KR101472312B1 - Method for maintaining the security of a message encrypted using Identity based Signcryption System thereof - Google Patents

Abstract

The present invention relates to a system capable of preventing forgery and falsification of an encrypted message encrypted by an ID-based private encryption scheme, thereby maintaining the security of the message.
In order to maintain safety, the disclosed system performs encryption of the m by applying a hash function on a value that only the sender can have among the values used for encrypting the message (m) by the ID-based private encryption And a decryption unit for decrypting the m, and the encryption unit includes a value that can be acquired only by the decryption unit in encryption.
In the case of encrypting a message according to the ID-based encryption technique according to the present invention, a message is encrypted by applying a hash function to a value that only a sender can have among values used for encryption, and in a decryption or verification process Since the value that can be obtained only by the receiver is included in the encryption process, the message can be secured from the external attack.

Description

[0001] The present invention relates to a system and a method for maintaining the security of an encrypted message,

The present invention relates to a system and method for maintaining the security of an ID-based private encryption message, and more particularly, to a system and method for protecting the security of an encrypted message by preventing forgery and falsification of an encrypted message, To a system and method for maintaining the same.

Signcryption An encryption scheme is a cryptographic scheme that can simultaneously provide encryption of a message and signature of a message. It is a hybrid scheme that requires encryption scheme and signature scheme to be applied independently or separately hybrid cryptography is more efficient in terms of computation and communication costs. (IND-CPA or IND-CCA) for the selective plaintext attack (or selective ciphertext attack), which is the security that should be considered in the cryptographic scheme, since the encryption scheme provides the services requiring the encryption scheme and the signature scheme at the same time. And the non-forgeryability (EUF-CMA) against the selective message attack, which is a safety factor to consider in the signature scheme.

The encryption technique has been studied in a public key infrastructure (PKI) -based cryptosystem, and then an ID-based encryption technique combined with an IDentity-based cryptosystem has been proposed.

ID - based cryptography has been proposed to solve the problem of certificate management in PKI - based cryptography. In the PKI-based encryption scheme, a public key certificate issued by a trusted certification authority is required for an arbitrary public key generated by a user. The ID-based encryption technique discloses a user's identity information such as a user's name, (KGC: Key Generation Center) which is a reliable third organization that securely issues a secret key corresponding to the user public key. ID-based cryptosystem is more convenient and efficient than PKI-based cryptosystem because it does not need to exchange or confirm the certificate in sending and receiving messages between sender and receiver. For this reason, ID-based cryptography is being applied in various fields such as encryption and digital signatures.

In this paper, we propose an ID-based encryption scheme that can be proved in a random oracle model that depends on the security provided by a hash function. In this paper, we propose an ID - based encryption method with provable security. However, there have been no ID-based authentication methods that can guarantee the security of messages in the standard model among the various ID-based authentication methods proposed so far (SSD Selvi, SS Vivek, D. Vinayagamurthy, and CP Rangan On the Security of ID Based Signcryption Schemes (http://eprint.iacr.org/2011/664, 2011).

On the other hand, in cryptography, the security model has been defined by defining the environment and purpose given to the attacker in order to prove safety (safety), and has proved safety based on algebraic difficulties. Since the proof of safety is not easy, we have designed cryptographic techniques and proved their safety by either changing a fairly well-defined safety model or finding other difficult problems that can be proven. It can be said that the originally defined safety model, which is not modified based on the hard problem, is safe in the standard model of the safety model. Random Oracle model is a model that has added hash oracle to the attacker, but it is a little easier to prove safety, but the encryption technique proved in the standard model is safer and cryptographically meaningful than the technique proved in random Oracle. .

Existing ID-based authentication methods applied in the standard model can be used to falsify signatures through manipulation of cryptograms obtained through sign queries, or to verify the authenticity of challenge messages in a not-identifiable or non-forgery- Respectively. That is, the impossibility of impossibility of division and impossibility of forgery can not be guaranteed, and consequently, the confidentiality and integrity of the message are not ensured, and thus the security of the message is seriously damaged.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made in view of the above problems, and it is an object of the present invention to provide a method and system for securing the confidentiality and integrity of a message encrypted by an ID-based private encryption technique in a standard model, This paper proposes a method to maintain the security of ID-based encryption encrypted messages.

In order to solve the above problems, a system for maintaining the security of an ID-based private encryption message is a hash-based public key cryptosystem for a value that only the sender can have among the values used for encrypting the message (m) And encrypting the m by applying a hash function. In addition, the disclosed system further includes a decoding unit for decoding the m, and the encryption unit solves the above problem by including a value that can be acquired only by the decoding unit in encryption.

A method for maintaining the security of an ID-based private encryption message, which is disclosed in order to solve the above problems, is a method for maintaining a hash function for a value that only a sender can have among values used for encryption of a message (m) and m is encrypted by applying a hash function. In addition, the disclosed method further includes the step of decrypting the m, and a value obtainable only in the decrypting step is included in the encrypting step to solve the above-mentioned problem.

In the case of encrypting a message according to the ID-based encryption technique according to the present invention, a message is encrypted by applying a hash function to a value that only a sender can have among values used for encryption, and in a decryption or verification process Since the value that can be obtained only by the receiver is included in the encryption process, the message can be secured from the external attack.

BRIEF DESCRIPTION OF THE DRAWINGS Fig.
Fig. 2 is a view showing a configuration of the present invention.

Prior to the description of the concrete contents for carrying out the present invention, for the sake of understanding, an outline of a solution to the problem to be solved by the present invention will be given first.

The present invention proposes an ID-based private encryption scheme that is safe from external attacks and can ensure the security of messages in the standard model (safety can not be compromised). The IDF- CMA), and it is possible to secure the message indiscriminability (IND-CPA) against the selective plaintext attack.

It encrypts the message m by applying a hash function to a value that only the sender can have among the values used for encrypting the message m, and also encrypts the value m that can be acquired only by the receiver in the decryption or verification process It is to maintain the security of the message by including it in the encryption process.

The present invention will now be described more fully hereinafter with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown. In the following description, It is to be noted that the same reference numerals are given to the drawings and that elements of other drawings can be cited when necessary in the description of the drawings. In the following description, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

The ID-based private encryption scheme is implemented in five stages: a setup phase, a secret key generation (issuance) phase, an encryption phase, a decryption phase, and a verification phase. In the present invention, in particular, a predetermined operation is performed on a value required in the encryption step, and a value that can be obtained only by the receiver in the decryption step is included in the encryption step, so that the problem of the existing ID-based private encryption technique applied in the standard model And to eliminate the concern of safety deterioration.

<Setup step: Setup ( ^1k )>

In this step, the setup unit 11 receives the security constant k as an input, and generates a master secret key msk and a public constant param (step S21). The step S21 is a step S21 of generating values necessary for encrypting and decrypting the message and verifying the validity of the signature Generates (outputs) the values necessary for encrypting and decrypting the message, and verifying the validity of the signature. At this time, the generation can be performed as follows.

는 어드미서블 겹선형 함수(admissible bilinear map)이다. G₁의 임의의 생성원 g를 선택한다.And generates cyclic groups (G ₁ , G _T , e) related to the bilinear maps. In this case, G ₁ and G _T have a prime number p as a rank, and g is a source of G ₁ .

Is an admissible bilinear map. And an arbitrary generation source g of G ₁ is selected.

을 선택하여(

는 Z_p에서 0을 제외한 값의 집합으로 예를 들어, 소수 p가 7이면

는 {0,1,2,3,4,5,6}이고,

는 {1,2,3,4,5,6}이다) g₁=g^a을 만족하는 g₁을 생성하고, G₁에서 임의의 난수들 g₂, u', m', t'를 선택하고, G₁에서 원소가 임의의 난수로 이루어진 각각 길이 n_u, n_m, n_t를 갖는 벡터

를 선택한다. 또한 암호학적인 해시 함수

와

를 선택한다. 이로부터 공개 상수 param와 마스터 비밀키 msk를 다음과 같이 생성한다.Random number

Select (

Is a set of values excluding Z in Z _p , for example, if the prime number p is 7

Is {0, 1, 2, 3, 4, 5, 6}

Is {1,2,3,4,5,6} is a) g ₁ = g s ^a random number in the random generation of g _1, and G ₁ satisfying g _2, u ', m', select, t ' And a vector having a length n _u , n _m , and n _t , each element having an arbitrary random number in G ₁

. The cryptographic hash function

Wow

. From this, the public constant param and the master secret key msk are generated as follows.

,

.

,

.

<Secret key generation (issuing) step: Extract (param, msk, ID)>

)와 수신자의 메시지 복호화 비밀키(

)를 생성하여 각각 송신자(암호화부(11))와 수신자(복호화부(12))에 발급하는 단계(s22)이다. 비밀키 생성부(12)는 두 비밀키를 다음과 같이 생성할 수 있다.This step includes the sender's private key for signature (

) And the recipient's message decryption secret key (

(Step S22) of issuing the message to the sender (the encrypting unit 11) and the receiver (the decrypting unit 12), respectively. The secret key generation unit 12 can generate two secret keys as follows.

를 u[i]=1인 i의 집합이라 정의한다. 한편 u에 대해서는 두 개가 정의되는데 u_r은 수신자의 ID를, u_s는 송신자의 ID를 표현하는 비트 문자열(비트 문장)이다.The public constant param generated in the setup step, the master secret key msk, and the IDs (ID _s and ID _r ) of the sender and the receiver, respectively. u is defined as a bit string having a length n _u representing an ID, u [i] is defined as an i-th bit value of u,

Is defined as a set of i with u [i] = 1. On the other hand, two u are defined, where u _r is the ID of the receiver and u _s is the bit string (bit string) representing the sender's ID.

를 선택하고, 송신자의 서명용 비밀키(

)와 수신자의 복호화 비밀키(

)는 다음과 같이 생성될 수 있다.Random number

And the sender's private key for signing (

) And the recipient's decryption secret key (

) Can be generated as follows.

.

.

><Encryption phase:

>

을 생성하는 단계(s23)로, 암호화부(13)는 암호문

를 다음과 같이 생성할 수 있다. 암호화부(13)는 본 발명에서 송신자의 핵심 구성 요소에 해당하는 것으로 이하 두 용어를 혼용하기로 하며, 후술할 복호화부(14)도 본 발명에서 수신자의 핵심 구성 요소에 해당되기 때문에 두 용어를 혼용하기로 한다.In this step, the message (m) is encrypted using a secret encryption technique

(Step s23). The encryption unit 13 encrypts the ciphertext

Can be generated as follows. The encryption unit 13 corresponds to a key component of the sender in the present invention, and the following two terms are used in common. The decryption unit 14, which will be described later, also corresponds to a key component of the receiver in the present invention. It is assumed to be mixed.

, 송신자의 서명용 비밀키

와 수신자의 아이디 ID_r를 입력으로 받는다. t를 해시(hash)를 표현하는 길이 n_t인 비트 문자열로 정의하며 t[i]를 t의 i번째 비트 값으로 정의하고,

을 t[i]=1인 i의 집합이라 정의한다. 아울러 메시지 m이 길이 n_m인 비트 문자열일 때 m[i]를 m의 i번째 비트 값으로 정의하고,

를 m[i]=1인 i의 집합이라 정의한다.Public constant param, message

, The sender's private key for signature

And the ID ID _r of the receiver. We define _t as a bit string with a length n _t representing a hash, and define t [i] as the i-th bit value of t,

Is defined as a set of i with t [i] = 1. Further, when the message m is a bit string of length n _m , m [i] is defined as the i-th bit value of m,

Is defined as a set of i with m [i] = 1.

를 선택한 후 메시지 m에 사인크립션 기법을 적용하여 암호화되는 암호문

을 다음과 같이 생성할 수 있다.Random number

And then encrypting the message m by encrypting it.

Can be generated as follows.

,

,

--- 식(1).

,

,

--- Expression (1).

--- 식(2).

- (2).

내지

은 각각 다음과 같다.Here, H ₁ () and H ₂ () mean a hash function,

To

Respectively.

의 조작 가능성을 원천적으로 불가능하도록 하는 점인데, 이는 암호화에 이용되는 값에 해시 함수를 적용한 결과를 암호화에 이용하기 때문이다(암호화 과정에 해시 함수를 적용하기 때문이다). 위의 경우에는 식(1)과 식(2)에 제시된 바와 같이 해시 함수를 적용한 결과값인 T₂, T₃을 암호화에 이용하였으며,

와

의

에 반영되어 있다.One of the distinctive features of the ID-based private encryption scheme according to the present invention is that it can be distinguished from the existing ID-

Because it uses the result of applying the hash function to the value used for encryption in the encryption (because the hash function is applied to the encryption process). In the above case, as shown in Equation (1) and Equation (2), the result values T ₂ and T ₃ using the hash function are used for encryption,

Wow

of

.

이고 출력은 T₂, T₃이며, T₁(g₁, g₂, s₁)과

는 송신자(암호화부(13))만 가지고 있는 고유한 값이기 때문에 제3자가 T₁(g₁, g₂, s₁)과

을 알 수 없으므로 암호문

의 조작이 원천적으로 불가능한 것이다.The hash function has a property of one-side function, and the unidirectional function has a property that the input can not be determined even if the output of the function is given. Applying these properties to Eqs. (1) and (2), the input is T ₁ (g ₁ , g ₂ , s ₁ )

And the outputs are T ₂ and T ₃ , and T ₁ (g ₁ , g ₂ , s ₁ ) and

Is a unique value possessed only by the sender (the encryption unit 13), and therefore, the third party transmits T ₁ (g ₁ , g ₂ , s ₁ )

Can not be known,

It is impossible to operate it.

이 수신자에 의해 복호화될 때 수신자(복호화부(14))만 얻을 수 있게 할 값으로서 해시 함수가 이에 적용되는 것(

,

)이 메시지 m(암호문

)의 안전성을 유지함에 있어 가장 바람직할 것이다. 왜냐하면 T₁은 수신자(복호화부(14))만 얻을 수 있도록 해야 하는 값이기 때문에 이 값에 대해서는 나머지 제3자에 대해 기밀성을 확보해야 할 필요성이 보다 더 높기 때문이다.Further, as will be described in detail later, the above-mentioned T ₁ is a cipher text

A hash function is applied as a value to be obtained only by the receiver (decryption unit 14) when decrypted by this recipient (

,

) This message m (cipher text

). &Lt; / RTI &gt; This is because T ₁ is a value that should be obtained only by the receiver (decryption unit 14), and therefore, it is more necessary to secure confidentiality for the remaining third parties with respect to this value.

Meanwhile, it is obvious from the standpoint of those skilled in the art that the hash function can be applied by selecting different values from Equations (1) and (2) by merely selecting a specific value among the values used for encryption and applying the hash function something to do. The key in the encryption step according to the present invention is to apply a hash function to a unique value that only the sender (encryption unit 13) can have.

><Decryption step:

>

과 수신자의 복호화용 비밀키

을 입력으로 받아 암호문

를 다음과 같이 복호화하여 메시지 m을 얻는다(s24).The receiver (decryption unit 14) receives the public constant param,

And the secret key for decrypting the receiver

As input

Is decrypted as follows to obtain a message m (s24).

= m - (3).

및 복호화 단계에서 정당한 수신자만에 의해 추출되는 T₁(=

)이 서명이라고 볼 수 있다.Since encryption is a cryptographic scheme in which a cipher text is expressed by a combination of a value relating to a cipher, a value relating to a signature, and a value associated with both a cipher and a signature (since the cipher scheme and the signature scheme are implemented by a single algorithm) m and the remaining ciphertext values are themselves treated as signatures. That is, the signature is not output separately. Therefore,

And T ₁ (= _&lt; RTI ID = 0.0 &gt; = &_lt; / RTI &

) Is a signature.

를 이용하여 암호문

를 복호화하는 경우에는, 위에서 본 바와 같이,

이므로

를 T₂로 나누어 준다. T₂는 T₁의 해시 함수의 출력 값이므로 T₁은 정당한 수신자만이 자신의 복호화용 비밀키

로 추출해낼 수 있게 되는 것이다. 후술할 서명의 유효성 검증 단계에 T₁을 추출하는 과정이 제시되어 있는데,

에서 T가 T₁이다.Secret key for decryption by receiver

The ciphertext

In the case of decoding, as shown above,

Because of

Is divided by T ₂ . T ₂ because it is the output value of the hash function of the T ₁ T ₁ is only valid for their recipient secret decryption key

As shown in FIG. The process of extracting T ₁ from the signature validation step, which will be described later,

Where T is T ₁ .

<Verification step: Verify (param, m, σ, ID _s >

The public constant param, the message m, the signature σ, and the ID _s of the sender as input (s25). Since the decrypted message (m) is assumed to be treated as a signature, this step may also be referred to as validating the validity of the message. The verification unit 15 can verify that the validity thereof is shown by the following expression.

의 복호화는 식(3)에 의하면 결국 다음의 식으로 단순화될 것이다.cryptogram

(3), it will be simplified to the following equation.

.

.

,

,

이므로 수신자측에서 아래의 두 식이 모두 만족하는지 검증되면 서명 σ은 유효한(valid) 것으로 검증된 것이다.Meanwhile, in the encryption step

,

,

Therefore, if the following two expressions are satisfied on the receiver side, the signature σ is proved to be valid.

.

.

.

.

[Verification]

.

.

.

.

= e(g₁, g₂). 따라서 서명 σ의 유효성이 검증되었다.By the nature of the folded linear function

_{= E (g 1, g 2} ). Therefore, the validity of the signature σ was verified.

The method of the present invention can also be embodied as computer readable code on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and also implemented in the form of a carrier wave (for example, transmission over a wired or wireless network) . The computer-readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner.

The present invention has been described above with reference to preferred embodiments thereof. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. The disclosed embodiments should, therefore, be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (10)

And an encryption unit for encrypting the m by applying a hash function to a value that only the sender can have among the values used for encrypting the message m by the ID based signcryption However,
The secret key used for the encryption is generated by applying the public constant, the master secret key, and each ID of the sender / receiver to the following equation,

(In this case, the g ₂ ^α is the master secret key, and u 'are public constants and, u _i denotes the i-th bit string of u indicates the identity characters transmitted and received, U _s is identity of the sender, r ₂ are random Represents a random number, and g represents the generation source of the cyclic group associated with the folded linear function.)
Wherein the encryption statement used in the encryption is generated by applying a secret technique to the message m according to the following equation.

(Where u ', t', m 'are public constants, U _r is the receiver ID, u _i is the i th bit string representing the identity of the sender and receiver, t _i is the i th bit string Where m ₁ denotes an i-th string of a message m, g denotes a generation source of a cyclic group related to a folded linear function, s ₁ and s ₂ are arbitrary random numbers, H ₁ (), H ₂ ) Is the hash function, and g ₂ ^α is the master secret key.) The method according to claim 1,
And a decoding unit for decoding the m,
Wherein the encrypting unit includes a value obtained only by the decrypting unit in the encryption of m when the encrypting unit encrypts the m. 3. The method of claim 2,
Wherein the hash function is applied to a value that can be obtained only by the decryption unit. 4. The method according to any one of claims 1 to 3,
Wherein the encryption of m is applied in a standard model. &Lt; RTI ID = 0.0 &gt; 11. &lt; / RTI &gt; 4. The method according to any one of claims 2 to 3,
Wherein a value (T ₁ ) that can be obtained only by the decryption unit is obtained by the following equation:

Where g ₁ and g ₂ are arbitrary random numbers selected from a cyclic group associated with the folded linear function and s ₁ is a random number selected from a prime number p Have

. &Lt; / RTI &gt; ID-Based Secret Encryption A system that maintains the security of a message hash function for values that only the sender can have among the values used to encrypt the message (m) by ID based signcryption. To encrypt the m,
The secret key used by the system for maintaining the security of the ID-based private encryption message is generated by applying the public constant, the master secret key, and the identity of each transceiver to the following equation,

(In this case, the g ₂ ^α is the master secret key, and u 'are public constants and, u _i denotes the i-th bit string of u indicates the identity characters transmitted and received, U _s is identity of the sender, r ₂ are random Represents a random number, and g represents the generation source of the cyclic group associated with the folded linear function.)
The encryption-based encryption method used by the system for maintaining the security of the ID-based encrypted encryption message is generated by applying the encryption method to the message (m) according to the following equation: &lt; EMI ID = To maintain the safety of the.

(Where u ', t', m 'are public constants, U _r is the receiver ID, u _i is the i th bit string representing the identity of the sender and receiver, t _i is the i th bit string Where m ₁ denotes an i-th string of a message m, g denotes a generation source of a cyclic group related to a folded linear function, s ₁ and s ₂ are arbitrary random numbers, H ₁ (), H ₂ ) Is the hash function, and g ₂ ^α is the master secret key.) The method according to claim 6,
Further comprising decrypting the m by a system that maintains the security of the ID-based encrypted enciphered message,
Wherein the step of encrypting the m includes a value that can be obtained only in the decryption step. The method of claim 10, wherein the encrypting step includes encrypting the encrypted ID. 8. The method of claim 7,
Wherein the hash function is applied to a value that can be obtained only in the decryption step. 9. The method according to any one of claims 6 to 8,
Wherein the encryption of m is applied in a standard model. &Lt; RTI ID = 0.0 &gt; [10] &lt; / RTI &gt; 9. The method according to any one of claims 7 to 8,
Wherein a value (T ₁ ) that can be obtained only in the decryption step is obtained by the following equation.

Where g ₁ and g ₂ are arbitrary random numbers selected from a cyclic group associated with the folded linear function and s ₁ is a random number selected from a prime number p Have

. &Lt; / RTI &gt;

Images