KR20170123212A - Broadcast encryption method and Broadcast decoding method for generating simplified header - Google Patents

Abstract

Disclosed are a broadcast encoding method and a broadcast decoding method for generating a simplified header. The broadcast encoding method comprises the steps of: generating a message encoding key K and a header Hdr by using a proper user device group S and a public key PK; and encoding a message M by using the message encoding key K, and generating an encoded message C_M. The identification information of a proper user device included in the proper user device group S is represented by using a Boolean representation. The broadcast encoding method can reduce the size of the header.

Description

[0001] The present invention relates to a broadcast encryption method and a broadcast decryption method capable of generating a simplified header,

Embodiments of the present invention are directed to a broadcast encryption method and a decryption method that can reduce the size of a header.

Recently, researches on broadcast encryption / decryption techniques have been actively carried out. According to a conventional broadcast encryption / decryption technique, a transmitting device transmits a broadcast signal including a legitimate user group S, a header and an encrypted message C _M to a plurality of receiving devices, A receiving device belonging to a legitimate user group S among the receiving devices restores the message encryption key using the header, and decrypts the encrypted message using the message encryption key. That is, only the receiving device belonging to the legitimate user group S should be able to decrypt the encrypted message, and the receiving device not belonging to the legitimate user group S should not be able to decrypt the encrypted message. The broadcast encryption / decryption technique can be efficiently used for transmitting a content to a phase TV receiving service or a copyright protected content of a pay channel since only a legitimate user can acquire a message through one broadcasting.

There are symmetric key setting and public key setting as a kind of broadcasting encryption / decryption technique. In the symmetric key based scheme, only the trusted transmitting device generates and distributes the secret key, and transmits the broadcast signal to the receiving device. In this case, the trusted transmission device assumes full responsibility for the broadcast encryption, the failure of the trusted transmission device causes the entire broadcast system to become paralyzed, and a complex key renewal process when members join / leave. The public key based scheme can overcome the disadvantages of the symmetric key based scheme because any member can transmit the broadcast signal using the public key commonly used in the broadcast system and does not require a complicated key renewal process.

On the other hand, in the broadcast encryption / decryption technique, the length of the header, the size of the secret key and the public key, and the encryption / decryption time are important parameters. Although it is preferable to minimize the above parameters, since they conflict with each other, there is a problem that the value of one parameter increases when the value of one parameter decreases.

In this regard, the related prior art document entitled " Revocation and tracing schemes for stateless receivers, Dalit Naor, Moni Naor, and Jeffery Lotspiech. " Dan Boneh, Xavier Boyen, and Eu-Jin Goh. "(Hereinafter referred to as" Prior Art 2 ") and" Collusion resistant broadcast encryption with short ciphertexts and private keys, Dan Boneh, Craig Gentry, , "Prior Art 3").

The prior art document 1 is a symmetric key-based broadcast encryption / decryption technique. When r user devices among a plurality of user devices (reception devices) are to be excluded from broadcast decryption, a message header of 2r-1 is required. If there are a total of N user devices, the public key needs a constant number, the secret key requires O ((logN) ² ), and O (log N) time is required for encryption / decryption. Because it is based on a symmetric key, only the central server (transmission device) can send the encrypted message and each user device can perform decryption only.

The preceding document 2 requires the message header of 2r-1 as in the prior art document 1 and the encryption / decryption time of O (log N) public keys, O (log N) ² ) Is required. However, since the preceding document 2 is based on an asymmetric key, each user device can perform encryption and decryption.

Prior Art 3 requires O (N) public keys and a constant number of secret keys and a constant number of message headers based on an asymmetric key. However, O (log N) message headers are needed to describe the decryptable user device list. In order to perform encryption / decryption for each user device, a time of O (N) is required.

In other words, the conventional broadcast encryption scheme has a header size of 2r-1, which is disadvantageous in size.

In order to solve the problems of the related art as described above, the present invention proposes a broadcast encryption method and a decryption method that can reduce the size of a header.

Other objects of the invention will be apparent to those skilled in the art from the following examples.

According to a preferred embodiment of the present invention, there is provided a broadcast encryption method comprising: generating a message encryption key K and a header Hdr using a legitimate user device group S and a public key PK; And generating an encrypted message C _M by encrypting the message M using the message encryption key K. The identification information of a legitimate user device belonging to the legitimate user device group S may be represented by a Boolean representation, A broadcast encryption method is provided.

Wherein the valid user device group S is a group including a legitimate user device that is at least a part of all user devices, the identification information of the user device is represented by a bit value, and the legitimate user device group S includes at least one identification information pair Wherein each of said identification information pairs includes a first bit value and a second bit value, wherein said first bit value is a bit value representing identification information of at least a part of said user devices, The 2-bit value may be a bit value representing identification information of the user device that is excluded from at least some of the user devices represented by the first bit value.

Bits corresponding to the identification information of the user device, the first bit value and the second bit value, including but l bits, l bits, each constituting the bit value corresponding to the identification information of the user device is has a value of one of 0 and 1, the first bit value and l bits composing the second bit values each of which being of a value of 0, 1, and *, the * is both 0 and 1 .

According to another embodiment of the present invention, there is also provided a broadcast decryption method comprising: receiving a valid user device group S, a header Hdr and an encrypted message C _M ; Decrypting the message encryption key K using the header Hdr and the previously stored secret key; And decrypting the message C _M encrypted using the message encryption key K. The identification information of a legitimate user device belonging to the legitimate user device group S is expressed using a Boolean representation A broadcast decryption method is provided.

The broadcast encryption method and the decryption method according to the present invention are advantageous in that the header size can be reduced.

1 is a diagram illustrating a schematic configuration of a broadcast system according to an embodiment of the present invention.
2 is a flowchart illustrating a broadcast encryption method according to an embodiment of the present invention.
3 is a flowchart illustrating a broadcast decryption method according to an embodiment of the present invention.

As used herein, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. In this specification, the terms "comprising ", or" comprising "and the like should not be construed as necessarily including the various elements or steps described in the specification, Or may be further comprised of additional components or steps. Also, the terms "part," " module, "and the like described in the specification mean units for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software .

Various embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a schematic configuration of a broadcast system according to an embodiment of the present invention.

Referring to FIG. 1, a broadcast system 100 according to an exemplary embodiment of the present invention includes a first user device 110, which is one transmission device, and a second user device 120, which is a plurality of reception devices.

That is, since the broadcast system 100 according to an embodiment of the present invention uses a public key-based broadcast encryption / decryption technique, all user devices constituting the broadcast system 100 transmit broadcast signals For convenience of explanation, a user device operating as a transmission device is referred to as a 'first user device', and a user device operating as a receiving device is referred to as a 'second user device'.

In more detail, the first user device 110 operating as a server generates a broadcast signal and transmits the generated broadcast signal to a plurality of second user devices 120 operating as clients. At this time, the first user device 110 generates a broadcast signal using the broadcast encryption method, and the second user device 120 decodes the message M in the broadcast signal using the broadcast decryption method.

Hereinafter, a broadcast encryption method performed in the first user device 110 and a broadcast decryption method performed in the second user device 120 will be described.

1. Broadcast Encryption Method

2 is a flowchart illustrating a broadcast encryption method according to an embodiment of the present invention.

First, at step 210, the first user device 110 generates a message encryption key K and a header Hdr using the legitimate user device group S and the public key PK.

Then, in step 220, the first user device 110 encrypts the message M using the message encryption key K to generate an encrypted message C _M. This will be described in more detail as follows.

(

는 랜덤값인 소수 p의 대한 잉여계)를 선택하고, 랜덤 그룹 구성요소(element)

(

는 소수(prime) p의 위수(order)에 대한 바이리니어 그룹)를 선택하며,

를 계산한다. 그리고, 제1 사용자 디바이스(110)는 아래의 수학식 1과 같이 표현되는 공개 키 PK를 선택한다.
First, the first user device 110 generates a public key PK. In detail, assuming that 2 ^l is the number of time intervals, {0, 1} ^m is a message space, the first user device 110 generates a random integer

(

(A residue system for a prime number p, which is a random value), selects a random group element,

(

Selects a bilinear group for the order of prime p,

. Then, the first user device 110 selects a public key PK expressed by Equation (1) below.

). 이를 위해, 제1 사용자 디바이스(110)는 랜덤값

를 선택하며, 아래의 수학식 2와 같이 비밀 키 SK_ID를 생성할 수 있다.
Next, the first user device 110 generates a secret key SK _ID for each of the plurality of second user devices 120. [ At this time, the identification information ID of the second user device 120 is represented by a bit value including 1 bit (

). To this end, the first user device < RTI ID = 0.0 > 110 &

And generates a secret key SK _{ID according} to Equation (2) below.

는

가 아닌 비트를 의미한다. here,

The

≪ / RTI >

For example, the secret key SK ₀₁₀ of the second user device 120 having the ID = 010 of the second user device 120 may be expressed as Equation 3 below.

Subsequently, the first user device 110 establishes a valid user device group S. [ That is, a legitimate user device group S means a group consisting of at least a part of a second user device of a plurality of second user devices 120, and at least a part of the second user device is a legitimate Means a user device having authority. Hereinafter, a second user device belonging to a legitimate user device group S will be referred to as a " legitimate user device ".

At this time, the identification information of a legitimate user device can be expressed using a Boolean representation.

According to one embodiment of the present invention, a legitimate user device group S includes at least one identification information pair, and each identification information pair may include a first bit value and a second bit value. Here, the first bit value is a bit value representing identification information of at least a part of the user devices of the entire second user device, and the second bit value is a bit value representing the identification information of the user device And may be a bit value representing the identification information of the device.

More specifically, the first bit value and a second bit value, but similarly includes a l bits and bit values corresponding to the identification information of the second user device, l constituting the bit value corresponding to the identification information of the user device bits each have the value of one of 0 and 1, the l of each bit constituting one bit value and a second bit value may have a value of 0, 1, and *. In this case, * may be a value including both 0 and 1. When a legitimate user device group S includes one identification information pair, it can be expressed as the following equation (4).

As an example, the total number of second user devices (nodes) is eight, and the identification information of each second user device is represented by a bit value including three bits (i.e., 000 (node 1), 001 A legitimate user device among the eight nodes is connected to the node 2 (node 2), 010 (node 3), 011 (node 4), 100 (node 5), 101 (node 6), 110 2, node 4, node 5, node 6, node 7, node 8 (excluding node 1 and node 3). In this case, the legitimate user device group S includes two pairs of identification information, wherein the first pair of identification information is represented by (* 0 *, 001), and the second pair of identification information is represented by (* 1 *, 011). Here, * 0 * includes 000, 100, 001, and 101, and * 1 * includes 010, 110, 011,

As another example, when the legitimate user device group S is represented by S = (** 0 *, 0 * 01), the first bit value ** 0 * is 0000, 0001, 0100, 0101, 1000, 1001, 1100 , 1101, and the second bit value 0 * 01 includes 0001, 0101. Thus, a legitimate user device group S represents a second user device whose identification information is 0000, 0100, 1000, 1001, 1100, 1101. [

Next, the first user device 110 generates a message encryption key K and a header Hdr using the generated public key PK and the established authorized user device group S.

According to an embodiment of the present invention, the message encryption key K and the header Hdr may be expressed as Equation (5) below.

), e( )는 페어링 함수를 의미한다. Here, s is a random number (

), e () denotes a pairing function.

Thereafter, the first user device 110 encrypts the message M using the message encryption key K to generate an encrypted message C _M.

Meanwhile, the generated legitimate user device group S, the header Hdr, and the encrypted message C _M are transmitted to the plurality of second user devices 120, and the public key PK is transmitted together.

2. Broadcast decryption method

3 is a flowchart illustrating a broadcast decryption method according to an embodiment of the present invention.

First, in step 310, the second user device 120 receives a valid user device group S, a header Hdr, and an encrypted message C _M. At this time, the identification information of the legitimate user device belonging to the legitimate user device group S can be expressed using the blind expression as described above.

Next, in step 320, the second user device 120 decrypts the message encryption key K using the header Hdr and the pre-stored secret key.

Subsequently, at step 330, the second user device 120 decrypts the encrypted message C _M using the message encryption key K.

This will be described in more detail as follows.

로 표현되며(

), 식별정보가 ID를 구성하는 비트 중 j번째 비트의 비밀 키 SK_{ID ,j}가 아래의 수학식 6과 같이 표현되는 경우, 메시지 암호화 키 K는 아래의 수학식 7과 같이 표현될 수 있다.
First, the identification information of the second user device 120 is ID, the header Hdr is

(

), And the secret key SK _{ID , j} of the jth bit among the bits constituting the identification information is expressed as Equation (6) below, the message encryption key K can be expressed by Equation (7) below.

In this case, Equation (7) is expressed as Equation (8) below.

인 경우, 제2 사용자 디바이스(120)는

의 관계를 이용하여 아래의 수학식 9와 같이 B를 산출할 수 있다.
As an example, when the identification information of the second user device 120 is ID = (0000) and the legitimate user device group S is (** 0 *, 0 * 01), the second Since the user device is a legitimate user device,

, Then the second user device 120

, B can be calculated as shown in Equation (9) below.

및

이므로,

로부터

를 제외시킬 수 있다. 따라서, 식별정보가 ID=(0010)인 제2 사용자 디바이스(120)는

로부터 B를 계산할 수 없다. As another example, when the identification information of the second user device 120 is ID = (0010) and the legitimate user device group S is (** 0 *, 0 * 01), identification information ID = 2 User device is not a legitimate user device. At this time,

And

Because of,

from

Can be excluded. Therefore, the second user device 120 whose identification information is ID = (0010)

B can not be calculated.

,

,

및

,

이므로,

로부터

를 제외시키고,

로부터

를 제외시키고,

로부터

를 제외시키고,

로부터

를 제외시킨다. 따라서, 식별정보가 ID=(0001)인 제2 사용자 디바이스(120)는 비밀 키

로부터 B를 계산할 수 없다.As another example, when the identification information of the second user device 120 is ID = (0001) and the legitimate user device group S is (** 0 *, 0 * 01), identification information ID = The second user device is not a legitimate user device. At this time,

,

,

And

,

Because of,

from

≪ / RTI >

from

≪ / RTI >

from

≪ / RTI >

from

. Therefore, the second user device 120 whose identification information is ID = (0001)

B can not be calculated.

In other words, the broadcast encryption method and the decryption method according to an embodiment of the present invention are not limited to expressing a legitimate user device based on a tree but using a blind expression in logic optimization, Can be reduced.

In addition, the above-described technical features may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and limited embodiments and drawings. However, it should be understood that the present invention is not limited to the above- Various modifications and variations may be made thereto by those skilled in the art to which the present invention pertains. Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

Claims (7)

In a broadcast encryption method,
Generating a message encryption key K and a header Hdr using a legitimate user device group S and a public key PK; And
And encrypting the message M using the message encryption key K to generate an encrypted message C _M ,
Wherein identification information of a legitimate user device belonging to the legitimate user device group S is expressed using a Boolean representation. The method according to claim 1,
The legitimate user device group S is a group including a legitimate user device that is at least a part of all user devices, the identification information of the user device is represented by a bit value,
The valid user device group S comprises at least one identity pair, each said identity pair comprising a first bit value and a second bit value, said first bit value being associated with at least a portion And the second bit value is a bit value representing identification information of a user device that is excluded from at least a part of the user devices represented by the first bit value Broadcast encryption method. 3. The method of claim 2,
Bits corresponding to the identification information of the user device, the first bit value and the second bit value, including but l bits,
Each of the l bits constituting the bit value corresponding to the identification information of the user device has a value of one of 0 and 1,
The first bit value and l bits, respectively constituting the second bit values being of a value of 0, 1, and *, the * is broadcast cryptography, characterized in that a value that includes both the 0 and 1 Way. In the broadcast decoding method,
Receiving a legitimate user device group S, a header Hdr and an encrypted message C _M ;
Decrypting the message encryption key K using the header Hdr and the previously stored secret key; And
And decrypting the encrypted message C _M using the message encryption key K,
Wherein identification information of a legitimate user device belonging to the legitimate user device group S is expressed using a Boolean representation. 5. The method of claim 4,
The legitimate user device group S is a group including a legitimate user device that is at least a part of all user devices, the identification information of the user device is represented by a bit value,
The valid user device group S comprises at least one identity pair, each said identity pair comprising a first bit value and a second bit value, said first bit value being associated with at least a portion And the second bit value is a bit value representing identification information of a user device that is excluded from at least a part of the user devices represented by the first bit value Broadcast decoding method. 6. The method of claim 5,
Bits corresponding to the identification information of the user device, the first bit value and the second bit value, including but l bits,
Each of the l bits constituting the bit value corresponding to the identification information of the user device has a value of one of 0 and 1,
Wherein each of the l bits constituting the first bit value and the second bit value has a value of one of 0, 1 and *, and the symbol " * " Way. A computer-readable recording medium storing a program for performing the method of any one of claims 1 to 6.

Images