A message deciphering method

The present invention relates to a method for securely transmitting data or digital messages simultaneously to two electronic devices.

The transmission of confidential information or messages between two or more electronic devices is known to be achieved by encrypting the messages to be transmitted (and, consequently, deciphering those received) in accordance with particular cryptographic methods. In particular, by such methods, the exchanged messages which it is desired be made secret or confidential are encrypted by applying appropriate encryption rules and using appropriate encryption keys.

Encryption methods are subdivided into symmetrical or asymmetrical methods depending on whether a message is encrypted and decrypted using a single key (symmetrical secret key) or two distinct keys (a public and a private key), respectively.

For example, one asymmetric method known is the IBE (Identity Based Encryption) method. In accordance with the IBE method, the public key of a user transmitting in an encrypted manner is obtained from the identity of the user (for example the user's tax code) and does not constitute confidential information. The user's private key is secret and is assigned to each user by a unique central authority denominated Trusted Authority TA. The methods for the generation of the public and private keys and the operating characteristics of the trusted authority TA are known to those skilled in the art.

In some applications, it may be useful to securely transmit a message, using the IBE method, simultaneously to two electronic devices.

In accordance with known encryption techniques, the message to be transmitted to both devices is encrypted, sequentially, once with the public key corresponding to the first device and a second time with that corresponding to the second device.

In order to restore the original message, the received encrypted message is, to begin with, decrypted firstly with the private key corresponding to the second device. Subsequently, the result of such decryption is sent to the first device which decrypts it using its own private key, thus restoring the original message.

In this way, the encrypted message may be decrypted only by using subsequent decryption operations carried out by both devices. Indeed, a single device does not have sufficient information to decrypt the message in question.

In particular, it is observed that the transmitted message which has been encrypted using encryption keys according to a pre-established order, may only be restored by applying the decryption keys in reverse order with respect to the corresponding encryption keys. That constitutes a limitation for the known encryption methods.

Furthermore, the message to be transmitted simultaneously to two devices requires an encryption step that is taxing from the computational point of view.

Document <nplcit id="ncit0001" npl-type="b"><text>Boneh D et al: "Identity-based Encryption from the Weil Pairing" Advances in Cryptology. Crypto 2001.21ST annual international cryptology conference, Santa Barbara, CA, AUG. 19-23, 2001. proceedings, lecture notes in computer science; vol. 2139, Berlin: Springer, DE, 19 August 2001, pages 213-229</text></nplcit> describes a method for decrypting messages in accordance with the encryption techniques above indicated.

The object of the present invention is that of proposing a method for encrypting a message simultaneously to two devices which is improved with respect to the known methods.

The object is achieved by using a method as described in the enclosed claim 1. Preferred embodiments of the method of the invention are defined in the dependent claims 2 to 21.

An encrypted massage transmission system which uses such a method in accordance with claim 22, also forms an object of the present invention.

The characteristics and the advantages of the present invention will be understood from the following detailed description of one of its exemplificative, and in no way limiting, embodiments in relation to the enclosed drawings, in which <ul id="ul0001" list-style="bullet" compact="compact"><li>figure 1 schematically shows a first embodiment of the method for enabling the creation of a joint identity for the devices in accordance with the invention;</li><li>figure 2 schematically shows a second embodiment of the method for enabling the creation of a joint identity for the devices in accordance with the invention;</li><li>figure 3 schematically shows a third embodiment of the method for enabling the creation of a joint identity for the devices in accordance with the invention.</li></ul>

It is appropriate to premise that some of the steps of the method of the invention provide encrypted communication using keys, which may be carried out by using a symmetrical or private key type method, or by using an asymmetrical, preferably identity based type IBE method. These two methods have characteristics and general properties, which are known to those skilled in the art.

In figure 1 is schematically shown a system 100 in accordance with the present invention and comprising a first electronic device SIM and a second electronic device ME intended for jointly communicating encryptedly with a further electronic device (not shown).

Advantageously, the present invention is applicable to all types of electronic devices intended for encrypted communication. For example, such devices may be: a smart card associated with a mobile radio communications network user; a mobile telephone which operates within the ambit of a cellular telephone system; a credit card implemented as an additional smart card to be inserted inside the cellular telephone or connected thereto or to another terminal through a wireless communication link. Other types of devices are, for example, a remote internet server or, more particularly, the server of a software update provider.

A first Trusted Authority TA-SIM and a second Trusted Authority TA-ME are associated with the first SIM and with the second ME electronic devices respectively.

The first TA-SIM and the second TA-ME trusted authorities, which are physically distinct from one another, generate the public and private keys to be associated with the respective devices by using, for example, mathematical schemes, known those skilled in the art and characteristic, for example, of the identity based IBE encryption method. In particular, it is observed that with each trusted authority is associated a collection of functions and common parameters indicated, briefly, by the notation &lt;G₁, G₂, ê, P, H, H₁&gt;. In such notation, for example: <ul id="ul0002" list-style="dash" compact="compact"><li>G₁ is an additive group of points of an algebraic curve;</li><li>G₂ is a finite multiplicative group;</li><li>ê is a bilinear function which associates an element of the group G₂ with each pair of elements of the additive group G₁;</li><li>P is a point of an algebraic curve, i.e. it is an element of the additive group G₁;</li><li>H and H₁ are, for example, hash type mathematical functions. In particular, the first hash function H, when applied to arbitrary strings, converts the latter into elements of the additive group G₁. The second hash function H₁, when applied to elements of the multiplicative group G₂ generates strings of bits of appropriate length.</li></ul>

Furthermore, in the description hereinbelow, reference will be made to known properties of the bilinear function ê. In particular, for the points L, Q, R, S ∈ G₁, i.e. for a four-membered group of elements of the additive group G₁, the following equality applies: <maths id="math0001" num="(1)"><math display="block"><mi mathvariant="normal">ê</mi><mo>⁢</mo><mfenced separators=""><mi mathvariant="normal">L</mi><mo mathvariant="normal">+</mo><mi mathvariant="normal">Q</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">R</mi><mo mathvariant="normal">+</mo><mi mathvariant="normal">S</mi></mfenced><mo mathvariant="normal">=</mo><mi mathvariant="normal">ê</mi><mfenced><mi mathvariant="normal">L</mi><mo>⁢</mo><mi mathvariant="normal">R</mi></mfenced><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">ê</mi><mfenced><mi mathvariant="normal">L</mi><mo>⁢</mo><mi mathvariant="normal">S</mi></mfenced><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">Q</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">R</mi><mo mathvariant="normal">)</mo><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">Q</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">S</mi><mo mathvariant="normal">)</mo><mo mathvariant="normal">⋅</mo></mrow></mrow></math><img file="EP1548976B1_D0001.tif" /></maths> As will be apparent to the expert in the art, the operator "·" represents an external product in additive group G₁. In particular, such external product is definable as follows: <maths id="math0002" num="(2)"><math display="block"><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">y</mi><mo mathvariant="normal">→</mo><mi mathvariant="normal">z</mi><mo mathvariant="normal">,</mo><mspace width="1em" /><mi mathvariant="normal">x</mi><mo mathvariant="normal">∈</mo><mfenced open="{" close="}" separators=""><mn mathvariant="normal">1</mn><mo mathvariant="normal">,</mo><mn mathvariant="normal">2</mn><mo mathvariant="normal">,</mo><mo mathvariant="normal">…</mo><mo mathvariant="normal">,</mo><mi>ord</mi><mspace width="1em" /><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">G</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">)</mo><mo mathvariant="normal">-</mo><mn mathvariant="normal">1</mn></mrow></mfenced></math><img file="EP1548976B1_D0002.tif" /></maths><maths id="math0003" num=""><math display="block"><mi>y</mi><mspace width="1em" /><mo>,</mo><mi>z</mi><mspace width="1em" /><mo>∈</mo><mspace width="1em" /><mi>G</mi><mo>⁢</mo><mn>1</mn><mo>;</mo></math><img file="EP1548976B1_D0003.tif" /></maths> where "ord" is the number of elements of the group G₁. In addition, if a and b are two integers and L and Q are points belonging to group G₁ then the following equation is valid: <maths id="math0004" num="(3)"><math display="block"><mi mathvariant="normal">ê</mi><mfenced separators=""><mi mathvariant="normal">a</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">L</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">b</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">Q</mi></mfenced><mo mathvariant="normal">=</mo><mi mathvariant="normal">ê</mi><mo>⁢</mo><msup><mfenced><mi mathvariant="normal">L</mi><mo>⁢</mo><mi mathvariant="normal">Q</mi></mfenced><mi>ab</mi></msup></math><img file="EP1548976B1_D0004.tif" /></maths>

It is observed that each device recognises the functions and parameters which characterise the corresponding trusted authority.

Furthermore, during the initialisation procedure of the inventive method, each device acquires from the corresponding trusted authority, information useful for the subsequent correct application of the method itself. Such information is stored within appropriate memory space with which the devices are equipped.

In such a manner, for example, the first device SIM recognises a first identity ID_SIM associated with it and a further first identity ID_TA-SIM from the first trusted authority TA-SIM. Analogously, the second device ME recognises a second identity ID_ME and a further second identity ID_TA-ME from the second trusted authority TA-ME. Such identities are strings of bits or characters which unambiguously identify the first SIM and the second ME devices, the first TA-SIM and the second TA-ME authorities, and in no way represent confidential information.

It is observed that the first TA-SIM and the second TA-ME authorities also possess a first S_TA-SIM and a second S_TA-ME master key, respectively. Such first S_TA-SIM and second S_TA-ME master keys are generally distinct from one another, and each is kept secret from the other trusted authority.

Furthermore, the first device recognises (and stores within a memory) a first public key Kp_SIM, a first intermediate key Ki_SIM and a first secret key Ksyk_SIM. As is known, the first public key Kp_SIM is obtained by applying the first hash function H to the first identity ID_SIM and is also shown as H(ID_SIM). The first intermediate key Ki_SIM is a private or secret key obtained by applying the first master key S_TA-SIM to the aforesaid public key H(ID_SIM) in accordance, for example, with the following expression: <maths id="math0005" num="(4)"><math display="block"><msub><mi>Ki</mi><mi>SIM</mi></msub><mo>=</mo><msub><mi>S</mi><mrow><mi>TA</mi><mo>-</mo><mi>SIM</mi></mrow></msub><mo>⋅</mo><msub><mi>Kp</mi><mi>SIM</mi></msub></math><img file="EP1548976B1_D0005.tif" /></maths>

Finally, the first secret key Ksyk_SIM is obtained by applying a further hash function to the first intermediate key Ki_SIM.

Analogously, the second device ME recognises (and stores within a memory) a second public key Kp_ME, a second intermediate key Ki_ME and a second secret key Ksyk_ME. Such keys are obtained by using procedures which are analogous to those described in relation to the first device SIM.

It is observed that the first Ksyk_SIM and the second Ksyk_ME secret keys allow the accomplishment of the symmetric, encrypted communication between each device and the corresponding Trusted Authority.

It is observed that the devices themselves might autonomously generate the first Ksyk_SIM and the second Ksyk_ME secret keys by starting from the first Ki_SIM and from the second Ki_ME intermediate keys respectively, each and every time it is made necessary to communicate symmetrically with the respective Authority. In such a case, each device should recognise, besides the previously mentioned hash functions, a further hash function arranged with the corresponding trusted authority which allows the transformation of the intermediate key (Ki_SIM, Ki_ME) into the corresponding secret key (Ksyk_SIM, Ksyk_ME). In such a manner, memorising such secret keys within the corresponding devices during the initialisation phase should be avoided.

Alternatively, the first Ksyk_SIM and the second Ksyk_ME secret keys may be directly pre-arranged by each Trusted Authority and assigned to the corresponding device, without carrying out any processing of the intermediate keys.

It is observed that in the preceding acquisition step of the identities and of the public and private keys, the first SIM and the second ME devices are not connected to one another yet. Regarding this, it is assumed that such devices are directly connected when, for example, the smart card is inserted within the mobile equipment in such a manner that the first SIM and the second ME device are in electronic contact with one another.

Alternatively, the first SIM and the second ME devices may be connected together over a distance by using appropriate means of transmission (<i>e.g</i>. mobile radio communication networks).

Subsequent to being connected, each electronic device transmits its own identity and the identity of its own trusted authority to the other. For example, the first device SIM sends its own first identity ID_SIM and the further first identity ID_TA-SIM of the first trusted authority TA-SIM to the second device ME, and <i>vice versa</i> as shown schematically in figure 1.

It is observed that the method of the invention allows the creation of a common or joint identity associated with the first SIM and the second ME device. In this way, each encrypted message to be transmitted simultaneously to such devices is sent to the aforesaid joint identity in order to be jointly decrypted by both. The characteristic properties of the joint identity and the joint decryption methods will be described in the following.

Furthermore, the method of the invention allows the creation of a secure communication channel between the devices. In particular, the method of the invention provides for the generation of session keys, which are usable by the first SIM and by the second ME device as secret keys in order to establish a symmetrical type encrypted communication with one another. In other words, such secret session keys will be used, during a communication session, in order to encrypt and decrypt all the subsequent messages exchanged between the two devices.

Advantageously, the generation of the session keys actualises a reciprocal authentication of the two devices SIM and ME.

The method of the invention provides three preferred embodiments for enabling the devices for the joint decryption of the messages and, simultaneously, generating the secret session keys.

With reference to figure 1 a first preferred embodiment of the method of the invention will be described.

In this case, it is observed, first of all, that the transmission of symmetrically encrypted messages is easily applicable between each electronic device and the corresponding trusted authority. Indeed, the first/second trusted authority TA-SIM/TA-ME shares the first/second secret key Ksyk_SIM/Ksyk_ME with the first/second device SIM/ME.

Furthermore, as it is self-evident for those skilled in the art, the method of the invention may include the transmission of further information in addition to that contained within the messages which will be explicitly described in the following.

Subsequent to the reciprocal exchange of identities, the first device SIM generates a first numerical value t_SIM · P by carrying out operation (2) between a first number t_SIM which it has generated randomly and the point P of the additive group G₁. Analogously, the second device ME generates a second numerical value t_ME · P by carrying out the same operation (2) between a second number t_ME (generated randomly) and the same point P.

In relation to figure 1, the first device SIM transmits to the first trusted authority TA-SIM a message containing the second identity ID_ME, the further second identity ID_TA-ME (the first device SIM has received such identities from the second device ME in the preceding step) and the first numerical value t_SIM · P. Prior to being transmitted, such identities and such a numerical value are encrypted using the first secret key Ksyk_SIM so that the first trusted authority TA-SIM may decrypt them with the same key in accordance with the above mentioned symmetrical encryption method.

In greater detail, the message which is transmitted contains the identities encrypted in accordance with the following notation, which is also indicated in figure 1: <maths id="math0006" num="(5)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></math><img file="EP1548976B1_D0006.tif" /></maths> wherein, by ENC is indicated the encryption operation carried out on the second ID_ME identity, on the further second ID_TA-ME identity, and on the first numerical value t_SIM · P using the key Ksyk_SIM. Such an encryption operation is carried out in accordance with the preselected, symmetrical key cryptography algorithm.

The first authority TA-SIM decrypts the message received in accordance with the notation (not shown in figure 1) <maths id="math0007" num="(6)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mo>(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi><mo mathvariant="normal">)</mo></mfenced></math><img file="EP1548976B1_D0007.tif" /></maths> wherein, with DEC is indicated the decryption operation carried out on (5) by using the key Ksyk_SIM. Such a decryption operation allows the first trusted authority TA-SIM to recognise (<i>i.e</i>. store in an appropriate memory) the second ID_ME and the further second ID_TA-ME identities. In other words, the first trusted authority TA-SIM is informed about the typology of the second device ME (for example the type of mobile communication equipment) and about other data relating to the second trusted authority TA-ME. In particular, after having acquired the second ID_ME identity, the first trusted authority TA-SIM is able to generate (and therefore to store) the second public key Kp_ME associated with the second device ME. In greater detail, the first trusted authority TA-SIM applies the first hash function H (common to both trusted authorities) to the second identity ID_ME in order to generate said public key Kp_ME or H(ID_ME). Furthermore, by decrypting the message received, the first trusted authority TA-SIM recognises (and stores within an appropriate memory) the first numerical value t_SIM · P.

Subsequently, the first trusted authority TA-SIM generates a first random number r_SIM which, in particular, is an integer. Using such random number r_SIM, the first trusted authority TA-SIM generates a first quantity r¹_SIM and a second quantity r²_SIM by starting from the first H(ID_SIM) and the second H(ID_ME) public keys, respectively. In particular, such quantities are calculated in accordance with the following expressions: <maths id="math0008" num="(7)"><math display="block"><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mspace width="1em" /><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0008.tif" /></maths><maths id="math0009" num="(8)"><math display="block"><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mspace width="1em" /><mfenced><msub><mi>ID</mi><mi>ME</mi></msub></mfenced></math><img file="EP1548976B1_D0009.tif" /></maths>

The first quantity r¹_SIM is encrypted by using the first secret key Ksyk_SIM and sent as a message to the first device SIM by the first trusted authority TA-SIM. The message which is sent contains the first quantity r¹_SIM, encrypted symmetrically in accordance with the following notation (analogous in type to notation (5)), which is also indicated in figure 1: <maths id="math0010" num="(9)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0010.tif" /></maths>

The message, in accordance with notation (9), is received and decrypted (with the same secret key Ksyk_SIM) by the first device SIM. This takes place in accordance with the following notation (analogous to (6) and itself also not indicated in figure 1) <maths id="math0011" num="(10)"><math display="block"><msub><mi>DEC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>SIM</mi></msub></mfenced></mfenced></math><img file="EP1548976B1_D0011.tif" /></maths>

It is observed that if the first device SIM is able to decrypt such a message received from the first trusted authority TA-SIM, with the first secret key Ksyk_SIM, it is automatically authenticated, i.e. it is not possible that a clone is substituting it.

In such a manner, the first device SIM may recognise (and store in an appropriate memory) the first quantity r¹_SIM.

Alternatively, the encryption and decryption operations associated with the transmission of the first quantity r¹_SIM to the first device SIM, may be carried out, not according to the symmetrical method, but by using the IBE type asymmetric method. In such a case, the encryption key used is the first public key Kp_SIM and the decryption key is the first intermediate key Ki_SIM. Both these keys are known to the first authority TA-SIM in as much as they have been generated by it itself.

Furthermore, the first trusted authority TA-SIM sends a message containing the second quantity r²_SIM and the first numerical value t_SIM · P to the second device ME. In this case, such a message is encrypted in accordance with the asymmetric IBE method, <i>i.e</i>. it is in accordance with the following notation, (also indicated in figure 1) <maths id="math0012" num="(11)"><math display="block"><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mfenced separators=""><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></math><img file="EP1548976B1_D0012.tif" /></maths> which expresses the fact that the encryption is carried out by using the second public key Kp_ME.

The second device ME decrypts (11) by using the second intermediate key Ki_ME in accordance with the notation: <maths id="math0013" num="(12)"><math display="block"><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>ME</mi></msub></msub><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi><mo mathvariant="normal">)</mo></mfenced></math><img file="EP1548976B1_D0013.tif" /></maths>

In such a manner, the second device ME recognises (and stores within a memory) the second quantity r²_SIM and the first numerical value t_SIM · P.

It is observed that if the second device ME is able to decrypt (11) received from the first trusted authority TA-SIM with its own second intermediate key Ki_ME, it is automatically authenticated, <i>i.e</i>. it is not a clone.

Still in reference to figure 1, the preferred embodiment of the inventive method also provides for an exchange of encrypted messages which involves the second device ME and the second trusted authority TA-ME in a way which exactly mirrors that described previously.

In particular, the second device ME transmits a message containing the first identity ID_SIM, the further first identity ID_TA-SIM (which it has received from the first device SIM in the preceding step) and the second numerical value t_ME · P to the second trusted authority TA-ME. Prior to being transmitted, such identities and such a numerical value are encrypted by using the second secret key Ksyk_ME so that the second trusted authority TA-ME may decrypt them by using the same key in accordance with the symmetrical encryption method.

In greater detail, the message which is transmitted contains the identities encrypted in accordance with the following notation (also indicated in figure 1): <maths id="math0014" num="(13)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></math><img file="EP1548976B1_D0014.tif" /></maths> wherein, by ENC is indicated the encryption operation carried out on the identities ID_ME, ID_TA-ME and on the second numerical value t_ME · P, by using the key Ksyk_ME.

The second trusted authority TA-ME decrypts the message received in accordance with the notation (not shown in figure 1) <maths id="math0015" num="(14)"><math display="block"><mrow><msub><mi>DEC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mo>(</mo><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0015.tif" /></maths> wherein, with DEC is indicated the decryption operation carried out on (13) by using the key Ksyk_ME.

Such a decryption operation allows the second trust authority TA-ME to recognise (<i>i.e.</i> store in an appropriate memory) the first ID_SIM and the further first ID_TA-SIM identities. In other words, the second trusted authority TA-ME is informed about the typology of the first device SIM and about the first trusted authority TA-SIM. In particular, after having acquired the first identity ID_SIM, the second trusted authority TA-ME is able to generate (and therefore to store) the first public key H(ID_SIM) associated with the first device SIM. Furthermore, by decrypting the message received, the second trusted authority TA-ME recognises (and stores within an appropriate memory) the second numerical value t_ME · P.

Subsequently, the second trusted authority TA-ME generates a second random number r_ME which, in particular, is an integer. The second trusted authority TA-ME generates a third quantity r¹_ME and a fourth quantity r²_ME using such random number r_ME by starting from the second H(ID_ME) and from the first H(ID_SIM) public keys, respectively. In particular, such quantities are calculated in accordance with the following expressions: <maths id="math0016" num="(15)"><math display="block"><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mspace width="1em" /><mfenced><msub><mi>ID</mi><mi>ME</mi></msub></mfenced></math><img file="EP1548976B1_D0016.tif" /></maths><maths id="math0017" num="(16)"><math display="block"><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mspace width="1em" /><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0017.tif" /></maths>

The third quantity r¹_ME is encrypted by using the second secret key Ksyk_ME and sent as a message to the second device ME by the second trusted authority TA-ME. The message sent is in accordance with the following notation which is also indicated in figure 1: <maths id="math0018" num="(17)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>ME</mi></msub></mfenced></math><img file="EP1548976B1_D0018.tif" /></maths>

The message (17) is received and decrypted (by using the same secret key Ksyk_ME) by the second device ME. That comes about in accordance with the following notation (not indicated in figure 1) <maths id="math0019" num="(18)"><math display="block"><msub><mi>DEC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>ME</mi></msub></mfenced></mfenced></math><img file="EP1548976B1_D0019.tif" /></maths>

It is observed that if the second device ME is able to decrypt such a message received from the second trusted authority TA-ME, by using the second secret key Ksyk_ME, it is automatically authenticated, <i>i.e</i>. it is not possible that a clone is substituting it.

In such a manner, the second device ME may recognise (and store in an appropriate memory) the third quantity r¹_ME.

Alternatively, the encryption and decryption operations associated with the transmission of the third quantity r¹_ME to the second device ME, may be carried out, not according to the symmetrical method, but by using the IBE type asymmetric method. In such a case, the encryption key used is the second public key Kp_ME and the decryption key is the second intermediate key Ki_ME. Both these keys are known to the second trusted authority TA-ME in as much as they have been generated by it itself.

Furthermore, the second trusted authority TA-ME sends a message containing the fourth quantity r²_ME and the second numerical value t_ME · P to the first device SIM. In this case, such a message is encrypted in accordance with the asymmetric IBE method, <i>i.e</i>. it is in accordance with the following notation, (also indicated in figure 1): <maths id="math0020" num="(19)"><math display="block"><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mfenced separators=""><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></math><img file="EP1548976B1_D0020.tif" /></maths> which expresses the fact that the encryption is carried out by using the first public key Kp_SIM.

The first device SIM decrypts (19) by using the first intermediate key Ki_SIM in accordance with the notation: <maths id="math0021" num="(20)"><math display="block"><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">t</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi><mo mathvariant="normal">)</mo></mfenced></math><img file="EP1548976B1_D0021.tif" /></maths>

In such a manner, the second device ME recognises (and stores within a memory space) the fourth quantity r²_ME and the second numerical value t_ME · P.

It is observed that if the first device SIM is able to decrypt (20) received from the second trusted authority TA-ME with its own first intermediate key Ki_SIM, it is automatically authenticated, <i>i.e</i>. it is not a clone.

Through the information received from the trusted authorities, the first SIM and the second ME devices are able to generate the corresponding secret session keys. It is observed that such keys may be generated in accordance with alternative forms of generation, by using different mathematical schemes.

In particular, in accordance with a first form of generation of the session keys, the first device SIM generates its own secret session key as an external product (analogous to (2)) between the second numerical value t_ME · P acquired and the first number t_SIM (which has been generated randomly and stored previously by the same device SIM). Analogously, the second device ME generates its own secret session key as an external product between the first numerical value t_SIM · P acquired and the second number t_ME (which has been randomly generated and stored previously by the same device ME).

The aforesaid products are in accordance with the equalities: <maths id="math0022" num="(21)"><math display="block"><msub><mi>Ks</mi><mi>SIM</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">t</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mfenced separators=""><msub><mi mathvariant="normal">t</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></math><img file="EP1548976B1_D0022.tif" /></maths><maths id="math0023" num="(22)"><math display="block"><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">t</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mfenced separators=""><msub><mi mathvariant="normal">t</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></math><img file="EP1548976B1_D0023.tif" /></maths> It is observed, in particular, that the secret session keys Ks_SIM and Ks_ME thus generated, are identical for both devices.

Alternatively, a second form of generation of the session keys provides that such keys may be generated by starting from the quantities which the first SIM and the second ME devices have received from the trusted authorities.

In particular, in a first instant, the first device SIM carries out a first operation by applying the bilinear function ê to the second public key H(ID_ME) and to the sum of the first quantity r¹_SIM and the fourth quantity r²_ME. Subsequently, the first device SIM applies the second hash function H₁ to the result of such an operation thus obtaining its own secret session key Ks_SIM which is in accordance with the following notation: <maths id="math0024" num="(23)"><math display="block"><mrow><msub><mi>Ks</mi><mi>SIM</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">+</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0024.tif" /></maths> Analogously, the second device ME carries out , initially, a first operation by applying the bilinear function ê to the first public key H(ID_SIM) and to the sum of the third quantity r¹_ME ad the second quantity r²_SIM. Subsequently, the second device ME applies the second hash function H₁ to the result of such operation thus obtaining its own secret session key Ks_ME. Such session key is in accordance with the notation: <maths id="math0025" num="(24)"><math display="block"><mrow><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>ME</mi></msub><mo>+</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo>,</mo><mi mathvariant="normal">H</mi><mo>(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo>)</mo><mo>)</mo></mrow></math><img file="EP1548976B1_D0025.tif" /></maths> Thus obtained, the secret session keys Ks_SIM and Ks_ME are identical. Indeed, by starting from (15) and from (8), the equality (24) corresponds to: <maths id="math0026" num="(25)"><math display="block"><mrow><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0026.tif" /></maths> and this latter may be expressed, taking (4) into account, as <maths id="math0027" num="(26)"><math display="block"><mrow><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">H</mi><mfenced separators=""><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>⁢</mo><msub><mrow><msup><mspace width="1em" /><mo mathvariant="normal">∧</mo></msup><mo mathvariant="normal">(</mo></mrow><mmultiscripts><mi>ME</mi>&lt;mprescripts /&gt;&lt;none /&gt;<mi mathvariant="normal">r</mi></mmultiscripts></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0027.tif" /></maths> It is observed that, still on the basis of (3), (26) also corresponds to: <maths id="math0028" num="(27)"><math display="block"><mrow><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0028.tif" /></maths><i>i.e.</i> to <maths id="math0029" num="(28)"><math display="block"><mrow><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">+</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0029.tif" /></maths> As observed, (28) coincides with (23), and hence the secret session key of the second device ME coincides with that of the first device SIM.

Furthermore, it is observed that in the first embodiment of the method of the invention described, the information transmitted by the trusted authorities to the devices, such as, for example, the quantities r¹_SIM, r²_SIM, r¹_ME and r²_ME enable the devices themselves for the joint decryption of a generic message addressed to both and encrypted using their joint identity, as will be described below.

With reference to figure 2, a second preferred embodiment of the method of the invention will be described, which enables the devices both for the joint decryption of messages, and for the generation of the secret session keys.

The elements represented in figure 2 which have already been introduced in figure 1, will be indicated by using the same references. In particular, the system 200 of figure 2 comprises the first SIM and the second ME devices, to which are associated the first TA-SIM and the second TA-ME trusted authorities, respectively.

Also, within such second embodiment of the method is foreseen, the exchange of their corresponding identities between the devices, <i>i.e.</i> ID_SIM, ID_TA-SIM from SIM to ME and ID_ME, ID_TA-ME from ME to SIM, as shown schematically in figure 2. As already described above, the aforesaid exchange of identities occurs following the connection of the two devices.

Afterwards, the first device SIM transmits a message containing the second identity ID_ME and the further second identity ID_TA-ME, received from the second device ME, to the first trusted authority TA-SIM. Prior to being transmitted, such identities are encrypted using the first secret key Ksyk_SIM so that the first trusted authority TA-SIM may decrypt them with the same key, in accordance with the aforementioned symmetrical encryption method.

In greater detail, the message which is transmitted contains the identities encrypted in accordance with the following notation (also indicated in figure 2): <maths id="math0030" num="(29)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced><msub><mi>ID</mi><mi>ME</mi></msub><mo>⁢</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo>-</mo><mi>ME</mi></mrow></msub></mfenced></math><img file="EP1548976B1_D0030.tif" /></maths> wherein, by ENC is indicated the encryption operation carried out on the second ID_ME and on the further second ID_TA-ME identities, using the key Ksyk_SIM.

The first trusted authority TA-SIM decrypts the message received in accordance with the notation (not shown in figure 2) <maths id="math0031" num="(30)"><math display="block"><mrow><msub><mi>DEC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mo>(</mo><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced><msub><mi>ID</mi><mi>ME</mi></msub><mo>⁢</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0031.tif" /></maths> wherein, with DEC is indicated the decryption operation carried out on (29) by using the same key Ksyk_SIM. Such a decryption operation allows the first trusted authority TA-SIM to recognise (<i>i.e.</i> store in an appropriate memory) the second ID_ME and the further second ID_TA-ME identities. Consequently, the first trusted authority TA-SIM is able to generate (and hence store) the second public key Kp_ME associated with the second device ME. In greater detail, the first trusted authority TA-SIM applies the first hash function H to the second identity ID_ME in order to generate said public key Kp_ME (or H(ID_ME)).

Subsequently, the first trusted authority TA-SIM generates a further first quantity s'_SIM by using the first master key s_TA-SIM and the second public key H(ID_ME). In particular, such further first quantity s'_SIM is calculated in accordance with the expression: <maths id="math0032" num="(31)"><math display="block"><msub><mi mathvariant="normal">sʹ</mi><mi>SIM</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">S</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>ME</mi></msub></mfenced></math><img file="EP1548976B1_D0032.tif" /></maths>

The first trusted authority TA-SIM sends a message containing the further first quantity s'_SIM to the second device ME. In this case, such message is encrypted in accordance with the asymmetric IBE method, <i>i.e</i>. it is in accordance with the following notation, (also indicated in figure 2): <maths id="math0033" num="(32)"><math display="block"><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mfenced><msub><mi mathvariant="normal">sʹ</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0033.tif" /></maths> which expresses the fact that the encryption is carried out by using the second public key Kp_ME.

The second device ME decrypts (32) by using the second intermediate key Ki_ME in accordance with the notation: <maths id="math0034" num="(33)"><math display="block"><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>ME</mi></msub></msub><mo>(</mo><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mfenced><msub><mi mathvariant="normal">sʹ</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0034.tif" /></maths>

In such a way, the second device ME recognises (and stores within a memory space) the further first quantity s'_SIM.

It is observed that if the second device ME is able to decrypt (32) received from the first trusted authority TA-SIM with its own second intermediate key Ki_ME, it is automatically authenticated, <i>i.e.</i> it is not a clone.

Still with reference to figure 2, the second preferred form of the method of the invention also provides for an exchange of the encrypted messages which involves the second device ME and the second trusted authority TA-ME.

In particular, the second device ME transmits a message containing the first identity ID_SIM and the further first identity ID_TA-SIM, received in the preceding step from the first device SIM, to the second trusted authority TA-ME. Prior to being transmitted, such identities and such numerical value are encrypted using the second secret key Ksyk_ME so that the second trusted authority TA-ME may decrypt them by using the same key, in accordance with the symmetrical encryption method.

In greater detail, the message which is transmitted contains the identities encrypted in accordance with the following notation (also indicated in figure 1): <maths id="math0035" num="(34)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mo>(</mo><mrow><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0035.tif" /></maths>

The second trusted authority TA-ME decrypts the message received in accordance with the notation (not shown in figure 2) <maths id="math0036" num="(35)"><math display="block"><mrow><msub><mi>DEC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mo>(</mo><msub><mi>ENC</mi><msub><mi>Ksyk</mi><mi>ME</mi></msub></msub><mo>⁢</mo><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub><mo>⁢</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0036.tif" /></maths> Such a decryption operation allows the second trusted authority TA-ME to recognise (<i>i.e.</i> store in an appropriate memory) the first ID_SIM and the further first ID_TA-SIM identities. Furthermore, after having acquired the first identity ID_SIM, the second trusted authority TA-ME is able to generate (and hence to store) the first public key H(ID_SIM) associated with the first device SIM.

Subsequently, the second trusted authority TA-ME generates a further second quantity s'_ME by using the second master key s_TA-ME and the first public key H(ID_SIM). In particular, such further second quantity s'_ME is calculated in accordance with the expression: <maths id="math0037" num="(36)"><math display="block"><msub><mi mathvariant="normal">sʹ</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">S</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0037.tif" /></maths>

The second trusted authority TA-ME sends a message containing the further second quantity s'_ME to the first device SIM. In this case, such message is encrypted in accordance with the asymmetric IBE method, <i>i.e.</i> it is in accordance with the following notation, (also indicated in figure 2): <maths id="math0038" num="(37)"><math display="block"><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mfenced><msub><mi mathvariant="normal">sʹ</mi><mi>ME</mi></msub></mfenced></math><img file="EP1548976B1_D0038.tif" /></maths> which expresses the fact that the encryption is carried out by using the first public key Kp_SIM.

The first device SIM decrypts the (37) by using the first intermediate key Ki_SIM in accordance with the notation: <maths id="math0039" num="(38)"><math display="block"><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mo>(</mo><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mfenced separators=""><msub><mi mathvariant="normal">sʹ</mi><mi>ME</mi></msub><mo>)</mo></mfenced></math><img file="EP1548976B1_D0039.tif" /></maths>

In such a way, the second device ME recognises (and stores within memory space) the further second quantity s'_ME.

It is observed that if the first device SIM is able to decrypt (37) received from the second trusted authority TA-ME with its own intermediate key Ki_SIM, it is automatically authenticated, <i>i.e.</i> it is not a clone.

Through the information received from the trusted authorities, the first SIM and the second ME devices are able to generate the corresponding secret session keys.

In particular, the first device SIM performs a first operation by applying the bilinear function ê to the second public key H(ID_ME) and to the sum of the first intermediate key Ki_SIM and the further second quantity s'_ME, received from the second trusted authority TA-ME. Subsequently, the first device SIM applies the second hash function H₁ to the result of such an operation thus obtaining its own secret session key Ks_SIM which is in accordance with the following notation: <maths id="math0040" num="(39)"><math display="block"><msub><mi>Ks</mi><mi>SIM</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><msub><mi>Ki</mi><mi>SIM</mi></msub><mo mathvariant="normal">+</mo><mrow><msub><mi mathvariant="normal">sʹ</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0040.tif" /></maths> Analogously, the second device ME initially carries out a first operation, by applying the bilinear function ê to the first public key H(ID_SIM) and to the sum of the second intermediate key Ki_ME ad the further first quantity s'_SIM. Subsequently, the second device ME applies the second hash function H₁ to the result of such an operation thus obtaining its own secret session key Ks_ME, in accordance with the following notation: <maths id="math0041" num="(40)"><math display="block"><mrow><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><msub><mi>Ki</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">sʹ</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo>)</mo><mo>)</mo></mrow></math><img file="EP1548976B1_D0041.tif" /></maths> The secret session keys KS_SIM and KS_ME thus generated are identical. That is demonstrable if one proceeds in a manner analogous to that described in relation to the first form of session key generation of the method of the invention (see equations (25) to (28)).

In particular, it is observed that in the second embodiment of the method, the information transmitted from the trusted authorities to the devices such as, for example, the further quantities s'_SIM and s'_ME and the intermediate keys Ki_SIM and Ki_ME, enable the devices themselves for joint decryption. Hence, such quantities are analogous to those introduced in the first embodiment of the method.

With reference to figure 3 a third preferred embodiment of the method of the invention will be described.

In particular, a system 300 comprising the devices SIM, ME and the trusted authorities TA-SIM, TA-ME is represented schematically in figure 3. As will be described below, all the messages exchanged between the devices and the trusted authorities will be encrypted in accordance with the asymmetrical IBE method, hence distinct encryption and decryption keys will be used.

Analogously to the previous embodiment, following the connection of the devices, the first device SIM sends the first ID_SIM and the further first ID_TA-SIM identities to the second device ME. In dual mode, the second device ME sends the second ID_ME and the further second ID_TA-ME identities to the first device SIM, as shown schematically in figure 3.

Subsequently, the first device SIM transmits a message containing the second identity ID_ME and the further second identity ID_TA-ME, received from the second device ME, to the first trusted authority TA-SIM. Optionally, the first device SIM also transmits its own identity ID_SIM within such a message in order to allow it to be identified rapidly from amongst the numerous different devices associated with the first trusted authority TA-SIM.

Advantageously, the first device SIM sends such a message by encrypting it with the further first public key Kp_TA-SIM in accordance with the asymmetric IBE method.

However, it is observed that in this case the encryption operation also includes an electronic signature of the message sent.

For the calculation of the signature, the first device SIM applies a hash function H_F to the previous identities ID_ME, ID_TA-ME, ID_SIM in such a way as to obtain a digest H_F(ID_ME, ID_TA-ME, ID_SIM) of the aforesaid identities. Such a hash function H_F may coincide with the first hash function H or with the second hash function H₁, introduced previously, or may be a different hash function. However, the devices and the trusted authorities must be in agreement regarding the use of the same function H_F for the calculation of the digest.

The digest H_F(ID_ME, ID_TA-ME, ID_SIM) is encrypted by using the first intermediate key Ki_SIM thus obtaining the digital signature of the message containing the identities ID_ME, ID_TA-ME, ID_SIM. Such signature is indicated by: <maths id="math0042" num="(41)"><math display="block"><mrow><msub><mi>ENC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0042.tif" /></maths>

Finally, the message sent to the first trusted authority TA-SIM is in accordance with the following notation, (also indicated in figure 3): <maths id="math0043" num="(42)"><math display="block"><msub><mrow><mi>ENC</mi><mo>-</mo><mi mathvariant="normal">S</mi></mrow><msub><mi>Kp</mi><mrow><mi mathvariant="normal">Tλ</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub></msub><mo>⁢</mo><mfenced><msub><mi>ID</mi><mi>ME</mi></msub><mo>⁢</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo>-</mo><mi>ME</mi></mrow></msub><mo>⁢</mo><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0043.tif" /></maths> and is equivalent to: <maths id="math0044" num="(43)"><math display="block"><mtable columnalign="left"><mtr><mtd><msub><mi>ENC</mi><msub><mi>Kp</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub></msub><mrow><mo>(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo>,</mo></mrow></mtd></mtr><mtr><mtd><mspace width="4em" /><msub><mi>ENC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo>)</mo><mo mathvariant="normal">)</mo></mfenced></mtd></mtr></mtable></math><img file="EP1548976B1_D0044.tif" /></maths> The message (43) contains both the identities ID_ME, ID_TA-ME, ID_SIM and the signature attached by the device SIM according to the notation (41) and both are encrypted by using the further first public key Kp_TA-SIM of the first trusted authority TA-SIM.

The first trusted authority TA-SIM decrypts (43) by using the further first intermediate key Ki_TA-SIM in accordance with the notation (not shown in figure 3): <maths id="math0045" num="(44)"><math display="block"><mtable columnalign="left"><mtr><mtd><msub><mi>DEC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub></msub><mo>(</mo><msub><mi>ENC</mi><msub><mi>Kp</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub></msub><mrow><mo>(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo>,</mo></mrow></mtd></mtr><mtr><mtd><mspace width="4em" /><msub><mi>ENC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo>)</mo><mo mathvariant="normal">)</mo><mo>)</mo></mfenced></mtd></mtr></mtable></math><img file="EP1548976B1_D0045.tif" /></maths> In such a manner, the first trusted authority TA-SIM recognises (and stores in an appropriate memory) the second ID_ME and the further second ID_TA-ME identities. By applying the first hash function H to such identities, the first trusted authority TA-SIM is able to calculate the second public key Kp_ME=H (ID_ME) and the further second public key Kp_TA-ME=H(ID_TA-ME).

Optionally, by starting from the identities ID_ME, ID_TA-ME, ID_SIM, the first trusted authority TA-SIM may calculate, autonomously, the signature H_F(ID_ME, ID_TA-ME, ID_SIM).

In such a manner, the same trusted authority TA-SIM verifies the SIM signature of (41) by using the first public key Kp_SIM of the first device SIM. The first trusted authority TA-SIM directly calculates such public key by starting from the first identity ID_SIM, which is public. That comes about in accordance with the notation (not indicated in figure 3): <maths id="math0046" num="(45)"><math display="block"><msub><mi>DEC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo>)</mo></mfenced></math><img file="EP1548976B1_D0046.tif" /></maths> It is observed that the decryption operation (45) comes about in accordance with the property of interchangeability in the use of the public and private keys, such as occurs for example in the IBE method. Such a property is known to any expert in the art. Following on from (45), the first trusted authority TA-SIM recognises the digest H_F(ID_ME, ID_TA-ME, ID_SIM) sent to it from the SIM. Advantageously, if the transmission of the identities ID_ME, ID_TA-ME, ID_SIM between the first device SIM and the first trusted authority has come about without any alterations, then the calculated signature and the signature received are equal.

It is observed that all the messages encrypted in accordance with the third embodiment of the method of the invention, which will be described in the following, will contain the electronic signature of the transmitted message. Such contrivance ensures greater security of transmission.

Subsequent to the decryption of the message sent from the first device SIM, the first trusted authority TA-SIM generates the first random number r_SIM. Using such random number r_SIM, the first trusted authority TA-SIM generates a first quantity r¹_SIM and a second quantity r²_SIM by starting from the first H(ID_SIM) and the second public keys H(ID_ME), respectively. In particular, such quantities are calculated in accordance with the preceding equalities (7) and (8).

The first quantity r¹_SIM is encrypted by using the first public key Kp_SIM and sent as a message to the first device SIM by the first trusted authority TA-SIM. The sent message is encrypted in such a manner as to also contain the electronic signature of the first quantity r¹_SIM in accordance with the following notation (which is also indicated in figure 3): <maths id="math0047" num="(46)"><math display="block"><msub><mrow><mi>ENC</mi><mo mathvariant="normal">-</mo><mi mathvariant="normal">S</mi></mrow><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0047.tif" /></maths> which, as is known, corresponds to <maths id="math0048" num="(47)"><math display="block"><mrow><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>SIM</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0048.tif" /></maths>

The message, in accordance with the notation (47), is received by the first device SIM and decrypted by using the first intermediate key Ki_SIM. That comes about in accordance with the following notation: <maths id="math0049" num="(48)"><math display="block"><mrow><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>SIM</mi></msub><mo>,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>SIM</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0049.tif" /></maths>

It is observed that if the first device SIM is able to decrypt such a message received from the first trusted authority TA-SIM, by using the first intermediate key Ki_SIM, it is automatically authenticated, <i>i.e.</i> it is not possible that a clone is substituting it.

In this way, the first device SIM may recognise (and store in an appropriate memory) the first quantity r¹_SIM. In addition, the first device SIM may check the electronic signature relating to the first quantity r¹_SIM, thus verifying the correctness of the message received.

Furthermore, the first trusted authority TA-SIM sends an encrypted message containing the second quantity r²_SIM and the electronic signature of such quantity to the second device ME, in accordance with the following equation <maths id="math0050" num="(49)"><math display="block"><mtable columnalign="left"><mtr><mtd><mi>ENC</mi><mo>-</mo><msub><mi>S</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub></mfenced><mo>=</mo></mtd></mtr><mtr><mtd><mrow><mo>=</mo><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>SIM</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>)</mo></mrow></mtd></mtr></mtable></math><img file="EP1548976B1_D0050.tif" /></maths>

The second device ME decrypts (49) by using the second intermediate key Ki_ME in accordance with the notation: <maths id="math0051" num="(50)"><math display="block"><mrow><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>ME</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo>,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>SIM</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>)</mo><mo>)</mo></mrow></math><img file="EP1548976B1_D0051.tif" /></maths>

In such a way, the second device ME recognises (and stores within a memory) the second quantity r²_SIM.

It is observed that if the second device ME is able to decrypt (49) received from the first trusted authority TA-SIM with its own second intermediate key Ki_ME, it is automatically authenticated, <i>i.e</i>. it is not a clone.

Finally, the first trusted authority TA-SIM sends an encrypted message containing the identities ID_SIM, ID_TA-SIM, ID_ME to the second trusted authority TA-ME. Such message also includes the electronic signature of such identities and is in accordance with the equation: <maths id="math0052" num=""><math display="block"><mtable columnalign="left"><mtr><mtd><msub><mrow><mi>ENC</mi><mo mathvariant="normal">-</mo><mi mathvariant="normal">S</mi></mrow><msub><mi>Kp</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub></msub><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">=</mo></mtd></mtr><mtr><mtd><msub><mi>ENC</mi><msub><mi>Kp</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub></msub><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">,</mo></mrow></mtd></mtr></mtable></math><img file="EP1548976B1_D0052.tif" /></maths><maths id="math0053" num="(51)"><math display="block"><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo>)</mo><mo mathvariant="normal">)</mo></mfenced></math><img file="EP1548976B1_D0053.tif" /></maths>

The second trusted authority TA-ME decrypts such a message by using the further second intermediate key Ki_TA-ME in accordance with equation: <maths id="math0054" num="(52)"><math display="block"><mtable columnalign="left"><mtr><mtd><msub><mi>DEC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub></msub><mo>(</mo><msub><mi>ENC</mi><msub><mi>Kp</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub></msub><mrow><mo>(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo>,</mo></mrow></mtd></mtr><mtr><mtd><mspace width="4em" /><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo>)</mo><mo mathvariant="normal">)</mo><mo>)</mo></mfenced></mtd></mtr></mtable></math><img file="EP1548976B1_D0054.tif" /></maths> Hence, the second trusted authority TA-ME recognises (and stores in memory) the identities ID_SIM, ID_TA-SIM e ID_ME. In particular, from the first ID_SIM and from the second ID_ME identities, the second trusted authority TA-ME is able to generate the first Kp_SIM=H (ID_SIM) and the second Kp_ME=H(ID_ME) public keys, respectively.

Subsequently, the second trusted authority TA-ME generates the second random number r_ME. Using such random number r_ME, the second trusted authority TA-ME generates the third quantity r¹_ME and the fourth quantity r²_ME by starting from the second H(ID_ME) and from the first H(ID_SIM) public keys, respectively. It is observed that, in particular, such quantities are calculated in accordance with the previous equalities (15) and (16).

The fourth quantity r²_ME is encrypted by using the first public key Kp_SIM and sent as a message to the first device SIM by the second trusted authority TA-ME. The message sent is encrypted in such a manner as to also contain the electronic signature of the fourth quantity r²_SIM in accordance with the following notation (which is also indicated in figure 3): <maths id="math0055" num="(53)"><math display="block"><mtable columnalign="left"><mtr><mtd><mi>ENC</mi><mo>-</mo><msub><mi mathvariant="normal">S</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub></mfenced><mo>=</mo></mtd></mtr><mtr><mtd><mrow><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>ME</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>)</mo></mrow></mtd></mtr></mtable></math><img file="EP1548976B1_D0055.tif" /></maths>

The message, in accordance with the notation (53), is received by the first device SIM and decrypted by using the first intermediate key Ki_SIM in accordance with the notation: <maths id="math0056" num="(54)"><math display="block"><mrow><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>SIM</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>SIM</mi></msub></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub><mo>,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>ME</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0056.tif" /></maths>

It is observed that if the first device SIM is able to decrypt such a message received from the second trusted authority TA-ME, it is automatically authenticated, <i>i.e</i>. it is not possible that a clone is substituting it.

In this way, the first device SIM may recognise (and store in an appropriate memory) the fourth quantity r²_ME. In addition, the first device SIM may check the electronic signature relating to the fourth quantity r²_ME, thus verifying the correctness of the message received.

Furthermore, the second trusted authority TA-ME sends an encrypted message containing the third quantity r¹_ME and the electronic signature of such quantity to the second device ME, in accordance with the following equation: <maths id="math0057" num=""><math display="block"><mtable><mtr><mtd><mi>ENC</mi><mo>-</mo><msub><mi mathvariant="normal">S</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mfenced><msub><msup><mi mathvariant="normal">r</mi><mn>2</mn></msup><mi>ME</mi></msub></mfenced><mo>=</mo></mtd></mtr></mtable></math><img file="EP1548976B1_D0057.tif" /></maths><maths id="math0058" num="(55)"><math display="block"><mo>=</mo><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>ME</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo>)</mo></mfenced></math><img file="EP1548976B1_D0058.tif" /></maths>

The second device ME decrypts (55) by using the second intermediate key Ki_ME in accordance with the notation: <maths id="math0059" num="(56)"><math display="block"><mrow><msub><mi>DEC</mi><msub><mi>Ki</mi><mi>ME</mi></msub></msub><mo>⁢</mo><mfenced separators=""><msub><mi>ENC</mi><msub><mi>Kp</mi><mi>ME</mi></msub></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>ME</mi></msub><mo>,</mo><msub><mi>ENC</mi><msub><mi>Ki</mi><mrow><mi>TA</mi><mo>-</mo><mi>ME</mi></mrow></msub></msub><mo>(</mo><msub><mi mathvariant="normal">H</mi><mi mathvariant="normal">F</mi></msub><mo>(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">)</mo></mfenced><mo>)</mo><mo>)</mo></mrow></math><img file="EP1548976B1_D0059.tif" /></maths>

In this way, the second device ME recognises (and stores within memory space) the third quantity r¹_ME.

It is observed that if the second ME device is able to decrypt (55) received from the second trusted authority TA-ME, it is automatically authenticated, <i>i.e.</i> it is not a clone.

The secret session keys associated with the first SIM and the second ME devices may be generated by starting from the quantities which the first SIM and the second ME devices have received from the trusted authorities. Analogously to that described in relation to the first embodiment of the method of the invention, the secret session keys of the first SIM and the second ME devices may be generated, for example, in accordance with equations: <maths id="math0060" num="(57)"><math display="block"><mrow><msub><mi>Ks</mi><mi>SIM</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo>⁢</mo><mfenced separators=""><mi mathvariant="normal">ê</mi><mfenced separators=""><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub></mfenced><mo mathvariant="normal">,</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">+</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">2</mn></msup><mi>ME</mi></msub></mfenced><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0060.tif" /></maths><maths id="math0061" num="(58)"><math display="block"><mrow><msub><mi>Ks</mi><mi>ME</mi></msub><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo>⁢</mo><mfenced separators=""><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">1</mn></msup><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">2</mn></msup><mi>SIM</mi></msub><mo mathvariant="normal">,</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced></mrow></mfenced><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0061.tif" /></maths> and, as shown previously, such keys are identical.

It is useful to observe that the secret session key Ks_SIM = Ks_ME generated in the three cases described, may be related to each specific communication session between the devices. Such key may be re-calculated at each new communication session, such as, for example, due to the switching on again of the cellular telephone.

Furthermore, such key may be changed during the same communication session and due to the refreshing of the identities by the first TA-SIM and the second TA-ME trusted authorities (for example, when a date is associated with the identity).

It is observed that the three embodiments of the method of the invention described, enable the first SIM and the second ME devices for the joint decryption of a generic message encrypted by using the joint identity associated with both.

In particular, in accordance with the method of the invention, the first SIM and the second ME devices may be jointly identified in that they are both associated with a single or common entity. A generic message may be encrypted with the IBE method using the aforesaid common entity so that only the joint operation of the two devices allows its decryption.

Furthermore, none of the trusted authorities related to the devices associated with the common entity recognises the keys indispensable for decrypting the messages received conjointly by the devices themselves. Nevertheless, both trusted authorities cooperate in order to reconstruct such keys. Consequently, it is hypothesised that the common entity be governed by a virtual authority, known as the Virtual Trusted Authority VTA. Such virtual trusted authority VTA does not have an active role in the joint encryption scheme which will be described below, but is simply a mathematical abstraction of the proposed scheme.

It is observed that a joint identity or joint public key Kp_ME/SIM is associated with the common entity comprising the first SIM and the second ME devices. Such joint identity Kp_ME/SIM corresponds to the sum of the second H(ID_ME) and the first H(ID_SIM) public keys, i.e. to the following equation: <maths id="math0062" num="(59)"><math display="block"><msub><mi>Kp</mi><mrow><mi>ME</mi><mo>/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo>+</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced></mrow></math><img file="EP1548976B1_D0062.tif" /></maths>

With reference to the first or to the third embodiment of the method of the invention, a joint private key d_ME/SIM, <i>i.e.</i> a private key associated with the common entity, is in accordance with the following equation: <maths id="math0063" num="(60)"><math display="block"><mrow><msub><mi mathvariant="normal">d</mi><mrow><mi>ME</mi><mo>/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">=</mo><mrow><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo>+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo>⋅</mo><mo>+</mo><mo>(</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>ME</mi></msub></mfenced></mrow><mo>+</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0063.tif" /></maths> wherein r_ME and r_SIM are the random numbers generated by the trusted authorities.

Alternatively, the joint private key d_ME/SIM with reference to the second embodiment of the method is in accordance with the equation <maths id="math0064" num="(61)"><math display="block"><mrow><msub><mi mathvariant="normal">d</mi><mrow><mi>ME</mi><mo>/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">=</mo><mrow><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">S</mi><mrow><mi>TA</mi><mo mathvariant="normal">-</mo><mi>ME</mi></mrow></msub><mo>+</mo><msub><mi mathvariant="normal">S</mi><mrow><mi>Ta</mi><mo mathvariant="normal">-</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">)</mo><mo>⋅</mo><mo>(</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>ME</mi></msub></mfenced></mrow><mo>+</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced><mo>)</mo></mrow></math><img file="EP1548976B1_D0064.tif" /></maths> wherein the sum of the second and the first random numbers r_ME+r_SIM is substituted by the sum of the second and the first s_TA-ME +s_Ta-SIM master keys.

An example of the encryption of a message to the common entity comprising the two devices and the joint decryption of such a message will be described below.

For reasons of brevity, it is observed that such an example is in accordance with the first (or the third) embodiment of the method of the invention. Nevertheless, through appropriate adaptations, the example in question could also be applied to the above mentioned second embodiment.

Above all, a third device C which intends to transmit a digital message M to the common entity comprising the first SIM and the second ME devices, must first appropriately encrypt such a message M by carrying out the following steps of the process.

In a first instant, such third device C, which recognises the characteristic parameters of the trusted authorities, acquires (and memorises) from the first TA-SIM and from the second TA-ME trusted authorities further first r_SIM · P and further second r_ME · P points from the additive group G₁, respectively, <i>i.e.</i> the device C acquires the external product between the first random number r_SIM and the point P and the external product between the second random number r_ME and the point P. In this way, the third device C may calculate (and memorise) a joint public point P_pubME/SIM in accordance with the following equation: <maths id="math0065" num="(62)"><math display="block"><msub><mi mathvariant="normal">P</mi><mrow><mi>pubME</mi><mo mathvariant="normal">/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">=</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></math><img file="EP1548976B1_D0065.tif" /></maths>

It is observed that in order to calculate said joint public point in accordance with the second embodiment of the method it is enough to substitute the first r_SIM and the second r_ME random numbers with the first s_TA-SIM and with the second s_TA-ME master keys, respectively. Subsequently, the third device C follows the Boneh and Franklin protocol in order to encrypt the message as is known to any expert in the art. In particular, the third device C generates an further random number x which is an integer and generates a first point U of the additive group G₁ in accordance with the equation: <maths id="math0066" num="(63)"><math display="block"><mi mathvariant="normal">U</mi><mo mathvariant="normal">:</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">p</mi></math><img file="EP1548976B1_D0066.tif" /></maths> Furthermore, the device C generates the string of bits V in accordance with the following equation: <maths id="math0067" num="(64)"><math display="block"><mi mathvariant="normal">V</mi><mo mathvariant="normal">:</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mfenced separators=""><mi mathvariant="normal">ê</mi><mfenced separators=""><msub><mi>Kp</mi><mrow><mi>ME</mi><mo mathvariant="normal">/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><msub><mi mathvariant="normal">P</mi><mrow><mi>pubME</mi><mo mathvariant="normal">/</mo><mi>SIM</mi></mrow></msub></mfenced></mfenced></math><img file="EP1548976B1_D0067.tif" /></maths> As is shown in (64), the third device C applies the bilinear function ê to the joint public key Kp_ME/SIM and to the external product between the further random number x and the joint public point P_pubME/SIM. The result of such an operation belongs to the finite multiplicative group G₂ and the string of bits V is extracted from such result by using the second hash function H₁.

Finally, the device C encrypts the message M to be sent to the common entity. The encrypted and transmitted message is generally indicated by the notation: <maths id="math0068" num="(65)"><math display="block"><mo mathvariant="normal">&lt;</mo><mi mathvariant="normal">U</mi><mo mathvariant="normal">,</mo><mi mathvariant="normal">M</mi><mo mathvariant="normal">⊕</mo><mi mathvariant="normal">V</mi><mo mathvariant="normal">&gt;</mo></math><img file="EP1548976B1_D0068.tif" /></maths> on the basis of which the encrypted message comprises, in a first part, the first point U and in a second part, the result of the operation M⊕V. As is apparent to the expert in the art, the operator "⊕" represents an OR-exclusive or XOR type operation between bits between the digital message in clear M and the string of bits V.

The first SIM and the second ME devices simultaneously receive the encrypted message (65) and may generate, simultaneously and autonomously from one another, a first W_SIM and a second W_ME half decryption token, respectively. In particular, such first W_SIM and second W_ME half tokens are numbers which are generated by starting from an initial part of the encrypted message (65) (<i>i.e.</i> the first point U) and by using the quantities which each device has received from the trusted authorities in the preceding step.

Indeed, the first half token W_SIM is generated by the first device SIM (which also memorises it in its own memory) by applying the bilinear function ê to the first point U and to the sum of the first r¹_SIM and of the fourth r²_ME quantities, as expressed by the following equality: <maths id="math0069" num="(66)"><math display="block"><msub><mi mathvariant="normal">W</mi><mi>SIM</mi></msub><mo mathvariant="normal">:</mo><mrow><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>SIM</mi></msub><mo>+</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">2</mn></msup><mi>SIM</mi></msub><mo>,</mo><mi mathvariant="normal">U</mi></mrow><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0069.tif" /></maths> By starting from (66) and by using subsequent steps in which account is taken of the equations (3), (7), (16) and (63) introduced previously, the first half token W_SIM also corresponds to: <maths id="math0070" num="(67)"><math display="block"><mtable columnalign="left"><mtr><mtd><msub><mi mathvariant="normal">W</mi><mi>SIM</mi></msub><mo>:</mo></mtd><mtd><mo>=</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">+</mo></mrow><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mfenced separators=""><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></mrow></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><mo>=</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo>⁢</mo><msup><mfenced separators=""><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced><mo mathvariant="normal">∧</mo></msup><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub></mfenced></mrow></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><mo mathvariant="normal">=</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo>⁢</mo><msup><mrow><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">P</mi></mrow><mo mathvariant="normal">)</mo></mrow><mo mathvariant="normal">∧</mo></msup><mo>⁢</mo><mi mathvariant="normal">x</mi><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub></mfenced></mrow></mtd></mtr></mtable></math><img file="EP1548976B1_D0070.tif" /></maths> Analogously, the second half token W_ME is generated by the second device ME (and is memorised within the memory of the latter) by applying the bilinear function ê to the first point U and to the sum of the third r¹_ME and of the second r²_SIM quantities, as expressed by the following equality: <maths id="math0071" num="(68)"><math display="block"><msub><mi mathvariant="normal">W</mi><mi>ME</mi></msub><mo mathvariant="normal">:</mo><mrow><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><msub><msup><mi mathvariant="normal">r</mi><mn>1</mn></msup><mi>ME</mi></msub><mo>+</mo><msub><msup><mi mathvariant="normal">r</mi><mn mathvariant="normal">2</mn></msup><mi>SIM</mi></msub><mo>,</mo><mi mathvariant="normal">U</mi></mrow><mo mathvariant="normal">)</mo></mrow></math><img file="EP1548976B1_D0071.tif" /></maths> By starting from (68) and by using subsequent steps in which account is taken of the equations (3), (8), (15) and (63) introduced previously, the second half token W_ME also corresponds to: <maths id="math0072" num="(69)"><math display="block"><mtable columnalign="left"><mtr><mtd><msub><mi mathvariant="normal">W</mi><mi>ME</mi></msub><mo>:</mo></mtd><mtd><mo>=</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">+</mo></mrow><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">H</mi><mfenced separators=""><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced></mrow></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><mo>=</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo>⁢</mo><msup><mfenced separators=""><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mfenced><mo mathvariant="normal">∧</mo></msup><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub></mfenced></mrow></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><mo mathvariant="normal">=</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo>⁢</mo><msup><mrow><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">P</mi></mrow><mo mathvariant="normal">)</mo></mrow><mo mathvariant="normal">∧</mo></msup><mo>⁢</mo><mi mathvariant="normal">x</mi><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub></mfenced></mrow></mtd></mtr></mtable></math><img file="EP1548976B1_D0072.tif" /></maths>

Preferably, at this point, the first device SIM sends the first half decryption token W_SIM generated by encrypting it with its own session key Ks_SIM, to the second device ME. Preferably, in an analogous way, the second device ME transmits the second half token W_ME encrypting it with its own session key Ks_ME, to the first SIM. In such a way, each device is able to autonomously generate a joint decryption key W by starting from such half tokens. In particular, such joint decryption key W is a number which both devices may calculate in accordance with the following equation: <maths id="math0073" num="(70)"><math display="block"><mi mathvariant="normal">W</mi><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mfenced separators=""><msub><mi mathvariant="normal">W</mi><mi>ME</mi></msub><mo mathvariant="normal">*</mo><msub><mi mathvariant="normal">W</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0073.tif" /></maths> wherein, as is known to an expert in the art, the symbol "*" indicates an internal product within the multiplicative group G₂. From (67) and (69), the equation (70) is equivalent to <maths id="math0074" num="(71)"><math display="block"><mtable columnalign="left"><mtr><mtd><mi mathvariant="normal">W</mi><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">+</mo><mi mathvariant="normal">H</mi><mo>⁢</mo><msup><mfenced separators=""><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">P</mi></mfenced><mo mathvariant="normal">∧</mo></msup><mo>⁢</mo><mi mathvariant="normal">x</mi><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub></mfenced></mrow></mtd></mtr><mtr><mtd><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mo>⁢</mo><mfenced separators=""><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">⋅</mo><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">+</mo><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi></mrow><mo mathvariant="normal">)</mo></mfenced></mtd></mtr><mtr><mtd><msub><mrow><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi></mrow><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">=</mo><mi mathvariant="normal">ê</mi><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mfenced separators=""><msub><mi mathvariant="normal">d</mi><mrow><mi>ME</mi><mo mathvariant="normal">/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><mi mathvariant="normal">U</mi><mo mathvariant="normal">)</mo></mfenced></mrow></mtd></mtr></mtable></math><img file="EP1548976B1_D0074.tif" /></maths> i.e. the joint decryption key W corresponds to applying the bilinear function ê to the joint private key d_ME/SIM, which none are able to extract, and to the point U.

Furthermore, it is observed that due to a property of bi-linearity known to any expert in the art, the equation (71) compares to: <maths id="math0075" num="(72)"><math display="block"><mtable columnalign="left"><mtr><mtd><mi mathvariant="normal">W</mi></mtd><mtd><msub><mrow><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi></mrow><mn mathvariant="normal">1</mn></msub><mfenced separators=""><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">D</mi><mrow><mi>ME</mi><mo mathvariant="normal">/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><mi mathvariant="normal">U</mi></mfenced></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><msub><mrow><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi></mrow><mn mathvariant="normal">1</mn></msub><mo>⁢</mo><mfenced separators=""><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">⋅</mo><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>ME</mi></msub></mfenced><mo mathvariant="normal">+</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced><mo mathvariant="normal">)</mo><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi><mo mathvariant="normal">)</mo></mfenced></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><msub><mrow><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi></mrow><mn mathvariant="normal">1</mn></msub><mrow><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>ME</mi></msub></mfenced><mo mathvariant="normal">+</mo><mi mathvariant="normal">H</mi><mo>⁢</mo><msup><mrow><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced><mo mathvariant="normal">,</mo><mi mathvariant="normal">P</mi><mo mathvariant="normal">)</mo></mrow><mo mathvariant="normal">∧</mo></msup><mo>⁢</mo><mi mathvariant="normal">x</mi><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub></mfenced></mrow></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><msub><mrow><mo mathvariant="normal">=</mo><mi mathvariant="normal">H</mi></mrow><mn mathvariant="normal">1</mn></msub><mo mathvariant="normal">(</mo><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><mi mathvariant="normal">H</mi><mrow><mo mathvariant="normal">(</mo><msub><mi>ID</mi><mi>ME</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">+</mo><mi mathvariant="normal">H</mi><mfenced><msub><mi>ID</mi><mi>SIM</mi></msub></mfenced></mrow><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo>⁢</mo><mfenced separators=""><msub><mi mathvariant="normal">r</mi><mi>ME</mi></msub><mo mathvariant="normal">+</mo><msub><mi mathvariant="normal">r</mi><mi>SIM</mi></msub><mo mathvariant="normal">)</mo><mo mathvariant="normal">⋅</mo><mi mathvariant="normal">P</mi><mo mathvariant="normal">)</mo></mfenced></mtd></mtr><mtr><mtd><mspace width="1em" /></mtd><mtd><mo mathvariant="normal">=</mo><msub><mi mathvariant="normal">H</mi><mn mathvariant="normal">1</mn></msub><mfenced separators=""><mi mathvariant="normal">ê</mi><mo mathvariant="normal">(</mo><msub><mi>Kp</mi><mrow><mi>ME</mi><mo mathvariant="normal">/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">,</mo><mi mathvariant="normal">x</mi><mo mathvariant="normal">⋅</mo><msub><mi mathvariant="normal">P</mi><mrow><mi>pubME</mi><mo mathvariant="normal">/</mo><mi>SIM</mi></mrow></msub><mo mathvariant="normal">)</mo></mfenced></mtd></mtr></mtable></math><img file="EP1548976B1_D0075.tif" /></maths> As is known, equation (72) corresponds to (64), or rather to the string of bits V.

On the basis of such result, the message M originally encrypted by the third device C may be restored, autonomously, both by the first SIM and by the second ME devices by carrying out another XOR operation between the encrypted message M⊕V and the joint decryption key W, as shown in the following equation: <maths id="math0076" num="(73)"><math display="block"><mi mathvariant="normal">M</mi><mo>⊕</mo><mi mathvariant="normal">V</mi><mo mathvariant="normal">⊕</mo><mi mathvariant="normal">W</mi><mo>→</mo><mi mathvariant="normal">M</mi></math><img file="EP1548976B1_D0076.tif" /></maths>

Advantageously, the joint decryption key W is related to a specific joint decryption session of the message by the first SIM and by the second ME devices and is recalculated for each specific decryption session. Alternatively, said key W is periodically recalculated. An additional functionality of the method of the invention provides for the possibility of securely memorising the sensitive data of one device within the memory of the other. For example, the first device SIM may memorise its own sensitive data, for simplicity, indicated as the generic message M1, within the memory of the second device ME by simply encrypting such data with a first random string H'(W_SIM) according to the equation: <maths id="math0077" num="(74)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">⊕</mo><mi mathvariant="normal">Hʹ</mi><mfenced><msub><mi mathvariant="normal">W</mi><mi>SIM</mi></msub></mfenced></math><img file="EP1548976B1_D0077.tif" /></maths> i.e. by carrying out the XOR operation between the sensitive data M1 and said string obtained by applying a third hash function H' to the first half decryption token W_SIM. It is observed that such hash function H' is distinct from the second hash function H₁, despite having the same characteristics of the latter.

The data encrypted in accordance with (74) are sent to the second device ME which in turn encrypts them by carrying out an additional XOR operation by using a second random string H'(W_ME) obtained by applying the hash function H' to the second half token W_ME, <i>i.e</i>.: <maths id="math0078" num="(75)"><math display="block"><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">⊕</mo><mi mathvariant="normal">M</mi><mo>⁢</mo><mn mathvariant="normal">1</mn><mo mathvariant="normal">⊕</mo><mi mathvariant="normal">Hʹ</mi><mfenced><msub><mi mathvariant="normal">W</mi><mi>SIM</mi></msub></mfenced><mo>⊕</mo><mi mathvariant="normal">Hʹ</mi><mfenced><msub><mi mathvariant="normal">W</mi><mi>ME</mi></msub></mfenced></math><img file="EP1548976B1_D0078.tif" /></maths>

The overall encrypted message obtained is stored permanently within the memory of the second device ME and remains there even when the first device SIM is disconnected from the second ME. Advantageously, in order to decrypt any such future messages it will be indispensable that the original device SIM be connected to the second device ME.

Furthermore, it is observed that both the cryptography algorithms and the method procedures with which the various cryptographic keys, the numerical quantities and the decryption tokens are generated are implemented in hardware, software or hybrid procedures, <i>i.e</i>. by combining both the preceding methods. In particular, the algorithms or the software implemented method procedures are contained within memory storage space belonging to the trusted authorities or the first SIM and the second ME devices. The hardware-type procedures are implemented through appropriate electronic circuitry.

For example, in correspondence with a trusted authority in which there are no dimensional or power dissipation limitations, such procedures may be implemented in a hardware manner, <i>i.e.</i> by integrating with electronic circuitry. On the contrary, within the individual devices (SIM or ME) wherein the previously mentioned limitations are considerable, it is preferable to implement the method algorithms and procedures through software.

It is observed that the method of the invention allows sending a message M simultaneously to two devices by carrying out a unique encryption operation, showing itself therefore to be simple and versatile from the computational point of view, without compromising the confidentiality of the transmission.

Furthermore, in accordance with the method of the invention, the first SIM and the second ME devices both take part in decrypting the encrypted message M sent to both of them by generating the corresponding half decryption tokens.

It is observed that as a consequence of the reciprocal exchange of such tokens between the devices, the first SIM and the second ME devices may generate the joint decryption key W in order to decrypt the encrypted message received in parallel, <i>i.e.</i> they may decrypt such a message independently from one another.

In this way, the need for both devices having to decrypt the encrypted message received in turn, in order to restore the message in clear, such as currently occurs with the known art, is avoided. Indeed, by applying the known art, following the first decryption, the entire message, which is still not intelligible, must be exchanged between the devices, hence the quantity of information which they must exchange is considerable. Furthermore, the device which lastly decrypts the encrypted message in order to restore the message in clear is in a position of advantage with respect to the other within the joint decryption operation.

Instead, in accordance with the method of the invention, the devices forming the common entity autonomously decrypt the encrypted message received, only after having each independently generated the joint decryption key W.

Ultimately, the devices having recourse to the method of the invention have an equal role during the decryption operation and enjoy the same advantages.

Finally, in order to carry out such an operation correctly, the devices need only exchange their half decryption tokens with one another, <i>i.e.</i> exchange a much reduced quantity of information.

Obviously, to the method of the present invention for encrypting a message conjointly to two devices, an expert in the art, with the aim of satisfying contingent and specific requirements, might carry out further modifications and variations, all of which are included within the scope of protection of the invention, such as defined by the following claims.