WO2021014081A1

WO2021014081A1 - Method for secure data storage and system for implementing said method

Info

Publication number: WO2021014081A1
Application number: PCT/FR2020/051295
Authority: WO
Inventors: Cyril DEVER
Original assignee: Edgewhere
Priority date: 2019-07-19
Filing date: 2020-07-17
Publication date: 2021-01-28

Abstract

The invention relates to a method for secure storage of a source data (DS) of an owner (To) with the participation of third parties (Tj (j=1…m)) each having a public key (Kj) and a private key (Kj). The characterised method consists of - obfuscating (Ob) the source data (DS) - splitting (Fr) the obfuscated data (Ob (MS)) into crumbs (Mi) (i = 1…n) - dividing the crumbs (Mi) into groups Gj (j=…m or j=0.1…m), each crumb being present in at least two groups Gj, the number of groups being equal to the number of participants, - assigning a group (Gj) to each participant (Pj) - encrypting (Kj) of the crumbs (Mi) of each group (Gj) by the assigned participant of the group using his public key (Kj) - regrouping the encrypted crumbs (Kj (Mi) → Σ Kj [Gj (Mi)]) - hashing (H) of the source data (DS) by the owner (To) and encrypting the hash - composing the transformed data as a message (MC) combining the encrypted hash HX (DS) and the encrypted crumbs (Kj (Mi)).

Description

PROCESS FOR SECURE STORAGE OF DATA AND SYSTEM FOR IMPLEMENTING THE PROCESS

FIELD OF THE INVENTION

The present invention relates to a secure data storage method and a system for implementing this method.

STATE OF THE ART

There are multiple ways to store data after encrypting it.

However, current techniques for encrypting data for storage and for retrieving and decrypting stored data are operations that are more complex as the security must be high.

In addition, the encryption / decryption code is always susceptible to being broken.

PURPOSE OF THE INVENTION

The object of the present invention is to develop simple and particularly effective means for securing the storage of data.

DISCLOSURE AND ADVANTAGES OF THE INVENTION

To this end, the invention relates to a method of secure storage of a source data (DS) of a holder (To) with the participation of third parties (Tx (x = l ... m)) each having a public key (Kj) and a private key (Kj), constituting the participants Pj (To, Tx) (j = o ... m)

method characterized in that it comprises the steps of

-obfuscate (Ob) the source data (DS)

- split (M) the obfuscated data [Ob (MS)] into crumbs (Mi) (i = 0 ... n)

- assign a group (Gj) to each participant (Pj)

- distribute the crumbs (Mi) except the crumb Mo into groups Gj (j = l ... m), each crumb (Mi) (i = l ... n) being present in at least two groups Gj, including the group (Go) of the holder (To) containing at least the crumb (Mo) which is not in any of the other groups (Gj

(j = l ... m)) intended for other participants (Pj, j = l ... m)

- encrypt (K) the crumbs (Mi) of each group (Gj) with the public key (Kj) of the participant (Pj) assigned to the group (Gj) to obtain the encrypted groups Kj (Gj) - regroup (å) the encrypted groups (Kj (Gj) to obtain the groups of concatenated crumbs å Kj (Gj) (j = o ... m)

- hash (H) the source data (DS) by the holder (To)

- encrypt the H (DS) hash of the source data (DS) by an encryption function with the encrypted crumb (KoGo) of the holder (To) to obtain an encrypted HX (DS) hash,

- compose (C) the data transformed as message (MC) combining the encrypted hash HX (DS) and the encrypted crumbs å (Kj (Gj)) concatenated.

This secure storage process and its reverse for data recovery are particularly safe procedures since certain encryption / decryption elements are distributed between holders (third parties / participants) and cannot be discovered by any procedure that would allow a code to be broken. unique encryption. This distribution of fractions of data (crumbs) and their separate encryption greatly increases the security of the storage since, without the intervention of a participant, the message can only be partially recovered in its obfuscated form. Furthermore, the presence among the participants of the holder who is the priority participant, does not make it possible to recover the source data item other than by the holder of the source data item which has been stored.

The same participant cannot be used to encrypt all the crumbs and therefore in the end we will never be able to reconstitute the crumbs with the reverse process. No participant should be able to decipher all the crumbs.

In this method / system, all operations are carried out at the owner of the source data; third parties never have access to the source data or to the crumbs in the clear, that is to say the crumbs that are always obfuscated in the sense of encryption.

In general, the decryption request can come a priori from any participant and the latter could ask the other participants to send back the crumbs that they can decrypt so that he alone can recombine them and disobfuscate the result for obtain the decrypted data because this can only be done by the holder.

Thus, the data recovery process is carried out initially on the machines of the participants who are the only ones to hold their private keys. The process ends on the machine of the requestor of the data which in general is normally the holder. According to a particularly interesting feature, the H (DS) hash is encrypted with the encrypted crumb (KoGo) by the XOR function to obtain the H encrypted hash (DS).

According to an advantageous characteristic, according to the method, the encrypted crumbs are divided into groups, including one group intended for the holder and containing at least one crumb which is not found in any of the other groups intended for the other participants.

According to a very advantageous characteristic, we cut (M) the obfuscated wise mes (Ob (DS)) into a number of crumbs (Mi) corresponding to the number of participants (Pj (j = 0, l ... m)), and we distribute the crumbs (Mi): a) by forming groups (Gj) with a pair of crumbs (Mi) whose first crumb is the second crumb of the pair of the group (Gj- 1) preceding this sequence

b) the holder (To) keeps a crumb (Mo) not distributed with the other crumbs (Mi = l ... m) of the division in the other groups (Gj) j = l ... m).

According to an advantageous characteristic, in order to obfuscate the string of characters constituting the source datum DS, it is completed to have an even number of characters and it is obfuscated by a Feistel network by applying an intermediate key at each turn.

The keys used in the Feistel network are the cardholder's keys, which further increases security.

According to the invention, the method for recovering the source data originating from the secure storage comprises the following steps consisting of

- separate (C) the combined message MC with its hash HX (DS) and its groups of encrypted crumbs å Kj (Gj)

- decrypt (K) the crumbs recovered by the participants (Pj), with their respective private key (Kj)

- recombine (M) the decrypted crumbs Mi (i = l ... n) and add the crumb (Mo) to obtain the obfuscated data [Ob (DS]

- disobfuscate (Ob) this obfuscated data OB (DS) recovered

- check (VF) the integrity of the data retrieved by comparing the HX (DS) hash extracted from the combined message MC and the H (DS) hash kept by the holder To.

The subject of the invention is also a secure storage / retrieval system for source data for the implementation of the method.

This system includes - an obfuscation function (Ob) of the source data (DS) and its reciprocal function (Ob) to unobfuscate the obfuscated data.

- a crumbling function (M) to split the obfuscated data into crumbs (Mi) and its inverse function (M) to recompose the obfuscated data from the crumbs.

- a grouping function (G) to compose groups (Gj) of crumbs (Mi) containing a determined number of crumbs and its inverse function G

-a concatenation function (å) to group the encrypted crumbs and its inverse function å

- a hash function (H) to hash the source data (DS).

- a combination function (C) to combine the concatenation of groups of encrypted crumbs, the encrypted hash HX (Ds) of the source data (DS) and its inverse function (C) of separation (C) to separate the hash HX (DS) and groups of encrypted crumbs å Kj (Gj)

- pairs of public / private keys Kj, Kj. (j = o ... m)

a verification function (VF) for comparing the HX (DS) hash recovered from the combined message (MC), decrypting it and comparing it with the source data (DS) kept by the holder To.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be described in more detail below using the example of the secure storage method and system according to the invention shown in the accompanying drawings in which:

[Fig. 1] Basic diagram of the secure storage process

[Fig. 2] Basic diagram of the process for recovering data from secure storage

[Fig. 3] Diagram of the system for implementing the method DESCRIPTION OF AN EMBODIMENT

The subject of the present invention is a method for secure storage of data DS of a holder To with the intervention of m third parties Tx (x = 1 ... m) each having a pair of keys (public key Kj , private key Kj), and thus forming the participants Pj (j = o ... m) composed of the holder To and the third parties Tx.

The data holder To is, as the case may be, a natural person or a legal person (company) to which the data will be entrusted or vice versa.

The holder can also be one or more natural or legal persons, as well as the persons to whom the given. However, this does not modify the principle of secure storage / retrieval, described below, for the sake of simplification, in the case of a single To holder.

For example, in a case that will occur frequently, there are two holders, the one to whom the data belongs and the one to whom it is intended to be processed as well as three trusted third parties participating in the secure storage and destocking process.

The holder To and the third parties Tx train the participants Pj j = p ... m) in the storage / retrieval process (reverse process) of the data.

According to FIG. 1, the secure storage method consists for the holder To of the source datum DS, in a first step in obfuscating Ob the datum DS to obtain an obfuscated datum Ob (DS). Then in a second step the holder To splits M (cutting; crumbling) this obfuscated datum Ob (DS) into crumbs Mi (i = o ... n).

Advantageously but not imperatively, the number of crumbs Mi is equal to the number of participants Pj.

The number of participants is freely chosen. For optimal operation, the system uses at least three thirds T in addition to the holder To which is in priority situation and the recipient of the data Ds which is the security counterpart of the holder.

The fault of a third party is automatically compensated by the presence of the other two, which allows either to replace the faulty third party or to repair.

The default of the holder To definitively protects the stored data item because the reverse process can no longer be applied as will be seen below.

In the next step, the crumbs Mi are divided into as many groups Gj as there are participants Pj, including the holder.

The crumbs Mi are distributed in the groups Gj so that each crumb Mi is present in at least two groups except the crumb Mo reserved for the holder To.

By respecting this condition and as a function of the number (n) of crumbs Mi and of the number (m) of participants Pj, the groups Gj contain a variable, identical or different number of crumbs Mi. According to the security requirements, the To holder assigns himself a Go group which contains one or more MB crumbs that are not in any other Gj (j¹o) group.

After assigning the groups Gj to the participants Pj, the crumbs Mi of the group Gj of each participant (K) with the public key Kj of that participant.

Gj (Mi) Kj (Gj) (j = o ... m)

Thus one or more crumbs Mi of the groups are encrypted with the public key Kj of the participant Pj.

After the encryption, we regroup (å) all the groups of encrypted crumbs

In parallel, the holder To hashes (H) the source data (DS)

(DS) H (DS)

and then encrypts it by the XOR function with its encrypted Mo crumb KoGo to obtain the special HX (DS) hash.

Then we form the combined message MC by combining (C) by concatenation the hash HX (DS) and the groups of encrypted crumbs Kj (Gj) (j = o ... m) MC = HX (DS), å Kj ( Gj)

The combined message MC can then be saved without risk by any service since it is indecipherable.

The holder To keeps the H (DS) hash of the source data to be able to verify the authenticity of the data that will be recovered. To do this, on recovery, it compares its hash H (DS) to the HX (DS) recovered from the combined data C.

In the various stages of formation of the message MC, no participant Pj, with the exception of the holder To, has any knowledge of the source data DS.

The first step is that of obfuscation (Ob) which constitutes a first security.

Obfuscation (Ob) transforms the data DS into a series of characters of the same length but no longer making it possible to understand the meaning directly, that is to say without disobfuscation. Obfuscation uses Feistel's network implementation, requiring the size of the source DS data to consist of an even number of characters. If this is not the case, the data DS is completed by padding to add a character to the string of size im even.

Obfuscation is performed as follows:

- checking the size of the DS source data

- addition of a special character on the left ("left padding") if the size is odd

- application of an implementation of the Feistel network:

* for each turn, the data is split into two equal parts

* the right part is encrypted by an intermediate key in a hash algorithm (SHA-256 in this case).

* the two parts are combined by the XOR function and then concatenated backwards (left to right and right to left) to give birth to a new character string of identical length

* this operation is repeated x turns (x being configurable and fixed for example at 10).

* the character string thus obtained forms the obfuscated data Ob (DS).

The keys used in the Feistel network are keys of which only the holder To is the holder.

The splitting (M) (also called crumbling) of the obfuscated data Ob (DS), into crumbs Mi (i = l ... n) entrusted to the participants Pj who encrypt them with their public key Kj constitutes an additional barrier because no of participants Pj cannot read crumbs encrypted by other participants.

It is recalled that a crumb Mo is reserved for the holder To and will not be combined with crumbs Mi (i = l ... n) in the groups Gj formed subsequently.

Obfuscated data Ob (DS) is cut into random length crumbs. The number of crumbs depends on the number of participants Pj. For n participants P], there will be n crumbs; n must be strictly greater than 1 (n ³ 2).

The variation in length of each crumb Mi depends on the number of crumbs to be obtained. A random factor (deltaMax) is applied to the average length of the crumbs (equal to the length of the chain Ob (DS) di referred to by the number of crumbs n). This DeltaMax factor must be less than or equal to the average size - 1, a crumb cannot be zero length. It can be equal to 0. By way of example we use the highest possible value taking into account the length of the size of the chain Ob (DS) and a minimum size of crumb (TAILLE_MINI fixed at 2) : deltaMax - max (0,2 * (floor (length Ob (DS) / n) - SIZE-MINI))

The length of the largest crumb is taken into account, for example 16 characters, and the left padding is applied to each of the crumbs, using at least two padding characters. So, if the largest crumb is 16 characters long, all final padded crumbs will be 18 characters long.

Padding / "padding" is done by adding a special character to the header / to the left of the string recursively until you get a string of the desired length.

The value of this special character depends on the value of the first two characters of the string to be padded. By default, this is the Unicode character \ u0002, but if the value of the first or the last character of the string to be padded is equal to this character at the binary level, an alternative value is used, which must also be different of the first and last character of the string to be padded.

The crumb (Mi) thus obtained in the group Gj will be of identical length to the length before encryption.

The split distribution (RD) of the crumbs Mi in groups Gj constitutes an additional security because in the event of the disappearance of a third party Tx, the crumbs Mi of its group Gx are, by definition, contained in at least two other groups and therefore they can be collected separately from third parties to which the groups containing these crumbs have been assigned.

The last step is to create a unique HX (DS) hash of the DS source data object of the operation, then to concatenate this encrypted hash with all the groups of encrypted crumbs Kj (Gj); the HX (DS) hash is placed at the head of the character string thus formed.

The generation of the HX (DS) encrypted hash is carried out as follows:

- the source data DS is hashed with a hash algorithm using for example SHA-256 giving the hash H (DS).

- the hash obtained is cut into two equal parts - the second part (the one on the right) is combined by an XOR function with the concatenation of the encrypted crumbs, making the result obtained unique to the operation since it depends on the encryption operation which generates unique crumbs by processing

- the unchanged left part and the new right part are concatenated to form the unique encrypted hash HX (DS).

This encrypted hash HX (DS) is then concatenated with the concatenation of the groups of encrypted crumbs åKj (Gj) under their simplified reference M [l,

PI] ...

Thus, we have:

shown schematically that each crumb Mi is attributed here to two participants Pj

This MC character string can therefore be stored for future use by all or some of the participants, or even by another third party who does not have any key.

MC data cannot be deciphered without the presence of at least two participants (a priori a trusted third party and the initial holder of the data).

The HX (DS) hash placed in the header will be used for indexing the data in a database as well as for verifying the conformity of the decrypted data with the DS source data: the decrypted hash of the decrypted data must be equal to the hash of the source data.

The situation of the holder To vis-à-vis third parties Tl ... Tm can be of the same level or take priority.

In this case, if the holder To is on the same level as the third parties Tj, the crumbs Mi of his group Go are also found in two or more groups Gj of third parties. Mi crumbs can be recovered by third parties Tl ... Tm without intervention of the holder To. But Mi crumbs will only be available in this state of crumbs.

If the holder To maintains a priority situation according to which he reserves at least one MB crumb in his Go group and which is not in any of the other Gj groups, this Mo crumb will be encrypted by the sole holder. In its absence, all of the crumbs Mi cannot be decrypted by third parties Ti ... Tj with their private key Kj and the data Obfuscated Ob (DS) cannot be reconstructed. The source data DS remains protected at this level.

FIG. 2 shows the reciprocal part of the secure storage method for recovering the data stored in its combined form MC.

In particular, the combined data item MC is verified at the end of decryption by the verification function VF which verifies the integrity of this data by comparing its hash HX (DS) with the hash H (DS) kept by the holder To. hash of the combination MC with the hash of the holder To proves that the DS data has not been modified during its storage.

Before this verification and to allow it to be done, the part å Kj (Mi) i.e. the concatenation of the groups Gj of encrypted crumbs is separated (separation function (C) inverse of the combination function (C )) then the crumbs are decrypted with the private keys Kj of the respective participants Pj. The crumbs of the decrypted groups Kj (Gj) are recombined by the inverse fractionation function M to obtain the obfuscated datum Ob (DS) which can be processed by the deobfuscation function Ob by the holder To or the recipient and then obtain the disobfused data which is the source data DS.

In summary, decryption performs the various steps in reverse:

- extraction of the encrypted HX (DS) hash and Mi crumbs (i = l ... n) and recovery of the decrypted hash

- decryption of the crumbs by each of the stakeholders [each trusted third party taking care to record - in a log file - the fact that one of the owners of the data (generally the company which wishes to use it) requests this decryption ]

- un-stuffing of crumbs

- concatenation of unbuffered crumbs

- deobfuscation of crumbs

- verification of the conformity of the data DS by the verification hash HX (DS) and the hash HX (DS) recovered from the combination.

The system for implementing the method (Figure 3) consists of a set of data processing functions applying processing to the data and reciprocal functions which perform a reverse processing from that of the direct functions.

The system also includes a set of public keys / private keys Kj, Kj used by third parties Tj. The functions of the system are applied by the holder To of the source data DS or his proxy.

Thus the S system includes:

- an obfuscation function (Ob) of the source data DS and its reciprocal function (Ob) to disobfuscate the obfuscated data.

- a crumbling function (M) to split the obfuscated data into Mi crumbs. The number of crumbs and the content of the crumbs depend on the adjustable parameters of this M function.

- an inverse function (M) which makes it possible, from the crumbs, to recompose the obfuscated data.

a grouping function (G) consisting in composing groups Gj of crumbs Mi containing a determined number of crumbs. This distribution into groups also depends on the parameters of this function according to the number of crumbs, the number of third parties Tj including or not the holder To is the identified or different number of crumbs placed in the groups Gj.

-a concatenation function (å) to group together the crumbs encrypted by third parties Tj with their public key Kj.

- a hash function (H) to hash the source data (DS).

- a combination function (C) to combine with the concatenation of the encrypted crumbs, the hash H (DS) 1 of the source data (DS).

- pairs of public / private keys Kj, Kj available to the participants Pj of the processing of data DS, including the holder To who has a pair of keys K, K

- a VF verification function to check the data returned after storage and verify its integrity by comparing the hash

H (DS) 1 extract from the combined message MC and the hash H (DS) 2 kept by the holder To.

NOMENCLATURE OF THE MAIN ELEMENTS

DS Source data

Ob Obfuscate function

Ôb "Unobfuscate" function

Ob (DS) Obfuscated source data

M "Cut into pieces" function

M “Recombine the crumbs” function

Mi [Ob (DS)] Crumb of obfuscated source data

Crumb of obfuscated source data (simplified reference)

“Divide the crumbs into groups” function

Mi crumb group

Holder group containing the crumb Mo Group encrypted with the public key Kj

"Concatenate groups of encrypted crumbs" function Concatenation of encrypted groups

Hash function (Hash function)

Hashed DS source data

DS source data hashed and encrypted by the XOR function with the KoGo encrypted crumb

KA "Encrypt" function

KA "decrypt" function

Kj Participant's public key Pj

Kj Private key of participant Pj

MC Combined message

To Owner of the source data

Tj Third Party

Pj Participant in treatment

FI "Check" function

Claims

1. Method for secure storage of a source data (DS) of a holder (To) with the participation of third parties (Tx (x = l ... m)) each having a public key (Kj) and a key private (Kj), constituting the participants Pj (To, Tx) (j = o ... m)

method characterized in that it comprises the steps of

-obfuscate (Ob) the source data (DS)

- split (M) the obfuscated data [Ob (MS)] into crumbs (Mi) (i = o ... n)

- assign a group (Gj) to each participant (Pj)

(j = l ... m)) intended for other participants (Pj, j = l ... m)

- encrypt (K) the crumbs (Mi) of each group (Gj) with the public key (Kj) of the participant (Pj) assigned to the group (Gj) to obtain the encrypted groups Kj (Gj)

- regroup (å) the encrypted groups (Kj (Gj) to obtain the groups of concatenated crumbs å Kj (Gj) (j = o ... m)

- hash (H) the source data (DS) by the holder (To)

2. Method according to claim 1,

characterized in that

we encrypt the hash H (DS) with the encrypted crumb (KoGo) by the XOR function to obtain the encrypted hash hX (DS).

3. Method according to claim 1,

characterized in that

we cut (M) the obfuscated message (Ob (DS)) into a number of crumbs (Mi) corresponding to the number of participants (Pj (j = 0, l ... m)), and we distribute the crumbs (Mi ):

a) by forming groups (Gj) with a pair of crumbs (Mi) whose first crumb is the second crumb of the pair of the group (Gj- 1) preceding this sequence

4. Method according to claim 1,

characterized in that to obfuscate the character string constituting the source data (DS), it is completed to have an even number of characters and it is obfuscated by a Feistel network by applying an intermediate key at each turn.

5. Method for recovering the source data (DS) of the secure storage method according to any one of claims 1 to 4, characterized in that it comprises the following steps consisting of:

- disobfuscate (Ob) this obfuscated data Ob (DS) recovered

- check (VF) the integrity of the data retrieved by comparing the HX (DS) hash extracted from the combined message MC and the H (DS) hash kept by the holder To

6. Secure storage / destocking system for a source data (DS) for the implementation of the method according to any one of claims 1 to 5,

system including:

- an obfuscation function (Ob) of the source data (DS) and its reciprocal function (Ob) to disobfuscate the obfuscated data.

- a hash function (H) to hash the source data (DS).

- pairs of public / private keys Kj, Kj. (j = o ... m)