KR101380347B1 - Broadcast encryption method and broadcast decryption method thereof - Google Patents

Abstract

A broadcast encryption method and a decryption method thereof are disclosed. The broadcast encryption method according to an embodiment of the present invention comprises the steps of generating a message encryption key using a public key and a secret key generated using a Strong Diffie-Hellman tuple, the message encryption key Encrypting the message, and generating a message header using a sum of those belonging to a legitimate user group of the Strong Deep-Hellman tuples. Therefore, the amount of transmission and storage can be reduced when transmitting a broadcast encrypted message.

Broadcast encryption, elliptic curves, strong deep-helman tuples

Description

Broadcast encryption method and decryption method {BROADCAST ENCRYPTION METHOD AND BROADCAST DECRYPTION METHOD THEREOF}

1 is a diagram illustrating a broadcast encryption message transmission according to an embodiment of the present invention.

2 is a flowchart illustrating a broadcast encryption method according to an embodiment of the present invention.

3 is a flowchart illustrating a broadcast decoding method according to an embodiment of the present invention.

4 is a diagram illustrating a case where the total number of users is divided into a plurality of small groups.

<Explanation of symbols for the main parts of the drawings>

110: sender user

120: recipient users

The present invention relates to a broadcast encryption method and a decryption method thereof, and more particularly, to a broadcast encryption method for generating a public key and a secret key using a Strong Diffie-Hellman tuple and a decryption method thereof. will be.

Recently, research on broadcast encryption has been actively conducted. Broadcast encryption means that when a sender sends a user set (S), a header, and an encrypted message to a large number of users, only the users belonging to the user set (S) use the header to restore the message encryption key. Decrypt the encrypted message using the message encryption key.

At this time, a user belonging to the user set S should be called a legitimate user, and only they should be able to obtain a message, and a user who does not belong to the user set S should not be able to obtain a message.

Broadcast encryption can be effectively used for the phased TV reception service of pay channels or the transmission of copyright-protected content in that only one legitimate user can obtain the encryption key through a single broadcast.

Broadcast encryption includes a symmetric key setting and a public key setting. In the symmetric key-based scheme, only a trusted sender generates and distributes a user's secret key and sends a broadcast message to the user. In this case, the trusted sender assumes full responsibility for broadcast encryption, in case the trusted sender fails, the entire broadcast cryptosystem is paralyzed, and a complicated key renewal process is required when members join or leave.

The public key-based method can overcome the disadvantages of the symmetric key-based method by using the public key commonly used in the system, so that anyone in the group can send a broadcast message and do not require a complicated key update process. In addition, broadcast encryption based on public key can be easily converted to symmetric key based.

D. Boneh, C. Gentry, and B. Waters, in 2005, published a paper entitled "Collusion resistant broadcast encryption with short ciphertexts and private keys" published in CRYPTO vol.3621, pp.258-275. In this paper, we propose a broadcast encryption method based on public key that has efficiency in transmission and storage.

However, according to the methods proposed by D. Boneh, C. Gentry, and B. Waters, 2n + 1 public keys are required for n users, and 2n-1 public keys are required for decryption. There is an urgent need for a new broadcast encryption method and a decryption method that can reduce the number of keys to reduce the amount of transmission.

SUMMARY OF THE INVENTION The present invention has been made to solve the problems of the prior art as described above, and aims to enable broadcast encryption / decryption while using a Strong Deep-Hellman tuple to reduce transmission and storage.

In addition, an object of the present invention is to enable more efficient broadcast encryption / decryption such as generating a message header or transmitting a message header using a strong deep-helman tuple corresponding to a legitimate user group or a withdrawal group.

It is also an object of the present invention to divide the entire users into a plurality of small groups and to share Strong Deep-Hellman tuples for each small group, effectively reducing the amount of broadcast encryption transmission.

In order to achieve the above object and to solve the problems of the prior art, the broadcast encryption method according to an embodiment of the present invention, a public key and secret generated using a Strong Diffie-Hellman tuple Generating a message encryption key using a key, encrypting a message with the message encryption key, and generating a message header using a sum of those belonging to a legitimate user group of the Strong Deep Hellman tuples; It is characterized by.

In addition, in the broadcast decryption method according to an embodiment of the present invention, a user belonging to a legitimate user group receives a Strong Deep-Hellman tuple, a message header, and an encrypted message corresponding to the group among public keys, the Strong Deep Calculating a value corresponding to the following equation using a Hellman tuple and a message header, performing a pairing operation using the calculated value, restoring an encryption key, and encrypting the message using the encryption key It characterized in that it comprises a step of decoding.

(a _ij = 1 / (ji), b _ij = -1 (ji), S: legitimate user group, Gi = (1 / (x + i)) G), Gj = (1 / (x + j)) G, i: index corresponding to the user who received the encrypted message)

For details on the Strong Diffie-Hellman tuple described in the present invention, see Dan Boneh, Xavier Boyen, and Hovav Shacham. Short group signatures. In CRYPTO 2004, volume 3152 of LNCS, pages 41-55. Springer-Verlag, 2004. et al.

Symbols used in the present invention are defined as follows.

G: generator that forms a group of order p on the elliptic curve

H: any element in the group produced by G

W: any element in the group created by G

Zp: group with rank p

x: any element selected in Zp (used as random number to generate public / secret key)

s: random element selected from Zp (used to randomly generate the message encryption key K that is sent each time)

S: set of legitimate users out of n total users

i: A legitimate user belonging to S who wants to obtain the message encryption key K from Hdr (message header)

j: Users that are not i as legitimate users of S

e (): pairing function defined above the elliptic curve

Gi: Gi = (1 / (x + i)) G for i = 1, ..., n

: S와 관련된 Gi 들의 집합

: Set of Gis related to S

In the present invention, the strong deep-helman tuple may represent only (1 / (x + i)) G among ((1 / (x + i)) G, i).

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a broadcast encryption message transmission according to an embodiment of the present invention.

), 정당한 사용자 그룹(S), 메시지 헤더(Hdr) 및 암호화된 메시지(C_M)를 전송한다.Referring to FIG. 1, in a broadcast encryption message transmission according to an embodiment of the present invention, a sender user 110 may have a strong user group S corresponding to a legitimate user group S among public keys. Deep-Hellman Tuple (

), Legitimate user group (S), message header (Hdr) and encrypted message (C _M ).

)은 Gi들 중 정당한 사용자 그룹(S)과 관련된 것들의 집합일 수 있다.At this time, Strong Deep-Hellman tuple corresponding to the legitimate user group (S) (

) May be a collection of Gis associated with a legitimate user group (S).

The encrypted message C _M is encrypted using the encryption key K. At this time, the encryption key is generated using a public key and a secret key generated using the Strong Deep-Hellman tuple. At this time, the secret key is a secret key corresponding to the transmitting user 110 shown in FIG.

The header Hdr may be generated using the sum of the strong deep-helman tuples belonging to a legitimate user group.

As shown in FIG. 1, the broadcast encryption method and the decryption method of the present invention are performed when a public key is transmitted together with a legitimate user set S, a message header Hdr, and an encrypted message C _M. Instead of sending all public keys, only strong Deep-Hellman tuples corresponding to a legitimate user group of public keys need to be sent.

The users belonging to the legitimate user set S among the receiving users 120 may restore the encryption key K by using the transmitted information, and the users who do not belong to the legitimate user set S may be sent. The encryption key K cannot be restored from the.

2 is a flowchart illustrating a broadcast encryption method according to an embodiment of the present invention.

2, a broadcast encryption method according to an embodiment of the present invention generates a message encryption key using a public key and a secret key generated using a Strong Diffie-Hellman tuple. (S210).

At this time, the public key may be generated using Equation 1 below.

(PK: public key, G: source that constitutes a group of p on the elliptic curve, H: any element in the group created by G, x: any element selected from Zp, n: total number of users)

In Equation 1, (1 / (x + 1)) G, (1 / (x + 2)) G, ..., (1 / (x + n)) G are Strong Deep-Hellman tuples, respectively.

In addition, the secret key may be generated using Equation 2 below.

(Di: the private key of the user corresponding to i of the user, G: the generator constituting the group of p above the elliptic curve, W and H: any element in the group created by G, x: any selected from Zp) Element, i: natural number from 1 to n, n: total number of users)

That is, the public and private key generation of the present invention may be performed in the following order.

First, the present invention sets a group whose order on the elliptic curve is p, and sets the generation source G and the random numbers W and H.

The present invention also computes the Strong Deep-Hellman tuple for user index i as (1 / (x + i)) G for random number x.

Then, the present invention generates a public key and a secret key corresponding to Equations 1 and 2 above.

In operation S210, the message encryption key may be generated using Equation 3 below.

(K: message encryption key, e: pairing function defined on elliptic curve, Di: secret key of user corresponding to i among users, G: generator constituting a group above p of elliptic curve, W and H: respectively Any element in the group created by G, s: any element selected from Zp, Gi = (1 / (x + i)) G)

That is, the present invention calculates e (W, G) using a public key (PK) and its private key (Di) by a user of a sender who wants to transmit a broadcast message, and calculates e (W, G). By using to generate the encryption key as shown in the equation (3).

In addition, the broadcast encryption method according to an embodiment of the present invention encrypts the message with the generated message encryption key (S220).

In addition, the broadcast encryption method according to an embodiment of the present invention generates a message header by using the sum of those belonging to a legitimate user group among the strong deep-helman tuples (S230).

In this case, the message header may be generated using Equation 4 below.

(Hdr: the message header, G: the generator that makes up the group p above the elliptic curve, any element in the group generated by H: G, any element selected from s: Zp, Gj = (1 / (x + j)) G, S: legitimate user group)

)을 함께 전송할 수 있다.The sending user who sends the broadcast message performs the broadcast message encryption shown in Fig. 2, and then broadcasts the legitimate user group S, the message header Hdr and the encrypted message C _M. At this time, the user of the transmitting side is a Strong Deep-Hellman tuple corresponding to the group in the public key (

) Can be sent together.

)을 브로드캐스트 메시지와 함께 전송하지 아니하고, 수신 측 사용자가 이를 미리 저장하고 있을 수도 있다.According to an embodiment, the sending user may use a Strong Deep-Hellman tuple corresponding to the group in the public key.

) May not be transmitted together with the broadcast message, but may be stored in advance by the receiving user.

The broadcast encryption method shown in FIG. 2 is applied to each of the divided small groups of the entire user group, and the message header may be generated using the sum of those belonging to each of the small groups of the Strong Deep-Hellmann tuple. .

That is, if the total user is 25, for each of the five small groups consisting of five to generate a public key and a secret key using the Strong Deep-Hellman tuple in the same manner as the broadcast encryption method shown in FIG. Encryption keys and headers may also be generated and broadcast. In this case, the message header may be generated using Equation 5 below.

(Hdr: message header, G: generator constituting a group of p on the elliptic curve, H1 to H5: any element in the group each created with G, s: any element selected from Zp, Gj = (1 / (x + j)) G, S1 to S5: small group)

3 is a flowchart illustrating a broadcast decoding method according to an embodiment of the present invention.

3, in the broadcast decryption method according to an embodiment of the present invention, a user belonging to a legitimate user group receives a public key, a message header, and an encrypted message (S310).

At this time, the public key does not need to receive all the public keys, but only the Strong Deep Hellman tuple corresponding to the legitimate user group among the public keys. At this time, the Strong Deep Hellman tuple corresponding to the legitimate user group may be a collection of Gis associated with the legitimate group.

At this time, the public key, the message header, and the encrypted message are broadcast by the sender user and can be received by all users. However, only a user belonging to the legitimate user group can restore the encryption key using the received information.

In addition, the broadcast decoding method according to an embodiment of the present invention calculates a value corresponding to Equation 6 by using the Strong Deep-Hellman tuple and the message header (S320).

(a _ij = 1 / (ji), b _ij = -1 (ji), S: legitimate user group, Gi = (1 / (x + i)) G), Gj = (1 / (x + j)) G, i: index corresponding to the user who received the encrypted message)

At this time, the step (S320) is used to with respect to every user in the proper user group except for the user corresponding to i by using the equation (7) calculating a _ij and b _ij, and the a _ij, and the b _ij To calculate the value corresponding to the equation (6).

(x: any element selected in Zp, i is the index corresponding to the user who received the encrypted message, j is the index of the member belonging to the legitimate user group except i)

In addition, the broadcast decryption method according to an embodiment of the present invention restores the encryption key by performing a pairing operation using the calculated value (S330).

In this case, the pairing operation uses pairing on an elliptic line. For more information on pairing operation, published in 2005 CRYPTO vol.3621, pp.258-275 by D. Boneh, C. Gentry, and B. Waters. It is described in detail in "Collusion resistant broadcast encryption with short ciphertexts and private keys".

In this case, step S330 may restore the encryption key using Equation 8 below.

(K: encryption key, e: pairing function defined above the elliptic curve, Hdr: message header, H and W: any element in the group each generated by G, s: any element selected from Zp, G: above the elliptic curve The generators that make up the group of the order p, a _ij = 1 / (ji), b _ij = -1 (ji), S: legitimate user group, Gi = (1 / (x + i)) G), Gj = (1 / (x + j)) G, i: index corresponding to the user who received the encrypted message, Di: private key of the user corresponding to i of the user)

In addition, the broadcast decryption method according to an embodiment of the present invention decrypts the encrypted message using the restored encryption key (S340).

Thus, only the user corresponding to the legitimate user group can decrypt the encrypted message without having to receive all the public keys.

The broadcast decoding method shown in FIG. 3 is applied to each of the small groups in which the entire user group is divided, and the message header may be generated using the sum of those belonging to each of the small groups in the Strong Deep-Hellman tuple. .

That is, when the total number of users is 25, the encryption message may be decrypted by restoring the encryption key in the same manner as the broadcast decryption method shown in FIG.

Each step shown in FIGS. 2 and 3 may be performed in the order shown, in the reverse order, or simultaneously.

4 is a diagram illustrating a case where the total number of users is divided into a plurality of small groups.

Referring to FIG. 4, it can be seen that 25 total users are divided into 5 small groups of 5 people.

At this time, in each small group, G ₁ , G ₂ , G ₃ , G _4, and G ₅ represent five users in the small group. These five elements are commonly used for five small groups. In addition, H ₁ , H ₂ , H ₃ , H ₄ and H ₅ are selected as elements representing each small group.

For details on the application of the broadcast decryption method and the encryption method by dividing the total number of users into a plurality of small groups, see 2005 CRYPTO vol.3621, pp.258 by D. Boneh, C. Gentry, and B. Waters. The details are disclosed in "Collusion resistant broadcast encryption with short ciphertexts and private keys", published at -275.

In FIG. 4, G, G ₁ , G ₂ , G ₃ , G ₄ and G ₅ are the same as described with reference to FIGS. 1 to 3, and S ₁ , S ₂ , S ₃ , S ₄ and S ₅ represent each small group. And H ₁ , H ₂ , H ₃ , H ₄ and H ₅ are taken out of any element in the group produced by G for each small group. In this case, according to an embodiment of the present invention, G ₁ , G ₂ , G ₃ , G _4, and G ₅ are commonly used for efficiency in broadcasting encryption / decryption, and sG is commonly used among message headers. Can be.

The broadcast encryption method and the decryption method according to the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. The medium may be a transmission medium such as an optical or metal line, a wave guide, or the like, including a carrier wave for transmitting a signal designating a program command, a data structure, or the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

The broadcast encryption method and the decryption method of the present invention can use the Strong Deep-Hellman tuple to perform broadcast encryption / decryption while reducing the amount of transmission and storage.

In addition, the present invention may enable more efficient broadcast encryption / decryption such as generating a message header or transmitting the message header using a strong deep-helman tuple corresponding to a legitimate user group or a group of withdrawal groups.

In addition, the present invention can effectively reduce the amount of broadcast encryption transmission by dividing the entire users into a plurality of subgroups and sharing Strong Deep-Hellman tuples for each subgroup.

Claims (12)

Generating a message encryption key using a public key and a private key generated using a Strong Diffie-Hellman tuple; Encrypting a message with the message encryption key; And Generating a message header using the sum of the strong deep-helman tuples belonging to a legitimate user group Lt; / RTI &gt; Generating the message encryption key, Generating n + 2 public keys and n secret keys using the Strong Deep-Hellman tuple; And Generating the message encryption key using at least one of the n + 2 public keys and at least one of the n private keys Broadcast encryption method comprising a. The method according to claim 1, Generating the message encryption key And generating the message encryption key using the public and private keys corresponding to Equations 1 and 2, respectively. [Equation 1]

&Quot; (2) &quot;

(PK: public key, Di: secret key of user corresponding to i of user, G: generator that constitutes a group of order p on the elliptic curve, any element in the group created by W and H: G) , Zp: group with rank p, x: any element selected from Zp, i: natural number greater than or equal to 1 and less than n, n: total number of users) 3. The method of claim 2, Generating the message encryption key Broadcast encryption method, characterized in that for generating the message encryption key using the following equation (3). &Quot; (3) &quot;

(K: message encryption key, e: pairing function defined on elliptic curve, Di: secret key of user corresponding to i of user, G: generator constituting a group of order p above elliptic curve, W and H: any element in the group, each created by G, Zp: a group of rank p, s: any element selected from Zp, Gi = (1 / (x + i)) G, i: receive an encrypted message Index corresponding to one user) The method of claim 3, Generating the message header Broadcast encryption method, characterized in that for generating the message header using the following equation (4). &Quot; (4) &quot;

(Hdr: message header, G: source constituting a group of order p on the elliptic curve, any element in the group created by H: G, Zp: group with rank p, s: random selected from Zp An element of, Gj = (1 / (x + j)) G, S: a legitimate user group, j: an index corresponding to a user other than i as a legitimate user belonging to the S) The method according to claim 1, The broadcast encryption method An entire user group is applied to each of the divided small groups, and the message header is generated using a sum of those belonging to each of the small groups of the Strong Deep-Hellman tuples. 6. The method of claim 5, The message header is a broadcast encryption method, characterized in that generated using the following equation (5). &Quot; (5) &quot;

(Hdr: message header, G: generator constituting a group of order p on the elliptic curve, H1 to H5: any element in the group each created with G, Zp: group with rank p, s: Zp Any element selected from Gj = (1 / (x + j)) G, S1 to S5: small group, i: index corresponding to the user receiving the encrypted message, j: legitimate user belonging to S1 to S5 As the index corresponding to the user other than i) Receiving, by a user belonging to a legitimate user group, a Strong Deep-Hellman tuple, a message header, and an encrypted message corresponding to the group in a public key; Calculating a value corresponding to Equation 6 using the Strong Deep-Hellman tuple and message header; Restoring an encryption key by performing a pairing operation using the calculated value; And Decrypting the message encrypted using the encryption key Broadcast decoding method comprising a. &Quot; (6) &quot;

(a _ij = 1 / (ji), b _ij = -1 (ji), S: legitimate user group, Gi = (1 / (x + i)) G), Gj = (1 / (x + j)) G, i: index corresponding to the user receiving the encrypted message, j: index corresponding to non-i users as a legitimate user belonging to S, x: any element selected from Zp, Zp: group with rank p , G: generator, forming a group of order p on the elliptic curve 8. The method of claim 7, Calculating a value corresponding to Equation 6 Calculating a _ij and b _ij using Equation 7 for all users in the group except the user corresponding to i; And Calculating a value corresponding to Equation 6 using the a _ij and the b _ij Broadcast decoding method comprising a. &Quot; (7) &quot;

(Zp: group with order p, x: any element selected from Zp, i is the index corresponding to the user who received the encrypted message, j is the index of the member belonging to the legitimate user group except i) 9. The method of claim 8, Restoring the encryption key Broadcast decryption method characterized in that to restore the encryption key using the equation (8). &Quot; (8) &quot;

(K: encryption key, e: pairing function defined above the elliptic curve, Hdr: message header, H and W: any element in the group each created with G, Zp: group with order p, s: Zp Any element selected from G, the generator that constitutes a group of order p on the elliptic curve, a _ij = 1 / (ji), b _ij = -1 (ji), S: legitimate user group, Gi = (1 / (x + i)) G), Gj = (1 / (x + j)) G, i: index corresponding to the user who received the encrypted message, Di: secret of the user corresponding to i among the users key) 8. The method of claim 7, The strong deep-helman tuple corresponding to the group is a set of Gis associated with the group. delete delete

Images