KR20180109487A - Broadcast encryption and decryption method based on subset difference - Google Patents

Abstract

Disclosed is a broadcast encryption and decryption method based on a subset difference. The broadcast encryption method comprises: a step of generating a public key and a secrete key with respect to each of a plurality of second devices; a step of generating an encrypted key based on a subset difference by using the public key; and a step of encrypting a message by using the generated encrypted key based on the subset difference for broadcasting the message, wherein the encrypted key based on the subset difference is produced by a public key corresponding to an identifier of a device group included in a message reception target among the second devices, and a public key corresponding to an identifier of the device group excluded from the included device group, thereby reducing the size of the secret key.

Description

[0001] Broadcast encryption and decryption method based on subset difference [

The present invention relates to a subset-aggregation-based broadcast encryption and decryption method.

Broadcast encryption is an encryption method for securely transferring a message to a group of recipients. It can decrypt received messages only by specific users. Examples of applications include pay TV and digital rights management (DRM).

Numerous broadcast encryption methods with different characteristics have been introduced. Broadcast encryption methods include symmetric key setting and public key setting.

The public key based broadcast encryption method allows anyone to broadcast a message to a changing set of authorized users using a public key. On the other hand, the private key broadcast encryption method can only broadcast a message to a specific center that knows the secret key. The broadcast encryption method may be stateful or stateless. The state-based broadcast encryption method allows the user's secret key to be updated from time to time, while the stateless broadcast encryption method ensures that the user's secret key is the same for the lifetime of the system. Security can be defined against enemies that compete in whole or in part. Broadcast encryption methods can be aggregated with exclusion and revocation and traitor-tracing algorithms. The algorithm may support an identity-based public key scheme and / or forward security.

In the broadcast encryption method, the message format is generally expressed as (S, Hdr, C _M ). Here, S denotes a user group, Hdr denotes a header, and _CM denotes a ciphertext of the original message. The sender generates the cipher text C _M of the message M with the session key K _s , calculates Hdr by S and K _s , and transmits (S, Hdr, C _M ). For decryption, a particular user decrypts the ciphertext by computing K _s from the private key and header. However, excluded users can not infer K _s with their personal information. Furthermore, K _s can not be calculated even if all excluded users compete.

In the broadcast encryption method, the length of the header, the size of the secret key / public key, and the encryption / decryption time are important factors. These elements are ideal as small as possible, but in most broadcast encryption methods, one element decreases and the other increases. In broadcast encryption where messages are sent to a very large number of recipients, it is important to minimize the header length along with the actual computational cost and storage medium size.

In this connection, as a prior art reference, "Revocation and tracing schemes for stateless receivers, Dalit Naor, Moni Naor, and Jeffery Lotspiech." (Hereinafter referred to as Prior Art 1), "Public Key Broadcast Encryption for Stateless Receivers, Y. Dodis N. Fazio. " (Hereinafter referred to as Prior Art 2), "Hierarchical identity based encryption with constant size ciphertext, Dan Boneh, Xavier Boyen, and Eu-Jin Goh. (Hereinafter referred to as Prior Art 3), " Collusion resistant broadcast encryption with short ciphertexts and private keys, Dan Boneh, Craig Gentry, and Brent Waters. (Hereinafter referred to as Prior Art 4) and "Public-Key Revocation and Tracing Schemes with Subset Difference Methods Revisited, Kwangsu Lee, Woo Kwon Koo, Dong Hoon Lee and Jong Hwan Park. (Hereinafter, referred to as prior art document 5) is disclosed.

Assuming that there are a total of N devices and r devices are excluded from the broadcast decryption, the prior art 1 is a symmetric key-based broadcast encryption scheme, in which the shared key is O (1) O ((log N) ² ). The decryption time is O (log N), and the size of the ciphertext is O (r).

The combination of the prior art 2 and the prior art 3 is a public key based broadcast encryption scheme. In this scheme, the size of the public key is O (log N) and the size of the secret key is O ((log N) ³ ). The decryption time is O (log N), and the size of the ciphertext is O (r).

Prior art 4 is a public key based broadcast encryption scheme in which the size of the public key is O (N) and the size of the secret key is O ((log N) ² ). The decryption time is O (1), and the size of the cipher text is O (r).

In the prior art 5, the size of the public key is O (1) and the size of the secret key is O ((log N) ² ). The decryption time is O (1), and the size of the cipher text is O (r).

Broadcast encryption methods are needed that reduce one of the size of the ciphertext, the size of the secret key / public key, or the encryption / decryption time compared to the conventional broadcast encryption method.

The present invention relates to a partial set difference-based broadcast encryption and decryption method capable of reducing the size of a secret key to O (log N) which is smaller than a conventional one while maintaining the size of a cipher text as O (r).

According to an aspect of the present invention, a broadcast encryption method is disclosed in which a first device performs a message transmission to at least one of a plurality of second devices.

A broadcast encryption method according to an exemplary embodiment of the present invention includes generating a public key and a secret key for each of the plurality of second devices, generating a subset difference based encryption key using the public key, And encrypting and broadcasting a message using the generated subset difference-based encryption key, wherein the subset-difference-based encryption key is a key for encrypting a message included in a device A public key corresponding to the identifier of the group, and a public key corresponding to the identifier of the device group excluded from the included device group.

The identifier is represented using a Boolean representation.

Wherein the secret key is composed of an included public key corresponding to the identifier of the second device and a public key that is excluded, wherein the random value R selected for the device is multiplied by the included public key, Is multiplied by the inverse (R- ¹ ) of the random value.

Wherein the device group consisting of the specific device is represented by an identifier pair including a first bit value and a second bit value, the first bit value is an identifier of the included device group, Lt; / RTI >

According to another aspect of the present invention, there is provided a broadcast decryption method performed by the second device, the first device having received an encrypted message broadcast to transmit a message to at least one of the plurality of second devices, do.

A broadcast decryption method according to an exemplary embodiment of the present invention includes: storing a secret key and a public key generated by the first device; generating a secret key and a public key by using the received encrypted message and the stored secret key and a public key, Generating a second subset aggregation-based encryption key that is the same as the first subset aggregation-based encryption key generated by the second subset aggregation-based encryption key, and decrypting the encrypted message using the generated second subset aggregation-based encryption key , And the second partial set difference-based encryption key is generated by calculating a public key constituting the first partial set difference-based encryption key from the stored secret key and the public key.

Wherein the first partial set key based encryption key corresponds to a first public key corresponding to an identifier of a device group included in a message transmission target of the plurality of second devices and an identifier of a device group excluded from the included device group The second public key.

Wherein the secret key is composed of an included public key corresponding to the identifier of the second device and a public key that is excluded, wherein the random value R selected for the device is multiplied by the included public key, Is multiplied by the inverse (R- ¹ ) of the random value.

The step of generating the second partial set key-based encryption key comprises: multiplying the random value (R) by the included public key and multiplying the excluded public key by the inverse (R- ¹ ) of the random value And calculates the first public key and the second public key from the secret key by performing the multiplication operation to erase the random value (R) and the inverse (R- ¹ ) of the random value.

The method of encrypting and decrypting a partial set difference based broadcast according to an embodiment of the present invention reduces the size of a secret key to O (log N), which is smaller than a conventional one, while maintaining the size of a cipher text as O (r) have.

1 schematically illustrates a configuration of a broadcast system according to an embodiment of the present invention;
FIG. 2 is a flowchart illustrating a partial set difference-based broadcast encryption method according to an embodiment of the present invention; FIG.
3 is a flowchart illustrating a method of decoding a partial set difference based broadcast according to an embodiment of the present invention.

As used herein, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. In this specification, the terms "comprising ", or" comprising "and the like should not be construed as necessarily including the various elements or steps described in the specification, Or may be further comprised of additional components or steps. Also, the terms "part," " module, "and the like described in the specification mean units for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software .

Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram schematically illustrating a configuration of a broadcast system according to an embodiment of the present invention.

1, a broadcast system 100 according to an exemplary embodiment of the present invention includes a first device 110 that transmits a message through broadcasting, a second device 110 that receives a message broadcast from the first device 110, The second device 120 of FIG.

That is, since the broadcast system 100 according to the embodiment of the present invention uses a public key-based broadcast encryption and decryption technique, all the devices constituting the broadcast system 100 transmit and receive messages in a broadcast manner can do. However, for the convenience of understanding and explanation, as described above, a device that operates as a transmitting node is referred to as a first device 110, and a device that operates as a receiving node is referred to as a second device 120. [

Referring again to FIG. 1, a first device 110 may be configured to transmit a message to a specific one of a plurality of second devices 120 by using a subset-aggregation-based broadcast encryption method according to an embodiment of the present invention To broadcast the encrypted message.

The specific device 130 receiving the encrypted message broadcasted by the first device 110 may decrypt the encrypted message by performing the partial set difference based broadcast decryption method according to the embodiment of the present invention .

The broadcast encryption method performed by the first device 110 and the broadcast decryption method performed by the second device 120 will be described below with reference to FIGS. 2 and 3. FIG.

FIG. 2 is a flowchart illustrating a subset-aggregation-based broadcast encryption method according to an embodiment of the present invention.

In step S210, the first device 110 generates a public key PK and a secret key (SK _ID ) for each of the plurality of second devices 120, respectively.

가 생성된다. 여기서,

는 비트 사이즈 θ(λ)의 프라임 오더(prime order) p에 대한 바이리니어 그룹이다. 그리고, 랜덤 엘리먼트(random element) g ∈

가 선택되고, 랜덤 지수(random exponent)

(

는 랜덤값인 p에 대한 잉여계)가 선택된다. 그리고, O(l)개의 랜덤 그룹 엘리먼트(random group elements) h_1,0, h_1,1, …, h_l,0, h_l,1, k_1,0, k_1,1, …, k_l,0, k_l,1 ∈

가 선택된다. 그래서, 마스터키 MK = g^α와 하기 수학식 1의 공개키가 산출된다.First, a bilinear group

Is generated. here,

Is a bilinear group for the prime order p of the bit size [theta] ([lambda]). Then, a random element g?

Is selected, a random exponent is selected,

(

A surplus system for p, which is a random value) is selected. Then, O (l) random group elements h _1,0 , h _1,1 , ... , _{h1, 0} , _{h1, 1} , _k1,0 , _k1,1 , ... , k _{l, 0} , k _{l, 1} ∈

Is selected. Thus, the master key MK = g ^alpha and the public key of the following equation (1) are calculated.

가 선택되고, 비밀키(SK_ID)가 하기 수학식 2와 같이 산출된다.The secret key is generated using an identifier (ID), a master key (MK), and a public key (PK). That is, the random exponent _?? And r?

Is selected, and the secret key (SK _ID ) is calculated according to the following equation (2).

이다.here,

to be.

For example, the first device 110 may generate a public key PK defined as: < EMI ID = 3.0 >

Here, d represents the number of public keys. Assuming that the number of the second devices 120 is N, the number of public keys d = log N.

The secret key (SK _ID ) is generated using the public key corresponding to the identifier (ID) of each second device 120.

Here, each identifier (ID) can be expressed using a Boolean representation. That is, the identifier may be represented by a bit value including d bits, such as ID = (b ₁ ... b _d ).

For example, assuming that the number of the second devices 120 is eight, the number of public keys d is three. In this case, the identifiers of the eight second devices 120 may be 000, 001, 010, 011, 100, 101, 110, and 111, respectively.

Hereinafter, for convenience of understanding and explanation of the present invention, it is assumed that the number of the plurality of second devices 120 is eight.

If the number of the plurality of second devices 120 is 8, the public key can be expressed by Equation (4).

The public key corresponding to the identifier (ID) can be expressed by the following equation (5).

The secret key (SK _ID ) is composed of an embedded public key corresponding to the identifier (ID) and a public key that is excluded. The public key including the random value R selected for the device is multiplied by the public key, (R- ¹ ) of the random value.

For example, the secret key (SK ₀₀₁ ) of the second device 120 having the identifier of ID = 001 among the eight second devices 120 can be expressed by Equation (6).

In step S220, the first device 110 generates a subset difference-based encryption key using the public key PK.

For example, the partial set difference-based encryption key corresponds to the public key corresponding to the identifier of the device group included in the message transmission destination among the plurality of second devices 120 and the identifier of the device group excluded from the included device group Lt; / RTI >

A device group composed of a specific device 130 is represented by an identifier pair, and the identifier pair may include a first bit value and a second bit value. Here, the first bit value is a bit value representing an identifier of some of the devices of the second device 120, and the second bit value is a bit value representing an identifier of a device that is excluded from some devices represented by the first bit value .

More specifically, the first bit value and the second bit value each include d bits similar to the bit value corresponding to the identifier of the second device 120, and each of the d bits constituting the bit value is 0, 1 and *. ≪ / RTI > At this time, * may be a value including both 0 and 1.

For example, if the identifier of each of the eight second devices 120 is represented by a bit value that includes three bits, then 000 (node 1), 001 (node 2), 010 (node 3) A specific device 130 capable of receiving and decrypting the broadcasted encrypted message is a node 2 (node 2), node 100 (node 5), node 101 (node 6) , Node 4 and node 6, respectively. In this case, the identifier pair of the device group constituted by the specific device 130 can be represented by (** 1, 111). Here, ** 1 is a first bit value indicating the identifier of the included device group, and 111 is a second bit value indicating the identifier of the excluded device group. ** 1 indicates 001 (node 2), 011 (node 4), 101 (node 6), and 111 (node 8) May be 001 (node 2), 011 (node 4), and 101 (node 6).

The device group composed of the specific device 130 is configured so that the public key corresponding to the identifier pair (** 1, 111) is a public key (h _1,0 h _1,1 h _2,0 h _2,1 h _3,1 ) and the excluded public keys (k _1,1 k _2,1 k _3,1 ).

Therefore, the partial set difference-based encryption key corresponds to the identifier of the included device group, which is a public key corresponding to the identifier pair (** 1, 111) composed of the identifier of the included device group and the identifier of the excluded device group the public key _{(h 1,0 h 1,1 h 2,0 h} 2,1 h 3,1) and a public key (k k _{1,1 2,1 3,1} k corresponding to the group identifier of the device are excluded ). ≪ / RTI > That is, the subset-aggregation-based encryption key may be composed of a public key corresponding to the identifier of the device group included and a public key corresponding to the identifier of the excluded device group.

In step S230, the first device 110 encrypts and broadcasts the message using the generated partial set difference-based encryption key.

_T) 및 공개키(PK)를 이용하여 수행된다. 랜덤 지수 t ∈

가 선택되고, 암시적으로 (GL, ML)이 포함된 암호문(ciphertext)이 하기 수학식 7과 같이 산출된다.That is, message encryption using a subset-difference-based cryptographic key is performed using labels (GL, ML), messages (M ∈

_T ) and a public key (PK). Random exponent t ∈

Is selected, and a ciphertext including implicitly (GL, ML) is calculated as shown in Equation (7).

이다.here,

to be.

3 is a flowchart illustrating a method of decoding a partial set difference based broadcast according to an embodiment of the present invention.

In step S310, the plurality of second devices 120 receive the encrypted message broadcast by the first device 110. [

In step S320, the plurality of second devices 120 generate a partial set difference-based encryption key using the received encryption message and the previously stored secret key and the public key upon receiving the encryption message. Here, as described above, the secret key and the public key are generated by the first device 110, and each of the plurality of second devices 120 receives the public key and the secret key from the first device 110, have.

That is, the plurality of second devices 120 may calculate the public key that constitutes the partial set difference-based encryption key used for encrypting the encrypted message, and use the partial set difference-based encryption key generated by the first device 110 as the same Can be generated.

Of course, only the specific device 130 among the plurality of second devices 120 can generate the partial set difference-based encryption key generated by the first device 110 in the same manner.

For example, if the partial set difference-based cryptographic key generated by the first device 110 is a public key corresponding to the identifier of the included device group, which is a public key corresponding to the identifier pair (** 1, 111) _{1, 0, 1, 1} h _2,0 h _2,1 h _3,1 ) and the public key (k _1,1 k _2,1 k _3,1 ) corresponding to the identifier of the excluded device group , The second device 120 having the identifier of ID = 001 among the eight second devices 120 becomes the specific device 130. The specific device 130 having the identifier of ID = 001 has the secret key as shown in Equation (4). The specific device 130 having the identifier ID = 001 uses the secret key and the public key of Equation 4 to calculate the partial set difference-based encryption key generated by the first device 110 as Equation (5) Can be generated.

That is, the specific device 130 having ID = 001 identifies the random value R multiplied by the included public key and the inverse (R- ¹ ) random value multiplied by the excluded public key by a multiplication operation The public key corresponding to the identifier of the device group constituting the partial set difference-based encryption key generated by the first device 110 and the public key corresponding to the identifier of the excluded device group are calculated from the secret key of the device .

On the other hand, the second device 120, which is not the specific device 130 having the identifier of ID = 111, has the secret key as shown in Equation (6).

The second device 120 having the identifier of ID = 111 cancels the inverse (R- ¹ ) of the random value multiplied by the random value R multiplied by the included public key and the excluded public key by the multiplication operation , It is necessary to have at least one of the public keys k _1,1 k _2,1 k _3,1 of the partial set difference-based encryption key generated by the first device 110 as a secret key. However, ID = as shown in Equation (6) represents the private key of the second device 120 with the identifier 111 of the second device 120 having an identifier of ID = 111 is R ^-1 · k _{1, 1, ^{R -1 · k 2,1, R -1}} · k 3, does not have at least one secret key of the _first. Accordingly, the second device 120, which is not the specific device 130, erases the inverse (R ^-1 ) of the random value multiplied by the random value R multiplied by the included public key and the excluded public key, It is not possible to generate the partial set difference based encryption key generated by the first device 110 because the public key constituting the partial set difference based encryption key generated by the first device 110 can not be calculated from its own secret key .

In step S230, the first device 110 decrypts the encrypted message using the generated subset difference-based encryption key.

과

이 계산되고, 복화화된 메시지는 하기 수학식 10과 같이 산출된다.That is, the decryption of the encrypted message is performed using ciphertexts (CT _{(GL, ML)} ), secret key (SK _ID ) and public key (PK). Let d be the number of bits in an ID different from ML. If d > 0,

and

Is calculated, and the decoded message is calculated according to the following equation (10).

The accuracy can be verified by the following equation (11).

이고,here,

ego,

이고,

ego,

이다.

to be.

On the other hand, the components of the above-described embodiment can be easily grasped from a process viewpoint. That is, each component can be identified as a respective process. Further, the process of the above-described embodiment can be easily grasped from the viewpoint of the components of the apparatus.

In addition, the above-described technical features may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

It will be apparent to those skilled in the art that various modifications, additions and substitutions are possible, without departing from the spirit and scope of the invention as defined by the appended claims. Should be regarded as belonging to the following claims.

100: Broadcast system
110: first device
120: second device
130: Specific device

Claims (9)

A broadcast encryption method performed by a first device to transmit a message to at least one of a plurality of second devices,
Generating a public key and a secret key for each of the plurality of second devices;
Generating a subset difference based encryption key using the public key; And
And encrypting and broadcasting the message using the generated subset difference-based encryption key,
Wherein the partial set difference-based encryption key is generated by generating a public key corresponding to an identifier of a device group included in a message transmission target among the plurality of second devices and a public key corresponding to an identifier of a device group excluded from the included device group Gt; a < / RTI > broadcast encryption method.
The method according to claim 1,
Wherein the identifier is represented using a Boolean representation.
The method according to claim 1,
Wherein the secret key is composed of an included public key corresponding to the identifier of the second device and a public key that is excluded, wherein the random value R selected for the device is multiplied by the included public key, (R < ^-1 >) of the random value.
The method according to claim 1,
Wherein the device group composed of the specific device is represented by a pair of identifiers including a first bit value and a second bit value,
Wherein the first bit value is an identifier of the included device group and the second bit value is an identifier of the excluded device group.
A broadcast decryption method performed by a second device, the first device receiving an encrypted message broadcast to transmit a message to at least one of a plurality of second devices, the method comprising:
Storing a secret key and a public key generated by the first device;
Generating a second partial set key based encryption key identical to the first partial set key based encryption key generated by the first device using the received encrypted message and the stored private key and public key; And
And decrypting the encrypted message using the generated second subset aggregation-based encryption key,
Wherein the second partial set key difference based encryption key is generated by calculating a public key constituting the first partial set difference based encryption key from the stored secret key and the public key.
6. The method of claim 5,
Wherein the first partial set key based encryption key corresponds to a first public key corresponding to an identifier of a device group included in a message transmission target of the plurality of second devices and an identifier of a device group excluded from the included device group And a second public key for decrypting the public key.
The method according to claim 6,
Wherein the secret key is composed of an included public key corresponding to the identifier of the second device and a public key that is excluded, wherein the random value R selected for the device is multiplied by the included public key, (R- ¹ ) of the random value.
8. The method of claim 7,
Wherein the generating the second subset set-based encryption key comprises:
(R) multiplied by a value obtained by multiplying the random value (R) by the included public key and a value obtained by multiplying the excluded public key by the inverse (R- ¹ ) of a random value to calculate the inverse of the random value (R- ¹ ) from the secret key by deleting the first public key and the second public key from the secret key.
9. A computer-readable recording medium recording a program for performing the method of any one of claims 1 to 8.

Images