CN118337372A - Security traceable group key negotiation method and system based on aggregated broadcast - Google Patents
Security traceable group key negotiation method and system based on aggregated broadcast Download PDFInfo
- Publication number
- CN118337372A CN118337372A CN202410401561.6A CN202410401561A CN118337372A CN 118337372 A CN118337372 A CN 118337372A CN 202410401561 A CN202410401561 A CN 202410401561A CN 118337372 A CN118337372 A CN 118337372A
- Authority
- CN
- China
- Prior art keywords
- key
- group
- tree
- user
- signature
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 54
- 230000005540 biological transmission Effects 0.000 claims abstract description 8
- 238000005538 encapsulation Methods 0.000 claims abstract description 7
- 238000004364 calculation method Methods 0.000 claims description 20
- 238000011423 initialization method Methods 0.000 claims description 7
- 238000012545 processing Methods 0.000 claims description 7
- 238000003672 processing method Methods 0.000 claims description 6
- 230000007423 decrease Effects 0.000 claims description 4
- 238000004891 communication Methods 0.000 abstract description 24
- 238000010586 diagram Methods 0.000 description 4
- 230000009977 dual effect Effects 0.000 description 3
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 230000008094 contradictory effect Effects 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 235000013399 edible fruits Nutrition 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000004806 packaging method and process Methods 0.000 description 1
- 230000008092 positive effect Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a security traceable group key negotiation method and a system based on an aggregate broadcast, which are used for solving the problem of group message transmission security of a plurality of participants in an unsafe communication network. The invention uses the key tree to divide the group users into a plurality of subgroups, introduces a signature-based polymerizable broadcast encryption scheme and combines the key encapsulation idea to carry out key negotiation among the subgroups, and dynamically realizes the operations of creating groups, adding and deleting users, updating keys and the like. The invention designs a double ratchet tree key exchange scheme, which can meet the security attributes such as privacy, forward and backward security, traceability after key leakage and the like of a group key, respectively reduce the computation complexity and communication expenditure of a group sender and a group receiver to O (log) and O (1), and has certain feasibility in medium-sized groups of tens to hundreds of users.
Description
Technical Field
The invention belongs to the technical field of cryptography, relates to a group key negotiation method and system, and in particular relates to a security traceable group key negotiation method and system based on a polymerizable broadcast.
Background
Today, society increasingly relies on instant messaging, and communication and dissemination of information all require the internet or other digital communication networks to achieve. End-to-end communication applications, such as Whatsapp, signal, etc., are one of the most widely used encryption applications on the internet, providing two-party communication or multi-party group communication services for billions of everyday users. However, while these applications bring convenience to life, the problem of message leakage threatens personal privacy of people from time to time, and this threat often causes more serious negative effects in group communication. A secure messaging protocol enables users to communicate securely over an untrusted infrastructure, and as such, increasing the security and privacy of internet instant messaging is of increasing interest.
The group key negotiation protocol is a type of cryptographic protocol for negotiating and managing a shared group key among a plurality of participants. In group communications, multiple members may need to share a key to secure communications, and a group key agreement protocol is designed to achieve this. Currently, there are many effective solutions to the problem of two-party secure communication, such as Signal protocol introducing dual ratchet algorithm and two-party key agreement protocol without certificate, which not only ensures the privacy of two-party communication data, but also ensures the forward security (FS, forward secrecy) and backward security (PCS, post-compromise security) of message keys in user communication, etc., but the group key agreement protocol under the group scene still has no satisfactory solution. In the communication protocol, forward security means that even if a certain party leaks the shared key at the moment, the message transferred before the leak is still secure; conversely, backward security means that after the leak problem is repaired, the security of the protocol can be restored as originally. However, once the protocols designed for the two-party communication scenario are extended to be applied to the group communication protocol, only the manner of the group user pair communication can be adopted, so that the square of the communication overhead is increased, and the forward and backward security of the group message is difficult to ensure.
Considering the problem of difficult expansion of two-party protocols in multiparty scenes, the newly proposed protocols mostly aim at the characteristic of negotiation of a plurality of users in a group, take a key tree as a main structure, and complete negotiation of a group key in a form of encrypting information broadcast. The system is difficult to lock and remove malicious users in time, and cannot enter the next stage quickly and restore the security of the protocol.
Disclosure of Invention
In order to ensure that the communication overhead of key updating is reduced to a certain extent and simultaneously ensure a plurality of safety characteristics of group private keys, the invention abandons a mode of calculating public keys and private keys layer by layer through a tree structure, only keeps shared calculation of the private keys, and provides a safety traceable group key negotiation method and a system based on the polymerizable broadcasting by utilizing a signature-based polymerizable public key broadcasting scheme.
The technical scheme adopted by the method is as follows: a security traceable group key negotiation method based on an aggregate broadcast comprises an initialization method, a group creation method, a member addition method, a member removal method, a key update method and a message processing method;
the initialization method comprises the steps of initializing a public key to generate a security parameter, and generating a public parameter by using a signature-based polymerizable broadcast encryption scheme based on the security parameter; initializing a user sequence identifier to form a user list, recording the current state of a user, wherein an initialization variable is used for tracking the change of a public key tree generated based on a group, and an initialization sequence is used for tracking the change of a signature tree generated by the user based on the group in each round of updating;
The group creation method comprises the steps of creating a new group, generating public and private key pairs for each user by using a signature-based polymerizable broadcast encryption scheme, calculating a signature, and creating a public key tree and a signature tree to generate an initial group key;
the member adding method comprises the steps of generating a new public and private key pair according to a new user identifier when a new user is added in a group, creating a new leaf node record user key information in a public key tree and a signature tree, and updating the public key tree and the signature tree;
the member removing method comprises the steps that when a group has a user to be removed, the user is found in a key tree, key information of the user is deleted, and the key tree information is updated;
The key updating method comprises the steps of generating a new public key pair and a new group key under the condition that a group needs to update a key, and updating key tree information;
The message processing method comprises message transmission among group users and encryption and decryption of messages.
Preferably, in the initializing method, each user can obtain IDs of all users in the group G, and signs each ID except for the user by using a public and private key of the user, and the signature value is broadcast to other users for downloading by the user; after receiving the broadcast, the user downloads the signatures of all other users to the self ID, and creates and calculates a private signature tree.
Preferably, when a user creates a new group, firstly initializing group user information and related state variables, and constructing a group public key tree and a user signature tree according to user key information; every time a change of a group member or an update operation of a key is performed, the current group state is updated, and the group public key tree and the user signature tree structure are updated, so that the group is promoted to enter the next state.
Preferably, in the group creation method, all current group members are divided into different subgroups according to the arrangement in the public key tree, all users contained under each intermediate node form a unique subgroup, and the aggregate public key contained in the intermediate node is called subgroup public key; the group key updated by the user is sent to the corresponding subgroup after the group key is encapsulated by the subgroup public key of the public key tree, and the user contained in the subgroup decrypts by using the private key of the user; when the user increases or decreases, the user key information is updated or the group key needs to be updated, the public key tree and the signature tree operate corresponding operations to update for one round.
Preferably, in the group creation method, a ratchet tree is created, including a public key tree and a signature tree, the public key tree and the signature tree are constructed and generated according to key information, tree nodes are traversed, intermediate nodes are calculated by homomorphic multiplication, and complete key tree information is output;
the ratchet tree creation algorithm TREECREATE specifically includes the following steps:
Step 1: inputting a user set g= (ID 0,ID1,ID2,...,IDn-1), and a key set k= (K n-1,kn,kn+1,...,k2n-2), wherein a user key corresponding to each ID i is K i+n-1;
step 2: creating a ratchet tree tau according to the number of users, the key information of each leaf node comprising (ID i,ki+n-1);
step 3: traversing and calculating other tree nodes;
Calculating intermediate nodes upwards from the leaf node k n-1, wherein key information of each intermediate node is calculated by a corresponding child node; if k i is the public key of the user, the intermediate node adopts public key homomorphic multiplication calculation, namely Up to the calculation of the root nodeIf k i is the user signature, the intermediate node adopts signature homomorphic multiplication calculation, namely k i/2＝ki⊙ki+1, until the root node is calculated
Step 4: the ratchet tree τ is output.
The key tree updating algorithm TreeUpdate updates key tree information by adopting a dual ratchet tree key exchange scheme, and specifically comprises the following steps:
step 1: inputting a ratchet tree tau and updated key information (ID i,ki);
Step 2: the corresponding key k i+n-1 of ID i is modified to k'.
Step 3: traversing and calculating update tree nodes;
Calculating intermediate nodes upwards from the leaf node k n-1, wherein key information of each intermediate node is calculated by a corresponding child node; if k i is the public key of the user, the intermediate node adopts public key homomorphic multiplication calculation, namely Up to the calculation of the root nodeIf k i is the user signature, the intermediate node adopts signature homomorphic multiplication calculation, namely k i/2＝ki⊙ki+1, until the root node is calculated
Step 4: the ratchet tree τ' is output.
Preferably, the security parameter is used for generating public parameters by using a signature-based polymerizable broadcast encryption scheme, a public-private key pair is constructed by using a bilinear pairing principle, and for any input character string, the following four operations are performed, so that a valid signature is generated, the validity of the signature is verified, a ciphertext is encrypted and output, and the plaintext is decrypted. The method is a broadcast encryption scheme under public key system, and it can be used as both signature scheme and broadcast scheme. The generated public key may be used to both sign and encrypt the message, and any valid signature may be used to decrypt the ciphertext under the public key, except that the ciphertext may be decrypted with a valid private key. For a public key pair generated by the same system parameter, the combination of the signatures of the same message by two different public keys is also a valid signature for the message, and the combination of the given public keys can be used for verification, and ciphertext encrypted by the combination public keys can also be decrypted.
Preferably, the method uses a signature-based polymerizable broadcast encryption scheme to generate public-private key pairs for each user and calculate a signature, when the user creates a new group, the group user information and related state variables are initialized first, and a group public key tree and a user signature tree are constructed according to the user key information. The signature information is broadcast in subgroups divided by the key tree, and the current initial group key is obtained through initial round update. Every time the change of the group member or the updating operation of the secret key is carried out, the current group state is updated, the corresponding algorithm of the public key tree and the signature tree is called to update the tree structure, and the group is caused to enter the next state. The availability of the group key at each stage is ensured through the maintenance of the group state, and the forward and backward security of the group key is ensured.
The system of the invention adopts the technical proposal that: a security traceable group key negotiation system based on an aggregate broadcast comprises an initialization module, a group creation module, a member addition module, a member removal module, a key update module and a message processing module;
the initialization module is used for initializing the public key to generate a security parameter, and generating a public parameter by using a signature-based polymerizable broadcast encryption scheme based on the security parameter; initializing a user sequence identifier to form a user list, recording the current state of a user, wherein an initialization variable is used for tracking the change of a public key tree generated based on a group, and an initialization sequence is used for tracking the change of a signature tree generated by the user based on the group in each round of updating;
The group creation module is used for creating a new group, generating public and private key pairs for each user by using a signature-based polymerizable broadcast encryption scheme, calculating a signature, and creating a public key tree and a signature tree to generate an initial group key;
The member adding module is used for generating a new public and private key pair according to a new user identifier when a new user is added in the group, creating a new leaf node record user key information in the public key tree and the signature tree, and updating the group public key tree and the user signature tree;
the member removing module is used for finding the user in the key tree and deleting the key information of the user when the user needs to be removed in the group, and updating the key tree information;
the key updating module is used for generating a new public and private key pair and a group key under the condition that the group needs to update the key, and updating the key tree information;
the message processing module is used for message transmission among group users and encryption and decryption of messages.
Compared with the prior art, the invention has the advantages and positive effects mainly represented in the following aspects:
1. The invention provides a novel traceable group key negotiation protocol based on the aggregate broadcasting, which expands the public key broadcasting scheme originally used under the constraint of static group conditions to safely share the group key in a dynamic group, ensures the privacy of the message key in communication and ensures the forward security and the backward security in long-term communication.
2. The invention designs a double ratchet tree key exchange scheme, which utilizes the key encapsulation idea to carry out intra-group key exchange, reduces the broadcast communication overhead of key update, reduces the complexity to the minimum, and simultaneously ensures the traceability after the key leakage.
3. The invention compares the aspects of security, communication overhead, storage space and the like with the prior proposal, realizes the security characteristics of key privacy, forward and backward security, traceability after key leakage and the like of group key negotiation, and has certain expandability in medium-sized groups of tens to hundreds of users.
Drawings
The following examples, as well as specific embodiments, are used to further illustrate the technical aspects of the present invention. In addition, in the course of describing the technical solutions, some drawings are also used. Other figures and the intent of the present invention can be derived from these figures without inventive effort for a person skilled in the art.
Fig. 1 is a block diagram of a method of an embodiment of the present invention.
FIG. 2 is a schematic diagram of a group public key tree according to an embodiment of the present invention.
FIG. 3 is a schematic diagram of a user signature tree of an embodiment of the present invention.
Fig. 4 is a schematic diagram of sending a packaged group key to a subgroup by an update node in an embodiment of the invention.
Detailed Description
In order to facilitate the understanding and practice of the invention, those of ordinary skill in the art will now make further details with reference to the drawings and examples, it being understood that the examples described herein are for the purpose of illustration and explanation only and are not intended to limit the invention thereto.
Referring to fig. 1, the security traceable group key negotiation method based on the polymerizable broadcast according to the present embodiment includes an initialization method, a group creation method, a member addition method, a member removal method, a key update method, and a message processing method.
The initialization method comprises the steps of initializing a public key to generate a security parameter lambda, and generating a public parameter pi-ParaGen (1 λ) by using a signature-based polymerizable broadcast encryption scheme based on the security parameter; a group-related state variable is initialized. The initialization user sequence identifier ID forms a user list, records the current state of the user, the initialization variable tau is used for tracking the change of the public key tree generated based on the group, and the initialization tau i sequence is used for tracking the change of the signature tree generated by the user based on the group in each round of updating.
In the same group, since the IDs of the users are different, the private signature trees of the users are different, so that the sender uses the same public key in the public key tree during encryption, but the decryption private keys calculated by the private signature trees of the different users are also different.
The group creation method comprises the steps of creating a new group, generating public and private key pairs for each user by using a signature-based polymerizable broadcast encryption scheme, calculating a signature, and creating a public key tree and a signature tree to generate an initial group key;
In one embodiment, a new group is created using the initialized user information, specifically comprising the steps of:
Step 1: input user set g= (ID 0,ID1,ID2,...,IDn-1); wherein, ID 0,ID1,ID2,...,IDn-1 is the identity of n users;
Step 2: a key pair is obtained. Generating a package key using a signature-based, aggregatable broadcast scheme, creating a total of n key pairs for each user ID i in the group set G: (pk i,ski) ≡keygen (pi); wherein pk i,ski is the public and private keys of user ID i, respectively;
step 3: a signature is calculated. Each user ID i e G signs all user IDs j e G in the user set: σ i(IDj)←Sign(pki,ski,IDj); wherein user ID i uses private key sk i to sign σ i(IDi of ID i) is stored privately by the user himself, broadcasting public key information pk i and other signatures σi＝(σi(ID1),...,σi(IDi-1),σi(IDi+1)...,σi(IDn-1)) to other users; where σ≡sign (pk, sk, s) is the output of a public/private key pair (pk, sk) at the input of pi.
Step 4: a public key tree and a signature tree are created. The public key pk= (pk 0,pk1,...,pkn-1) broadcasted by the input set G and each user and the signature information sigma= (sigma 0,σ1,...,σn-1) of each user are respectively called to create a ratchet tree algorithm to obtain a public key tree tau≡ TREECREATE (G, pk) and n user signature trees tau i←TreeCreate(G,σi.
Step 5: group key transmission and reception. The group creator generates the group key gk 0 as the initial group key and sends it through the key tree to km≡ SendKey (ID i,gk0) in the subgroup, decrypting it individually by the subgroup users to obtain gk 0＝RecKey(IDj, KM).
Step 6: the public key tree τ, all τ i are output.
The dual ratchet tree key exchange scheme of this embodiment includes a public key tree and a signature tree, see fig. 2 and 3. After one operation, all users need to negotiate a private group key shared in a group, the users use a public key tree to carry out key encapsulation on the private group key and then distribute the private group key to different subgroups, and subgroup users calculate different private keys according to a signature tree to carry out key deblocking to obtain the private group key, so that one key negotiation task is completed.
In one embodiment, the creating ratchet tree algorithm TREECREATE specifically includes the following steps:
Step 1: inputting a user set g= (ID 0,ID1,ID2,...,IDn-1), and a key set k= (K n-1,kn,kn+1,...,k2n-2), wherein a user key corresponding to each ID i is K i+n-1;
step 2: creating a ratchet tree tau according to the number of users, the key information of each leaf node comprising (ID i,ki+n-1);
step 3: traversing and calculating other tree nodes;
Calculating intermediate nodes upwards from the leaf node k n-1, wherein key information of each intermediate node is calculated by a corresponding child node; if k i is the public key of the user, the intermediate node adopts public key homomorphic multiplication calculation, namely Up to the calculation of the root nodeIf k i is the user signature, the intermediate node adopts signature homomorphic multiplication calculation, namely k i/2＝ki⊙ki+1, until the root node is calculated
Step 4: the ratchet tree τ is output.
In one embodiment, when a user creates a new group, first initializing group user information and related state variables, and constructing a group public key tree and a user signature tree according to user key information; every time the change of the group member or the updating operation of the key is carried out, the current group state is updated, and the corresponding algorithm of the public key tree and the signature tree is called to update the key tree structure so as to promote the group to enter the next state.
The member adding method comprises the steps of generating a new public and private key pair according to a new user identifier when a new user is added in a group, creating a new leaf node record user key information in a public key tree and a signature tree, and updating a key tree;
In one embodiment, all current group members may be partitioned into different subgroups according to an arrangement in a key tree, with all users contained under each intermediate node constituting a unique subgroup, and the aggregate public key contained by this intermediate node being referred to as a subgroup public key; the group key which the user wants to update is sent to the corresponding subgroup after being subjected to key encapsulation by the subgroup public key of the public key tree, and the users contained in the subgroup decrypt by using the private key of the users; when the user increases or decreases, the user key information is updated or the group key needs to be updated, the public key tree and the signature tree can operate corresponding operations to update for one round.
In one embodiment, adding a new user to the group specifically comprises the steps of:
Step 1: inputting a new user ID k and a public key tree tau;
step 2: checking whether ID k is already present in G, if so, the addition fails;
Step 3: obtaining a new key pair (pk k,skk) ≡keygen (pi);
Step 4: a signature is calculated. The new user ID k signs the current set G to obtain the signature set σ k＝(σk(ID0),...,σk(IDn)) and broadcasts the signature value to other users.
Step 5: invoking a ratchet tree addition user node algorithm to update the shared public key tree τ' ≡adduser (τ, ID k,pkk) and the user signature tree τ i'←AddUser(τi,IDk,σk(IDi), respectively);
Step 6: user ID k generates a symmetric key gk l+1 as a new group key and sends it to km≡ SendKey (ID k,gkl+1) in the subgroup, where it is decrypted separately by the subgroup users to obtain gk l+1＝RecKey(IDi, KM);
step 7: the public key tree τ' is output.
In one embodiment, the adding user node algorithm AddUser specifically includes the following steps:
Step 1: inputting a ratchet tree tau and new user information (ID i,ki);
Step 2: checking whether the ID i exists in the G or not, and if so, cannot be added;
Step 3: empty leaf nodes are checked. If the empty node exists in the fruit tree, the key information is stored in the first empty node; creating a new node if no empty node exists;
step 4: update tree τ' ≡ TreeUpdate (τ, ID i,ki);
step 5: the ratchet tree τ' is output.
In one embodiment, the tree updating algorithm TreeUpdate specifically includes the following steps:
step 1: inputting a ratchet tree tau and updated key information (ID i,ki);
Step 2: the corresponding key k i+n-1 of ID i is modified to k'.
Step 3: traversing and calculating update tree nodes;
Calculating intermediate nodes upwards from the leaf node k n-1, wherein key information of each intermediate node is calculated by a corresponding child node; if k i is the public key of the user, the intermediate node adopts public key homomorphic multiplication calculation, namely Up to the calculation of the root nodeIf k i is the user signature, the intermediate node adopts signature homomorphic multiplication calculation, namely k i/2＝ki⊙ki+1, until the root node is calculated
Step 4: the ratchet tree τ' is output.
The member removing method comprises the steps that when a group has a user to be removed, the user is found in a key tree, key information of the user is deleted, and the key tree information is updated according to a double ratchet tree key exchange scheme;
in one embodiment, deleting an existing user from the group specifically comprises the steps of:
Step 1: inputting a removal user ID k;
Step 2: checking whether the ID k exists in G, if not, removing the failure;
Step 3: invoking a ratchet tree deletion user node algorithm to update the shared public key tree τ' ≡ RemUser (τ, ID k,pkk) and the user signature tree τ i'←RemUser(τi,IDk,σk(IDi), respectively;
Step 4: ID k generates a symmetric key gk l+1 as a new shared group key and sends the symmetric key to a subgroup KM≡ SendKey (ID k,gkl+1), and the symmetric key gk l+1＝RecKey(IDi and KM are obtained by independent decryption of subgroup users;
step 5: the public key tree τ' is output.
In one embodiment, the deleting user node RemUser algorithm specifically includes the following steps:
Step 1: inputting a ratchet tree tau and deleting user information (ID i,ki);
Step 2: checking whether the ID k exists in the G or not, and if not, failing to delete;
Step 3: the tree nodes on the modified path are calculated from the deleted and updated nodes to the root node. Deleting and setting the key information in the leaf node to 1, updating the tree τ' ≡ TreeUpdate (τ, ID i,ki);
Step 4: the ratchet tree τ' is output.
The key updating method comprises the steps that when a group needs to update a key, such as a user key is lost or a group key is revealed, a new public key pair and a new group key are generated, and key tree information is updated;
In one embodiment, the method for updating the key specifically includes the following steps:
Step 1: inputting an update user ID k;
Step 2: checking whether the ID k exists in G, if not, removing the failure;
Step 3: obtaining a new key pair (pk k',skk') ∈ (pi);
Step 4: invoking an update tree algorithm of the ratchet tree to update the shared public key tree τ' ≡ TreeUpdate (τ, ID k,pkk) and the user signature tree τ i'←TreeUpdate(τi,IDk,σk(IDi), respectively);
Step 5: ID k generates a symmetric key gk l+1 as a new shared group key and sends the symmetric key to a subgroup KM≡ SendKey (ID k,gkl+1), and the symmetric key gk l+1＝RecKey(IDi and KM are obtained by independent decryption of subgroup users;
step 6: the public key tree τ' is output.
In one embodiment, the key sending SendKey algorithm specifically includes the following steps:
step 1: inputting a user ID k, a group key gk;
Step 2: selecting brother nodes of all nodes on the path from the ID k leaf nodes to the root node, and acquiring the corresponding public key or subgroup public key;
Step 3: the group key encryptions (pk k-1, gk) (or encryptions (gpk i, gk)) are encrypted with the public key pk k-1 (or the aggregated valid public key gpk i) contained by these nodes, and the encapsulated logn keys KM are output and sent to the corresponding subgroups as shown in fig. 4.
In one embodiment, the key sending RecKey algorithm specifically includes the following steps:
Step 1: inputting a user ID k and packaging a key KM;
Step 2: obtaining a corresponding node signature (or an aggregate signature value of a subgroup node) in a signature tree corresponding to the packaged key, and performing deblocking calculation on the key to obtain an updated group key gk (gk= Decrypt (pk k-1,IDk,σk-1, KM) (or gk= Decrypt (gpk i,IDk,σi, KM));
Step 3: the group key gk is output.
The message processing method comprises message transmission among group users and encryption and decryption of messages.
The message processing of the present embodiment includes sending and receiving messages. Sending a message: after the message m sent by the user is encrypted by the group key gk l to obtain the ciphertext c, the ciphertext c is sent to each subgroup. Receiving a message: and decrypting the ciphertext c received by the user by using the shared group key gk l to obtain a plaintext.
The embodiment also provides a security traceable group key negotiation system based on the aggregated broadcast, which comprises an initialization module, a group creation module, a member addition module, a member removal module, a key update module and a message processing module;
the initialization module is used for initializing the public key to generate a security parameter, and generating a public parameter by using a signature-based polymerizable broadcast encryption scheme based on the security parameter; initializing a user sequence identifier to form a user list, recording the current state of a user, wherein an initialization variable is used for tracking the change of a public key tree generated based on a group, and an initialization sequence is used for tracking the change of a signature tree generated by the user based on the group in each round of updating;
The group creation module is used for creating a new group, generating public and private key pairs for each user by using a signature-based polymerizable broadcast encryption scheme, calculating a signature, and creating a public key tree and a signature tree to generate an initial group key;
The member adding module is used for generating a new public and private key pair according to a new user identifier when a new user is added in the group, creating a new leaf node record user key information in the public key tree and the signature tree, and updating the group public key tree and the user signature tree;
the member removing module is used for finding the user in the key tree and deleting the key information of the user when the user needs to be removed in the group, and updating the key tree information;
the key updating module is used for generating a new public and private key pair and a group key under the condition that the group needs to update the key, and updating the key tree information;
the message processing module is used for message transmission among group users and encryption and decryption of messages.
In the invention, when a user creates a new group, a shared ratchet tree tau for storing public keys of all users is generated, each leaf node represents a public key of the current user, the value of each intermediate node is calculated by the public key value of the child node, and still represents a valid public key, and the root node records the group member group aggregation public key; at the same time, each user creates a private ratchet tree for storing the signatures of other users, each leaf node representing a current user's signature of the tree owner ID, each intermediate node's value calculated from its child node signature value, still representing a valid signature, and its root node representing the aggregate signature value of each user's signature of the signature tree owner ID.
In the initialization stage, each user can obtain the IDs of all users in the group G, and signs each ID except the user by using the public and private keys, and the signature value is broadcasted to other users for downloading by the users. After receiving the broadcast, the user downloads the signatures of all other users to the self ID, and creates and calculates a private signature tree. In the same group, since the IDs of the users are different, the private signature trees of the users are different, so that the sender uses the same public key in the public key tree during encryption, but the decryption private keys calculated by the private signature trees of the different users are also different.
In the present invention, all the current group members may be divided into different subgroups according to the arrangement in the tree structure, and all the users contained under each intermediate node constitute a unique subgroup, and the aggregate public key contained in this intermediate node is called subgroup public key. The group key which the user wants to update is sent to the corresponding subgroup after being subjected to key encapsulation by the subgroup public key of the public key tree, and the users contained in the subgroup decrypt by using the private key of the users. When the user increases or decreases, the user key information is updated or the group key needs to be updated, the public key tree and the signature tree can operate corresponding operations to update for one round.
The invention uses the key tree to divide the group users into a plurality of subgroups, introduces a signature-based polymerizable broadcast encryption scheme and combines the key encapsulation idea to carry out key negotiation among the subgroups, and dynamically realizes the operations of creating groups, adding and deleting users, updating keys and the like. The invention designs a double ratchet tree key exchange scheme, which can meet the security attributes such as privacy, forward and backward security, traceability after key leakage and the like of a group key, respectively reduce the computation complexity and communication expenditure of a group sender and a group receiver to O (log) and O (1), and has certain feasibility in medium-sized groups of tens to hundreds of users.
It should be understood that the embodiments described above are some, but not all, embodiments of the invention. In addition, the technical features of each embodiment or the single embodiment provided by the invention can be combined with each other at will to form a feasible technical scheme, and the combination is not limited by the sequence of steps and/or the structural composition mode, but is necessarily based on the fact that a person of ordinary skill in the art can realize the combination, and when the technical scheme is contradictory or can not realize, the combination of the technical scheme is not considered to exist and is not within the protection scope of the invention claimed.
It should be understood that the foregoing description of the preferred embodiments is not intended to limit the scope of the invention, but rather to limit the scope of the claims, and that those skilled in the art can make substitutions or modifications without departing from the scope of the invention as set forth in the appended claims.
Claims (9)
1. A security traceable group key negotiation method based on an aggregate broadcast is characterized in that: the method comprises an initialization method, a group creation method, a member adding method, a member removing method, a key updating method and a message processing method;
the initialization method comprises the steps of initializing a public key to generate a security parameter, and generating a public parameter by using a signature-based polymerizable broadcast encryption scheme based on the security parameter; initializing a user sequence identifier to form a user list, recording the current state of a user, wherein an initialization variable is used for tracking the change of a public key tree generated based on a group, and an initialization sequence is used for tracking the change of a signature tree generated by the user based on the group in each round of updating;
The group creation method comprises the steps of creating a new group, generating public and private key pairs for each user by using a signature-based polymerizable broadcast encryption scheme, calculating a signature, and creating a public key tree and a signature tree to generate an initial group key;
the member adding method comprises the steps of generating a new public and private key pair according to a new user identifier when a new user is added in a group, creating a new leaf node record user key information in a public key tree and a signature tree, and updating a user key tree;
the member removing method comprises the steps that when a group has a user to be removed, the user is found in a key tree, key information of the user is deleted, and the key tree information is updated;
The key updating method comprises the steps of generating a new public key pair and a new group key under the condition that a group needs to update a key, and updating key tree information;
The message processing method comprises message transmission among group users and encryption and decryption of messages.
2. The security traceable group key negotiation method based on an aggregated broadcast according to claim 1, wherein: according to the initialization method, each user can obtain the IDs of all users in the group G, and signs each ID except the user by using the public and private keys of the user, and the signature value of each ID can be broadcast to other users for downloading by the users; after receiving the broadcast, the user downloads the signatures of all other users to the self ID, and creates and calculates a private signature tree.
3. The security traceable group key negotiation method based on an aggregated broadcast according to claim 1, wherein: when a user creates a new group, initializing group user information and related state variables, and constructing a group public key tree and a user signature tree according to user key information; every time a change of a group member or an update operation of a key is performed, the current group state is updated, and the group public key tree and the user signature tree structure are updated, so that the group is promoted to enter the next state.
4. The security traceable group key negotiation method based on an aggregated broadcast according to claim 1, wherein: in the group creation method, all current group members are divided into different subgroups according to the arrangement in a key tree, all users contained under each intermediate node form a unique subgroup, and an aggregate public key contained in the intermediate node is called a subgroup public key; the group public key of the group key public key tree updated by the user is sent to the corresponding subgroup after the key encapsulation, and the user contained in the subgroup decrypts by using the private key of the user; when the user increases or decreases, the user key information is updated or the group key needs to be updated, the public key tree and the signature tree operate corresponding operations to update for one round.
5. The security traceable group key negotiation method based on an aggregated broadcast according to claim 1, wherein: in the group creation method, a ratchet tree is created, which comprises a public key tree and a signature tree, a group public key tree and a user signature tree are constructed and generated according to key information, tree nodes are traversed, intermediate nodes are calculated by homomorphic multiplication, and complete key tree information is output;
The step of creating the ratchet tree specifically comprises the following steps:
Step 1: inputting a user set g= (ID 0,ID1,ID2,...,IDn-1), and a key set k= (K n-1,kn,kn+1,...,k2n-2), wherein a user key corresponding to each ID i is K i+n-1;
step 2: creating a ratchet tree tau according to the number of users, the key information of each leaf node comprising (ID i,ki+n-1);
step 3: traversing and calculating other tree nodes;
Calculating intermediate nodes upwards from the leaf node k n-1, wherein key information of each intermediate node is calculated by a corresponding child node; if k i is the public key of the user, the intermediate node adopts public key homomorphic multiplication calculation, namely Up to the calculation of the root nodeIf k i is the user signature, the intermediate node adopts signature homomorphic multiplication calculation, namely k i/2＝ki⊙ki+1, until the root node is calculated
Step 4: the ratchet tree τ is output.
6. The security traceable group key negotiation method based on an aggregated broadcast of claim 5, wherein: in the key updating method, a double ratchet tree key exchange scheme is adopted to update key tree information; the method specifically comprises the following steps:
step 1: inputting a ratchet tree tau and updated key information (ID i,ki);
Step 2: traversing and calculating update tree nodes;
Calculating intermediate nodes upwards from the leaf node k n-1, wherein key information of each intermediate node is calculated by a corresponding child node; if k i is the public key of the user, the intermediate node adopts public key homomorphic multiplication calculation, namely Up to the calculation of the root nodeIf k i is the user signature, the intermediate node adopts signature homomorphic multiplication calculation, namely k i/2＝ki⊙ki+1, until the root node is calculated
Step 3: the ratchet tree τ' is output.
7. The security traceable group key negotiation method based on an aggregated broadcast according to any of claims 1-6, wherein: the method comprises the following steps of generating public parameters by utilizing a signature-based polymerizable broadcast encryption scheme based on security parameters, constructing public and private key pairs by utilizing a bilinear pairing principle, and for any input character string, comprising four operations: and generating a valid signature, verifying the validity of the signature, encrypting and outputting a ciphertext, and decrypting to obtain a plaintext.
8. The security traceable group key negotiation method based on an aggregated broadcast according to any of claims 1-6, wherein: generating public and private key pairs for each user by using a signature-based polymerizable broadcast encryption scheme, calculating a signature, creating a new group by the user, initializing group user information and related state variables, and constructing a group public key tree and a user signature tree according to the user key information; broadcasting signature information in subgroups divided by a key tree, and obtaining a current initial group key through initial round updating; every time the change of the group member or the updating operation of the secret key is carried out, the current group state is updated, the corresponding algorithm of the public key tree and the signature tree is called to update the tree structure, and the group is caused to enter the next state.
9. A security traceable group key negotiation system based on an aggregated broadcast, characterized by: the system comprises an initialization module, a group creation module, a member adding module, a member removing module, a key updating module and a message processing module;
the initialization module is used for initializing the public key to generate a security parameter, and generating a public parameter by using a signature-based polymerizable broadcast encryption scheme based on the security parameter; initializing a user sequence identifier to form a user list, recording the current state of a user, wherein an initialization variable is used for tracking the change of a public key tree generated based on a group, and an initialization sequence is used for tracking the change of a signature tree generated by the user based on the group in each round of updating;
The group creation module is used for creating a new group, generating public and private key pairs for each user by using a signature-based polymerizable broadcast encryption scheme, calculating a signature, and creating a public key tree and a signature tree to generate an initial group key;
The member adding module is used for generating a new public and private key pair according to a new user identifier when a new user is added in the group, creating a new leaf node record user key information in the public key tree and the signature tree, and updating the group public key tree and the user signature tree;
the member removing module is used for finding the user in the key tree and deleting the key information of the user when the user needs to be removed in the group, and updating the key tree information;
the key updating module is used for generating a new public and private key pair and a group key under the condition that the group needs to update the key, and updating the key tree information;
the message processing module is used for message transmission among group users and encryption and decryption of messages.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410401561.6A CN118337372A (en) | 2024-04-03 | 2024-04-03 | Security traceable group key negotiation method and system based on aggregated broadcast |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410401561.6A CN118337372A (en) | 2024-04-03 | 2024-04-03 | Security traceable group key negotiation method and system based on aggregated broadcast |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN118337372A true CN118337372A (en) | 2024-07-12 |
Family
ID=91775523
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410401561.6A Pending CN118337372A (en) | 2024-04-03 | 2024-04-03 | Security traceable group key negotiation method and system based on aggregated broadcast |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN118337372A (en) |
-
2024
- 2024-04-03 CN CN202410401561.6A patent/CN118337372A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Lin et al. | A collaborative key management protocol in ciphertext policy attribute-based encryption for cloud data sharing | |
| WO2019101134A1 (en) | Multi-distributed sm9 decryption method, medium and key generating method | |
| US8005225B2 (en) | Hierarchical threshold tree-based broadcast encryption method | |
| US10412063B1 (en) | End-to-end double-ratchet encryption with epoch key exchange | |
| KR101466780B1 (en) | Key sharing system, communication terminal, management apparatus, key sharing method and computer program | |
| CN110880972A (en) | Block chain key management system based on safe multiparty calculation | |
| CN112187450B (en) | Method, device, equipment and storage medium for key management communication | |
| WO2023082599A1 (en) | Blockchain network security communication method based on quantum key | |
| Mo et al. | Two-party fine-grained assured deletion of outsourced data in cloud systems | |
| Kumar et al. | A secure and robust group key distribution and authentication protocol with efficient rekey mechanism for dynamic access control in secure group communications | |
| CN109962924B (en) | Group chat construction method, group message sending method, group message receiving method and system | |
| Ambika et al. | A novel RSA algorithm for secured key transmission in a centralized cloud environment | |
| Rana et al. | A comprehensive survey of cryptography key management systems | |
| Bodur et al. | Implementing Diffie-Hellman key exchange method on logical key hierarchy for secure broadcast transmission | |
| Li et al. | An efficient and anonymous attribute-based group setup scheme | |
| Arslan et al. | Security issues and performance study of key management techniques over satellite links | |
| CN118337372A (en) | Security traceable group key negotiation method and system based on aggregated broadcast | |
| CN117318943B (en) | Quantum distributed data storage and recovery method | |
| CN111901101B (en) | Key updating method and system | |
| CN114978496B (en) | Lightweight encryption-based safe data deduplication method | |
| CN118233096B (en) | Server-free multi-system networking method and storage device | |
| Bakiras et al. | An anonymous messaging system for delay tolerant networks | |
| Eya et al. | New user authentication and key management scheme for secure data transmission in wireless mobile multicast | |
| Bodur et al. | Implementation Logical Key Hierarchy to a Nosql Database in Cloud Computing | |
| EP3179669B1 (en) | Drm key tree provisioning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |