KR100701884B1 - Method of managing a key of user for broadcast encryption - Google Patents

Abstract

The present invention relates to broadcast encryption, and proposes a method for acquiring an encryption key for decrypting a session key at a node receiving a service with a small amount of computation. To this end, a plurality of subgroups composed of at least one node among a plurality of nodes are generated, and a hierarchy is formed according to the number of nodes constituting the generated subgroups. A decimal number is allocated to each subgroup so as not to overlap, and a subgroup of a lower layer including a node constituting a subgroup of an upper layer and a subgroup of the upper layer is connected. Each subgroup is reassigned a minority assigned to a subgroup of its upper hierarchy, a decimal number assigned to a subgroup of the same hierarchy and a lower hierarchy that is not associated with itself, and an encryption key composed of the reallocated prime numbers. By receiving, each node can obtain a session key with a small amount of computation.

Broadcast encryption (BE), session key, hierarchy, decimal

Description

How to manage user keys for broadcast encryption {METHOD OF MANAGING A KEY OF USER FOR BROADCAST ENCRYPTION}

1 is a diagram illustrating a network structure of a data transmission system using general broadcast encryption;

2 illustrates a concept of broadcast encryption for allocating keys in a conventional tree structure;

3 illustrates a concept of broadcast encryption for allocating keys in a tree structure according to an embodiment of the present invention;

FIG. 4 is a diagram interconnecting nodes constituting a group and subgroups consisting of nodes;

FIG. 5 is a diagram in which nodes and subgroups are interconnected when four nodes form a group; FIG.

FIG. 6 is a diagram illustrating subgroups separated by layers when four nodes form a group; FIG.

FIG. 7 illustrates another diagram in which subgroups are separated by layers when four nodes form a group; FIG.

8 is a diagram illustrating subgroups forming one layer;

FIG. 9 is another diagram illustrating subgroups forming one layer. FIG.

Explanation of symbols on the main parts of the drawings

100: content producer 110: service provider

120: satellite 130: Internet network

140: network 141: set-top box

142: mobile communication terminal 150: smart home network

151, 152, 153, 154, 155: terminal 160: illegal user

The present invention relates to a broadcast encryption method, and more particularly to an efficient user key management method for broadcast encryption.

Broadcast encryption (hereinafter, referred to as 'BE') is a method of effectively transmitting information only to users who are desired by a sender (ie, a broadcast center) among all users. It must be able to be used effectively when the set of users is arbitrarily and dynamically changing. The most important property in a BE is the revocation or exclusion of unwanted users (eg, illegal users or expired users).

1 is a diagram illustrating a network structure of a data transmission system using general broadcast encryption. Referring to FIG. 1, the content producer 100 produces various useful data including audio or video data, and provides the produced data to the service provider 110. The service provider 110 may allow legitimate users (eg, mobile digital rights management (DRM) network 140, smart home, etc.) to pay for data corresponding to the data provided from the content producer 100 through various wired and wireless communication networks. The DRM network 150 is broadcasted.

That is, the service provider 110 may transmit data to a device of users such as a set-top box 141 equipped with various satellite receivers through the satellite 120, and may transmit data through a mobile communication network. 142 can also be sent. In addition, the terminal 130 may transmit to various terminals 150, 151, 152, 153, 154, and 155 of the smart home network 150 through the internet network 130.

In this case, the data is encrypted by broadcast encryption (BE) in order to prevent the illegal user 160 who does not pay a fair fee for the data from using the data.

The security of such an encryption and decryption system usually depends on the system that manages the encryption key. The most important thing in such an encryption key management system is how to generate an encryption key. In addition, it is also important to manage and update the generated encryption key (Key Update).

Since the concept of BE was first proposed in 1991, many changes have been made, and the current BE assumes a stateless receiver. This concept means that each session's private key is never changed or updated as the session changes. In this case, the term 'k-resilient' is used in terms of safety, which means that the k-resilient user cannot recover information even if a public attack is performed by k users. Since r usually represents the number of excluded users, 'r-resilient' means that all excluded users are safe to collaborate.

On the other hand, in BE, transmission overhead, storage overhead, and computation overhead are important, respectively, the amount of headers to be transmitted by the transmitting side, the amount of secret keys that the user must store, and the user. Means the amount of computation needed to obtain the session key. Among these, reducing the amount of transmission is a major problem. The amount of transmission initially decreased from the value of N, the total number of users, to the value of r, the number of users that are currently excluded. Reducing the transmission to less than r has become a big challenge for BE as technologies emerge that are proportional to r.

Based on these BE problems, the 'Subset Difference (SD) Method' published by 'Naor-Naor-Lotspiech' shows the best results. The SD method requires a storage amount of O (log ^{1 + e} n) and a transmission amount of O (2r-1) when there are n total users.

However, even the SD method has a problem in terms of being efficient for use by a large number of users.

As described above, various algorithms have been proposed to date since Berkovits first published a paper on BE in 1991. Among these important algorithms, a secret key sharing scheme, a subset cover-free system model scheme, and a tree structure scheme have been proposed.

First, a model based on secret key sharing will be described. The private key sharing model was introduced in 1991 by S. First proposed by Berkovits, Noar 'and' B. More efficient improvements were made in Pinkas' article entitled "Efficient Trace and Revoke Schemes." In S Berkovits's "How to Broadcast a Secret", a method using polynomial interpolation and a method based on vector based secret sharing are presented.

Referring to the polynomial interpolation method, a center (ie, a broadcasting center or a transmitting side) transmits a point (x _i , y _i ) to a secret channel to each user. In this case, x _i is a different value and (x _i , y _i ) are each user's private key. Then, to broadcast the secret information S to legitimate users t of each session, a polynomial P having a random integer j and order t + j + 1 is selected. The polynomial P is a polynomial that passes through t random users' private keys (x _i , y _i ) and any j points (x, y) and (O, S) that are not the secret keys of any other user. The center transmits points different from the t + j points on the polynomial P. Then, since t legitimate users know one point (own secret key) in addition to t + j points, they can recover polynomial P of order t + j + 1 and also obtain secret information S. However, the excluded user never knows t + j points, so he never recovers the polynomial P.

In this method, the transmission amount is O (t + j + 1), the storage amount is O (1), and the calculation amount is approximately t ³ multiplications. In addition, there is an advantage that easy revocation can be prevented, competition tracing is also possible. However, for a large number of users, there is a problem that can not be used practically because it is inefficient and unsafe to write repeatedly.

M. Noar and B. Pinkas's "Efficient Trace and Revoke Schemes" uses a threshold secret sharing scheme using Lagrange's interpolation formula. The Noar-Pinkas method uses the property that an order-order polynomial can be recovered by knowing the points above r + 1 polynomials, but cannot be recovered with one or fewer r points. That is, the center selects a random t-order polynomial P and provides each user with different points as a secret key. When r users are excluded, the center broadcasts information on the total of t points by adding the excluded r secret keys and t-r points randomly selected. As a result, the excluded user still knows only t points even though their secret information is summed, but the non-excluded user knows t + 1 points to recover the polynomial P. This polynomial is used to find the session key P (0).

These methods are also easy to dispose of, prevent collusion and track collusion. In particular, there is a big advantage in that it is possible to add new users, and the transmission amount is O (t) and the storage amount is quite efficient as O (1). However, this method has a problem that it is impossible to exclude more than t users initially defined. In addition, the number of points to be transmitted or the amount of computation required to compute the polynomial depends on t, which is inefficient in many cases. In addition, as t increases, the calculation time increases greatly, and thus it is difficult to use when a large number of users is included.

Secondly, the subset cover-free system model defines the concept of a subset cover-free system in a set that takes subsets of S as elements when the set of entire users is S. If you can find such a system, you can use it to perform BE. However, there is a disadvantage in that the storage amount and the transmission amount are about O (r log n) and are not efficient. We also introduced a way to extend the 1-resilient model to create a k-resilient model. An effective 1-resilient technique is relatively easy to devise, which makes sense for such an extension, but the proposed method has greatly reduced the efficiency of the expansion.

Third, recently, methods using a tree structure have been attracting attention. In 1998, C. K. Wong, M. Gouda, and G. S. Lam proposed the Logical-tree-hierarchy (LTH) method, but it was difficult to exclude a large number of users in one session. In addition, the user's private key is a model that changes over the course of the session, which is far from a modern BE that assumes a stateless receiver. Then, in 2001, D. Naor, M. Naor, and J. Lotspiech proposed "Complete Subset (CS) Cover Scheme" and "Subset Difference (SD) Scheme". Both methods assume that the number of users is n and the number of excluded users is r, and the center creates a binary tree of log n height and assigns the corresponding private key to every node. . Then assign users one by one to the leaf node.

First, the CS Cover method shows that each user receives and stores the secret key of all nodes located in the path from the root node to his leaf node. Here, a complete subtree that does not include any excluded users of the subtrees is called a "Complete Subtree (CS)". If the CS is in the proper mode, all non-excluded users may be included. At this time, if the session key is encrypted and transmitted with the secret key corresponding to the root nodes of the used CSs, legitimate users can recover the session key, but the excluded users are not included in any CS used above. It becomes impossible.

2 is a diagram illustrating the concept of broadcast encryption for allocating keys in a conventional tree structure. Referring to FIG. 2, each node 220 provided with data through broadcast encryption has its own key value (nodes 32 to 47), and at the same time, each node connected to itself in a tree structure. It will have a key value.

For example, node 34, along with its 34 key value, inputs the key value of node 17 209, the key value of node 8 204, the key value of node 4 202, and the key value of node 2 201. Have. At this time, the key value of node 209 of node 34 has node 35 also shared. Similarly, the key value of node 8 (204) of node 34 is also shared with nodes 32, 33, and 35.

On the other hand, if the nodes 32 to 47 are legitimate nodes, the transmission of the secured data is preferably performed by transmitting the same to all nodes including the node 2 201 key value in the header portion of the data to be transmitted. It becomes possible.

However, if node 36 221 is not a legitimate node, that is, a revoked node, since the other nodes share key values of the node associated with node 36 221, update the corresponding key values. The giving process will be needed. That is, the key values of nodes 18 (210), 9 (205), 4 (202) and 2 (201) must be updated. At this time, the key value is updated in the order of the lower node to the upper node.

First, since the node value of the node 18 210 is shared by the node 37, the updated key value of the node 18 210 is encrypted from the server with the key value of the node 37 and transmitted to the node 37. Then, the node 9 205's key value is shared with node 37, and node 38 and node 39 under node 19 211 are shared with each other. Encrypted and transmitted with the key value of the node 18 (210) already updated, and encrypted with the key value of the node 19 (211) to the node 38 and node 39 and transmitted.

Similarly, the key values of node 4 202 are shared by nodes 32, 33, 34, 35 under node 8 204, and by nodes 37, 38, 39 under node 9 205 Therefore, the updated key value of the node 4 202 is encrypted and transmitted to the node 32 to the node 35 with the key value of the node 8 204, and the node 9, 205, and 39 are already updated. The value is encrypted and transmitted.

Finally, the key value of node 2 201 is shared by nodes other than node 36 221 among nodes 32 to 39 under node 4 204, and nodes 40 to 47 under node 5 203. Share the updated key value of node 2 (201) with node 32, 33, 34, 35, 37, 38, and 39, and transmit the encrypted key value of node 4 (202). 40 to 47 are encrypted with the key value of node 5 (203) and transmitted. This key renewal process can block access to illegal (or revoked) nodes.

In the above-described method (i.e., the CS model), the transmission amount is O (r log (n / r)), which is the number of CSs including all non-excluded nodes, and the storage overhead is O (log n). )to be.

On the other hand, the SD (Subset Difference) method significantly improves the transmission amount by requiring the storage amount of O (log ² n) and the transmission amount of O (2r-1) by the above-described modification of the CS model. The SD model considers a subtree subtracting a subtree rooted at one node v from a subtree rooted at another node w included in the subtree. Branch nodes under this subtree are valid nodes, and branch nodes under a subtree rooted by w are excluded nodes. This method may cover the CS model as one subset, in which case the two or more subsets must be included if there are excluded nodes between a reasonable number of legitimate nodes. The SD method obtains a hash value starting with the hash value of the key assigned to the node v and up to the node w, and sets a value corresponding to the value as the session key. Each node has a private key with hash values for sibling nodes for each node on the path from the root node to its branch node. Therefore, due to the unidirectionality of the hash function, only legitimate nodes can recover the session key. At this time, the transmission amount of the SD model is O (2r-1), the storage amount is O (log ² n), the calculation amount is only a hash of the maximum O (log n).

Then, in 2002, the LSD model was proposed, which improved the SD model. In the LSD model, the amount of storage is reduced to O (log ^3/2 n) by using each subtree layer, but the transmission amount is twice that of the SD model.

The best efficiency among the above-described BE models is a model using a tree structure such as LSD or SD. However, in the case of using the tree structure, it is difficult to expect any further improvement since the number of subsets required for broadcasting is highly dependent on the location of users. In addition, the tree structure has a disadvantage in that a considerable cost is required for maintenance. Therefore, there is a demand for more efficient BE technology than the tree structure described above.

Accordingly, an object of the present invention is to propose a method for a node requesting a service to obtain an encryption key for decrypting a session key received from a service provider with a small calculation amount.

The present invention provides a method comprising: generating a plurality of subgroups including at least one node among a plurality of nodes, and forming a hierarchy according to the number of nodes constituting the generated subgroups; Allocating a prime number so as not to overlap each of the subgroups, and concatenating a subgroup of a lower layer including a subgroup of an upper layer and a node constituting a subgroup of the upper layer; And a sub-number assigned to each subgroup by a subgroup of a higher layer, a sub-number assigned to a subgroup of a same layer and a lower layer not connected to the sub-group, and the sub-group assigned to the sub-group. The present invention proposes an encryption key management method for broadcast encryption, comprising: receiving an encryption key.

Hereinafter, with reference to the drawings will be described the present invention in more detail. Hereinafter, a user and a node will be used in the same concept.

Figure 3 illustrates the concept of broadcast encryption for assigning keys using a tree structure in accordance with the present invention. Referring to FIG. 3, nodes to which contents are to be provided are nodes 1 to 27. A node to which content is to be provided is assigned to one group of a plurality of groups. According to Figure 3, nine groups are shown, each group consisting of three nodes. That is, the first group is composed of nodes 1 to 3, and node 1 'manages the first group. Of course, node 1 'is not a node that receives actual content, but a logical node for forming a tree structure.

The second group is composed of nodes 4 to 6, and node 2 'manages the second group. The third group is composed of nodes 7 to 9, and node 3 'manages the third group. The eighth group is composed of nodes 22 to 24, and node 8 'manages the eighth group. The ninth group is composed of nodes 25 to 27, and node 9 'manages the ninth group.

The tenth group consisting of node 1 ', node 2', and node 3 'is managed by node a which is a logical node, and the eleventh group consisting of node 4', node 5 ', and node 6' is managed by node b. A twelfth group consisting of nodes 7 ', 8', and 9 'is managed by node c, which is a logical node. In addition, a thirteenth group consisting of node a, node b, and node c is managed by node A, which is a logical node. In this way, nodes to be provided with content may form a tree structure. Of course, FIG. 3 illustrates the number of nodes included in each group as three, but may vary according to a user's setting. In addition, the number of nodes included in each group may also be set differently according to the user's setting. For example, the number of nodes included in the first group may be set to three, and the number of nodes included in the second group may be set to four.

Hereinafter, a process of assigning an encryption key to each node will be described with reference to FIG. 4. As described above, each node can obtain a session key capable of decrypting content by decrypting the encryption key.

4 illustrates a process of assigning encryption keys to first to third nodes included in a first group. FIG. 4 illustrates the first to third nodes in a hierarchical structure in a predetermined manner. In the first layer, a virtual management node (M) managing first to third nodes is located, and in the second layer, a subgroup consisting of nodes 1, node 2, and node 3 is located. Subgroups consisting of two nodes are located. According to FIG. 4, the subgroups are a subgroup consisting of node 1 and node 2, a subgroup consisting of node 1 and node 3, and a subgroup consisting of node 2 and node 3.

The subgroups that make up each layer are connected by certain rules. That is, the management node is connected to all the subgroups forming the second layer, and the subgroup forming the second layer is connected to the subgroup which includes itself among the subgroups forming the third layer. do.

That is, node 1, which is the first subgroup of the second layer, is connected to the management node of the first layer and is connected to the first subgroup and the second subgroup of the third layer. Node 2, the second subgroup of the second layer, is connected to the management node of the first layer, and is connected to the first subgroup and the third subgroup of the third layer. Node 3, the third subgroup of the second layer, is connected to the management node of the first layer, and is connected to the second subgroup and the third subgroup of the third layer.

Hereinafter, a first allocation process of sequentially allocating prime numbers to each subgroup is performed. That is, the management node is assigned '2', and node 1, which is the first subgroup of the second layer, is assigned '3'. Node 2, the second subgroup of the second layer, is assigned '5', and node 3, the third subgroup of the second layer, is assigned '7'. The first subgroup of the third layer is assigned '11', the second subgroup of the third layer is assigned '13', and the third subgroup of the third layer is assigned '17'. As described above, it has been described as sequentially assigning prime numbers to each subgroup, but each subgroup may be randomly assigned a prime number according to a user's setting.

The execution of the first allocation process is terminated and the second allocation process is performed. The second allocation process is a process of assigning an encryption key to each node or subgroup.

The second allocation process uses the prime numbers assigned to each subgroup through the first allocation process. Each subgroup is reassigned a minority assigned to a subgroup of its upper hierarchy, and a minority assigned to a subgroup of the same hierarchy and a lower hierarchy that is not connected to itself. That is, node 1 is assigned to '2' assigned by the management layer (first layer) and '5, 7' assigned to node 2 and node 3, which are nodes of the same layer (second layer) not connected to itself, and to itself. The third subgroup, which is a subgroup of the unconnected lower layer (third layer), is reallocated '17'. The first subgroup of the third layer has '2, 3, 5, 7' assigned to the management node, the first node, the second node, and the third node, which are nodes of the upper layer, and the same layer not connected to itself. The second subgroup and the third subgroup, which are subgroups of the third layer), are reassigned '13, 17 '.

Once this has been described, node 1 is reassigned '2, 5, 7, 17', node 2 is reassigned '2, 3, 7, 13', and node 3 is '2, 3, 5,' Reassign 11 '. The first subgroup of the third layer is assigned '2, 3, 5, 7, 14, 17', and the second subgroup of the third layer is assigned '2, 3, 5, 7, 11, 17'. The third subgroup of the third layer is reassigned '2, 3, 5, 7, 11, 13'.

When the reassignment process of the second assignment process ends, an encryption key is actually assigned to each node. Node 1 is assigned {k ₀ ^{2 · 5 · 7 · 17} } (k ₀ is any constant), Node 2 is assigned {k ₀ ^{2 · 3 · 7 · 13} }, and Node 3 is {k ₀ ^{2 · 3 · 5 · 11} } are assigned. The first subgroup is assigned {k ₀ ^{2 · 3 · 5 · 7 · 13 · 17} }, the second subgroup is assigned {k ₀ ^{2 · 3 · 5 · 7 · 11 · 17} }, and the third The subgroup is assigned {k ₀ ^{2 · 3 · 5 · 7 · 11 · 13} }.

The service provider generates a encryption key for encrypting the session key.

Assuming that nodes 1 through 3 are legitimate nodes that receive content from the service provider, the content provider uses {k ₀ ^{2 · 3 · 5 · 7 · 11 · 13 · 17} } as an encryption key for encrypting the session key. . Node 1 uses the encryption key {k ₀ ^{2 · 5 · 7 · 17} } that is allocated and stored ({(k ₀ ^{2 · 5 · 7 · 17} ) ^3.11.13 }) It is possible to obtain a session key using the obtained encryption key. Nodes 2 to 3 may also obtain an encryption key used by a service provider by using an encryption key that is allocated and stored by the node 2 and node 3, and may obtain a session key using the obtained encryption key.

If Node1 is not a legitimate node for the content provider, the service provider encrypts the session key using the encryption key ({k ₀ ^{2 · 3 · 5 · 7 · 11 · 13} }) assigned to the third subgroup. . In this case, the node 2 uses the encryption key {k ₀ ^{2 · 3 · 7 · 13} } that is allocated and stored ({(k ₀ ^{2 · 3 · 7 · 13} ) ^5.11. }) The key may be obtained and a session key may be obtained using the obtained encryption key. Node 3 also uses the encryption key {k ₀ ^{2 · 3 · 5 · 11} } that is allocated and stored ({(k ₀ ^{2 · 3 · 5 · 11} ) ^7.13 }) to use the encryption key used by the service provider. The session key may be obtained using the obtained encryption key.

However, the node 1 may obtain the encryption key used by the service provider by using the encryption key {k ₀ ^{2 · 5 · 7 · 17} } that is allocated and stored. That is, in order to acquire the encryption key used by the service provider, node 1 removes the {k ₀ ¹⁷ } component from the allocated {k ₀ ^{2 · 5 · 7 · 17} }. However, the exponential function consisting of a small number can not obtain a ^{_{{k 0 2 · 5 · 7}} · 17} {k 0 2 · 5 · 7} from the owing to the nature of the one-way function. Therefore, only Node 2 and Node 3 can obtain a session key and can be provided with content using the obtained session key.

If only Node 1 is the legitimate node for the service provider, the service provider encrypts the session key using the encryption key assigned by node 1. In this case, as described above, the node 2 and the node 3 cannot obtain the encryption key used by the service provider.

When used again using FIG. 3, k ₀ (function used in node 1 ') is assigned as a function to be used in the first group, and k ₁ (function used in node 2') as a function to be used in the second group. Allocate Allocate k ₇ (the function used in node 8 ') as the function to use in the eighth group, and assign k ₈ (the function used in node 9') as the function to use in the ninth group. Nodes constituting the second to ninth groups are also assigned an encryption key using the assigned function as described in FIG.

The tenth group consisting of nodes 1 'to 3', the eleventh group consisting of nodes 4 'to 6', and the twelfth group consisting of nodes 7 'to 9' also function in the same way as the first to ninth groups. Is assigned. That is, the tenth group is assigned k ₉ as a function to use and the eleventh group is assigned k ₁₀ as a function to use. The twelfth group is assigned k ₁₁ as the function to use. The thirteenth group consisting of nodes a to c is also assigned a function k ₁₂ .

Hereinafter, the encryption keys assigned to the nodes 1 to 27 that form the tree structure composed of the first to the thirteenth groups will be described using Table 1.

Node Assigned Encryption Key Node 1 k ₀ ^{2 · 5 · 7 · 17} , k ₉ ^{2 · 5 · 7 · 17} , k ₁₂ ^{2, 5, 7, 17} Node2 k ₀ ^{2, 3, 7, 13} , k ₉ ^{2 · 5 · 7 · 17} , k ₁₂ ^{2, 5, 7, 17} Node3 k₀ ^{2, 3, 5, 11}, k₉ ^{2, 5, 7, 17}, k₁₂ ^{2, 5, 7, 17} Node 4 k ₁ ^{2 · 5 · 7 · 17} , k ₉ ^{2 · 3 · 7 · 13} , k ₁₂ ^{2, 5, 7, 17} Node 5 k ₁ ^{2 · 3 · 7 · 13} , k ₉ ^{2 · 3 · 7 · 13} , k ₁₂ ^{2, 5, 7, 17} ... ... Node 24 k ₇ ^{2, 3, 5, 11} , k ₁₁ ^{2 · 3 · 7 · 13} , k ₁₂ ^{2, 3, 5, 11} Node 25 k ₈ ^{2 · 3 · 7 · 13} , k ₁₁ ^{2 · 3 · 5 · 11} , k ₁₂ ^{2, 3, 5, 11} Node 26 k ₈ ^{2 · 3 · 7 · 13} , k ₁₁ ^{2 · 3 · 5 · 11} , k ₁₂ ^{2, 3, 5, 11} Node 27 k ₈ ^{2 · 3 · 5 · 11} , k ₁₁ ^{2 · 3 · 5 · 11} , k ₁₂ ^{2, 3, 5, 11}

As described in Table 1, each node is assigned the same number of encryption keys as the number of layers.

Hereinafter, the encryption key used by the service provider to encrypt the session key will be described. If the nodes 1 to 27 are legitimate nodes, the service provider uses the encryption key using the function assigned to the thirteenth group. That is, the session key is encrypted using {k ₁₂ ^{2 · 3 · 5 · 7 · 11 · 13 · 17} } which is an encryption key that all nodes constituting the thirteenth group can decrypt.

In addition, when the excluded node is included in the group constituting the lower layer, the node constituting the upper layer is also determined to include the excluded node. That is, when node 1 is an excluded node, it is determined that the first group, the tenth group, and the thirteenth group also include the excluded node. Hereinafter, a process in which the service provider determines an encryption key for encrypting the session key when the node 1 is excluded will be described.

When the node 1 is excluded as described above, since the tenth group and the thirteenth group also include the excluded node, the service provider includes the eleventh group (the fourth to sixth groups) and the twelfth group ( The session key is encrypted using an encryption key that can be decrypted only in the seventh to ninth groups). In addition, the service provider encrypts the session key using an encryption key that can be decrypted only in the second group and the third group. In addition, the service provider encrypts the session key using an encryption key that can be decrypted only in nodes 2 and 3 of the first group. That is, the service provider uses {k ₁₂ ^{2 · 3 · 5 · 7 · 11 · 13} , k ₉ ^{2 · 3 · 5 · 7 · 11 · 13} , k ₀ ^{2 · 3 · 5 · 7 · 11 · 13} } Encrypt the session key. In this way, the nodes constituting the 11th group and the 12th group acquire a session key using {k ₁₂ ^{2 · 3 · 5 · 7 · 11 · 13} }, and form the second to third groups. The existing nodes obtain the session key using {k ₉ ^{2 · 3 · 5 · 7 · 11 · 13} }. Node 2 and Node 3 obtain a session key using {k ₀ ^{2 · 3 · 5 · 7 · 11 · 13} }.

Even when at least two of the nodes 1 to 27 are excluded, an encryption key for decrypting the session key is determined in the same manner as described with reference to FIG. 4.

5 shows an example in which four nodes form one group. FIG. 5 also interconnects subgroups by the same method as described with reference to FIG. 4. However, since the number of subgroups with three nodes is added, the number of allocating decimals is increased. That is, the prime numbers assigned to each subgroup are '2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 47, 53'.

As the number of nodes included in the group increases, the amount of computation for processing an encryption key allocated to each node also increases. If the four nodes in the group are legitimate nodes, the encryption key used by the service provider is {k ₀ ^{2 · 3 · 5 · 7 · 11 · 13 · 17 · 19 · 23 · 29 · 31 · 37 · 41 · 47 · 53} }. As the number of nodes constituting the group increases, the exponent of the exponential function increases, thereby increasing the amount of computation in each node.

6 and 7 illustrate a method for solving the problem of FIG. 5. FIG. 6 illustrates subgroups consisting of nodes and subgroups consisting of two nodes, and FIG. 7 illustrates subgroups consisting of nodes and subgroups consisting of three nodes. Hereinafter, a process of assigning an encryption key to each node will be described with reference to FIGS. 6 and 7.

The process of assigning an encryption key to each node of FIGS. 6 and 7 is as described with reference to FIG. 4. However, only the function used in FIG. 6 and the function used in FIG. 7 differ. That is, according to FIGS. 6 and 7, nodes constituting one group are assigned encryption keys using two functions. For example, if the function used in FIG. 6 is referred to as 'k ₀₁ ' and the function used in FIG. 7 is referred to as 'k ₀₂ ', each node has an encryption key using 'k ₀₁ ' and an encryption key using 'k ₀₂ '. Is assigned.

The service provider encrypts the session key using the encryption key using 'k ₀₁ ' when two nodes among the nodes constituting the group are excluded, and 'k ₀₂ ' when one node is excluded. Encrypt the session key using the encryption key using. As such, by allocating two encryption keys for each node included in one group, the amount of processing performed by each node is reduced. Of course, the number of encryption keys stored in each node increases.

However, if two encryption keys are assigned to each node of one group, the amount of computation is reduced, but the amount of computation required by the user may not be met. Referring to FIG. 6, the prime numbers assigned to each node and subgroup are '2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31'. In this case, the nodes described in FIG. 6 process a relatively small amount of computation compared to the nodes described in FIG. 5, but a user may require a smaller amount of computation.

8 and 9 illustrate a method for solving the problem of FIG. 6. Hereinafter, a method for solving the problem of FIG. 6 will be described with reference to FIGS. 8 and 9.

8 and 9 divide the subgroups shown in FIG. That is, the six subgroups shown in FIG. 6 are subdivided into two groups. 8 shows a subgroup composed of node 1 and node 2, a subgroup composed of node 1 and node 3, and a subgroup composed of node 2 and node 4. As shown in FIG. 9 shows a subgroup composed of node 1 and node 4, a subgroup composed of node 2 and node 3, and a subgroup composed of node 3 and node 4. FIG. Obviously, the number of subgroups to be subdivided may vary depending on the user's setting.

The process of interconnecting the node and the subgroup is the same as described with reference to FIG. 4 and will be omitted. In order to solve the problem of FIG. 6, the number of functions required to generate an encryption key allocated to each node used is increased. That is, although FIG. 6 assigns an encryption key to each node by using a single function, FIG. 8 and FIG. 9 which split FIG. 6 assign an encryption key to each node by using a unique function. That is, FIG. 8 assigns an encryption key using a function of k ₀₁₁ to each node, and FIG. 9 assigns an encryption key using a function of k ₀₁₂ to each node. That is, each node is assigned an encryption key using a function of k ₀₁₁ and an encryption key using a function of k ₀₁₂ . By doing so, the number of encryption keys assigned to each node increases, but the amount of computation for acquiring a session key is reduced.

That is, the user can adjust the number of encryption keys to be allocated to each node and the amount of computation to be processed at each node.

As described above, according to the present invention, it is possible to reduce the amount of transmission most important in broadcast encryption. In addition, embodiments of the present invention has the advantage that the amount of transmission can be significantly reduced compared to the SD known as the best method up to now.

In addition, although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the specific embodiments described above, but the technical field to which the invention belongs without departing from the spirit of the invention claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

Claims (8)

Generating a plurality of subgroups composed of at least one node among a plurality of nodes, and forming a hierarchy according to the number of nodes constituting the generated subgroups; Allocating a prime number so as not to overlap each of the subgroups, and concatenating a subgroup of a lower layer including a subgroup of an upper layer and a node constituting a subgroup of the upper layer; And Each subgroup is reassigned a minority assigned to a subgroup of its upper hierarchy, a decimal number assigned to a subgroup of a same hierarchy and a lower hierarchy that is not connected to the self, and an encryption made up of the reallocated prime numbers. Receiving a key; encryption key management method for broadcast encryption, comprising: a. The method of claim 1, wherein a virtual management node for managing subgroups consisting of one node is positioned at the top of the hierarchy. 2. The method of claim 1, wherein assuming that the number of nodes is N, the subgroup includes a subgroup consisting of managed nodes, a subgroup consisting of one node, subgroups consisting of two nodes, ..., An encryption key management method for broadcast encryption, characterized in that it is one of subgroups consisting of (N-1) nodes. 4. The method of claim 3, wherein the subgroups are divided into at least two groups, and an encryption key having a unique function is assigned to each of the divided groups. The method of claim 4, wherein The divided group includes a subgroup consisting of management nodes and a subgroup consisting of one node. The method of claim 5, And each node is assigned with the same number of encryption keys as the number of divided groups. 2. The method of claim 1, wherein if a node including service excluded from the service is included, a subgroup composed of nodes other than the node excluded from providing the service encrypts the session key using an assigned encryption key. An encryption key management method for broadcast encryption. 2. The method of claim 1, wherein each node is assigned an encryption key consisting of an exponential function having the reallocated prime numbers as exponents.

Images