KR101099851B1 - System and method for batch rekeying - Google Patents

Abstract

The batch key resetting system includes: a first subtree including a plurality of group key encryption keys arranged in a tree structure; And a second subtree including a plurality of first subgroup keys arranged in a star structure and a plurality of first private keys corresponding to a plurality of users. A dispensing module for disposing a key according to the departure time of each user; And an updating module for updating the first subgroup keys corresponding to the plurality of first private keys at predetermined time intervals. The batch key resetting method includes: a first subtree including a plurality of group key encryption keys arranged in a tree structure; And a second subtree including a plurality of first subgroup keys arranged in a star structure and a plurality of first private keys corresponding to a plurality of users. Placing keys according to the departure time of each user; And updating a first subgroup key corresponding to the plurality of first private keys at predetermined time intervals.

Description

System and method for batch rekeying}

Embodiments relate to a batch key reset system and method.

Multicast services enable people to share information, collaborate, and enjoy entertainment services. Multicast and group communication are required in many common applications. At higher levels, multicast services enable applications such as pay TV, online games, corporate conferencing systems, and the like. At a low level, multicast services reduce the computational burden at the transmitter and reduce the burden on the network. Since all users within the reception range can acquire broadcast signals (either wired or wireless), the main problem of multicast is to achieve access control.

Many communication systems, such as long term evolution (LTE) and Worldwide Interoperability for Microwave Access (WiMAX), use keys that encrypt multicast content. In WiMAX, multicast content is protected by encryption using a group traffic encryption key (GTEK). A key distribution center (KDC) is responsible for managing group keys and performing key reset operations. As required by accurate forward and backward secrecy, key renewal is required if any membership change occurs. Frequent key reset operations due to the dynamics of group members introduce high computational overhead and communication overhead for systems and networks. Thus, an efficient group key reset method is required to maintain the access control that is executed upon membership change.

Periodic and batch rekeying (PBR) improves key reset efficiency for large-scale and very dynamic groups instead of sacrificing some forward secrecy. It is known to significantly improve.

PBR can replace a user who leaves the KDC with a joining user so that the included key paths only need to be updated once, and some of the key paths from leaf to root need to be updated. Since be-updated) keys are shared by more than one path, the number of keys to be updated is reduced.

However, the PBR can cause the worst case of leaving users scattered at the leaf level. In this case, most of the keys in the tree must be updated. Due to the commonness of the uniform distribution, this worst case can occur frequently. At this time, the average communication cost for resetting the group key is greatly increased. Also, because the user location of the key tree is independent of their departure time, the KDC in the PBR cannot proactively control its performance.

In addition, the PBR becomes unbalanced when the number of users and participating users who leave at the batch key reset time point is not the same. That is, the length of the key path from the leaf to the root can be different for different users. Extremely, every user may form a chain of length 'n' (n is the group size). Thus, in order to overcome this imbalance, the PBR may require a balanced operation that incurs additional communication costs.

According to an aspect of the present invention, by adopting a departure dependent key topology (DDKT) and Departure-Aware Key tree Structure (DAKS) using the user departure time information, key storage overhead It is possible to provide a batch key reset system and method that can achieve high efficiency for batch key reset by reducing overhead and eliminating key tree unbalancing, while at the same time reducing key reset communication overhead.

According to one or more exemplary embodiments, a batch key resetting system includes: a first subtree including a plurality of group key encryption keys arranged in a tree structure; And a second subtree including a plurality of first subgroup keys arranged in a star structure and a plurality of first private keys corresponding to a plurality of users. A dispensing module for disposing a key according to the departure time of each user; And an updating module for updating the first subgroup keys corresponding to the plurality of first private keys at predetermined time intervals.

The key structure may further include a third subtree including a second subgroup key arranged in a star structure and a plurality of second private keys corresponding to a plurality of users, wherein the first subtree and the third subtree are included. The tree may be a subkey of the group traffic encryption key.

A batch key resetting method according to an embodiment includes a first subtree including a plurality of group key encryption keys arranged in a tree structure; And a second subtree including a plurality of first subgroup keys arranged in a star structure and a plurality of first private keys corresponding to a plurality of users. Placing keys according to the departure time of each user; And updating a first subgroup key corresponding to the plurality of first private keys at predetermined time intervals.

The batch key reset system and method according to an aspect of the present invention achieves high efficiency for batch key reset by reducing key storage overhead and eliminating key tree unbalancing, and at the same time reducing key reset communication overhead. can do.

FIG. 1 is a diagram schematically illustrating a departure dependent key topology (DDKT) that is the basis of a batch key reset system according to an embodiment of the present invention.
2A and 2B are diagrams showing the number of keys to be updated using sequential and non-sequential batches using change as a variable.
FIG. 3 is a diagram schematically illustrating an in-batch star structure used in a batch key resetting system according to an embodiment of the present invention.
4A and 4B are diagrams showing key resetting costs of star and tree structures when processing a plurality of membership changes.
FIG. 5 is a diagram illustrating a Departure-Aware Key tree structure (DAKS) used in a batch key reset system according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings looks at in detail with respect to the preferred embodiment of the present invention.

The batch key reset system according to an embodiment of the present invention may include a distribution module and an update module. The distribution module is responsible for distributing private keys to users. The distribution module may be, for example, a key distribution center (KDC). The update module plays a role of updating a key distributed to a user when a key re-establishment time comes. In this embodiment, the distribution module is involved in the process of placing and distributing the group key encryption key, the subgroup key and the private key to the user, and the update module is involved in the process of updating the key distributed to the user with respect to the dynamic user. do. The operation of the update module may be performed at a key distribution center (KDC) or at another device.

FIG. 1 is a diagram schematically illustrating a departure dependent key topology (DDKT) that is the basis of a batch key reset system according to an embodiment of the present invention.

DDKT has two big features. First, a user associated with the same batch to be evicted is placed under the subgroup key by directly connecting the user's private key K _indv with the subgroup key K _sg . That is, the private key K _indv and the subgroup key K _sg are organized in a star shape. Second, the subgroup keys K _sg are organized in a tree shape. Therefore, DDKT is a key topology in which a tree structure and a star structure are combined. Here, the same batch of users is treated like 'one user'.

Referring to FIG. 1, as described above, the subgroup keys K _sg are organized in a tree shape, and the users u ₁ to u ₁₆ of the batch 1 to batch 4 are the private key K _indv of the user. Is arranged under the subgroup key in a star structure by directly connecting with the subgroup key K _sg . The star structure of the DDKT is called an in-batch star structure, which will be described later with reference to FIG. 3.

In the batch key reset system according to an embodiment of the present invention, the DDKT is considered a departure time. If the KDC can place users with escape times contained within the same batch at the leaf level of the tree, the number of overlapped keys is maximized. For example, in Figure 1, users u ₁ to u ₁₆ Leaves the group sequentially. The users u1 to u4 depart within the same batch period, and so do u5 to u8, u9 to u12 and u13 to u16. They are therefore placed in batches 1-4, respectively. This is called sequential batching (SEQ).

2A and 2B are diagrams showing the number of keys to be updated using sequential and non-sequential batches using change as a variable.

FIG. 2A shows the case where N = 8, and FIG. 2B shows the case where N = 16. 2A and 2B, each time the number of changes increases. It can be seen that the number of keys to be updated rapidly increases in the case of non-sequential batches, but gradually increases in a stepwise manner in the case of sequential batches.

FIG. 3 is a diagram schematically illustrating an in-batch star structure used in a batch key resetting system according to an embodiment of the present invention.

Tree-based key topologies are efficient for single-user dynamics. However, this is not the case when the dynamics of a batch of users must be solved. Star structures, on the other hand, are more efficient when dealing with multiple users. Since the secondary key is not used in the star structure, no matter how many changes are made in the group, the key reset message number remains O (N).

4A and 4B are diagrams showing key resetting costs of star and tree structures when processing a plurality of membership changes.

The figures show that for most of the plurality of users the number of key reset messages using the star structure is less than the number of key reset messages in the tree structure.

Returning to FIG. 3 again, consider the batch 4 users shown in FIG. 3 to be replaced by the same number of new users and generate an update to the key (black node in FIG. 3). By applying the star structure to the sequential batch subtree, the subtree 301 of the tree structure of FIG. 3 may be replaced with the subtree 302 of the star structure. In this case, the number of keys to be updated is reduced from five (GKEK110, GKEK111, GKEK11, GKEK1, GTEK) to three (GKEK11, GKEK1, GTEK). These batch changes behave like a single change to a higher level, so it makes sense to treat them uniformly. On the other hand, in order to take advantage of tree-based topologies when processing single key resets, the upper tree-based scheme must be maintained. In addition, due to the star structure, the KDC and the user manage fewer keys than in conventional full tree based methods.

FIG. 5 is a diagram illustrating a Departure-Aware Key tree structure (DAKS) used in a batch key reset system according to an embodiment of the present invention.

DAKS is based on the DDKT described above. First, DAKS may be divided into a first subtree 501, a second subtree 502, and a third subtree 503. The first subtree 501 functions as a batch division subtree (BDS) 501, and the second subtree 502 is an in-batch subtree (IBS) ( 502, and the third subtree 503 functions as an N prior subtree (NPS) 503. The BDS 501 is an upper level complete tree-shape hierarchy that provides scalability for the following batches, and a plurality of group key encryption keys arranged in a tree structure. key; GKEK). The IBS 502 represents each batch in which users are accommodated for a long time, and includes a plurality of first subgroup keys K _{Sg (i)} arranged in a star structure and a first private key K _indv1 corresponding to the plurality of users. Include. The NPS 503 is a special subtree where a short-term user is arranged, and includes a second subgroup key K _SgP arranged in a star structure and a second private key K _indv2 corresponding to a plurality of users. The second subgroup key (K _SgP ), which is the root of the BDS 501 and the root of the NPS 503, is directly connected to the group traffic encryption key (GTEK) 504.

DAKS characterizes user u _k by the user's participation time JT (u _k ) and departure time DT (u _k ) to identify the user. Users are housed within IBS 502. The first subgroup Sg (i) representing each IBS 502 is indicated by a keying time point (RTP) RTP (i). Users in the first subgroup Sg (i) are updated at RTP (i). When the root of the GKEK BDS (501) is assumed to be K _{Sg (i)} depth path (path depth) to L, the number of the first sub-group is a 2 ^{L, L} is 1≤i≤2. Referring to FIG. 5, the first subgroup is updated one by one from left to right, but after Sg (8) is updated, Sg (1) is updated again. Thus, the first subgroup forms a closed ring with modulo 2 ^L , i.e., RTP ( ^2L + 1) = RTP (1). Here, the first subgroup updates the user in a cyclic manner.

In the IBS 502, the user is kept under the first subgroup key K _{Sg (i)} during the period of T, when T is the period in which the first subgroup Sg (i) is all updated once. That is, a user whose service time is T or more is accommodated in the IBS 502. Here, the service time means a difference between a user's participation time and departure time. After the user stays in the first subgroup for a time of T, the user will be evicted or moved to another first subgroup if he is supposed to leave with the first subgroup update. NPS 503 maintains a star structure and accommodates short term users with service times shorter than T. NPS 503 is updated at every RTP. T is the time that the user can set in advance as needed.

DAKS performs a key reset operation for one of the subgroups in every batch period. The batch period refers to a period in which the departure time is set in each first subgroup to include adjacent users in one batch, and is represented as a difference in key reset time points between adjacent first subgroups as shown in the following equation.

When the time becomes RTP (i), the first subgroup Sg (i) is cleared, the user whose departure time coincides with the time point is evicted, and the remaining users are other first subgroup regardless of the departure time. Is moved to. The KDC unicasts a key notification message to the moved user. The key notification message includes a key in the path from K _{Sg (j)} to the root of the key tree. Assuming no compression technique is used, the length of the key notification message is (L * key length). On the other hand, RTP (i) is updated to RTP (i) + T, where T = d * 2 ^L. For a user with DT (u _k )> max (RTP) = RTP (i-1), the user remains in Sg (i). After Sg (i) is updated, users who wish to join the group can be placed in the key topology according to their departure time. The set N _join of the participating users is expressed as the following equation.

N _joins are classified into three subsets as shown in the following equation according to the departure time.

Here, N _match represents a subset of N _joins whose users are supposed to leave the current first subgroup Sg (i), ie whose service time is between Td and T. N _prior represents users staying in the group for less than Td. N _post indicates users whose service time is longer than T. In addition, N _match and N _post represent long term users and will be accommodated in this empty first subgroup regardless of their departure time.

During the time when Sg (i) is updated, the NPS 503 performs a key reset operation. All users in the second subgroup SgP are evicted and an N _prior is placed in the NPS 503 with the users not leaving in the second subgroup SgP.

Referring to Fig. 5, for example, when the time becomes RTP (1), all members in the first subgroup Sg (1) are evicted except for the user u0, which is moved to the first subgroup Sg (7). Users u1 through u4 are new members of the first subgroup Sg (1), and users u5 through u9 are new members of the SgP. A first subgroup key _{(K Sg (1))} and a second subgroup key (K _SgP) a first private key (K _indv1) and a second private key (K _indv2) is deleted, the first subgroup key under The auxiliary key from (K _{Sg (1)} ) to the root GTEK is updated with the second subgroup key K _SgP . The KDC creates and sends new GTEKs and GKEKs to the user in the key oriented key message format.

6 is a flowchart illustrating a key reset operation in the batch key reset system according to the present invention.

First, when the RTP (i) is reached, a key reset operation is started (S601), and the KDC starts an eviction operation on the first subgroup Sg (i) (S602). The KDC determines whether the user u _k belongs to N _match of the first subgroup Sg (i) (S603), and if so, the user u _k is evicted from Sg (i) (S604). The user u _k is moved to another first subgroup Sg (j) (S605). This eviction operation is performed for all users in the first subgroup Sg (i) (S606).

Next, RTP (i) is updated to RTP (i) + T (S607), and the KDC starts the joining operation for the first subgroup Sg (i) (S608). The KDC classifies the set N _join of participating users (S609). N _joins are classified into three subsets of N _match , N _post, and N _prior according to the departure time (S609). The KDC determines whether the user u _k belongs to N _match or N _post (S610), and if so, the KDC inserts the user u _k into the first subgroup Sg (i) (S611). The user u _k is inserted into the second subgroup SgP (S612). This participation operation is performed for all users in the N _join (S607).

When all of the participation is completed, the first subgroup key of the first subgroup Sg (i) and the first subgroup Sg (i) using the first private key of the user u _k belonging to N _match or N _post . Encrypts an upper key of the first subgroup key of the second subgroup key of the second subgroup SgP and the second sub by using a second private key of the user u _k that does not belong to N _match or N _post . The high key of the second subgroup key of the group SgP is encrypted.

While specific embodiments of the present invention have been illustrated and described, the technical spirit of the present invention is not limited to the accompanying drawings and the above description, and various modifications can be made without departing from the spirit of the present invention. It will be apparent to those skilled in the art, and variations of this form will be regarded as belonging to the claims of the present invention without departing from the spirit of the present invention.

Claims (18)

A first subtree including a plurality of group key encryption keys arranged in a tree structure, a plurality of first subgroup keys arranged in a star structure, and a second including a plurality of first private keys corresponding to a plurality of users A distribution module for arranging the first private key of each user according to a departure time of each user using a key structure including a subtree; And
And an updating module for updating each of the first subgroup keys corresponding to the plurality of first private keys at a predetermined time interval.
The method of claim 1,
The key structure is
And a third subtree including a second subgroup key arranged in a star structure and a plurality of second private keys corresponding to a plurality of users,
And wherein the first subtree and the third subtree are disposed below a group traffic encryption key.
The method of claim 2,
Each of the first private keys corresponds to a user whose difference between the user's participation time and the departure time is equal to or greater than a preset time;
And wherein each of the second private keys corresponds to a user whose difference between the user's participation time and the departure time is less than the preset time.
The method of claim 1,
The plurality of first subgroup keys correspond to each of a plurality of batch periods.
And the distributing module arranges the first private key of the user whose departure time is within the same batch period as a sub key of the same first subgroup key.
The method of claim 1,
Each of the plurality of first subgroup keys has a preset key reset point in time, and the update module includes:
Clearing a first subgroup key corresponding to the key redefinition time of the plurality of first subgroup keys at the key resetting time point,
Of the plurality of first private keys disposed below the cleared first subgroup key, the first private key of the user whose elapsed time has elapsed is evicted, and the first private key of the user whose elapsed time has not elapsed is And a plurality of first subgroup keys disposed below a first subgroup key different from the cleared first subgroup key.
The method of claim 5,
The update module,
And encrypting another first subgroup key and an upper key of the other first subgroup key by using the first private key of the user whose elapsed time has not elapsed.
The method of claim 5,
The update module,
Update each of the first subgroup keys in sequence according to the key resetting time sequence, and when the last first subgroup key is updated, updating of the first first subgroup key is started again. system.
The method of claim 2,
While each of the first subgroup keys is updated, the update module
Evicting a second private key of the third subtree, and at a key resetting time of each of the first subgroup keys, a second corresponding to the user whose difference between the user's participation time and the departure time is less than the preset time; Placing the private key in the third subtree.
The method of claim 8,
The update module,
Encrypting the upper key of the second subgroup key of the third subtree and the second subgroup key of the third subtree by using the second private key of the third subtree. .
A first subtree including a plurality of group key encryption keys arranged in a tree structure; And a second subtree including a plurality of first subgroup keys arranged in a star structure and a plurality of first private keys corresponding to a plurality of users. Placing keys according to the departure time of each user; And
And updating each of the first subgroup keys corresponding to the plurality of first private keys at predetermined time intervals.
The method of claim 10,
The key structure is
And a third subtree including a second subgroup key arranged in a star structure and a plurality of second private keys corresponding to a plurality of users,
And wherein the first subtree and the third subtree are disposed below a group traffic encryption key.
The method of claim 11,
Each of the first private keys corresponds to a user whose difference between the user's participation time and the departure time is equal to or greater than a preset time;
And wherein each of the second private keys corresponds to a user whose difference between the participation time of the user and the departure time is less than the preset time.
The method of claim 10,
The plurality of first subgroup keys correspond to each of a plurality of batch periods.
And the disposing step further comprises disposing a first private key of a user whose departure time is within the same batch period as a sub key of the same first subgroup key.
The method of claim 10,
Each of the plurality of first subgroup keys has a preset key reset time point, and the updating may include:
Clearing a first subgroup key corresponding to the key redefinition time of the plurality of first subgroup keys at the key resetting time point; And
Of the plurality of first private keys disposed below the cleared first subgroup key, the first private key of the user whose elapsed time has elapsed is evicted, and the first private key of the user whose elapsed time has not elapsed is And arranging a plurality of first subgroup keys below a first subgroup key different from the cleared first subgroup key.
The method of claim 14,
The updating step,
Encrypting another first subgroup key and an upper key of the other first subgroup key by using the first private key of the user whose elapsed time has not elapsed. .
The method of claim 14,
The updating step,
Sequentially updating each of the plurality of first subgroup keys according to the key resetting time sequence; And
When updating of the last first subgroup key is completed, starting updating of the first first subgroup key again.
The method of claim 11,
While each of the first subgroup keys is updated, the updating comprises:
Evicting a second private key of the third subtree; And
Disposing a second private key in the third subtree corresponding to a user whose difference between the user's participation time and the departure time is less than the preset time at the key resetting time of each first subgroup key; Batch key resetting method comprising a.
The method of claim 17,
The updating step,
Encrypting a second subgroup key of the third subtree and an upper key of the second subgroup key of the third subtree using the second private key of the third subtree. How to reset batch keys.

Images