# US 10,122,530 B2 · Method and system for delegating calculation of a bilinear pairing value to a calculation server

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,530 B2
- Document ID: US10122530B2
- Status: Granted
- Kind: B2
- Application number: 14/897,361
- Filed: 2014-06-10
- Published: 2016-05-19
- Granted: 2018-11-06
- Earliest claimed: 2013-06-11
- Assignees: Orange
- Applicants: Orange
- Inventors: Sébastien Canard; Julien Devigne; Olivier Sanders
- Web page: https://patentgrep.com/patent/US10122530B2

## CPC

- H04L 9/0869: {involving random numbers or seeds}
- G06F 7/588: {Random number generators, i.e. based on natural stochastic processes}
- H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing}
- H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption
- H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

One embodiment relates to a method for enabling an entity to delegate calculation of a bilinear pairing value e(A,B) between two values A and B to a calculation server. The entity may select public elements P1 and P2 and secret elements S1 and S2, two of the elements from among P1, P2, S1, and S2 being selected to be equal to A and B, generate elements R1=vS1, R2=uS2, T1=uP1+S1, T2=vP2=S2, where u and v are random numbers, and transmit R1, R2, T1, and T2 to the calculation server. The server may calculate (a1)y=e(T1,T2)[e(R1,P2)e(P1,R2)]−1, and (a2)z=e(D1,D2), y and z designating two integers equal to 1 or to an integer c, D1 and D2 designating two public elements from among A and B or from among R1 and R2 and transmit a1 and a2 to the entity. The entity may obtain the value e(A,B) from a1 or a2.

## Claims

### Claim 1

A delegation method enabling an entity to delegate calculation of a bilinear pairing value e(A,B) between two values A and B to a calculation server, said delegation method comprising:
selecting, by said entity, two public elements P1 and P2 and two elements S1 and S2 that said entity keeps secret, two of the elements P1, P2, S1, and S2 being selected from among the values A and B respectively;
generating, by said entity, four elements:
R1=vS1
R2=uS2
T1=uP1+S1, and
T2=vP2+S2
where u and v designate random numbers;
transmitting, by said entity, said elements R1, R2, T1, and T2 to said calculation server;
calculation, by said calculation server, of two values a1 and a2 satisfying:
(a1)y=e(T1,T2)[e(R1,P2)e(P1,R2)]−1, and
(a2)z=e(D1,D2)
y and z designating two predetermined integers, each of said integers being equal to 1 or to a predetermined integer c, and D1 and D2 designating two public elements selected from among the values A and B or the elements R1 and R2;
transmitting, by said calculation server, the values a1 and a2 to said entity; and
obtaining, by said entity, said pairing value e(A,B) from the value a1 or from the value a2.

### Claim 2 (depends on 1)

The delegation method of claim 1, further comprising verifying the validity of the extracted pairing value e(A,B) by using an equality relating the values a1 and a2, the random numbers u and v, and an element S that is kept secret by said entity.

### Claim 3 (depends on 2)

The delegation method of claim 2, wherein the element S and the random numbers u and v are independent of the values A and B.

### Claim 4 (depends on 2)

The delegation method of claim 2, wherein the element S is such that Sy=e(S1,S2) or equal to e(uP1,vP2).

### Claim 5

An obtaining method enabling an entity to obtaining a bilinear pairing value e(A,B) between two values A and B from a value calculated by a calculation server, said obtaining method comprising:
selecting two public elements P1 and P2 and two elements S1 and S2 that said entity keeps secret, two of the elements P1, P2, S1, and S2 being selected from among the values A and B respectively;
generating four elements:
R1=vS1
R2=uS2
T1=uP1+S1, and
T2=vP2+S2
where u and v designate random numbers;
transmitting said elements R1, R2, T1, and T2 to said calculation server;
receiving two values a1 and a2 calculated by said calculation and satisfying:
(a1)y=e(T1,T2)[e(R1,P2)e(P1,R2)]−1, and
(a2)z=e(D1,D2)
y and z designating two predetermined integers, each of said integers being equal to 1 or to a predetermined integer c, and D1 and D2 designating two public elements selected from among the values A and B or the elements R1 and R2; and
obtaining said pairing value e(A,B) from the value a1 or from the value a2.

### Claim 6

A transmission method performed by a calculation server, said transmission method comprising:
receiving from an entity four elements R1, R2, T1, and T2;
calculating two values a1 and a2 satisfying:
(a1)y=e(T1,T2)[e(R1,P2)e(P1,R2)]−1, and
(a2)z=e(D1,D2)
wherein e(A,B) designates a bilinear pairing between two values A and B, P1 and P2 designate two public elements, y and z designate two predetermined integers, each of said integers being equal to 1 or to a predetermined integer c, and D1 and D2 designate two public elements selected from among two values A and B or from among the elements R1 and R2; and
transmitting the values a1 to a2 to said entity to enable the entity to obtain the bilinear pairing value e(A,B) between the two values A and B.

### Claim 7 (depends on 1)

The delegation method of claim 1, wherein the predetermined integers y and z satisfy:
z=c+1−y.

### Claim 8 (depends on 1)

The delegation method of claim 1, wherein the values A and B are kept secret by said entity, and wherein:
S1=A, S2=B, and
y=1, z=c or y=z=1.

### Claim 9 (depends on 1)

The delegation method of claim 1, wherein the values A and B are public values, and wherein:
P1=A, P2=B, and
y=c, z=1 or y=z=1.

### Claim 10 (depends on 5)

A computer having stored thereon a program comprising instructions for executing the obtaining method according to claim 5 when said program is executed by said computer.

### Claim 11 (depends on 5)

A non-transitory computer readable data medium having stored thereon a computer program comprising instructions for executing the obtaining method according to claim 5.

### Claim 12

An entity configured to obtain a bilinear pairing value e(A,B) between two values A and B from a value calculated by a calculation server, said entity comprising:
a selector configured to select two public elements P1 and P2 and two elements S1 and S2 that said entity keeps secret, two of the elements P1, P2, S1, and S2 being selected from among the values A and B respectively;
a generator configured to generate four elements:
R1=vS1
R2=uS2
T1=uP1+S1, and
T2=vP2+S2
where u and v designate random numbers;
a transmitter configured to transmit said elements R1, R2, T1, and T2 to said calculation server;
a receiver configured to receive two values a1 and a2 calculated by said calculation server and satisfying:
(a1)y=e(T1,T2)[e(R1,P2)e(P1,R2)]−1, and
(a2)z=e(D1,D2)
y and z designating two predetermined integers, each of said integers being equal to 1 or to a predetermined integer c, and D1 and D2 designating two public elements selected from among the values A and B or the elements R1 and R2; and
an obtainer configured to obtain said pairing value e(A,B) from the value a1 or from the value a2.

### Claim 13

A calculation server comprising:
a receiver configured to receive from an entity four elements R1, R2, T1, and T2;
a calculator configured to calculate two values a1 and a2 satisfying:
(a1)y=e(T1,T2)[e(R1,P2)e(P1,R2)]−1, and
(a2)z=e(D1,D2)
e designating a bilinear pairing, P1 and P2 designating two public elements, y and z designating two predetermined integers, each of said integers being equal to 1 or to a predetermined integer c, and D1 and D2 designating two public elements selected from among the values A and B or from among the elements R1 and R2; and
a transmitter configured to transmit the values a1 to a2 to said entity.

### Claim 14 (depends on 12)

A system comprising:
an entity according to claim 12; and
a calculation server, said calculation server comprising:
a receiver configured to receive from an entity-four elements R1, R2, T1, and T2;
a calculator configured to calculate two values a1 and a2 satisfying:
(a1)y=e(T1,T2)[e(R1,P2)e(P1,R2)]−1, and
(a2)z=e(D1,D2)
e designating a bilinear pairing, P1 and P2 designating two public elements, y and z designating two predetermined integers, each of said integers being equal to 1 or to a predetermined integer c, and D1 and D2 designating two public elements selected from among the values A and B or from among the elements R1 and R2; and
a transmitter configured to transmit the values a1 to a2 to said entity;
wherein said entity is configured to delegate to said calculation server a calculation of a bilinear pairing value e(A,B) between two values A and B.

### Claim 15 (depends on 6)

A computer having stored thereon a program comprising instructions for executing the transmission method according to claim 6 when said program is executed by said computer.

### Claim 16 (depends on 6)

A non-transitory computer readable data medium having stored thereon a computer program comprising instructions for executing the transmission method according to claim 6.