WO2021165625A1

WO2021165625A1 - Method for calculating a session key, and method for recovering such a session key

Info

Publication number: WO2021165625A1
Application number: PCT/FR2021/050300
Authority: WO
Inventors: Ghada ARFAOUI; Olivier Sanders; Adina Ioana NEDELCU
Original assignee: Orange
Priority date: 2020-02-19
Filing date: 2021-02-19
Publication date: 2021-08-26
Also published as: FR3107414A1

Abstract

The invention relates to a method for calculating a session key for two user devices U1, U2 intended to communicate, via a network managed by a management device E1, a request for recovering the key which can be authorised by an authorisation device E2 and issued by a recovery device E3, E4, a device Ej being associated with a private key sk{Ej} as well as with a public key pk{Ej} equal to g^sk{Ej}, g being a generator of a group, and a public value W equal to g^(sk{E3}sk{E4}) which has been calculated by at least one device E3, E4. The method comprises the steps of: - calculating (F10), by means of the device U1, values A, A1, A2, A3, A4, A5 which are respectively equal to g^u, pk{E1}^u, pk{E2}^u, pk{E3}^u, pk{E4}^u, W^u and transmitted (F20) to the device U2, u being a secret value of the device U1, - calculating (F30), by means of the device U2, values B, B1, B2, B3, C3, C4, D which are respectively equal to g^v, pk{E1}^v, pk{E2}^v, W^v, A3^v, A4^v, A^v and transmitted (F40) to the device U1, v being a secret value of the device U2, - calculating (F50), by means of the device U1, a value K1 equal to B1^(α1u) x B2^(α2u) x B3^((α3+α4)u), wherein αm is a hash of a quantity that is a function of pk{E1}, pk{E2}, pk{E3}, pk{E4} and a datum associated with αm, - calculating (F60), by means of the device U2, a value K2 equal to Α1^(α1v) x A2^(α2v) x A5((α3+α4)v).

Description

Method for calculating a session key, method for recovering such a session key

Prior art

The present invention belongs to the general field of cryptography. It relates more particularly to a method for calculating a session key for securing a communication session between two user entities. It also relates to a method for recovering, during a communication session between such user entities, said session key by at least one entity which differs from said two user entities. The invention finds a particularly advantageous application, although in no way limiting, in the aid for the investigation concerning the nature of exchanges carried out between two user entities, in particular when these exchanges are likely to relate to a conflicting situation, for example. example in a professional environment.

To date, many encryption techniques are known which make it possible to secure messages exchanged between two entities. These encryption techniques are based on cryptography algorithms having essentially for purpose the determination of keys thanks to which two entities, called “user entities” can encrypt / decrypt the messages which they exchange.

Some of these encryption techniques consist in particular in calculating a single secret key which is therefore intended to be commonly used by said two user entities during a future communication session. Said secret key, also called “session key”, therefore constitutes a secret shared by said user entities, and is determined by each of them at the end of a calculation method involving exchanges of different cryptographic values.

These exchanges of cryptographic values are conventionally carried out via a communication network managed by at least one so-called “management entity” and on which the future communication session is also intended to rely, once the session key has been calculated. between said user entities.

In particular situations, it is important that the session key determined by the two user entities can, although being a priori secret, be the subject of a recovery request sent by an entity, called a “recovery entity”, and authorized by an entity, called an “authorization entity”. By “recovery”, reference is made here to the recovery of the session key by the recovery entity.

The fact of recovering said session key allows the recovery entity in particular to have access to the exchanges shared between the entities, in order for example to determine the nature thereof. Such a possibility turns out to be of particular importance in multiple contexts.

For purely illustrative purposes, we can cite the case of an employee belonging to a department of a company and who is the victim of harassment on the part of the hierarchical manager of said department. This harassment can for example be characterized from electronic messages exchanged, under cover of secrecy via a session key, between the employee and the line manager. These messages also pass through a communication network internal to the company and managed by a network administrator who therefore plays the role of said management entity here. In order to have this situation of harassment recognized, said employee may contact a trusted third party such as for example a lawyer from said company and who here plays the role of said authorization entity. This lawyer can therefore initiate a dialogue with an appropriate service in the department to which said employee belongs, such as for example a service in charge of human resources and which therefore plays the role here of said recovery entity. If the lawyer authorizes it, the human resources department can launch a procedure for recovering the session key used during a communication session between the employee and his line manager who here play the role of said user entities. In this way, the human resources department can have access, with the help of the network administrator, to the messages exchanged between the employee and his line manager thanks to the session key thus retrieved, and therefore ultimately observe the harassment situation. .

In practice, the method for calculating the session key conventionally comprises transmission, from a first user entity to a second user entity, of a set of values. Such a transmission takes place in particular via the communication network managed by said at least one management entity which therefore plays the role of intermediary between said two user entities. The values of this set are values calculated by said first user entity as a function of a secret key which is specific to it as well as respective public keys of the management, authorization and recovery entities. In return, the second user entity transmits, via the network managed by said at least one management entity and to the first user entity, another set of values which it has itself calculated as a function of a secret key which it receives. is clean as well as said respective public keys of the management, authorization and recovery entities. Finally, each user entity calculates the session key from all or part of the values received from the other user entity.

Subsequently, when a recovery entity requests to recover the session key thus calculated by the user entities and used by them during a communication session, and obtains the authorization to do so from the authorization entity, a recovery method based on cooperation between said management, authorization and recovery entities is implemented. In particular, the management entity transmits to the authorization and recovery entities one of the values, called the “pivot value” which has been the subject of a transmission between the user entities during the method of calculating the session key. . Each of the management, authorization and recovery entities then calculates, as a function of this value transmitted by the management entity as well as of a secret key which is specific to it, an intermediate value. Finally, the management and authorization entities transmit their respective intermediate values to the recovery entity which can determine the session key from these received intermediate values as well as from its own intermediate value. Although effective in the case where only one recovery entity is concerned, this way of proceeding (calculation of the session key, recovery of said session key) does not nevertheless make it possible to deal satisfactorily with the case where a second entity recovery would also wish to recover said session key in order to access the communications exchanged during a communication session between the two user entities.

Indeed, if such a case were envisaged, said second recovery entity would necessarily have to receive, from the management entity, said pivot value. This results from the fact that this pivot value is essential for the calculations making it possible to retrieve the session key, given the way in which said session key is calculated by the user entities. It is therefore understood that the two recovery entities would share the same pivot value, and consequently also the same public key so that each is able to recover the same session key, which goes against possible independence. required between them.

By “independence” between recovery entities, reference is made here to situations in which it may be required that said recovery entities be independent from one another. In other words, in these situations, two recovery entities must be able to have their own keys, and not have to share the same one. Furthermore, each of these recovery entities must be able to perform the calculations for recovering a session key without the collaboration of said other entity.

To illustrate such a situation, and taking the previous example relating to a situation of harassment experienced by an employee of a company, we could consider the case where the lawyer (ie the authorization entity) would consider, for reasons of ethics, to authorize two entities to retrieve the session key: on the one hand, said human resources service of the department to which the employee belongs, and, on the other hand, another service, for example an assistance service social, belonging to a department other than that of the employee. The fact of considering a department other than that to which the employee belongs would come under a legitimate intention on the part of the lawyer, namely to prevent the said human resources department from being considered as judge and party given its membership in the employee's department.

The fact remains that the implementations proposed in the state of the art, and mentioned above, do not make it possible to respond to this problem (ie respect for the independence between two recovery entities if this ci is required), since the two services involved in this example would both be forced to use the same key. As a result, the anonymity of their respective calculations to retrieve the session key could be compromised.

Disclosure of the invention

The object of the present invention is to remedy all or part of the drawbacks of the prior art, in particular those set out above, by proposing a solution which makes it possible to calculate a session key intended to be used by two user entities to communicate with each other in a secure manner during a communication session, while offering the possibility for two recovery entities to recover said session key anonymously one vis-à-vis the other.

Note that a usual notation is used here in cryptography wherein an exponentiation is represented by the symbol ^""; and "g ^x" represents "g x power" or "g ^x"; the product of x and y is represented by a point: “. ", Or" x ", or nothing; thus "xy", "xxy" and "xy" represent "x multiplied by y".

To this end, and according to a first aspect, the invention relates to a method for calculating a session key for securing a communication session between two user devices U ₁ , U ₂ , said communication session being put in. works via a communication network managed by at least one management device E ₁ , the session key being able to be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, being associated with a public key pk {Ej} as well as a private key sk {Ej}, pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group of prime order p, a public value W equal to g ^(sk sk {E _3} _{4} E) having been calculated by at least one device recovery E ₃ , E ₄ .

Said method comprises steps of:

- calculating, by the user device U _1, values of A, A _1, A _2, A _3, A _4, A ₅ respectively equal to g ^u, pk {E _1} ^u, pk {S _2} ^u pk _{3} E ^u, E pk _{4} ^u, ^u W, U and forwarded to the user device ₂ via the management device E _1, u being a secret value U of the device _1,

- calculating, by the user device U ₂ values of B, B _1, B _2, B _3, C _3, C _4, D respectively equal to ^v g, pk {E _1} ^v, pk _{E2} ^v W ^v, a ₃ ^n, a ₄ ^n, a ⁿ and transmitted to the user device U ₁ via the management device E ₁ which stores at least C _3, C ₄ and D v is a value secret of device U ₂ ,

- calculation by the user U device _1, a value K equal to ₁ B ₁ ^(α ₁ u) x B ₂ ^(α ₂ u) x B ₃ ^((α ₃ + α ₄₎ u), where α _m , m ranging from 1 to 4, is a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and of a data associated with α _m ,

- calculation by the user U device _2, having a K value equal to ₂ A ₁ ^(α ν ₁₎ x A ₂ ^(α ₂ v) × A ₅ ^((α ₃ + α ₄₎ ν), the values K ₁ and K ₂ corresponding to said session key.

By "via the management device E ₁ ", reference is made here to the fact that data is transmitted via said communication network managed by the management device E ₁ , the latter thus fulfilling a function of relaying messages between the devices. users U ₁ , U ₂ .

It is important to note that in writing the value K ₁ , the values B ₁ , B ₂ and B ₃ are respectively raised to the powers α ₁ xu, α ₂ xu and (0 ₃ + α ₄ ) x u. Similarly, in the writing of the value K ₂ , the values A ₁ , A ₂ and A ₃ are respectively raised to the powers α ₁ xv, α ₂ xv and (α ₃ + α ₄ ) x v.

Said calculation method differs remarkably from the prior art in that it makes it possible to calculate values C ₃ and C ₄ from which the recovery devices can perform processing to recover the session key, as is detailed later.

In other words, the calculation method according to the invention is not satisfied with allowing two user devices to communicate with each other thanks to the calculated session key, but also offers the possibility that said session key can be retrieved by two communication entities. recovery and anonymously to each other.

In particular embodiments, the calculation method may also include one or more of the following characteristics, taken in isolation or in any technically possible combination.

In particular embodiments, in which the public value W is calculated by each of the two recovery entities E ₃ and E ₄ .

Such arrangements make it possible to verify whether the calculation of W by at least one of said recovery entities E ₃ , E ₄ is not tainted with an error, such an error possibly having its origin, for example, in the fact that the recovery entity. recovery in question is corrupted or else poorly configured to perform the invention. In this way, it is possible to block a recovery entity E ₃ , E ₄ whose calculation of W is erroneous in order to prevent it subsequently from recovering the session key.

The invention also proposes different modes of implementation of the calculation method, in which one or more checks are carried out in order to determine whether the different values respectively calculated by the devices U ₁ , U ₂ and E ₁ are erroneous or not, and , in the event of an erroneous calculation, allow said calculation method to be stopped.

In particular embodiments, during the transmission of the values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ from the user device U ₁ to the user device U ₂ , the management device E ₁ checks if, for a given bilinear coupling e:

- e [A ₁ , g] is equal to e [A, pk {E ₁ }],

- e [A ₂ , g] is equal to e [A, pk {E ₂ }],

- e [A ₃ , g] is equal to e [A, pk {E ₃ }],

- e [A ₄ , g] is equal to e [A, pk {E ₄ }],

- e [A ₅ , g] is equal to e [A, W], and, when transmitting values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D from user device U ₂ to the user device U ₁ , the management device E ₁ checks whether:

- e [B ₁ , g] is equal to e [B, pk {E ₁ }],

- e [B ₂ , g] is equal to e [B, pk {E ₂ }],

- e [B ₃ , g] is equal to e [B, W],

- e [C ₃ , g] is equal to e [D, pk {E ₃ }], - e [C ₄ , g] is equal to e [D, pk {E ₄ }],

- e [D, g] is equal to e [A, B], the calculation method being stopped as soon as the number of unverified equalities reaches a given threshold.

In particular modes of implementation, upon receipt of the value D from the user device U _2, U user device ₁ calculates a value D equal to A ⁿ and checks that said value D is equal to said value D, the calculation method being stopped if said equality is not verified.

In particular embodiments, a user device Ui, i ranging from 1 to 2, is associated with a public key pk {Ui} as well as a private key sk {Ui}, and:

- the user device U ₁ determines, by means of its private key sk {U ₁ }, a signature δ ₁ of a message function of pk {U ₁ }, pk {U ₂ }, A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ and N ₁ , where N ₁ is a random value, the signature δ ₁ and the value N ₁ also being transmitted to the user device U ₂ via the management device E ₁ ,

- the user device U ₂ determines, by means of its private key sk {U ₂ }, a signature δ ₂ of a message function of pk {U ₁ }, pk {U ₂ }, B, D, B ₁ , B ₂ , B ₃ and N ₂ , where N ₂ is a random value, as well as a signature δ ₃ of a message function of pk {U ₁ }, pk {U ₂ }, B, D, C ₃ , C ₄ and N ₃ , where N ₃ is a random value, the signatures δ ₂ , δ ₃ and the values N ₂ , N ₃ also being transmitted to the user device U ₁ via the management device E ₁ , the signature δ ₁ being verified by the management device E ₁ before its transmission to the user device U ₂ , as well as by said user device U ₂ after transmission, and the signatures δ ₂ and δ ₃ being verified by the management device E ₁ before their respective transmissions to the user device U ₁ , as well as by said user device U ₁ after transmission, the calculation method being stopped as soon as the number of unverified signatures reaches a given threshold.

The random value N ₁ corresponds for example to a number of the “nonce” type, this designation being well known to those skilled in the art. This remark also applies to the other random values N ₂ , N ₃ and N ₄ described below.

According to a second aspect, the invention relates to a method of communication between two user devices U ₁ , U ₂ during a communication session implemented via a communication network managed by at least one management device E ₁ , said communication session being secured by means of a session key that can be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E ₃ , E ₄ , a user device Ui, i ranging from 1 to ₂ , being associated with a public key pk {Ui} as well as with a private key sk {Ui}, a device Ej, j ranging from 1 to ₄ , being associated to a public key pk {Ej} and a private key sk {E _j}, pk {E _j} being equal to g ^sk {Ej} where g is a generator of a group of prime order p, a public value W equal to g ^(sk sk {E _3} _{4} E) having been calculated by at least one recovery device E _3, E _4, said session key being calculated according to a calculation method according to the invention.

In particular embodiments, a user device Ui, i ranging from 1 to 2, is associated with a public key pk {Ui} as well as a private key sk {Ui}, and the session key is calculated in accordance with a calculation method according to the invention.

According to a third aspect, the invention relates to a method for recovering a session key by means of which a communication session between two user devices U ₁ , U ₂ can be secured, said communication session being implemented via a communication network managed by at least one management device E ₁ , said recovery method being implemented following at least one request for recovery of said session key authorized by an authorization device E ₂ and sent by a recovery among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, being associated with a public key pk {Ej} as well as with a private key sk {Ej}, pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group of prime order p, a public value W equal to g ^(sk sk {E _3} _{4} E) having been calculated by at least one recovery device E ₃ , E ₄ , and said session key being calculated in accordance with a method of calculating the invention.

Said recovery process comprises steps of:

transmission, by the management device E ₁ , of the value D to the authorization device E _{2 as} well as of the value C ₄ to the recovery device E ₃ if said at least one recovery request is sent by said device E ₃ and / or the value C ₃ to the recovery device E ₄ if said at least one recovery request is sent by said device E ₄ ,

- calculating, by the management device E _1, a value T ₁ equal to D ^₍₁ α sk {E _1}) and transmitted to said recovery device of two recovery devices E _3, E _4,

- calculating, by E ₂ authorization device, a T ₂ value equal to α ₂ D ^{sk} {E ₂₎ and transmitted to said recovery device of two recovery devices E _3, E _4,

- calculating, by said recovery device of two recovery devices E _3, E _4, a value T equal to ₃ C ₄ ^((α ₃ + α ₄₎ E {sk} ₃₎ whether the retrieval request is emitted by said device E ₃ and / or a value T equal to ₄ C ₃ ^((α ₃ + α ₄₎ _4} E {sk) whether the retrieval request is issued by said E ₄ device,

- calculation, by said recovery device from among two recovery devices E ₃ , E ₄ , of a value K ₃ equal to T ₁ x T ₂ x T ₃ and / or of a value K ₄ equal to T ₁ x T ₂ x T ₄ , the values K ₃ and K ₄ corresponding to said recovered session key.

It is important to note that in writing the values T ₁ and T ₂ , the value D is respectively raised to the power α ₁ x sk {E ₁ } and α ₂ x sk {E ₂ }. Similarly, in writing the values T ₃ and T ₄ , the values C ₄ and C ₃ are respectively raised to the powers (α ₃ + α ₄ ) x sk {E ₃ } and (α ₃ + α ₄ ) x sk {E ₄ }. The recovery method according to the invention therefore offers the two recovery devices E ₃ and E ₄ the possibility of recovering the session key that the user devices U ₁ , U ₂ have calculated and that they use to communicate with each other during the communication session.

The recovery of said session key by the recovery devices E ₃ , E _{4 is} carried out completely invisible (ie undetectable) for said user devices U ₁ , U ₂ . This results from the fact that the recovery of the session key does not require values known only from said user devices U ₁ or U ₂ .

More specifically, the management device E ₁ and the authorization device E ₂ both use, during the recovery process, the value D initially exchanged between the user devices U ₁ , U ₂ during the calculation process. the session key (the value D is therefore seen as a pivot value from which intermediate values represented by T ₁ and T ₂ are calculated), the calculation of the value T ₃ (respectively T ₄ ) by the recovery E ₃ (respectively E ₄ ) not based in any way on this value D. In other words, and unlike the state of the art, each of the recovery devices E ₃ , E ₄ uses values which are specific to it to determine the last value T ₃ , T ₄ from which it is possible to retrieve the session key.

Furthermore, it is particularly advantageous for the recovery devices E ₃ , E _{4 to} recover the session key respectively from the values T ₃ , T ₄ . Indeed, the recovery method has the advantage of allowing the recovery devices E ₃ , E ₄ to recover the session key independently from one another given that each of these devices uses a different value, and therefore ultimately its own public key.

The fact that the session key can be recovered independently by the recovery devices E ₃ , E ₄ is important in multiple contexts, in particular when the recovery entities which respectively hold said recovery devices are independent of each other, and must remain so.

In particular embodiments, the recovery process may further include one or more of the following characteristics, taken in isolation or in any technically possible combination.

In particular modes of implementation, regardless of the number of recovery requests sent:

- the value C ₃ is also transmitted by the management device E ₁ to the recovery device E ₃ ,

- the value C ₄ is also transmitted by the management device E ₁ to the recovery device E ₄ .

Such arrangements make it possible to reinforce the security of the recovery process in that it makes it possible to avoid determining the origin of a recovery request. Indeed, given that each recovery device E ₃ , E ₄ receives the two values C ₃ , C ₄ , it becomes impossible to distinguish these recovery devices E ₃ , E ₄ from one another with regard to their possible recovery requests.

In particular embodiments, said session key is calculated in accordance with a calculation method according to the invention, and:

- the management device E ₁ transmits, before the calculations of the values T _{2 as} well as T ₃ and / or T ₄ , the signatures δ ₁ , δ ₂ , δ _{3 as} well as the values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ , N ₁ , B, B ₁ , B ₂ , B ₃ , N ₂ , N ₃ to the authorization device E ₂ as well as to the recovery device among two recovery devices E ₃ , E ₄ ,

- the authorization device E ₂ verifies the signatures δ ₁ , α ₂ , δ ₃ before calculating the value T ₂ ,

- said recovery device from among two recovery devices E ₃ , E ₄ verifies the signatures δ ₁ , δ ₂ , δ ₃ before calculating the value T ₃ and / or T ₄ , the recovery process being stopped as soon as the number of unverified signatures reaches a given threshold.

According to a fourth aspect, the invention relates to a set of computer programs comprising instructions for the implementation of a method for calculating a session key according to the invention or of a communication method according to the. invention or of a recovery method according to the invention when said set of programs is executed by one or more computers.

A program of said set of programs can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in n any other desirable shape.

According to a fifth aspect, the invention relates to an information or recording medium readable by a computer on which is recorded a set of computer programs according to the invention or a computer program belonging to a set of computer programs. computer according to the invention.

The information or recording medium can be any entity or device capable of storing the program (s). For example, the medium may comprise a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or else a magnetic recording means, for example a floppy disk or a disk. hard.

On the other hand, the information or recording medium can be a transmissible medium such as an electrical or optical signal, which can be conveyed via an electrical or optical cable, by radio or by other means. The set of programs according to the invention, or a program of said set of programs, can in particular be downloaded over an Internet type network.

Alternatively, the information or recording medium can be an integrated circuit in which the program or programs are incorporated, the circuit being adapted to execute or to be used in the execution of the method in question.

According to a sixth aspect, the invention relates to a user device U ₁ for calculating a session key for securing a communication session between said user device U ₁ and a user device U ₂ , said communication session being implemented via a communication network managed by a management device E ₁ , the session key possibly being the subject of at least one recovery request authorized by a device d authorization E ₂ and issued by a recovery device from among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, being associated with a public key pk {Ej} as well as with a private key Ej {sk}, {Ej} pk being equal to g ^sk {Ej} where g is a generator of a group of prime order p.

Said user device U ₁ comprises:

- a first calculation module configured to calculate values A, A _1, A _2, A _3, A _4, A ₅ respectively equal to g ^u, pk {E _1} ^u, pk {S _2} ^u pk _{3} E ^u, E pk _{4} ^u, W ^u, u being a secret value U of the device _1, and W is a public value calculated by at least one recovery device E _3, E ₄ and equal to g ^(sk sk {E _3} _{4} E),

- a communication module, configured to transmit said values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ to the user device U ₂ via the management device E ₁ , said communication module also being configured to receive , from the user U and device ₂ via the management device E _1, the values B, B _1, B _2, B _3, C _3, C _4, D calculated by said U user device ₂ and respectively equal to ^g v, pk {E _1} ^v, pk {S _2} ^v W ^v, a ₃ ^n, a ₄ ^n, a ^n, v being a secret value U device _2,

- a second calculation module configured to calculate a value K equal to ₁ B ₁ ^(α ₁ u) x B ₂ ^(α ₂ U) x B ₃ ^((α ₃ + α ₄₎ u), where α _m , m ranging from 1 to 4, is a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and of a data associated with α _m .

According to a seventh aspect, the invention relates to a user device U ₂ for calculating a session key for securing a communication session between said user device U ₂ and a user device U ₁ , said communication session being implemented via a communication network managed by a management device E ₁ , the session key being able to be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, being associated with a public key pk {Ej} as well as a private key sk {Ej}, pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group of prime order p.

Said user device U ₂ comprises:

- a communication module, configured to receive, from the user device U ₁ and via the management device E ₁ , values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ calculated by the user device U ₁ and respectively equal to g ^u, pk {E _1} ^u, pk _{2} E ^u, E ₃ {pk} ^u, pk {S _4} ^u, W ^u, u being a secret value U of the device _1, and W is a public value calculated by at least one recovery device E _3, E ₄ and equal to g ^(sk sk {E _3} _{4} E),

- a first calculation module configured to calculate B, B values _1, B _2, B _3, C _3, C _4, D respectively equal to ^v g, pk {E _1} ^v, pk _{E2} ^v W ^v, a ₃ ^n, a ₄ ^n, a ^n, v being a secret value U ₂ device, said communication module further being configured to transmit said values B, B _1, B ₂ , B ₃ , C ₃ , C ₄ , D to the device U ₁ via the management entity E ₁ , - a second calculation module configured to calculate a K value equal to ₂ A ₁ ^(α ν ₁₎ x A ₂ ^(α ₂ ν) x A ₅ ^((α ₁ + α ₄₎ ν), where α _m , m ranging from 1 to 4, is a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and of a data associated with α _m .

According to an eighth aspect, the invention relates to a management device E ₁ of a communication network via which a communication session between two user devices U ₁ , U ₂ is intended to be implemented, said communication session being secure. by means of a session key that can be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, associated with a public key pk {ej} and a private key sk {ej}, pk {Ej} being equal to g ^sk {Ej} where g is a generator of 'a first-order group p.

Said management device E ₁ comprises a communication module, configured to transmit:

- the user device U ₁ to U user device _2, the values A, A _1, A _2, A _3, A _4, A ₅ respectively equal to g ^u, pk {E _1} ^u, pk {E ₂ ^u}, {pk} ^u E _3, E _4} {pk ^u, W ^u, u being a secret value U of the device _1, and W is a public value calculated by at least one recovery device E ₃ , E ₄ and equal to g ^(sk sk {E _3} _{4} E),

- U ₂ U user device to the user device _1, values of B, B _1, B _2, B _3, C _3, C _4, D respectively equal to ^v g, pk {E _1} ^v, pk { E _2} ^v W ^v, a ₃ ^n, a ₄ ^n, a ^n, v being a secret value U of device _2, and further comprises:

- a storage module, configured to store at least C ₃ , C ₄ , D,

- a calculation module configured to calculate a value equal to D T ₁ ^(α ₁ E sk _{1}), where α ₁ is a hash function of an amount of pk {E _1}, {pk} E ₂ , pk {E ₃ }, pk {E ₄ } and data associated with α ₁ , said communication module being further configured to transmit:

- the value D to the authorization device E ₂ ,

the value C ₄ to the device E ₃ if said at least one recovery request is sent by said device E ₃ and / or the value C ₃ to the device E ₄ if said at least one recovery request is sent by said device E ₄ ,

- the value T _{1 to} said recovery device among two recovery devices E ₃ , E ₄ .

According to a ninth aspect, the invention relates to an authorization device E ₂ for authorizing at least one request for the recovery of a session key for securing a communication session between two user devices U ₁ , U ₂ , said communication session being implemented via a communication network managed by a management device E ₁ and said at least one recovery request being sent by a recovery device from among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk {Ej} where g is a generator first order group p. Said authorization device E ₂ comprises a communication module, configured for:

- send, to said at least one recovery device from among two recovery devices E ₃ , E ₄ , an authorization of said at least recovery request,

- receiving, from the management device ₁ E, a value D stored by said management device E ₁ and equal to A ^n, A being equal to ^u g, u and v being respective secret values user devices U ₁ and U _2, and further comprises a calculating module configured to calculate a value equal to T ₂ D ^(α ₂ {Sk} E _2), where α ₂ is a hash function of an amount of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and data associated with α ₂ , said communication module being further configured to transmit said value T _{2 to} said recovery device among two recovery devices E ₃ , E ₄ .

According to a tenth aspect, the invention relates to a recovery device E ₃ , E ₄ capable of sending a request for recovery of a session key for securing a communication session between two user devices U ₁ , U ₂ , said communication session being implemented via a communication network managed by a management device E ₁ and said at least one recovery request being authorized by an authorization device E ₂ , a device Ej, j ranging from 1 to 4 , being associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group of order prime p .

Said recovery device E ₃ , E ₄ comprises a communication module configured for:

- issue a request to retrieve the session key,

- receiving, from the management device E _1, a value T ₁ equal to D ^₍₁ α sk {E _1}), where α ₁ is a hash function of an amount of pk {E _1}, {pk E _2}, {pk} E _3, E _4} {pk and data associated to α ₁ and a value C equal to a ₃ ₃ ⁿ or C ₄ value equal to a ₄ ^n, A ₃ is equal to pk {E} ^u ₃ and A ₄ being equal to pk {E} ^u _4, u and v being respective secret values U user devices ₁ and U _2,

- receiving from the E ₂ authorization device, a value equal to T ₂ D ^(α ₂ {sk} E _2), where α ₂ is a hash function of an amount of pk {E _1}, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and a data associated with α ₂ .

Said recovery device E ₃ , E _{4 further} comprises:

- a first calculation module configured to calculate a public value W equal to g ^(sk sk {E _3} _{4} E),

- a second calculation module configured to calculate a value equal to T ₃ C ₄ ^((α ₃ + α ₄₎ sk _{3} E) if the value received from the management device E ₁ among the _three values C and C ₄ is said value C ₄ or a value T equal to ₄ C ₃ ^((α ₃ + α ₄₎ _4} E {sk) if the value received from the management device E ₁ among the values C ₃ and C ₄ is said value C ₃ ,

a third calculation module, configured to calculate a value K ₃ equal to T ₁ x T ₂ x T ₃ or a value K ₄ equal to T ₁ x T ₂ x T ₄ . According to an eleventh aspect, the invention relates to a system for calculating a session key, said system comprising user device U ₁ according to the invention, a user device U ₂ according to the invention as well as a management device E ₁ according to the invention.

According to a twelfth aspect, the invention relates to a system for recovering a session key calculated by a user device U ₁ according to the invention and also calculated by a user device U ₂ according to the invention, said system comprising a device management E ₁ according to the invention, an authorization device E ₂ according to the invention and two recovery devices E ₃ , E ₄ according to the invention.

Brief description of the drawings

Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended drawings which illustrate an exemplary embodiment thereof without any limiting nature. In the figures:

- Figure 1 schematically shows, in its environment, an embodiment of a computing system according to the invention, said computing system comprising a user device U ₁ , a user device U ₂ and a management device E ₁ ;

FIG. 2 schematically represents an example of the hardware architecture of the user device U ₁ of FIG. 1;

FIG. ₃ diagrammatically represents an example of the hardware architecture of the user device U ₂ of FIG. 1;

FIG. 4 diagrammatically represents an example of the hardware architecture of the management device E ₁ of FIG. 1;

FIG. 5 represents, in the form of a flowchart, the main steps of a method for calculating the session key according to the invention, as they are implemented by the calculation system of FIG. 1;

FIG. 6 represents, in the form of a flowchart, a first particular mode of implementation of the calculation method of FIG. 5;

FIG. 7 represents, in the form of a flowchart, a second particular embodiment of the calculation method of FIG. 5;

FIG. 8 represents, in the form of a flowchart, a third particular embodiment of the calculation method of FIG. 5;

FIG. 9 diagrammatically represents, in its environment, an embodiment of a system for the recovery of a session key calculated by the devices U ₁ , U ₂ of the calculation system of FIG. 1, said system for the recovery comprising the management device E ₁ , an authorization device E ₂ and two recovery devices E ₃ and E ₄ ;

FIG. 10 diagrammatically represents an example of the hardware architecture of the authorization device E ₂ of FIG. 9; FIG. 11 schematically represents an example of the hardware architecture of the recovery device E ₃ of FIG. 1;

- Figure 1 ₂ schematically shows an example of hardware architecture of the recovery device E ₄ of Figure 1;

FIG. 1 ₃ represents, in the form of a flowchart, the main steps of the method for recovering a session key according to the invention, as implemented by the recovery system of FIG. 9;

FIG. 14 represents, in the form of a flowchart, a particular embodiment of the recovery method of FIG. 1 ₃ .

Description of the embodiments

FIG. 1 schematically represents, in its environment, an embodiment of a calculation system 10 according to the invention.

According to the invention, the calculation system 10 comprises two user devices U ₁ , U ₂ .

In the embodiment illustrated by FIG. 1, the user devices U ₁ , U ₂ are mobile terminals owned by respective user entities. Such a mobile terminal is for example a smart phone or “smartphone”, a digital tablet, a laptop computer, etc. The user entity holding a user device Ui, i being an index ranging from 1 to ₂ , is for its part a natural person.

It should however be noted that no limitation is attached to the nature of said user devices U ₁ , U ₂ as long as the latter are configured to send and receive between them, via a communication network, messages comprising one or more cryptographic values, as well as performing calculations based on cryptographic values, as described in more detail later. Thus, it is possible to envisage that at least one of said user devices U ₁ , U ₂ is a fixed terminal. Moreover, nothing excludes considering that said user devices U ₁ , U ₂ are not both terminals.

The communication network used by said user devices U ₁ , U ₂ to send and receive messages between them is managed by at least one management device E ₁ . This management device E ₁ is typically owned by a management entity.

In the embodiment illustrated by FIG. 1, said management device E ₁ is a fixed computer owned by a natural person.

Nevertheless, here again, the invention remains applicable regardless of the nature of said management device E _{1 as} soon as the latter is configured for, as is described in more detail later: - transmitting, via said communication network, messages that the user devices U ₁ , U ₂ send to each other, the management device E ₁ thus fulfilling a function of relaying messages between the user devices U ₁ , U ₂ ,

- performing various cryptographic processing (calculations, or even verification of cryptographic signatures and / or verification of equality in particular embodiments),

- send messages comprising cryptographic values to devices other than said user devices U ₁ , U ₂ .

It should be noted that the invention also remains applicable in the case where the management entity is a legal person and / or at least one of the user entities is a legal person, this aspect not constituting a limiting factor of the invention. .

For the remainder of the description, it is considered in no way limiting that said communication network is a wireless network. However, considering a wireless communication network only constitutes an alternative embodiment of the invention. Nothing in fact excludes considering a wired communication network when the user devices U ₁ , U ₂ and the management device E ₁ are able to use it, that is to say able to communicate via this one.

The message exchange (s) between the user devices U ₁ , U ₂ , and via the management device E ₁ , take place during a communication session which is implemented via said communication network. In addition, and in accordance with the invention, said user devices U ₁ , U ₂ are configured to calculate, in cooperation with the management device E ₁ , a session key to secure such a communication session, by implementing a method of calculating a session key detailed later. Having regard to this cooperation between the various devices of the system 10, said system 10 has as its objective the calculation of a session key.

As a result, a session key is linked to the communication session for which it is calculated. In other words, a communication session being by nature limited in time, the session key is only valid for the duration of the communication session associated with it. In addition, and preferably, two distinct communication sessions are respectively associated with two distinct session keys.

Furthermore, and in accordance with the invention, the session key can be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E _3. , E ₄ .

As already mentioned previously, the term “recovery” refers here to the recovery of the session key by a recovery entity. The nature of said authorization E ₂ and recovery _{devices E 3} , E ₄ , their respective hardware and software configurations as well as the aspects of the invention relating to the possibility of recovering the session key are described in more detail later.

Note that Ton used thereafter a usual notation cryptography wherein an exponentiation is represented by the symbol ^""; and "g ^x" represents "g x power" or "g ^x"; the product of x and y is represented by a point: “. ", Or" x ", or nothing; thus "xy", "xxy" and "xy" represent "x multiplied by y".

Each device is associated with a public key as well as a private key. More precisely, the following notations are adopted:

- a user device Ui, i ranging from 1 to 2, is associated with a public key pk {Ui} as well as a private key sk {Ui} (said public key pk {Ui} being, in a manner known per se, associated with, ie calculated from, the private key sk {Ui} in this embodiment), and

- a device Ej, j ranging from 1 to 4, is associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group G of prime order p (said public key pk {Ei} being, in a manner known per se, associated with, ie calculated from, the private key sk {Ei} in this embodiment) .

For the remainder of the description, it is considered in no way limiting that the group G, the generator g and the prime number p are parameters made public and obtained by means of an initialization method (also called “Setup” in the description. English literature) parameterized by a parameter l called “security parameter” aiming to define a homogeneous level of security between potentially very different cryptographic algorithms. More particularly, to speak of a level of security defined by the parameter l amounts to considering a level of security at least equivalent to that obtained by virtue of a symmetric algorithm whose key comprises l bits. By way of example, said security parameter l comprises 1 ₂ 8 bits.

Conventionally, said “Setup” initialization method also makes it possible to generate, in addition to the parameters G, g and p, a bilinear coupling e on the group G as well as a hash function H which are also made public. Conventionally, the hash function H is able to transform any string of bits into an integer, for example an integer between 0 and p-1. Said hash function H can correspond to a standardized function, such as for example the SHA ₂ 56 function ("SHA" being the acronym of the English expression "Secure Hash Algorithm") or even the SHA ₃ function.

The implementation of such a “Setup” initialization method is carried out conventionally by means of suitable software means, such as for example a computer program dedicated to cryptographic computation and executed by a computer type processing device. Said processing device may be a device external to the computing system 10 or else be one of the devices of said computing system 10 or else one of said authorization E ₂ or recovery _{devices E 3} , E ₄ . In any event, said “Setup” initialization method is well known to those skilled in the art, and is therefore not described further here.

It should however be noted that the invention is not limited to the implementation of said “Setup” initialization method. Indeed, any method known to those skilled in the art for generating public / private keys, in particular via a generator of a first order group, as well as a bilinear coupling on such a group and a hash function can be implemented, and the choice of a particular method constitutes only one variant of implementation of the invention. FIG. 2 schematically represents an example of the hardware architecture of the user device U ₁ according to the invention.

As illustrated by FIG. 2, the user device U ₁ according to the invention has the hardware architecture of a computer. Thus, said user device U ₁ comprises, in particular, a processor 1_U ₁ , a random access memory 2_U ₁ , a ROM 3_U ₁ and a non-volatile memory 4_U ₁ . It also has 5_U ₁ communication means.

The communication means 5_U ₁ allow in particular the user device U ₁ to send, via said management device E ₁ , cryptographic values to the user device U ₂ , as well as to receive, also via said management device E ₁ , values cryptographic data originating from said user device U ₂ . To this end, the communication means 5_U ₁ comprise a communication interface compatible with the nature of the communication network, namely wireless in this exemplary embodiment. Thus, the communication interface means of communication 5_U ₁ is not wired and qu'apte to implement any suitable protocol known to the skilled person (WiFi, Bluetooth, _3G, 4G, 5G, etc. ). Of course, if, according to other exemplary embodiments, the nature of the communication network was wired, the communication interface would be adapted accordingly.

The read-only memory 3_U ₁ of the user device U ₁ constitutes a recording medium in accordance with the invention, readable by the processor 1_U ₁ and on which is recorded a computer program PROG_U _{1 in} accordance with the invention, comprising instructions for the execution of at least part of the steps of the method for calculating a session key according to the invention. The program PROG_U ₁ defines functional modules of the user device U ₁ , which are based on or control the hardware elements 2_U ₁ to 5_U _{1 of} said user device U ₁ mentioned above, and which include in particular:

- a first calculation module MOD_CALC1_U ₁ configured to calculate values A, A _1, A _2, A _3, A _4, A ₅ respectively equal to g ^u, pk {E _1} ^u, pk _{E2} ^u, E ₃ {pk} ^u, pk {S _4} ^u, W ^u, u being a secret value U of the device ₁ randomly chosen in the group Z / pZ, and W being a public value calculated by the least one recovery device E _3, E ₄ and equal to g ^(sk sk {E _3} _{4} E),

a MOD_COM_U ₁ communication module, configured to transmit said values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ to the user device U ₂ via the management device E ₁ , said MOD_COM_U ₁ communication module being in further configured to receive, from the user device U ₂ and via the management device E ₁ , values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D calculated by said user device U ₂ and respectively equal to ^v g, pk {E _1} ^v, pk {S _2} ^v W ^v, a ₃ ^n, a ₄ ^n, a ^n, v being a secret value U device ₂ pulled randomly in the Z / pZ group,

- a second module MOD_CALC2_U _1, configured to calculate a K value equal to ₁ B ₁ ^(α ₁ u) x B ₂ ^(α ₂ U) x B ₃ ^((α ₃ + α ₄₎ u), where α _m , m ranging from 1 to 4, is a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and of a data associated with α _m .

By way of non-limiting example, said quantity is generated using the hash function H mentioned above and obtained following the implementation of the initialization method "Setup". Furthermore, in this example, said data item associated with α _m corresponds to said index m. In summary, we have that α _m is equal to H (pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ }, m), the part of the argument of H formed by values pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } corresponding to a concatenation of the bits forming each of said values pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ }.

It should however be noted that no limitation is attached to the hash function that can be considered for the calculation of α _m . In other words, nothing excludes considering a hash function which differs from said function H, the person skilled in the art being able to access or generate a hash function different from H. Moreover, nothing is 'also excludes considering a datum associated with α _m which is not equal to m, such as for example a datum equal to f (m) where f is a strictly increasing function with integer values.

Finally, the invention is no more limited by the fact that the calculation of α _{m is} carried out by virtue of a hash function. Thus, nothing excludes considering any other method known to those skilled in the art so that α _m corresponds to a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and a data associated with α _m , this quantity being of reduced size by contribution to the sum of the respective sizes of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and the data associated with α _m .

In a particular exemplary embodiment, said first and second calculation modules MOD_CALC1_U ₁ , MOD_CALC2_U ₁ are integrated into one and the same calculation module, called “general module”. To this end, said general module comprises means configured in a hardware and / or software manner to perform the functions associated with each of said first and second calculation module MOD_CALC1_U ₁ , MOD_CALC2_U ₁ .

The user device U ₂ according to the invention also has the hardware architecture of a computer, an example of which is illustrated schematically in FIG. _3.

Thus, said user device U ₂ comprises, in particular, a processor 1_U ₂ , a random access memory 2_L) ₂ , a read only memory 3_L) ₂ and a non-volatile memory 4_L) ₂ . It also has means of communication 5_L) ₂ .

The communication means 5_L) _{2 in} particular allow the user device U ₂ to send (respectively receive), via said management device E ₁ , cryptographic values to the user device U ₁ (respectively from the user device U ₁ ), and are similar, at least as regards the communication interface, to the communication means 5_U ₁ described above for the user device U ₁ .

The read only memory 3_L) ₂ of the user device U ₂ constitutes a recording medium in accordance with the invention, readable by the processor 1_U ₂ and on which is recorded a computer program PROG_L) _{2 in} accordance with the invention, comprising instructions for the execution of at least part of the steps of the method for calculating a session key according to the invention. The program PROG_ U ₂ defines functional modules of the user device U ₂ , which are based on or control the hardware elements 2_U2 to 5_U _{2 of} said user device U ₂ mentioned above, and which include in particular: - a communication module MOD_COM_L) ₂ , configured to receive, from the user device U ₁ and via the management device E ₁ , said values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ calculated by the user device U ₁ ,

- a first calculation module MOD_CALCl_L) ₂ , configured to calculate said values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D, said communication module MOD_CALCl_L) ₂ being further configured to transmit said values B , B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D to the device U ₁ via the management entity E ₁ ,

- a second calculation module MOD_CALC2_L) _2, configured to calculate a K value equal to ₂ A ₁ ^(α ν ₁₎ x A ₂ ^(ν ₂₎ x A ₅ ^((α ₃ + α _4.) Ν ).

In a particular exemplary embodiment, said first and second calculation modules MOD_CALCl_L) ₂ , MOD_CALC2_L) ₂ are integrated into one and the same calculation module, called “general module”. For this purpose, said general module comprises means configured in a hardware and / or software manner to perform the functions associated with each of said first and second calculation module MOD_CALCl_U ₂ , MOD_CALC2_U ₂ .

Finally, the management device E ₁ according to the invention also has the hardware architecture of a computer, an example of which is illustrated schematically in FIG. 4.

Thus, said management device E ₁ comprises, in particular, a processor I_E ₁ , a random access memory 2_E ₁ , a read only memory 3_E ₁ and a non-volatile memory 4_E ₁ . It also has means of communication 5_E ₁ .

The communication means 5_E ₁ notably allow the management device E ₁ to transmit cryptographic values between the user devices U ₁ and U ₂ and are similar, at least as regards the communication interface, to the communication means 5_U ₁ and 5_U ₂ described above for user devices U ₁ and U ₂ .

The read only memory 3_E ₁ of the management device E ₁ constitutes a recording medium in accordance with the invention, readable by the processor I_E ₁ and on which is recorded a computer program PROG_E _{1 in} accordance with the invention, comprising instructions for the execution of at least part of the steps of the method for calculating a session key according to the invention. The program PROG_ E ₁ defines functional modules of the management device E ₁ , which are based on or control the hardware elements 2_E ₁ to 5_E _{1 of} said management device E ₁ mentioned above, and which notably include a communication module MOD_COM_E ₁ , configured to transmit:

- from user device U ₁ to user device U ₂ , said values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ ,

- from the user device U ₂ to the user device U ₁ , said values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D, and which further include a storage module MOD_MEM_E ₁ , configured to store at minus the values C ₃ , C ₄ , D.

By way of non-limiting example, said storage module MOD_MEM_E ₁ may correspond to all or part of the non-volatile memory 4_E ₁ fitted to the management device E ₁ . It should be noted that, in accordance with the invention, said computer programs PROG_U ₁ , PROG_L) ₂ and PROG_E ₁ can belong to the same set of computer programs, each device U ₁ , U ₂ , E ₁ being capable to obtain, for example via a download and thanks to the means of communication which equip it, the program PROG_U ₁ , PROG_L) ₂ , PROG_E ₁ which is associated with it from said set of programs.

FIG. 5 represents, in the form of a flowchart, the main steps of the method for calculating the session key according to the invention, as implemented by the calculation system 10 of FIG. 1.

Said calculation method is executed during a communication session between the user devices U ₁ , U ₂ , said communication session being implemented via the communication network managed by the management entity E ₁ and for example initiated by user device U ₁ . No limitation is however attached to the user device at the origin of said communication session, this user device can therefore be U _{2 as} an alternative.

For the remainder of the description, it is considered that the hash function used for the calculation of α _m , m ranging from 1 to 4, is the hash function H obtained following the implementation of the initialization method "Setup ".

According to the invention, the calculation process is carried out while a public value W equal to g ^(sk sk} {E ₃ {E4}) has already been calculated by at least one recovery device E _3, E ₄ . This calculation is implemented by a first calculation module MOD_CALCl_E ₃ , MOD_CALCl_E ₄ equipping said at least one recovery device E ₃ , E ₄ . As mentioned previously, the hardware and software configuration of said at least one recovery device E ₃ , E ₄ , including in particular said calculation module MOD_CALCl_E ₃ , MOD_CALCl_E ₄ , is detailed later in relation to aspects of the invention relating to the possibility to retrieve the session key.

Is of course understood that if W is calculated by the recovering device E _3, this calculation is carried out by raising to the power E {sk} _3, which is the secret key of E _3, the quantity g ^sk {E4} which corresponds to pk {E ₄ } and which is therefore public. Conversely, if W is calculated by the recovering device E _4, this calculation is carried out by raising the power sk {S _4}, which is the secret key E _4, the amount g ^sk E _{3} which corresponds at pk {E ₃ } and which is therefore public.

In a more particular example of implementation, the public value W is calculated by each of the two recovery entities E ₃ and E ₄ . Proceeding in this way offers the possibility of verifying whether the calculation of W by at least one of said recovery entities E ₃ , E ₄ is not vitiated by an error, such an error being able for example to find its origin in the fact that the entity recovery device in question is corrupted or else poorly configured to perform the invention. In this way, it is possible to prevent the calculation of the session key by the user devices U ₁ , U ₂ .

Therefore, the calculation method firstly comprises a step F10 for calculating, by the user device U ₁ , said values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ . This calculation step F10 is implemented by the first calculation module MOD_CALC1_U ₁ equipping said user device U ₁ . It should be noted that the secret value u is determined during a communication session. Consequently, the value A, which is itself also calculated during said communication session, can be considered as being a public key of the user device U 1 dedicated to this session.

Then, the calculation method comprises a step F20 of transmitting said values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ to the user device U ₂ via the management device E ₁ . This transmission step F ₂ 0 is implemented by the communication modules MOD_COM_U ₁ , MOD_COM_L) ₂ , MOD_COM_E ₁ respectively equipping said devices U ₁ , U ₂ , E ₁ .

The calculation method then comprises a step F30 of calculation, by the user device U ₂ , of said values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D. This calculation step F30 is implemented by the first calculation module MOD_CALCl_L) ₂ equipping said user device U ₂ .

According to arrangements similar to those mentioned above with regard to the value A, the secret value v is determined during the communication session. Consequently, the value B, which is itself also calculated during said communication session, can be considered as being a public key of the user device U ₂ dedicated to this session.

Then, the calculation method comprises a step F40 of transmitting said values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D to the user device U ₁ via the management device E ₁ which stores C ₃ , C ₄ and D during this transmission. This transmission step F40 is implemented by the communication modules MOD_COM_U ₁ , MOD_COM_L) ₂ , MOD_COM_E ₁ respectively equipping said devices U ₁ , U ₂ , E ₁ . In addition, said storage is implemented by the storage module MOD_MEM_E ₁ equipping said management device E ₁ .

The calculation method also comprises a step F50 of calculation, by the user device U _1, said value K equal to ₁ B ₁ ^(α ₁ u) x B ₂ ^(α ₂ U) x B ₃ ^((α ₃ + α ₄ ) u). Said calculation step F50 is implemented by the second calculation module MOD_CALC2_U ₁ equipping the user device U ₁ .

U user device _2, meanwhile, calculates in a step F60 of the calculation procedure said value K ₂ equal to A ₁ ^(α ν ₁₎ x A ₂ ^(α ₂ ν) x A ₅ ⁽ (α ₃ + α ₄ ) ν). Said calculation step F760 is implemented by the second calculation module MOD_CALC2_L) ₂ equipping the user device U ₂ .

No limitation is attached to the order in which said calculation steps F50 and F60 are executed. For example, the calculation step F50 is executed before the calculation step F60, or else vice versa. According to yet another example, said calculation steps F50 and F60 are executed in a synchronized manner.

Ultimately, at the end of the calculation method, the user devices U ₁ and U ₂ are respectively in possession of the values K ₁ and K ₂ . However, these values K ₁ and K ₂ are equal to each other, as can easily be verified. Said values K ₁ and K _{2 therefore} correspond to said session key from which said user devices U ₁ and U ₂ can communicate in a secure manner during the communication session. The remainder of the description aims to detail different modes of implementation of the calculation method, in which one or more checks are carried out in order to determine whether the different values respectively calculated by the devices U ₁ , U ₂ and E ₁ are erroneous or no, and, in the event of an erroneous calculation, allow said calculation process to be stopped.

FIG. 6 represents, in the form of a flowchart, a first particular mode of implementation of the calculation method of FIG. 5.

In said first particular mode illustrated by FIG. 6, the bilinear coupling involved in the verification calculations detailed below is the bilinear coupling e obtained following the implementation of the “Setup” initialization method.

As illustrated by FIG. 6, and initially, during step F20, the management device E ₁ verifies (for example using a verification module not illustrated in the figures), during the transmission of the values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ from user device U ₁ to user device U ₂ , if:

- e [A ₁ , g] is equal to e [A, pk {E ₁ }],

- e [A ₂ , g] is equal to e [A, pk {E ₂ }],

- e [A ₃ , g] is equal to e [A, pk {E ₃ }],

- e [A ₄ , g] is equal to e [A, pk {E ₄ }],

- e [A ₅ , g] is equal to e [A, W].

Then, in a second step, during step F40, the management device E ₁ checks, during the transmission of the values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D of the user device U ₂ to user device U ₁ , if:

- e [B ₁ , g] is equal to e [B, pk {E ₁ }],

- e [B ₂ , g] is equal to e [B, pk {E ₂ }],

- e [B ₃ , g] is equal to e [B, W],

- e [C ₃ , g] is equal to e [D, pk {E ₃ }],

- e [C ₄ , g] is equal to e [D, pk {E ₄ }],

- e [D, g] is equal to e [A, B].

The calculation method is then stopped as soon as the number of unverified equalities reaches a given threshold. No limitation is attached to the value of said threshold. For example, the calculation method can be stopped as soon as the first considered equality is not verified.

In addition, it should be noted that the order in which said equalities are considered during each transmission (step F ₂ 0 or step F40) is not limiting, the choice of a particular order constituting only one variant. implementation of the invention.

FIG. 7 represents, in the form of a flowchart, a second particular embodiment of the calculation method of FIG. 5.

In said second particular mode illustrated by FIG. 7, the user device U ₁ calculates (step F45_l, for example implemented by means of a third calculation module of the user device U ₂ not illustrated in the figures), following the reception of the D value from user device U ₂ , a value D ′ equal to A ^v and verifies (for example using a verification module not illustrated in the figures) that said value D ′ is equal to said value D.

The calculation method then being stopped if said equality between the values D ′ and D is not verified.

FIG. 8 represents, in the form of a flowchart, a third particular embodiment of the calculation method of FIG. 5.

In said third particular mode illustrated by FIG. 8, various cryptographic signatures are calculated by the user devices U ₁ , U ₂ , these signatures being further verified.

More particularly, the user device U ₁ determines (step F15, for example implemented by means of a module for determining the signature of the user device U ₁ not illustrated in the figures), by means of its private key sk {U ₁ }, a signature δ ₁ of a message M ₁ function of pk {U ₁ }, pk {U ₂ }, A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ and N ₁ , where N ₁ is a value random, the signature δ ₁ and the value N ₁ also being transmitted to the user device U ₂ via the management device E ₁ .

The user device U ₂ , for its part, determines (step F ₃ 5, for example implemented by means of a signature determination module of the user device U ₂ not illustrated in the figures), by means of its private key sk { U ₂ }, a signature δ ₂ of a message M ₂ function of pk {L) ₁ }, pk {U ₂ }, B, D, B ₁ , B ₂ , B ₃ and N ₂ , where N ₂ is a random value, as well as a signature δ ₃ of a message M ₃ function of pk {U ₁ }, pk {U ₂ }, B, D, C ₃ , C ₄ and N ₃ , where N ₃ is a random value , the signatures δ ₂ , δ ₃ and the values N ₂ , N ₃ also being transmitted to the user device U ₁ via the management device E ₁ .

Finally, the signature δ ₁ is verified (step F ₂ 0) by the management device E ₁ before its transmission to the user device U ₂ , as well as by said user device U ₂ (step F ₂ 5) after transmission. In addition, the signatures δ ₂ and δ ₃ are verified (step F40) by the management device E ₁ before their respective transmissions to the user device U ₁ , as well as by said user device U ₁ (step F45_ ₂ ) after transmission. These verifications are for example implemented by verification modules respectively equipping the user device U ₂ and the management device E ₁ , and not illustrated in the figures.

The calculation method is stopped as soon as the number of unverified signatures reaches a given threshold. For example, this threshold can be equal to 1.

The concept of cryptographic signature (also called digital signature or else electronic signature), as well as that of verification of a cryptographic signature, are well known to those skilled in the art, and are therefore not detailed further here. It is recalled only that the determination and verification of such signatures makes it possible to authenticate the devices at the origin of the calculations of the various data and values exchanged on the communication network.

It should be noted that said first, second and third particular modes, described above with reference respectively to FIGS. 7, 8 and 9, can be combined with one another in any technically operable combination. For example, said first and second particular modes can be implemented during the calculation process. According to another example, said second and third particular modes can be implemented during said calculation method.

In a preferred example, said first, second and third particular modes are all three implemented during the calculation process. Proceeding in this way advantageously makes it possible to optimize the security of said calculation method.

Once the session key K ₁ , K _{2 has been} calculated by the user devices U ₁ , U ₂ , said user devices U ₁ , U ₂ can communicate securely by implementing a communication method according to the invention. The implementation of such a communication method is carried out in a manner known per se, the user devices U ₁ , U ₂ using said session key to encrypt the messages they wish to exchange via the managed communication network. by the management device E ₁ and during the communication session during which the session key was calculated.

As mentioned previously, the session key K ₁ , K ₂ can be the subject of at least one recovery request authorized by the authorization device E ₂ and sent by a recovery device from among said two recovery devices E ₃ , E ₄ . The remainder of the description now aims to detail the aspects of the invention linked to the recovery of said session key K ₁ , K ₂ by said recovery devices E ₃ , E ₄ .

FIG. 9 schematically represents, in its environment, an embodiment of a system ₂ 0 for the recovery of the session key K ₁ , K ₂ calculated by said devices U ₁ , U ₂ .

The system ₂ 0 for the recovery of the session key K ₁ , K ₂ comprises the management device E ₁ of the calculation system 10 described above with reference to FIG. 1.

Moreover, and as illustrated by FIG. 9, said system ₂ 0 for the recovery of the session key K ₁ , K ₂ comprises said authorization device E ₂ , the latter being held by a management entity.

In the present embodiment, said authorization device E ₂ is a fixed computer owned by a natural person.

It should however be noted that no limitation is attached to the nature of said authorization device E ₂ when the latter is configured to send and receive, via the communication network, messages comprising one or more cryptographic values, as well as performing various cryptographic processing (calculations, or even verification of cryptographic signatures), as described in more detail later.

Finally, and as illustrated by FIG. 9, the system ₂ 0 for the recovery of the session key K ₁ , K ₂ also comprises said two recovery devices E ₃ and E ₄ respectively held by two separate recovery entities.

In this embodiment, each recovery device E ₃ , E ₄ is a fixed computer owned by a natural person.

Nevertheless, here again, the invention remains applicable regardless of the nature of said two recovery devices E ₃ and E ₄ , since each recovery device is configured to receive, via the communication network, messages comprising one or more cryptographic values, as well as perform various cryptographic processing (calculations, or even verification of cryptographic signatures), as described in more detail later.

It should also be noted that the invention also remains applicable in the case where the authorization entity is a legal person and / or at least one of the recovery entities is a legal person, this aspect not constituting a limiting factor. of the invention.

According to the invention, the management device E ₁ , the authorization device E _{2 as} well as the recovery device E ₃ or the recovery device E ₄ are configured to cooperate with each other so that said recovery devices E ₃ and / or E ₄ can recover the session key K ₁ , K ₂ during the communication session during which said session key K ₁ , K ₂ is calculated by the user devices U ₁ , U ₂ , by implementing a method for recovering said session key K ₁ , K ₂ according to the invention.

As already mentioned before, the program PROG_E ₁ of the management device E ₁ defines a communication module MOD_COM_E ₁ as well as a storage module MOD_MEM_E ₁ . Said program PROG_E ₁ also defines a module MOD_CALC_E _1, configured to calculate a value equal to D T ₁ ^(α ₁ E sk _{1}).

Furthermore, in addition to the functions of transferring values between the user devices U ₁ , U ₂ which it is responsible for implementing and which are described above, said communication module MOD_COM_E ₁ is also configured to transmit:

- the value D to the authorization device E ₂ ,

the value T ₁ to each of the recovery devices E ₃ , E ₄ having sent a request for recovery of the session key K ₁ , K ₂ .

FIG. 10 schematically represents an example of hardware architecture of the authorization device E ₂ according to the invention.

As illustrated by FIG. 10, the authorization device E ₂ according to the invention has the hardware architecture of a computer. Thus, said authorization device E ₂ comprises, in particular, a processor 1_E ₂ , a random access memory 2_E ₂ , a read only memory 3_E ₂ and a non-volatile memory 4_E ₂ . It also has means of communication 5_E ₂ .

The communication means 5_E ₂ notably allow the authorization device E ₂ to send (respectively receive) cryptographic values to the recovery devices E ₃ , E ₄ (respectively from the management device E ₁ ), as well as d '' send an authorization message for a recovery request, and are similar, at least as regards the communication interface, to the communication means described above for the user devices U ₁ , U ₂ or else for the management system E ₁ . The read only memory 3_ Ei of the authorization device E ₂ constitutes a recording medium in accordance with the invention, readable by the processor 1_E ₂ and on which is recorded a computer program PROG_E _{2 in} accordance with the invention, comprising instructions for the execution of at least part of the steps of the method for recovering the session key K ₁ , K ₂ according to the invention. The program PROG_E ₂ defines functional modules of the authorization device E ₂ , which are based on or control the hardware elements 2_E ₂ to 5_E _{2 of} said authorization device E ₂ mentioned above, and which include in particular a communication module MOD_COM_E ₂ , configured for:

- receive, from the management device E ₁ , the value D stored by said management device E ₁ and equal to A ^v , and which further include a calculation module MOD_CALC_E ₂ , configured to calculate a value T ₂ equal to D ^(α ₂ {Sk} E _2), said communication module MOD_COM_E ₂ being further configured to transmit said value T ₂ to said recovery device of two recovery devices E _3, E _4.

By way of non-limiting example, the issuance of an authorization for said at least one retrieval request is effected by means of a message whose format conforms to a given telecommunications standard.

FIG. 11 schematically represents an example of the hardware architecture of the recovery device E ₃ according to the invention.

As illustrated by FIG. 11, the recovery device E ₃ according to the invention has the hardware architecture of a computer. Thus, said recovery device E ₃ comprises, in particular, a processor 1_E ₃ , a random access memory 2_E ₃ , a read only memory 3_E ₃ and a non-volatile memory 4_E ₃ . It also has means of communication 5_E ₃ .

The communication means 5_E ₃ notably allow the recovery device E ₃ to receive cryptographic values originating from the management device E ₁ and from the authorization device E ₂ , and are similar, at least as regards the interface of communication, to the communication means described above for the user devices U ₁ , U ₂ , the management device E ₁ or even the authorization device E ₂ .

The read only memory 3_E ₃ of the recovery device E ₃ constitutes a recording medium in accordance with the invention, readable by the processor 1_E ₃ and on which is recorded a computer program PROG_E _{3 in} accordance with the invention, comprising instructions for the execution of at least part of the steps of the method for recovering the session key K ₁ , K ₂ according to the invention. The program PROG_E ₃ defines functional modules of the recovery device E ₃ , which are based on or control the hardware elements 2_E ₃ to 5_E _{3 of} said authorization device E ₃ mentioned above, and which notably include a communication module MOD_COM_E ₃ , configured for: - issue a request to retrieve the session key K ₁ , K ₂ ,

- receiving, from the management device E ₁ , said value T _{1 as} well as said value C ₄ ,

- receive, from the authorization device E ₂ , said value T ₂ , and which further include:

- said first calculation module MOD_CALCl_E ₃ , configured to calculate said public value W, as already mentioned before,

- a second calculation module MOD_CALC2_E ₃ , configured to calculate a value T ₃ equal to

C ₄ ^((α ₃ + α ₄₎ E sk _{3}),

- a third calculation module MOD_CALC3_E ₃ , configured to calculate a value K ₃ equal to T ₁ x T ₂ x T ₃ .

By way of non-limiting example, the transmission of a recovery request is carried out thanks to a message whose format conforms to a given telecommunications standard, typically the same standard as that used by the authorization device E ₂ for sending an authorization message.

FIG. 12 schematically represents an example of hardware architecture of the recovery device E ₄ according to the invention.

As illustrated by FIG. 12, the recovery device E ₄ according to the invention has the hardware architecture of a computer. Thus, said recovery device E ₄ comprises, in particular, a processor 1_E ₄ , a random access memory 2_E ₄ , a read only memory 3_E ₄ and a non-volatile memory 4_E ₄ . It also has means of communication 5_E ₄ .

The communication means 5_E ₄ notably allow the recovery device E ₄ to receive cryptographic values originating from the management device E ₁ and from the authorization device E ₂ , and are similar, at least as regards the interface of communication, to the communication means described above for the user devices U ₁ , U ₂ , the management device E ₁ or even the authorization device E ₂ .

The read only memory 3_E ₄ of the recovery device E ₄ constitutes a recording medium in accordance with the invention, readable by the processor 1_E ₄ and on which is recorded a computer program PROG_E _{4 in} accordance with the invention, comprising instructions for the execution of at least part of the steps of the method for recovering the session key K ₁ , K ₂ according to the invention. The program PROG_E ₄ defines functional modules of the recovery device E ₄ , which are based on or control the hardware elements 2_E ₄ to 5_E _{4 of} said recovery device E ₄ mentioned above, and which include in particular a communication module MOD_COM_E ₄ , configured for :

- issue a request to retrieve the session key K ₁ , K ₂ ,

- receiving, from the management device E ₁ , said value T _{1 as} well as said value C ₃ ,

- receive, from the authorization device E ₂ , said value T ₂ , and which further include: - said first calculation module M0D_CALC1_E ₄ , configured to calculate said public value W, as already mentioned before,

- a second calculation module MOD_CALC2_E _4, configured to calculate a value equal to T ₄ C ₃ ^((α ₃ + α ₄₎ _4} E {sk),

- a third calculation module MOD_CALC3_E ₄ , configured to calculate a value K ₄ equal to T ₁ x T ₂ x T ₄ .

In a particular exemplary embodiment, said first, second and third calculation modules MOD_CALCl_E _q , MOD_CALC2_E _q , MOD_CALC3_E _q , q being an index equal to ₃ or 4, are integrated into one and the same calculation module, called "general module ". To this end, said general module comprises means configured in a hardware and / or software manner to perform the functions associated with each of said first, second module and third calculation modules MOD_CALCl_E _q , MOD_CALC2_E _q , MOD_CALC3_E _q .

It should be noted that, in accordance with the invention, said computer programs PROG_E ₁ , PROG_E ₂ , PROG_E ₃ , PROG_E ₄ can belong to the same set of computer programs, each device E ₁ , E ₂ , E ₃ , E ₄ being able to obtain, for example via a download and thanks to the means of communication which equip it, the program PROG_E ₁ , PROG_E ₂ , PROG_E ₃ , PROG_E ₄ which is associated with it from among said set of programs.

For the remainder of the description, it is considered in no way limiting that two requests for recovery of the session key K ₁ , K ₂ were respectively sent by the recovery devices E ₃ and E ₄ to the authorization device E ₂ , and that each of these recovery requests has been authorized by said authorization device E ₂ .

FIG. 13 represents, in the form of a flowchart, the main steps of the method for recovering the session key K ₁ , K ₂ according to the invention, as implemented by the system ₂ 0 for recovering the data. figure 9.

Said recovery method is implemented during the communication session during which the session key K ₁ , K ₂ is calculated by the user devices U ₁ , U ₂ , it being understood that said session key K ₁ , K ₂ is already calculated at the time of the implementation of said recovery method and that said user devices U ₁ , U ₂ are therefore able to communicate with each other in a secure manner.

As illustrated by FIG. 1 ₃ , the recovery method firstly comprises a step R10 of transmission, by the management device E ₁ , of the value D to the authorization device E ₂ . Furthermore, during this transmission step R10, and given that as well as each of the recovery devices E ₃ , E ₄ has issued a recovery request accepted by the authorization device E ₂ , the values C ₄ and C ₃ are transmitted respectively to the recovery device E ₃ and to the recovery device E ₄ . It should be noted that this transmission step R10 is implemented by the communication module MOD_COM_E ₁ equipping said management device E ₁ . The recovery process then comprises a step R20 to calculate, by the management device E _1, said value T ₁ equal to D ^₍₁ α sk {E _1}). This calculation step R20 is implemented by the calculation module MOD_CALC_E ₁ equipping the management device E ₁ .

Given that thus each of the recovery devices E ₃ , E ₄ has issued a recovery request accepted by the authorization device E ₂ , said value T ₁ is then transmitted by the management device E ₁ to the two recovery devices E ₃ and E ₄ during a step R30 of the recovery process. This transmission step R30 is implemented by the communication module MOD_COM_E ₁ equipping the management device E ₁ .

The recovery method further comprises a calculation step R40, the _E2 enabling device, said value T ₂ equal to D ^(α ₂ E sk _{2}). This calculation step R40 is implemented by the calculation module MOD_CALC_E ₂ equipping the authorization device E ₂ .

Once again due to the transmission of the two recovery requests, said value T ₂ is then transmitted by the authorization device E ₂ to the two recovery devices E ₃ and E ₄ during a step R50 of the recovery process . This transmission step R50 is implemented by the communication module MOD_COM_E ₂ equipping the authorization device E ₂ .

The recovery method further comprises a step R60 for calculating said value T ₃ by the recovery device E ₃ . This calculation step R60 is implemented by the second calculation module MOD_CALC2_E ₃ equipping the recovery device E ₃ .

Similarly, the recovery method comprises a step R70 for calculating said value T ₄ by the recovery device E ₄ . This calculation step R70 is implemented by the second calculation module MOD_CALC_E ₄ equipping the recovery device E ₄ .

No limitation is attached to the order in which said calculating steps R60 and R70 are executed. For example, the calculation step R60 is executed before the calculation step R70, or else vice versa. According to yet another example, said calculation steps R60 and R70 are executed in a synchronized manner.

Finally, the recovery method comprises a step R80 for calculating said value K ₃ by the recovery device E ₃ . This calculation step R80 is implemented by the third calculation module MOD_CALC3_E ₃ equipping the recovery device E ₃ .

Similarly, the recovery method comprises a step R90 for calculating said value K ₄ by the recovery device E ₄ . This calculation step R90 is implemented by the third calculation module MOD_CALC3_E ₄ equipping the recovery device E ₄ .

No limitation is attached to the order in which said calculating steps R80 and R90 are executed. For example, the calculation step R80 is executed before the calculation step R90, or else vice versa. According to yet another example, said calculation steps R80 and R90 are executed in a synchronized manner.

Ultimately, at the end of the recovery process, the recovery devices E ₃ and E ₄ are respectively in possession of the values K ₃ and K ₄ . However, these values K ₃ and K ₄ are not only equal to each other, but also equal to said values K ₁ and K ₂ , as can easily be verified. Said values K ₃ and K _{4 therefore} correspond to said recovered session key.

The recovery method according to the invention therefore offers the two recovery devices E ₃ and E ₄ the possibility of recovering the session key that the user devices U ₁ , U ₂ have calculated and that they use to communicate with each other during the communication session.

It is particularly advantageous that the recovery devices E ₃ , E ₄ respectively recover the session key from the values T ₃ , T ₄ . Indeed, the use of a different value for each of these entities induces the possibility for each of them to have their own public keys.

The fact that the session key can be recovered anonymously by the recovery devices E ₃ , E ₄ is important in many contexts, in particular when the recovery entities which respectively hold said recovery devices are independent of each other, and must remain so.

As a reminder, by “independence” between recovery entities, reference is made here to situations in which it may be required that said recovery entities be independent from one another. In other words, in these situations, a recovery entity is not subject to the authority of the other recovery entity, and must therefore be able to perform its recovery calculations without collaboration with said other recovery entity.

Two examples of application of the present invention are now described without limitation, in order to illustrate, in particular, two distinct contexts in which the recovery entities holding the recovery devices are independent of one another.

The first application example described incorporates the elements introduced previously with regard to the case of an employee who is the victim of harassment by his line manager. Thanks to the invention, the lawyer (ie the authorization entity) of the company has the possibility of authorizing two independent recovery entities to retrieve the session key, namely the human resources service of the department to which it belongs. the employee and the social assistance service belonging to a department other than that of the employee, while preserving this independence.

Thanks to the invention, these two different services can therefore each recover the session key that would be used by said employee and said line manager during a communication session, for example in the form of instant message exchanges (" chat ”in Anglo-Saxon literature) via an internal communication network of the company, this network being managed by the network administrator of the company. Neither the employee nor the line manager could realize that their exchanges during the communication session are listened to by the recovery entities. In addition, a recovery entity would also not be able to know that the other recovery entity has access to these exchanges.

The second example of application refers for its part to user entities which are legitimate physical users (ie having a valid subscription) of a mobile communication network managed by a telecommunications operator. Within the framework of current regulations relating to the protection of the data of said users (eg General Data Protection Regulation known as "RGPD"), said telecommunications operator is obliged to protect user communications from an external attacker but also from himself . However, the current architecture of mobile networks does not make it possible to guarantee such protection insofar as the only possible encryption mode is a link encryption mode (also called “link encryption” in the English literature). In other words, each intermediate node in the communication network encrypts and decrypts the messages transmitted between users, thus opening the way to potential security breaches if, for example, a node were to suffer an attack.

Also, the invention advantageously makes it possible to provide much more effective protection of user data, while offering the possibility for authorized recovery entities to have access to a session key used by two users. By "much more effective protection", we refer here to an end-to-end encryption mode (also called "end-to-end" in the English literature) since only the users of the network have access to the messages that they exchange using the calculated session key.

Purely by way of illustration for this second example of application, we can consider the case where the telecommunications operator therefore represents, within the meaning of the invention, the management entity which owns the management device E ₁ , and where:

- the authorization entity corresponds to a judicial entity, such as for example a judge,

the recovery entities E ₃ , E ₄ correspond to law enforcement and security entities, such as for example two policies with distinct attribution powers so as to be independent from one another.

FIG. 14 represents, in the form of a flowchart, a particular mode of implementation of the recovery method of FIG. 1 ₃ .

In the particular mode illustrated by FIG. 1 ₃ , the various cryptographic signatures δ ₁ , δ ₂ , δ ₃ are verified. The object of these signature checks is, as already described above, to authenticate the devices at the origin of the calculations of the various data and values exchanged on the communication network, and, in the case where an authentication is not guaranteed, allow the said recovery process to be stopped.

More particularly, the management device E ₁ transmits, before the calculations of the values T ₂ and T ₃ , the signatures o ₁ , δ ₂ , δ _{3 as} well as the values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ , N ₁ , B, B ₁ , B ₂ , B ₃ , N ₂ , N ₃ to the authorization device E ₂ as well as to the two recovery devices E ₃ and E ₄ . This transmission is for example carried out at the same time as that of the values D, C ₃ and C ₄ (step R10).

These values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ , N ₁ , B, B ₁ , B ₂ , B ₃ , N ₂ , N ₃ are, as was already the case for the D values , C ₃ and C ₄ , stored by the management device E ₁ before their respective transmissions to the various devices E ₂ , E ₃ and E ₄ .

The authorization device E ₂ then checks the signatures δ ₁ , δ ₂ , δ ₃ (step R ₃ 5) before calculating the value T ₂ . Said recovery device E ₃ verifies the signatures δ ₁ , δ ₂ , δ ₃ (step R55) before calculating the value T ₃ .

Said recovery device E ₄ verifies the signatures δ ₁ , δ ₂ , δ ₃ (step R65) before calculating the value T ₄ .

The recovery process is stopped as soon as the number of unverified signatures reaches a given threshold. For example, this threshold is equal to 1.

The invention has been described until now by considering that the session key was recovered during a communication session between the user devices U ₁ , U ₂ . The fact remains that the invention remains applicable in the case where the session key is recovered outside of such a communication session. By way of non-limiting example, the session key can be recovered in a deferred manner on the basis of the communications exchanged between the user devices U ₁ , U ₂ and recorded and then stored, for example in a database.

Furthermore, the signatures considered so far in the invention, both for the calculation method and for the recovery method, are the signatures δ ₁ , δ ₂ , δ ₃ . However, nothing excludes that one or more other signatures, in addition to said signatures δ ₁ , δ ₂ , δ ₃ , are calculated and verified. For example, the management device E ₁ can calculate, during the calculation method and before the transmission of the signatures δ ₂ , δ ₃ to the user device U ₁ , and by means of its private key sk {E ₁ }, a signature δ ₄ of a message M ₄ function of pk {U ₁ }, pk {U ₂ }, A, B, D and N ₄ , where N ₄ is a random value. The signature δ ₄ and the value N ₄ are transmitted, during the recovery process, by the management device E ₁ to the recovery devices E ₃ , E ₄ , for example at the same time as the other signatures δ ₁ , δ ₂ , δ ₃ . The signature δ ₄ can therefore be verified by each of said recovery devices E ₃ , E ₄ .

The invention has also been described until now by considering that, during the recovery method, the two recovery devices E ₃ and E ₄ each issue a request for recovery of the session key. However, the invention remains applicable in the case where only one of these recovery devices issues a recovery request.

In addition, nothing excludes considering, according to a particular example of implementation, that, independently of the number of recovery requests issued,

Such arrangements make it possible to reinforce the security of the recovery process in that it makes it possible to avoid determining the origin of a recovery request. Indeed, given that each recovery device E ₃ , E ₄ receives the two values C ₃ , C ₄ , it becomes impossible to distinguish these recovery devices E ₃ , E ₄ from one another with regard to their possible recovery requests. . Finally, it should be noted that the recovery method has been described so far by considering that the different transmission and calculation steps (steps R10 to R90) are implemented even though the recovery requests by the recovery devices. recovery E ₃ , E ₄ were previously issued and authorized. The fact remains that the recovery method according to the invention also covers the case where, according to a particular embodiment, steps of issuing and authorizing said recovery and authorization requests are included. in said recovery process.

In a substantially similar manner, the invention also covers the possibility according to which the public value W is calculated during a step of the method for calculating the session key. In this case, the calculation system 10 also includes the recovery device (s) E ₃ , E ₄ having calculated this public value W.

Claims

[Claim 1] Method for calculating a session key for securing a communication session between two user devices U ₁ , U ₂ , said communication session being implemented via a communication network managed by at least one management device E ₁ , the session key being able to be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk {Ej} where g is a generating a first group of order p, a public value W equal to g ^(sk sk {E _3} _{4} E) having been calculated by at least one recovery device E _3, E _4, said method comprising stages of:

- computation (F10) by the user device U _1, values of A, A _1, A _2, A _3, A _4, A ₅ respectively equal to g ^u, pk {El} ^u, pk _{E2} ^u, E ₃ {pk} ^u, pk ^{E4} u, W ^u, and transmitted (F ₂ 0) to U user device ₂ via the management device E _1, u being a secret value U of the device ₁ ,

- calculation ₍₃ F 0) by the user device U ₂ values of B, B _1, B _2, B _3, C _3, C _4, D respectively equal to ^v g, pk {El} ^v, pk E ^{v _2}, W ^v, A ₃ ^n, A ₄ ^n, A ⁿ and transmitted to the user device U ₁ via the management device E ₁ which stores at least C _3, C ₄ and D ( F40), v being a secret value of the device U ₂ ,

- computation (F50) by the user U device _1, a value K equal to ₁ B ₁ ^(α ₁ u) x B ₂ ^(α ₂ U) x B ₃ ^((α ₃ + α ₄₎ u), where α _m , m ranging from 1 to 4, is a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and of a data associated with α _m ,

- computation (F60) by the user U device _2, having a K value equal to ₂ A ₁ ^(α ν ₁₎ x A ₂ ^(α ₂ ν) x A ₅ ^((α ₃ + a4) ν ), the values K ₁ and K ₂ corresponding to said session key.

[Claim 2] The method of claim 1, wherein, upon receipt of the value D from the user device U _2, U ₁ the user device calculates a value D equal to A ⁿ and checks that said value D 'is equal to said value D (F45), the calculation method being stopped if said equality is not verified.

[Claim 3] Method according to any one of claims 1 to 2, in which a user device Ui, i ranging from 1 to 2, is associated with a public key pk {Ui} as well as with a private key sk {Ui }, and in which:

- the user device U ₁ determines (F15), by means of its private key sk {U ₁ }, a signature δ ₁ of a message (M ₁ ) function of pk {U ₁ }, pk {U ₂ }, A , A ₁ , A ₂ , A ₃ , A ₄ , A ₅ and N ₁ , where N ₁ is a random value, the signature δ ₁ and the value N ₁ also being transmitted to the user device U ₂ via the management system E ₁ ,

- the user device U ₂ determines (F ₃ 5), by means of its private key sk {U ₂ }, a signature δ ₂ of a message (M ₂ ) function of pk {U ₁ }, pk {L) ₂ }, B, D, B ₁ , B ₂ , B ₃ and N ₂ , where N ₂ is a random value, as well as a signature δ ₃ of a message (M ₃ ) function of pk {U ₁ }, pk {L) ₂ }, B, D, C ₃ , C ₄ and N ₃ , where N ₃ is a random value, the signatures δ ₂ , δ ₃ and the values N ₂ , N ₃ also being transmitted to the user device U ₁ via the management device E ₁ , the signature δ ₁ being verified (F ₂ 0) by the management device E ₁ before its transmission to the user device U ₂ , as well as by said user device U ₂ (F ₃ 5) after transmission , and the signatures δ ₂ and δ ₃ being verified (F40) by the management device E ₁ before their respective transmissions to the user device U ₁ , as well as by said user device U ₁ (F45_ ₂ ) after transmission, the calculation method being stopped as soon as the number of signat unverified ures reaches a given threshold.

[Claim 4] Method of communication between two user devices U ₁ , U ₂ during a communication session implemented via a communication network managed by at least one management device E ₁ , said communication session being secured to the means of a session key that can be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E ₃ , E ₄ , a user device Ui, i ranging from 1 to 2, being associated with a public key pk {Ui} as well as with a private key sk {Ui}, a device Ej, j ranging from 1 to 4, being associated with a public key pk { ej} and a private key sk {ej}, pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group of prime order p, a public value W equal to ^g (sk {E ₃ } sk {E ₄ }) having been calculated by at least one recovery device E ₃ , E ₄ , said session key being calculated in accordance with to a calculation method according to any one of claims 1 to 2.

[Claim 5] A method according to claim 4, in which a user device Ui, i ranging from 1 to 2, is associated with a public key pk {Ui} as well as with a private key sk {Ui}, and in which the session key is calculated according to a calculation method according to claim ₃ .

[Claim 6] A method of recovering a session key by means of which a communication session between two user devices U ₁ , U ₂ can be secured, said communication session being implemented via a communication network managed by au at least one management device E ₁ , said recovery method being implemented following at least one request for recovery of said session key authorized by an authorization device E ₂ and emitted by a recovery device from among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, being associated with a public key pk {Ej} as well as with a private key sk {Ej}, pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group of prime order p, a public value W equal to g ^(sk sk {E _3} _{4} E) having been calculated by at least one recovery device E ₃ , E ₄ , and said session key being calculated in accordance with a calculation method according to any one of claims 1 to ₃ , said recovery method comprising steps of:

- transmission (R10), by the management device E ₁ , of the value D to the authorization device E _{2 as} well as of the value C ₄ to the recovery device E ₃ if said at least one recovery request is issued by said device E ₃ and / or from the value C ₃ to the recovery device E ₄ if said at least one recovery request is sent by said device E ₄ ,

- calculation (R20), by the management device E _1, a value T ₁ equal to D ^₍₁ α sk {E _1}) and transmitted (R30) to said recovery device of two recovery devices E _3, E ₄ ,

- calculation (R40) by the authorization device _E2, a value equal to T ₂ D ^(α ₂ {sk} E ₂₎ and transmitted (R50) to said recovery device of two recovery devices E ₃ , E ₄ ,

- calculation (R60, R70), by said recovery device among two recovery devices E ₃ ,

E _4, of a value T equal to ₃ C ₄ ^((α ₃ + α ₄₎ E {sk} ₃₎ whether the retrieval request is issued by said device E ₃ and / or T value equal ₄ -C ₃ ^((α ₃ + α ₄₎ _4} E {sk) whether the retrieval request is issued by said E ₄ device,

- calculation (R80, R90), by said recovery device from among two recovery devices E ₃ ,

E ₄ , with a value K ₃ equal to T ₁ x T ₂ x T ₃ and / or a value K ₄ equal to T ₁ x T ₂ x T ₄ , the values K ₃ and K ₄ corresponding to said key session retrieved.

[Claim 7] A method according to claim 6, wherein, regardless of the number of retrieval requests issued:

[Claim 8] A method according to any one of claims 6 to 7, wherein said session key is calculated according to a calculation method according to claim ₃ , and wherein:

- the management device E ₁ transmits (R10), before the calculations of the values T _{2 as} well as T ₃ and / or T ₄ , the signatures δ ₁ , δ ₂ , δ _{3 as} well as the values A, A ₁ , A ₂ , A ₃ , A ₄ , A ₅ , N ₁ , B, B ₁ , B ₂ , B ₃ , N ₂ , N ₃ to the authorization device E ₂ as well as to the recovery device among two recovery devices E ₃ , E ₄ , - the authorization device E ₂ checks (R ₃ 5) the signatures δ ₁ , δ ₃ δ a ₂ v, before calculating the value T ₂ ,

- said recovery device from among two recovery devices E ₃ , E ₄ verifies (R55, R65) the signatures δ ₁ , δ ₂ , δ ₃ before calculating the value T ₃ and / or T ₄ , the recovery method being stopped when the number of unverified signatures reaches a given threshold.

[Claim 9] Set of computer programs comprising instructions for implementing a method for calculating a session key according to any one of claims 1 to ₃ or a communication method according to any one of claims 4 to 5 or a recovery method according to any one of claims 6 to 8 when said set of computer programs are executed by one or more computers.

[Claim 10] A computer readable recording medium on which is recorded a set of computer programs according to claim 9 or a computer program belonging to a set of computer programs according to claim 9.

[Claim 11] User device U ₁ for calculating a session key for securing a communication session between said user device U ₁ and a user device U ₂ , said communication session being implemented via a network communication managed by a management device E ₁ , the session key being the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E _3, E _4, a device Ej, j ranging from 1 to 4, associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk {Ej } where g is a generator of a prime order group p, said user device U ₁ comprising:

- a second calculation module configured to calculate a value K equal to ₁ B ₁ ^(α ₁ u) x B ₂ ^(α ₂ U) x B ₃ ^((α ₃ + α ₄₎ u), where α _m , m ranging from 1 to 4, is a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and a data associated with α _m .

[Claim 1 ₂ ] User device U ₂ for calculating a session key for securing a communication session between said user device U ₂ and a user device U ₁ , said communication session being implemented via a communication network managed by a management device E ₁ , the session key being the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E _3, E _4, a device Ej, j ranging from 1 to 4, associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk { Ej} where g is a generator of a prime order group p, said user device U ₂ comprising:

- a first calculation module configured to calculate B, B values _1, B _2, B _3, C _3, C _4, D respectively equal to ^v g, pk {E _1} ^v, pk _{E2} ^v W ^v, a ₃ ^n, a 4 ^n, a ^n, v being a secret value U ₂ device, said communication module further being configured to transmit said values B, B _1, B _2, B ₃ , C ₃ , C ₄ , D to the device U ₁ via the management entity E ₁ ,

- a second calculation module configured to calculate a K value equal to ₂ A ₁ ^(α ν ₁₎ x A ₂ ^(α ₂ ν) x A ₅ ^((α ₃ + α ₄₎ ν), where α _m , m ranging from 1 to 4, is a quantity function of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and of a data associated with α _m .

[Claim 1 ₃ ] Management device E ₁ of a communication network via which a communication session between two user devices U ₁ , U ₂ is intended to be implemented, said communication session being secured by means of a session key that can be the subject of at least one recovery request authorized by an authorization device E ₂ and sent by a recovery device from among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4, being associated with a public key pk {Ej} as well as a private key sk {Ej}, pk {Ej} being equal to g ^{sk {E} j ^} where g is a generator of a group of first order p, said management device E ₁ comprising a communication module, configured to transmit:

- from user device U ₂ to user device U ₁ , values B, B ₁ , B ₂ , B ₃ , C ₃ , C ₄ , D respectively equal to ^v g, pk {E _1} ^v, pk {S _2} ^v W ^v, A ₃ ^n, A ₄ ^n, A ^n, v being a secret value U device ₂ , and further comprising:

- a storage module, configured to store at least C ₃ , C ₄ , D,

- the value D to the authorization device E ₂ ,

[Claim 14] Authorization device E ₂ for authorizing at least one request for recovery of a session key for securing a communication session between two user devices U ₁ , U ₂ , said communication session being put in work via a communication network managed by a management device E ₁ and said at least one recovery request being sent by a recovery device from among two recovery devices E ₃ , E ₄ , a device Ej, j ranging from 1 to 4 , being associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk {Ej} where g is a generator of a group of order prime p , said authorization device E ₂ comprising a communication module, configured for:

- receiving, from the management device ₁ E, a value D stored by said management device E ₁ and equal to A ^n, A being equal to ^u g, u and v being respective secret values user devices U ₁ and U _2, and further comprising a calculation module, configured to calculate a value equal to T ₂ D ^(α ₂ {Sk} E _2), where α ₂ is a hash function of an amount of pk {E ₁ }, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and data associated with α ₂ , said communication module being further configured to transmit said value T _{2 to} said recovery device among two recovery devices E ₃ , E ₄ .

[Claim 15] Recovery device E ₃ , E ₄ capable of sending a request for recovery of a session key for securing a communication session between two user devices U ₁ , U ₂ , said communication session being set. implemented via a communication network managed by a management device E ₁ and said at least one recovery request being authorized by an authorization device E ₂ , a device Ej, j ranging from 1 to 4, associated with a public key pk {Ej} and a private key sk {Ej} pk {Ej} being equal to g ^sk {Ej} where g is a generator of a first order group p, said recovery device E ₃ , E ₄ comprising a communication module configured for:

- issue a request to retrieve the session key,

- receiving from the E ₂ authorization device, a value equal to T ₂ D ^(α ₂ {sk} E _2), where α ₂ is a hash function of an amount of pk {E _1}, pk {E ₂ }, pk {E ₃ }, pk {E ₄ } and data associated with α ₂ , said recovery device E ₃ , E _{4 further} comprising:

a third calculation module, configured to calculate a value K ₃ equal to T ₁ x T ₂ x T ₃ or a value K ₄ equal to T ₁ x T ₂ x T ₄ .

[Claim 16] A system for calculating a session key, said system comprising user device U ₁ according to claim 11, a user device U ₂ according to claim 1 ₂ and a management device E ₁ according to claim 1 ₃ .

[Claim 17] System for the recovery of a session key calculated by a user device U ₁ according to claim 11 and also calculated by a user device U ₂ according to claim 1 ₂ , said system comprising a management device E ₁ according to claim 1 ₃ , an authorization device E ₂ according to claim 14 and two recovery devices E ₃ , E ₄ according to claim 15.