WO2016000861A1

WO2016000861A1 - Method for high-performance, fine-granularity and verifiable authorisation

Info

Publication number: WO2016000861A1
Application number: PCT/EP2015/060344
Authority: WO
Inventors: Jens-Uwe Busser
Original assignee: Siemens Aktiengesellschaft
Priority date: 2014-07-03
Filing date: 2015-05-11
Publication date: 2016-01-07
Also published as: DE102014212895A1

Abstract

The description relates to a method for authorising use of a volume-dependent service, having the following method steps: – generation (11) of a random number (H₀) that is initially known only to a user (1); – N-fold hashing, on the basis of the random number (H₀), so that the following hash chain applies: H₁ = hash (H₀); H₂ = hash (H₁);…; H_N=hash (H_N-1); and – registration of a user (1), using a digitally signed structure S that contains the last value in the hash chain H_N in plain text, with a service provider (2); – acknowledgement (14, 15, 16, 17) of every k-th partial service obtained or authorisation of every requested k-th partial service by means of sending of the (N-k)-th value H_N-k in the hash chain from the user (1) to the service provider (2) after or before said partial service is provided; – checking (22, 24, 26, 28) of the validity of the obtained value H_N-k by the service provider (2) as a new part of the hash chain H_N-k to H_N by means of hashing of the obtained value and comparison of the match between the hash value and the previously obtained value H_N-(k-1) or H_N from structure S in the case of the first obtained value; – provision of the next partial service or enabling of the requested partial service by the service provider (2) if the obtained value is correct, otherwise termination of the method. Application: access control, prepayment methods, billing for services.

Description

description

Method for high-performance, finely granular and verifiable authorization

The invention relates to the billing of volume-dependent

Services where a service or goods are purchased and billing is electronic. The use of many volume-based services is now already billed electronically. For example, in the telecommunications sector, in Internet offers, etc. Also for future services such as charging all-electric vehicles "eCar", electric car, or the use of "cloud" applications, such as storage of data or use of applications on the Internet, such solutions as expected enforce.

For example, "cloud computing" describes the approach of providing abstracted IT infrastructures over a network. The range of services offered in "cloud computing" covers the entire spectrum of information technology, including infrastructure, platforms and software.

The customer pays with an electronic first signature, a first digital signature. He can create during registration to prove his identity and Be ^¬ emption to use the service. However, then it is usually not clear to what extent he

Will take service or assistance, that is how long it will telephony ^¬ reindeer, which amount will absorb electrical energy the "eCar" or how many operations he of "Cloud" - will be carried out applications, etc. It is therefore neces- agile, For reasons of traceability after the termination of the use of a service, the customer must request a second digital signature confirming the use of the service and, above all, the extent of this use. If, for example, the connection terminates, a second signature can no longer be generated. The service provider will then have no demonstrable confirmation of the service usage and a claimed service volume. Therefore, it might be advantageous for a customer to interrupt the connection, in particular shortly before the termination of the service usage, and to deny the extent of the usage.

So far, for example, in telecommunications only the provider logs the use of its services by a customer and sends a monthly bill. These data stored on appropriate billing servers data of the provider have been recognized in the dispute by German courts in the rule. If the customer denied the correctness of the invoiced services, he had to provide explicit proof of the defectiveness.

When refueling on credit card or giro card the Tankau ^¬ tomat retains the card until the refueling process is performed and then debits the determined amount. Or it is already reserved before the start of refueling a certain amount on a credit card account. Up to this amount can then be refueled. The fuel terminal will deduct a smaller amount if less fuel has been used.

The invention is based on the object of describing a method for secure and high-performance billing in a volume-dependent service. The solution of this task is done by the Merkmalskombi ^¬ nation of an independently formulated claim. Advantageous embodiments can be taken from the subclaims.

A trivial solution would be the creation of each new signature based on asymmetric cryptography, as in ^¬ example RSA or elliptic curves, by the customer directly before or after the provision of a specific partial power, eg for each call unit when making a call or for each the charged kilowatt hour kWh at the eCar. This requires each ^¬ but a lot of computation.

It becomes a powerful, easy-to-use, and securely executable authorization when using volume-dependent

Services an input quantity for billing a service or a product in N approximately equal subsets divided, hereinafter referred to as partial services, and the partial services are confirmed to the service provider by sending a new value of a hash chain. The service provider can receive the received

Using hash values as evidence that he has provided the part Leis ^¬ obligations to the user.

A hash function, also called a scatter value function, is an image that maps an arbitrarily large input quantity to a smaller target quantity, the hash values. The input set may also hold elements of different lengths ent ^¬. By contrast, the elements of the target quantity have a constant length.

Are secure cryptographically phical Hash the method proposed here, that is at least weakly collision-onsresistente way functions with sufficiently large target ^¬ quantity to use. Recommendations for cryptographically secure hash functions are given for example by the German Federal Office for Information Security (BSI) and the US National Institute of Standards and Technology (NIST). Shash methods that are currently considered safe are, for example, SHA-256, SHA-512 and whirlpool; the hash methods MD-4, MD-5, SHA-0 or even SHA-1 are no longer considered safe.

A method is proposed with the following steps: the hash values are calculated in advance by the user, as a continuous chain, starting from a randomly chosen value Ho known only to the user; This random number may ^¬ with conventional cryptographic methods for supply If numbers or pseudo-random numbers are generated and should ^¬ te have at least the same length as the hash method. Each hash value Hi of Hashkette is the hash of the reciprocating before ^¬ R value ± -i, so

Hi = hash (H ₀ ), H ₂ = hash (hi),

Hi = hash (Hi-i), H _N = hash (H _N _i).

The random number Ho and the hash values Hi to H _N _i, ie all but H _N , are kept secret for the time being. The last hash value H _N is included as plain text together with other data in a structure S signed with asymmetric cryptography, which can also be used as a request of the user at the service provider.

The signed S structure preferably contains the fol ^¬ constricting data:

Unique name of the user / customer

Unique name of the service provider

- Possibly unique name of a specific Gerä ^¬ tes of the service provider

Possibly unique name of a billing company

Validity period

- Anchor value of the hash chain in the form of the last hash value H _N in plain text

Maximum number N of possible service or accounting units, partial quantities, partial services, operations to be performed, etc.

- Service or billing amount per unit, such as subset or per hash value.

The service provider now begins to provide partial services. Immediately after the provision of the k-th power is confirmed this by the user by sending the value H _N _ _k to the service provider. For each partial power received, the user notifies the service provider of such a hash value in the reverse order of the calculation, So first H _N _i, then H _N _ ₂ , last H _N _ _k after a total of k partial services were retrieved. If all N partial powers are called up at (k = N), then the last value communicated is the random number Ho.

The service provider checks for each received value H _N _ _k , whether its hash value Hash (H _N _ _k ) equal to the value received for the previous partial delivery (k-1) - or for the first value (k = l) equal to H _N from structure S - is:

If so, the hash chain known to the service provider has been successfully extended from H _N - _(k -i ₎ to H _N by another element H _N - _k , and service provision continues. Otherwise, the service provider reports an error, asks for the correct value and / or aborts the service.

The service provider stores at least the last obtained value H _N _ _k , which is needed together with the structure S for billing. The other hash values do not need to be stored explicitly because they can be easily calculated from the stored value by multiple hashing.

A second digital signature by the user after completion of the service is not necessary. For billing the service provider reaches the structure S and the value last received _N H _ _k in the billing center, such as bank, Clea ^¬ ring spot, etc., a. This clearinghouse verified by repeating the hashing Hashkette H _N _ _k to H _N, and thus also determines k as the length of Hashkette H _N _ _k to H _N. Subsequently, the service provider receives the agreed vergue ^¬ processing for k partial services credited. Performs maximum N times hashing, starting from the obtained value H _N _ _k, not the value H _N in the structure S, so a credit is abge ^¬ rejects. The structure S is preferably valid only for a limited time during which it can be billed; an already billed structure S as well as the number k of ^¬ be already settled partial services must be stored until the end of this period from the clearinghouse to to prevent multiple billing by the service provider.

The service provision can also be interrupted after an arbitrary number of 5 ki <N partial services and continued later with k2 further partial services (k ₂ ^ N-ki) as long as the validity period of the signed structure S has not expired. If ki partial services have already been billed for a structure S and the service provider of the payroll ^agent reports another, different value H * = H _N _ _(k 2 + _k i), then the payroll office again determines the length by repeated hashing ( k ₂ + ki) of the new hash chain. If this new hash chain is longer than the already settled hash chain, the service provider (k ₂ -ki) has provided new partial services, which can now be billed additionally.

The service provider may the initial value Ho and the zurücklie ^¬ constricting hash value Hi to H _N _ _k _i not be calculated, because the hash function is not reversible one-way function. Therefore, he can not account for more than part of the services he provided.

As it also known to him hash values H _N _ _k to H _N _i could not compute himself, he can prove the fact that he has received from the user for the provision of k partial performance of the service described in the signed structure S 25th

Advantage over conventional methods, in which only the commissioning and / or rendering of a total service with a

30 ner signature will be ^¬ confirmed based on public-key cryptography is the detailed repudiation he brought ^¬ partial performance even if something unexpected disconnection. Although partial services could also be confirmed with signatures, these procedures are

35 same as a hash calculation very computationally intensive (approx.

1000 times) and therefore require a significantly higher computing capacity, or can be used for low-performance components lead to unwanted time interruptions in the provision of services.

The method can also be advantageously used on a device which can generate no (pseudo) random numbers and / or can not calculate signatures: the random number Ho, the hash chain Hi to H _N and the signature of the structure S then become on another , calculated and stored on the user's device only and transmitted in use.

In the following, with reference to the accompanying, schematic, non-limiting, the invention, Figures 1 and 2 embodiments described:

FIG. 1 shows a flow diagram of an embodiment of the invention,

FIG. 2 shows a flow chart in which the respective hash value 14, 15, 16, 17 is sent before the partial power 21, 23, 25, 27 is provided.

1 shows the flowchart of an embodiment with a user 1, which first generates a random number Ho in a first step 11 and calculates the associated hash chain in a second step 12. While the application 13, he ^¬ demonstrates the user 1 is a signed data structure S, which among other data, includes the last value of Hashkette H _N, and sends this structure S to the service provider 2. The service provider 2 then provides partial services 21, 23,

25, 27 of his service, which are confirmed by the user 1 with corresponding values 14, 15, 16, 17 from the hash chain. The service provider 2 checks the values obtained in steps 22, 24, 26, 28. For billing 31, the service provider 2 sends the structure S and the last received hash value H _N _ _k to the clearing office 3. FIG. 2 shows a flowchart in which the respective hash value 14, 15, 16, 17 is sent prior to the provision of the partial power 21, 23, 25, 27, as is well applicable, for example, in the case of authorization methods.

Further embodiments:

In one embodiment, the user generates the to ^¬ random number Ho, the Hashkette Hi to H _N, and the signed with its private key structure S. The billing ^¬ means of structure S and hash value H _N _ _k is performed after the supply of k partial deliveries. Sketched in Figure 1.

In an alternative embodiment, it is also possible that the user first sends a new hash value each time and only then the associated partial power is provided, see Figure 2. This embodiment is particularly advantageous in Ver ^¬ drive for access control. Alternatively, the random number Ho, the hash chain Hi to H _N and the structure S may also be created by a third party and made available to the user for use. Thus prepayment methods "prepaid", as well as the issuing of authorization tokens are possible.

For performance reasons, it may be advantageous not to send a new value of the hash chain after each partial power, but only to send a respective new value after a certain number of partial services or after a specific time, which confirms the provision of these partial services.

In order to prevent a user with the same structure S from providing services to different service terminals of the service provider several times, it is advantageous that the service terminals are interconnected and exchange information about already used structures S and received values and hash chains. Alternatively, each structure S can also contain a unique designation of a service terminal, which is the only one authorized to accept this structure; one is not necessary, since ^¬ matching against dictionaries with other service terminals then.

The invention can be used advantageously, in particular in the following applications:

When charging eCars

- Smart metering and prepaid billing of electrical

Energy, water, gas, ...

Micro-payment, for example for Internet services or rechargeable ATM cards

Authorization of service requests in cloud applications - access and access management

electronic tickets, rechargeable payment cards

Special services in entertainment facilities; like swimming pool, amusement park etc.

Claims

claims

1. Authorization procedure for the use of a volume-based service, comprising the following procedural steps:

Generation (11) of a random number (Ho), which is initially known only to a user (1),

N-hath, starting from the random number (Ho), so the following hash chain applies:

Hi = hash (Ho); H ₂ = Hash (Hi); H _N = hash (H _N -i), and registration of a user (1) by means of a digitally signed ^¬ structure S, which contains the last value of the hash chain H _N in plain text, at a service provider (2), confirmation (14, 15,16,17) obtained every k-th power or authorize any requested k-th power -th means of transmission of the (Nk) value H _N _ _k of Hashkette by the user (1) to the service provider (2) to respectively prior to Provision of this partial service,

Test (22,24,26,28) of the validity of the ^¬ tes obtained H _N _ _k by the service provider (2) as a new part of the Hashkette H _N _ _k to H _N via hashing the obtained value and comparing the correspondence of the hash value with the previously obtained value H _N - _(k _i ₎ or with H _N from structure S in the case of the first value obtained, provision of the next partial power respectively release of the requested partial power by the service provider (2) if the received value is ^correct, otherwise Termination of the procedure.

2. The method of claim 1, wherein

the random number Ho and the hash values Hi to H _N _i, without H _N , are kept secret for the time being and the last hash value H _N is contained in clear text together with other data in a structure S signed with asymmetric cryptography,

3. The method according to any one of claims 1 - 2, wherein

the signed structure S has only limited validity.

4. The method according to any one of claims 1-3, wherein

the user (1) no longer sends hash values as soon as a service provider (2) stops the supply and / or the service provider (2) discontinues the service provision if the user (1) no longer sends hash values or if the hash values are faulty , by doing

Hash (H _k) to the value previously obtained H _{k +} i unequal, wherein the service provider (Nk) can settle exactly partial deliveries whose correct hash values H _k, H has i, _N H ER keep it _i _{k +.}

5. The method according to any one of claims 1-4, wherein the user (1) by sending a plurality of hash values or sending a hash value with a lower index multiple partial services or a larger partial power at once confirmed or ^¬ calls.

6. The method according to any one of claims ^1-5 , wherein the Ab ^¬ billing office (3) after receipt of a new billing (31) by the service provider (2) takes into account the already known from previous accounts hash chain and in the Fest ^¬ position of the billable service amount only the respective extension of the hash chain additionally credits.

7. A method according to any one of claims 1-6, wherein the data structure S includes a unique identifier of a terminal of the service provider (2) and is akzep ^¬ advantage only from this terminal.

8. A method according to any one of claims 1-7, wherein the Erzeu ^¬ account the random number HO, the calculation of the Hashkette and / or the digital signature performed in a first, high-performance device, and then transferred to a second, leistungsschwa ^¬ ches device of the user become.

9. A method according to any one of claims 1-8, wherein the random number through to ^¬ HO, the Hashkette and the digital signature a third party and made available to the user (1).

10. The method of claim 9, wherein the third party is the service provider (2).

11. The method according to any one of claims 1-10, wherein

a cryptographically secure hash method is used, which represents at least one weakly collision-resistant one-way function, with a sufficiently large target amount.

12. The method according to any one of claims 1-11, wherein as a calculated with a cryptographically secure pseudo-random number process is used to ^¬ random number.

13. Use of a method according to any one of claims ^¬ 1 to 12, for use in at least one application ^¬ case from the following group:

Procedure for charging, eCars \

Smart Metering ^λ and prepaid

Billing ^x of electrical energy, water, gas etc.,

Method for, micro-payment ^λ , for services on the Internet,

Procedure for authorization of service requests in

, Cloud ^λ applications,

Access and access management,

Method for operating electronic tickets or for

Operation of rechargeable payment cards,

Method for billing special services in entertainment facilities; like swimming pool, amusement park or

Similar.