₁, k ₂, k ₃, …, k _T) . For example, message M ₁ includes the encrypted secret message C 212 and key share k ₁. Message M ₁ includes the encrypted secret message C 212 and key share k ₂. Message M _T includes the encrypted secret message C 212 and key share k _T. In general, message M _i may include the encrypted secret message C 212 and key share k _i.

As illustrated in FIG. 3, from the received T number of messages 302, the decryption computing device may extract key shares 306 (k ₁, k ₂, k ₃, …, k _T) from (M ₁, M ₂, M ₃, …, M _N) . Then, combining operation 308 combines key shares 306 (k ₁, k ₂, k ₃, …, k _T) to generate the symmetric encryption key K 206. In one embodiment, combining operation 308 may call an s4_combine ( {k ₁, k ₂, k ₃, …, k _T} ) function that uses the Shamir secret sharing algorithm to generate the symmetric encryption key K 206.

Also, from any one message of messages 302, the decryption computing device may extract the encrypted secret message C 212. Then, decrypting operation 312 may use the generated symmetric encryption key K 206 to decrypt the encrypted secret message C 212 and generate the secret message S 202 (e.g. the original secret message) .

In one embodiment, decryption operation 312 may use an authenticated decryption algorithm and the symmetric encryption key K 206 to decrypt the encrypted secret message C 212. The authenticated decryption algorithm may be an AES-GCM decryption algorithm or an AES-CCM decryption algorithm. For example, decryption operation 312 may call a dec_aes_gcm_256 (data, key, iv, tagSize) function to decrypt the encrypted secret message C 212. Here in the function, “data” is the encrypted secret message C 212, “key” is a 256-bit AES key (e.g., the symmetric encryption key K 206) , “iv” is the initialization vector, and “tagSize” is the tag size for AES GCM mode. The output of the function dec_aes_gcm_256 (data, key, iv, tagSize) function is the original secret message S 202 in clear text (e.g., the unencrypted original secret message S 202) .

The embodiments described above in FIGs. 2 and 3 use a symmetric encryption key with an authenticated encryption algorithm for hybrid secret sharing. In these embodiments, the same symmetric encryption key K 206 is used for encryption of the secret message S 202 and for decryption of the encrypted secret message C 212.

In other embodiments, hybrid secret sharing technique may utilize asymmetric encryption algorithm to encrypt the secret message and decrypt the encrypted secret message. In this embodiment, the encryption operation 210 may use an asymmetric encryption algorithm that generates a key pair for encryption and decryption. A key pair may include a public key and a private key. The public key is used for encryption of the secret message, and the private key is used for decryption of the encrypted secret message. With respect to FIG. 2, if the hybrid secret sharing technique utilizes an asymmetric encryption algorithm, key K 206 is the private key, and splitting operation 204 splits the private key into the N key shares 208 (k ₁, k ₂, k ₃, …, k _N) to be included in the messages 214 (M ₁, M ₂, M ₃, …, M _N) , respectively. However, encryption of the secret message S 202 does not involve the private key 206. Rather, encrypting operation 210 uses the corresponding public key of the key pair to encrypt the secret message S 202 to generate the encrypted secret message C 212. With respect to FIG. 3, combining operation 308 may combine key shares 306 (k ₁, k ₂, k ₃, …, k _T) to generate the private key K 206, and decrypting operation 312 uses the private key K 206 to decrypt the encrypted secret message C 212 to generate the secret message 202 in clear text (e.g., the unencrypted secret message S 202) .

In those embodiments that utilize an asymmetric encryption algorithm for hybrid secret sharing technique, authentication may be achieved through digital signatures. In one non-limiting embodiment, the encrypting computing device may generate a second key pair. The second key pair may include a second private key and a second public key. For each respective message of the plurality of messages 214, the encrypting computing device may generate a digital signature using the second private key of the second key pair, and include the generated digital signature in the respective message in (M ₁, M ₂, M ₃, …, M _N) for later authentication of the respective message by the decryption computing device.

FIG. 4 illustrates a flowchart of method 400 for an encryption computing device to perform hybrid secret sharing of a secret message, according to some embodiments. Method 400 may be carried out or performed by routines, subroutines, or modules of software executed by one or more processors of the encryption computing device. Coding of the software for carrying out or performing method 400 is well within the scope of a person of ordinary skill in the art having regard to the present disclosure. The method may include additional or fewer operations than those shown and described and may be carried out or performed in a different order. Computer-readable code or instructions of the software executable by the one or more processor of the encryption computing device may be stored on a non-transitory computer-readable medium, such as for example, memory of the encryption computing device. Method 400 starts at operation 402, where the encryption computing device may encrypt a secret message using a first encryption key to generate an encrypted secret message. The secret message may be generated in a secure memory of the encryption computing device to prevent information leaking of the secret message.

At operation 404, the encryption computing device may split a second encryption key into a plurality of key shares in accordance with a threshold number. The threshold number may be less than or equal to the number of the plurality of key shares. At least the threshold number of different key shares from the plurality of key shares are required to reconstruct the second encryption key.

In one embodiment, the first encryption key may be a symmetric encryption key and the second encryption key may be identical to the first encryption key. In other words, the first encryption key and the second encryption key may be the same symmetric encryption key used in a symmetric encryption algorithm. In this embodiment, the encryption computing device may encrypt the secret message using an authenticated encryption algorithm and the symmetric encryption key to generate the encrypted secret message. The authenticated encryption algorithm may be an Advanced Encryption Standard with a Galois/Counter Mode (AES-GCM) encryption algorithm or an Advance Encryption Standard with CBC-MAC Mode (AES-CCM) encryption algorithm.

In another non-limiting embodiment, the first encryption key may be a public key of a key pair for asymmetric encryption, and the second encryption key may be a private key of the key pair. The encrypting computing device may generate a second key pair. The second key pair may include a second private key and a second public key. For each respective message of the plurality of messages, the encrypting computing device may generate a digital signature using the second private key of the second key pair and include the generated digital signature in the respective message for authenticating the respective message later on the reconstruction side.

In some embodiments, the encryption computing device may split the second encryption key into the plurality of key shares using a Shamir secret sharing scheme splitting function.

At operation 406, the encryption computing device may transmit a plurality of messages. Each message of the plurality of messages may comprise the encrypted secret message and a different one of the plurality of key shares.

FIG. 5 illustrates a flowchart of method 500 for a decryption computing device to perform hybrid secret sharing of an encrypted secret message, according to some embodiments. Method 500 may be carried out or performed by routines, subroutines, or modules of software executed by one or more processors of the decryption computing device. Coding of the software for carrying out or performing method 500 is well within the scope of a person of ordinary skill in the art having regard to the present disclosure. The method may include additional or fewer operations than those shown and described and may be carried out or performed in a different order. Computer-readable code or instructions of the software executable by the one or more processor of the encryption computing device may be stored on a non-transitory computer-readable medium, such as for example, memory of the decryption computing device. Method 500 starts at operation 502, where the decryption computing device may receive a plurality of messages. Each of the received plurality of messages may comprise the encrypted secret message and a different key share of a plurality of key shares.

At operation 504, the decryption computing device may determine that at least a threshold number of different key shares required to reconstruct an encryption key are received in the received plurality of messages.

If at least the threshold number of different key shares are received, then, at operation 506, the decryption computing device may combine the different key share in each message of the received plurality of messages to reconstruct the encryption key. In some embodiments, the decryption computing device may use a Shamir secret sharing scheme combining function to combine the different key share in each of the plurality of messages to generate the encryption key.

Next, at operation 508, the decryption computing device may decrypt the encrypted secret message using the reconstructed encryption key to generate a secret message. In some embodiments, the decryption computing device may authenticate each message of the received plurality of messages prior to decrypting the encrypted secret message. In one embodiment, for each message of the received plurality of messages, the decryption computing device may report tampering of the received plurality of messages when at least one of the received plurality of messages is not authenticated. In another embodiment, for each message of the received plurality of messages, the decryption computing device may report tampering of the received plurality of messages when a digital signature included in at least one of the received plurality of messages is not authenticated.

In some embodiments, the reconstructed encryption key may be a symmetric encryption key for encrypting the secret message using an authenticated encryption algorithm. The decrypting device may decrypt the encrypted secret message using the reconstructed symmetric encryption key and one of an Advanced Encryption Standard with a Galois/Counter Mode (AES-GCM) decryption algorithm or an Advance Encryption Standard with CBC-MAC Mode (AES-CCM) encryption algorithm to generate the secret message. The decryption computing device may detect tampering based on the result of the decrypting the encrypted secret message. For example, the decryption computing device may call a dec_aes_gcm_256 (C, K, iv, 256) function to decrypt the encrypted message C using the symmetric encryption key K, with iv being the initialization vector and the tag size being 256. If the decryption operation fails, the decryption computing device may detect tampering and report such tampering.

In some embodiments, the reconstructed encryption key is a private key of a key pair for asymmetric encryption. The key pair comprises the private key and a corresponding public key.

FIG. 6 illustrates a flowchart of method 600 for a decryption computing device to detect message tampering using hybrid secret sharing, according to some embodiments. Method 600 may be carried out or performed by routines, subroutines, or modules of software executed by one or more processors of the decryption computing device. Coding of the software for carrying out or performing method 600 is well within the scope of a person of ordinary skill in the art having regard to the present disclosure. The method may include additional or fewer operations than those shown and described and may be carried out or performed in a different order. Computer-readable code or instructions of the software executable by the one or more processor of the encryption computing device may be stored on a non-transitory computer-readable medium, such as for example, memory of the decryption computing device. Method 600 starts at operation 601, where the decryption computing device may receive a plurality of messages. Each of the received plurality of messages may comprise the encrypted secret message and a different key share of a plurality of key shares.

At operation 602, the decryption computing device may authenticate a message of the received plurality of messages. In one embodiment, the decryption computing device may determine whether the message is authenticated. In another embodiment, the decryption computing device may determine whether a digital signature included in the message is authenticated.

If the message is not authenticated, at operation 604, the decryption computing device may detect tampering. In one embodiment, method 600 may report tampering as soon as the method detects that one message has been tampered, and method 600 may end (not shown in FIG. 6) .

In another embodiment, the decryption computing device may wait until finishing checking authentication of all the received messages before reporting tampering. In this embodiment, after the decryption computing device detects tampering of a received message at operation 604, the decryption computing device may save the tampering status information related to the received message. Method 600 may then proceed to operation 606.

If the received message is authenticated, method 600 may also proceed to operation 606. At operation 606, the decryption computing device may check whether there are more received messages to be authenticated. If so, method 600 returns to operation 602 to authenticate the next received message. If there are no more received messages left to be authenticated, at operation 608, the decryption computing device check whether tampering has been detected for one or more received messages, based on the saved tampering information from operation 604. If tampering has been detected for at least one of the received messages, the decryption computing device may report such tampering at operation 610. If tampering has not been detected in any of the received messages, at operation 612, the decryption computing device may proceed to generate the decrypted secret message using techniques such as the one described with respect to FIG. 5.

In another embodiment, the decryption computing device may detect tampering based on the result of the decrypting the encrypted secret message. For example, if a symmetric encryption key has been constructed from at least the threshold number of key shares, the decryption computing device may call a dec_aes_gcm_256 (C, K, iv, 256) function to decrypt the encrypted message C using the symmetric encryption key K, with iv being the initialization vector and the tag size being 256. If the decryption operation fails, the decryption computing device may detect tampering and report the tampering.

FIG. 7 illustrates a graph of how the performance of one embodiment implementation of the hybrid secret sharing technique of the present disclosure is compared to the performance of the conventional approach of splitting the secret message, using the Shamir secret sharing scheme. In FIG. 7, the horizontal axis shows the data size of the secret messages. The vertical axis shows the number of splitting operations per second, which is directly proportional to the performance of the encryption computing device. As shown in FIG. 7, for the conventional secret sharing approach of splitting the secret message, using the Shamir secret sharing scheme, the larger the data size of the secret message, the less the splitting operations per second can be performed by the encryption computing device (i.e., the lower the computer performance) . For secret messages having data sizes over 256 bits, the hybrid secret sharing technique of the present disclosure outperforms the conventional approach of splitting the secret message, using the Shamir secret sharing scheme. For example, if the data size of a secret message is 8192 bits, the example hybrid secret sharing technique can perform almost 30 times as many splitting operations as the conventional approach of splitting the secret message, using the Shamir secret sharing scheme.

FIG. 8 is a block diagram of an embodiment processing system 800 for performing

methods

400, 500, 600 described herein, which may be a part of a computing device, such as the encryption computing device, the decryption computing device, and the computing devices using by the administrators. As shown, the processing system 800 includes a processor 804, a memory 806, and interfaces 810-814, which may (or may not) be arranged as shown in FIG. 8. The processor 804 may be any component or collection of components adapted to perform computations and/or other processing related tasks, and the memory 806 may be any component or collection of components adapted to store programming and/or instructions for execution by the processor 804. The memory 806 may include a non-transitory computer readable medium. In an embodiment, the memory 806 includes a secure memory 808 accessible only by a trusted execution environment of processing system 800. The trusted execution environment may include secure memory 808 storing secure data. Trusted applications may also be stored in secure memory 808 for accessing the secure data in secure memory 808. The

interfaces

810, 812, 814 may be any component or collection of components that allow the processing system 800 to communicate with other devices/components and/or a user. For example, one or more of the

interfaces

810, 812, 814 may be adapted to communicate data, control, or management messages from the processor 804 to applications installed on the host device and/or a remote device. As another example, one or more of the

interfaces

810, 812, 814 may be adapted to allow a user or user device (e.g., personal computer (PC) , laptop computer, smartphone, tablet, etc. ) to interact/communicate with the processing system 800. The processing system 800 may include additional components not depicted in FIG. 8, such as long term storage (e.g., non-volatile memory, etc. ) .

In some embodiments, the processing system 800 is included in a network device that is accessing, or part otherwise of, a telecommunications network. In one example, the processing system 800 is in a network-side device in a wireless or wireline telecommunications network, such as a base station, a relay station, a scheduler, a controller, a gateway, a router, an applications server, or any other device in the telecommunications network. In other embodiments, the processing system 800 is in a user-side device accessing a wireless or wireline telecommunications network, such as a mobile station, a user equipment (UE) , a personal computer (PC) , a tablet, a wearable communications device (e.g., a smart watch, etc. ) , or any other device adapted to access a telecommunications network.

It should be appreciated that one or more steps of the embodiment methods provided herein may be performed by corresponding units or modules. For example, a signal may be transmitted by a transmitting unit or a transmitting module. A signal may be received by a receiving unit or a receiving module. A signal, message, or key such as secret message S 202, symmetric encryption key K (206) , encrypted secret message C 212, may be processed by a processing unit or a processing module. Also, encryption operation 210, decryption operation 312, splitting operation 204, and combining operation 308 may be performed by a processing unit or processing module. Other steps may be performed by an identifying unit/module and/or a determining unit/module. The respective units/modules may be hardware, software, or a combination thereof. For instance, one or more of the units/modules may be an integrated circuit, such as field programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs) .

As described above, the disclosed hybrid secret sharing solution provides two major advantages over the conventional secret sharing approaches. First, hybrid secret sharing techniques can be performed much faster than conventional secret sharing approaches. So, the hybrid secret sharing techniques of the present disclosure are more suitable for distributing secret messages with a large data size. Second, the hybrid secret sharing techniques can more efficiently detect information tampering by examining only the threshold number of shares.

Although this invention has been described with reference to illustrative embodiments, this description is not intended to be construed in a limiting sense. Various modifications and combinations of the illustrative embodiments, as well as other embodiments of the invention, will be apparent to persons skilled in the art upon reference to the description. It is therefore intended that the appended claims encompass any such modifications or embodiments.

Claims

A method for encrypting a secret message, comprising:

encrypting, by a computing device, the secret message using a first encryption key to generate an encrypted secret message;

splitting, by the computing device, a second encryption key into a plurality of key shares in accordance with a threshold number, wherein the threshold number is less than or equal to a number of the plurality of key shares; and

transmitting, by the computing device, a plurality of messages, wherein each message of the plurality of messages comprises the encrypted secret message and one of the plurality of key shares.
The method of claim 1, wherein at least the threshold number of the plurality of key shares are required to reconstruct the second encryption key.
The method of claim 1 or 2, wherein the first encryption key is a symmetric encryption key, and the second encryption key is identical to the first encryption key.
The method of claim 3, wherein the encrypting comprises:

encrypting, by the computing device, the secret message using an authenticated encryption algorithm and the first encryption key to generate the encrypted secret message.
The method of claim 4, wherein the authenticated encryption algorithm is an Advanced Encryption Standard with a Galois/Counter Mode (AES-GCM) encryption algorithm or an Advance Encryption Standard with CBC-MAC Mode (AES-CCM) encryption algorithm.
The method of claim 1 or 2, wherein the first encryption key is a public key of a key pair for asymmetric encryption, and the second encryption key is a private key of the key pair.
The method of claim 6, further comprising:

generating, by the computing device, a second key pair comprising a second private key and a second public key; and

for each respective message of the plurality of messages:

generating, by the computing device, a digital signature using the second private key of the second key pair; and

including, by the computing device, the generated digital signature in the respective message for authenticating the respective message.
The method of any one of claims 1 to 7, wherein the splitting comprises splitting the second encryption key, using a Shamir secret sharing scheme splitting function, into the plurality of key shares.
The method of any one of claims 1 to 8, wherein the secret message is generated in a secure memory of the computing device.
A method for decrypting an encrypted secret message, comprising:

receiving, by a computing device, a plurality of messages, wherein each message of the received plurality of messages comprises the encrypted secret message and a different key share of a plurality of key shares;

after determining that at least a threshold number of different key shares required to reconstruct an encryption key are received:

combining, by the computing device, the different key share in each message of the received plurality of messages to reconstruct an encryption key; and

decrypting, by the computing device, the encrypted secret message using the reconstructed encryption key to generate a secret message.
The method of claim 10, further comprising:

prior to the decrypting, authenticating each message of the received plurality of messages.
The method of claim 11, wherein the authenticating comprises:

for each message of the received plurality of messages, reporting, by the computing device, tampering of the received plurality of messages when at least one of the received plurality of messages is not authenticated.
The method of claim 11, wherein the authenticating comprises:

for each message of the received plurality of messages, reporting, by the computing device, tampering of the received plurality of messages when a digital signature included in at least one of the received plurality of messages is not authenticated.
The method of any one of claims 10 to 13, wherein the reconstructed encryption key is a symmetric encryption key for encrypting the secret message using an authenticated encryption algorithm.
The method of claim 14, further comprising:

detecting tampering based on a result of the decrypting of the encrypted secret message.
The method of claim 14 or 15, wherein the decrypting comprises decrypting the encrypted secret message using the reconstructed encryption key and one of an Advanced Encryption Standard with a Galois/Counter Mode (AES-GCM) decryption algorithm or an Advance Encryption Standard with CBC-MAC Mode (AES-CCM) decryption algorithm to generate the secret message.
The method of any one of claims 10 to 13, wherein the reconstructed encryption key is a private key of a key pair for asymmetric encryption, and the key pair comprises the private key and a public key.
The method of any one of claims 10 to 17, wherein the combining comprises combining, using a Shamir secret sharing scheme combining function, the different key share in each of the plurality of messages to generate the encryption key.
A computing device, comprising:

a processor;

a memory storing instructions, which when executed by the processor, cause the computing device to perform the method any one of claims 1 to 9.
A computer-readable storage medium storing programming storing instructions, which when executed by a processor of a computing device, cause the computing device to perform the method any one of claims 1 to 9.
A computer program product comprising instructions which, when executed by a processor of a computing device, cause the computing device to perform the method any one of claims 1 to 9.
A computing device, comprising:

a processor;

a memory storing instructions, which when executed by the processor, cause the computing device to perform the method any one of claims 10 to 18.
A computer-readable storage medium comprising instructions, which when executed by a processor of a computing device, cause the computing device to perform the method of any one of claims 10 to 18.
A computer program product comprising instructions which, when executed by a processor of a computing device, cause the computing device to perform the method any one of claims 10 to 18.