KR101945885B1 - Method for Authenticating Evaluation Results of Homomorphic-Encrypted Data - Google Patents

Abstract

)에 따라 암호문의 집합(C)와 메시지의 집합(M)이 정해지며, 메시지 집합에서 암호문의 집합으로 보내는 비밀함수(s)로서 역함수가 존재하는 비밀함수(s)가 설정되며, 비밀키(K)가 정해진다.
본 발명에 의한 암호문 위변조 판단 방법은, 암호화 모듈이 메시지를 비밀함수(s)를 이용하여 암호문의 집합으로 보내는 인코딩을 수행하는 제1 단계와; 암호화 모듈이 메시지 각각에 부여되는 고유 번호(id)를, 비밀키(K)를 사용하는 의사 난수 함수(F_K)에 의해 생성된 암호문의 집합(C)의 랜덤 원소에 대응시키는 제2 단계와; 암호화 모듈이 제1 단계에서 생성한 인코딩 메시지를 제2 단계에서 생성한 랜덤 원소를 이용하여 마스킹하여 암호화 값(

)을 생성하는 제3 단계와; 복호화 모듈이 암호문의 위변조를 검증하는 제4 단계를 포함한다.
검증하는 제4 단계는, 메시지 각각의 고유 번호(id)를, 비밀키(K)를 사용하는 의사 난수 함수를 이용하여 암호문의 집합(C)의 랜덤 원소에 대응시키는 제4-1 단계와; 제4-1 단계에서 생성된 랜덤 원소를 이용하여 마스킹을 제거하는 제4-2 단계와; 비밀함수의 역함수를 이용하여 메시지를 복호화하는 제4-3 단계와; 제4-2 단계에서 마스킹을 제거하여 획득한 값이 비밀함수의 치역에 있는지 여부를 검증하고 참인 경우에만 제4-3 단계에서 복호화된 값을 출력하는 제4-4 단계를 포함한다.An environment in which the cipher forgery determination method according to the present invention is performed includes an information collection unit for collecting basic information, an encryption module for encrypting basic information, a decryption module for receiving and decrypting a cipher text as a result value of the encryption module, And a body that is controlled based on the received data.
Security Arguments (

A set of ciphertexts (C) and a set of messages (M) are defined in accordance with a set of ciphertexts and a secret function (s) having an inverse function is set as a secret function (s) K) is determined.
A method of determining a cryptogram forgery and falsification according to the present invention includes: a first step of performing an encoding in which an encryption module sends a message as a set of ciphertexts using a secret function (s); The encryption module is a unique identifier (id) is assigned to a message, respectively, and a second step of corresponding the random element of the ciphertext set (C) of the produced by the pseudo-random number function (F _K) using the secret key (K) ; The encryption module encrypts the encoding message generated in the first step by using the random element generated in the second step,

); ≪ / RTI > And a fourth step in which the decryption module verifies the forgery and corruption of the cipher text.
The fourth step of verifying is a step 4-1 of associating the unique number id of each message with a random element of the set of ciphertexts C using a pseudo-random number function using the secret key K; A fourth step of removing masking using the random element generated in step 4-1; A fourth step of decrypting the message using an inverse function of the secret function; And a fourth step of verifying whether the value obtained by removing the masking in the step 4-2 is in the range of the secret function and outputting the decrypted value in the step 4-3 only when the value is true.

Description

Method for Authenticating Evaluation of Homomorphic-Encrypted Data "

The present invention relates to a method for verifying the result of computing the same-encrypted data in an encrypted state.

Since the result of performing the operation in the encrypted state of the encrypted data is a value obtained by encrypting the result of the calculation of the plain text, it is not necessary to provide the plain text information in the operation of the data. Therefore, there is an advantage that the computed result of the data can be obtained without exposing the encrypted sensitive plaintext information to a third party.

However, serious problems arise if it is not verified whether or not the result of the operation in the same encryption state is forged in the middle.

For example, in the case of unmanned drones (autonomous vehicles) or autonomous vehicles that have been widely studied and are widely used in recent years, the control basic signals (speed, running direction, other information of the vehicle, etc.) acquired by the controlled drones or self- If the encrypted control signal is obtained and decrypted to obtain the control signal, even if the control basis signal is not exposed in the middle, if the operation is forged in the middle, There is a problem that a serious error may be caused in the control of the controlled object.

To solve this problem, the concept of homogeneous authentication cryptosystem has been proposed. However, there is a problem that the homogeneous authentication cryptosystem presented so far has very low efficiency.

For example, the paper "Homomorphic Authenticated Encryption Secure Against Chosen-Ciphertext Attack" published by Asiacrypt in 2013 proposes the concept of the same type of authentication cryptosystem and designs the scheme. However, this technique is based on factorization and Approximate Greatest Common Divisor (AGCD) It is designed on the basis of the problem, and since the size of the ciphertext exponentially increases in the operation to be performed in the encrypted state, it is very low efficiency to be practically used.

It is an object of the present invention to provide a method for verifying whether a result of the calculation of the same-type encrypted information is falsified by suggesting a homogeneous authentication encryption method with high efficiency by solving the problems of the related art.

An environment in which the cipher forgery determination method according to the present invention is performed includes an information collection unit for collecting basic information, an encryption module for encrypting basic information, a decryption module for receiving and decrypting a cipher text as a result value of the encryption module, And a body that is controlled based on the received data.

)에 따라 암호문의 집합(C)와 메시지의 집합(M)이 정해지며, 메시지 집합에서 암호문의 집합으로 보내는 비밀함수(s)로서 역함수가 존재하는 비밀함수(s)가 설정되며, 비밀키(K)가 정해진다.Security Arguments (

A set of ciphertexts (C) and a set of messages (M) are defined in accordance with a set of ciphertexts and a secret function (s) having an inverse function is set as a secret function (s) K) is determined.

)을 생성하는 제3 단계와; 복호화 모듈이 암호문의 위변조를 검증하는 제4 단계를 포함한다.A method of determining a cryptogram forgery and falsification according to the present invention includes: a first step of performing an encoding in which an encryption module sends a message as a set of ciphertexts using a secret function (s); The encryption module is a unique identifier (id) is assigned to a message, respectively, and a second step of corresponding the random element of the ciphertext set (C) of the produced by the pseudo-random number function (F _K) using the secret key (K) ; The encryption module encrypts the encoding message generated in the first step by using the random element generated in the second step,

); ≪ / RTI > And a fourth step in which the decryption module verifies the forgery and corruption of the cipher text.

The fourth step of verifying is a step 4-1 of associating the unique number id of each message with a random element of the set of ciphertexts C using a pseudo-random number function using the secret key K; A fourth step of removing masking using the random element generated in step 4-1; A fourth step of decrypting the message using an inverse function of the secret function; And a fourth step of verifying whether the value obtained by removing the masking in the step 4-2 is in the range of the secret function and outputting the decrypted value in the step 4-3 only when the value is true.

으로, 메시지의 집합이

로 설정되면, 비밀함수(s)는

(A: 역행렬이 존재하는 k by k 행렬; H: (n-k) by k 행렬)가 될 수 있다.A set of ciphertext

, A set of messages

, The secret function (s) is < RTI ID = 0.0 >

(A: k by k matrix in which the inverse matrix exists, H: (nk) by k matrix).

The environment in which the forgery and falsification determination method of a cryptographic operation according to the present invention is executed includes an information collecting unit for collecting basic information, an encryption module for encrypting basic information in the same manner, a central control unit for receiving and computing encrypted data, A decoding module for receiving and decoding operation result values of the central control unit, and a body including a body unit controlled based on the decoded data.

)에 따라 암호문의 선형공간(C)와 메시지의 선형공간(M)이 정해지며, 메시지 공간에서 암호문의 공간으로 보내는 비밀선형함수(s)로서 역함수가 존재하는 비밀선형함수(s)가 설정되며, 비밀키(K)가 정해진다.Security Arguments (

, A secret linear function (s) having an inverse function is set as a secret linear function (s) to be sent from a message space to a space of a cipher text in a linear space (C) of a cipher text and a linear space , And a secret key (K) are determined.

)을 생성하는 제3 단계와; 중앙 제어부가, 제3 단계에서 마스킹된 암호화 값에 대해서 선형 연산을 수행하여 암호화된 제어 신호(

)를 산출하는 제4 단계와; 복호화 모듈이 연산의 위변조를 검증하는 제5 단계를 포함한다.According to another aspect of the present invention, there is provided a method for judging forgery of a cryptographic operation, the method comprising: a first step of performing encoding such that the encryption module sends a message to a space of a ciphertext using a secret linear function (s); Second step of the encryption module corresponding to the unique number (id) is assigned to each message, the pseudo-random number function (F _K) a random element in the area of the ciphertext generated by using the secret key (K) and; The encryption module encrypts the encoding message generated in the first step by using a random element in the space of the cipher text generated in the second step,

); ≪ / RTI > The central control unit performs a linear operation on the encrypted value masked in the third step to generate an encrypted control signal

); And a fifth step in which the decryption module verifies the forgery and corruption of the operation.

The fifth step of verifying the forgery and falsification of the operation is the fifth step of verifying the forgery and falsification of the operation by using the pseudo random number function using the secret key K to associate the unique number id of each message with the random element in the space C of the ciphertext, Step 1; A fifth step of removing masking using the random element generated in step 5-1; Decrypting the control signal using an inverse function of the secret linear function; And a fifth step of verifying whether the value obtained by removing the masking in the step 5-2 is in the range of the secret linear function and outputting the decoded value in the step 5-3 only when the value is true.

으로, 메시지의 선형공간이

로 설정되면, 비밀선형함수(s)는

(A: 역행렬이 존재하는 k by k 행렬; H: (n-k) by k 행렬)가 될 수 있다.The linear space of a cipher

, The linear space of the message

, The secret linear function s is set to

(A: k by k matrix in which the inverse matrix exists, H: (nk) by k matrix).

)에 랜덤 벡터(

;

)를 더하거나 뺌으로써 암호화 값(

)을 생성하는 단계가 될 수 있고, 제4 단계의 암호화된 제어 신호(

)는

(f_j는 선형함수의 계수)에 의해 산출될 수 있다.The third step of the forgery and falsification method of the cipher text operation is the encoding of the encoded message

) To a random vector (

;

) To add or subtract the encryption value (

, And the encrypted control signal of the fourth step (step < RTI ID = 0.0 >

)

(f _j is a coefficient of a linear function).

로, 제3 단게에서 랜덤 벡터를 뺀 경우에는

에 의해서 마스킹을 제거하는 단계가 될 수 있다. 그리고 제5-3 단계에서 복호화값(

)은

에 의해 산출될 수 있고, 제5-4 단계에서 비밀함수의 치역에 있는지 여부를 검증하는 단계는,

가 참인지 여부를 판단하는 단계가 될 수 있다.Step 5-2, when the random vector is added in the third step,

, And when the random vector is subtracted from the third stage

The masking may be removed. In step 5-3, the decoded value (

)silver

And the step of verifying whether or not it is in the range of the secret function in step 5-4,

Quot; is < / RTI > true.

;

; G_K는 F_K와 같은 비밀키를 사용하는 의사 난수 함수)를 저장하는 제6 단계를 더 포함할 수 있다.According to another aspect of the present invention, there is provided a method of judging a forgery and falsification of a cryptographic operation,

;

; And G _K is a pseudo-random number function using a secret key such as F _K ).

)에 랜덤 벡터(

;

)를 더하거나 뺌으로써 암호화 값(

)을 생성하는 단계가 될 수 있고, 제4 단계의 암호화된 제어 신호(

)는

(f_j는 선형함수의 계수)에 의해 산출될 수 있다. 제5-2 단계는, 복호화 모듈이 의사 난수 함수(GK)를 이용하여 랜덤 벡터(

)를 산출하고, 제3 단계에서 랜덤 벡터를 더한 경우에는 검증 벡터(

)를 산출하고, 제3 단계에서 랜덤 벡터를 뺀 경우에는 검증 벡터(

)를 산출하는 단계가 될 수 있다. 제5-3 단계에서 복호화값(

)은

에 의해 산출될 수 있으며, 제5-4 단계에서 비밀함수의 치역에 있는지 여부를 검증하는 단계는,

가 참인지 여부를 판단하는 단계가 될 수 있다.The third step in this embodiment is to send the encoded message (

) To a random vector (

;

) To add or subtract the encryption value (

, And the encrypted control signal of the fourth step (step < RTI ID = 0.0 >

)

(f _j is a coefficient of a linear function). In step 5-2, the decryption module decrypts the random vector (GK) using the pseudo-random number function

In the case where a random vector is added in the third step, a verification vector (

). When the random vector is subtracted in the third step, the verification vector (

). ≪ / RTI > In step 5-3, the decoded value (

)silver

And verifying whether or not the secret function is in the range of the secret function in operation 5-4,

Quot; is < / RTI > true.

According to another embodiment of the present invention, the system may further include an operation unit. An additional operation unit for performing an operation necessary for encryption and the like is added when the calculation capability of the sensor unit or the encryption module is insufficient.

;

; G_K는 F_K와 같은 비밀키를 사용하는 의사 난수 함수)를 저장하는 제6 단계와; 연산부가 F_K와 G_K에 대해서 벡터값(

)을 산출하여 중앙 제어부에 전달하는 제7 단계를 더 포함할 수 있다.In the method of forging and falsifying a cryptographic operation according to this embodiment, when the encryption module is a random vector

;

; G _K is a pseudo-random number function using a secret key such as F _K ; The arithmetic operation is performed on the vector values F _k and G _K (

) To the central control unit.

)에 랜덤 벡터(

;

)를 더하거나 뺌으로써 암호화 값(

)을 생성하는 단계가 될 수 있고, 제4 단계의 암호화된 제어 신호(

)는

(f_j는 선형함수의 계수)에 의해 산출될 수 있다. 제5-2 단계는, 복호화 모듈이 의사 난수 함수(GK)를 이용하여 랜덤 벡터(

)를 산출하고, 제3 단계에서 랜덤 벡터를 더한 경우에는 검증 벡터(

)를 산출하고, 제3 단계에서 랜덤 벡터를 뺀 경우에는 검증 벡터(

)를 산출하는 단계가 될 수 있다. 제5-3 단계에서 복호화값(

)은

에 의해 산출될 수 있으며. 제5-4 단계에서 비밀함수의 치역에 있는지 여부를 검증하는 단계는,

가 참인지 여부를 판단하는 단계가 될 수 있다.The third step in this embodiment is to send the encoded message (

) To a random vector (

;

) To add or subtract the encryption value (

, And the encrypted control signal of the fourth step (step < RTI ID = 0.0 >

)

(f _j is a coefficient of a linear function). In step 5-2, the decryption module decrypts the random vector (GK) using the pseudo-random number function

In the case where a random vector is added in the third step, a verification vector (

). When the random vector is subtracted in the third step, the verification vector (

). ≪ / RTI > In step 5-3, the decoded value (

)silver

Lt; / RTI > The step of verifying whether or not the secret function is in the range of the secret function in operation 5-4,

Quot; is < / RTI > true.

According to the present invention, there is provided an effect that a forgery and falsification of a cipher text and an operation of the same-ciphered information can be determined and prevented in advance.

BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 shows an environment in which the invention is practiced. Fig.
2 is a flow chart of a verification method according to the present invention;
3 is a diagram showing another example of an environment in which the present invention is executed.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Encryption / decryption may be applied to the information (data) transmission process performed in the present specification, and expressions describing the process of transmitting information (data) in the present specification and claims are not limited to encryption / decryption Should be construed as including. Expressions of the form "transfer from A to B" or "receive from A" in this specification include transmission (transfer) or reception of another medium in between, It does not just represent transmission (forwarding) or receiving. In the description of the present invention, the order of each step should be understood to be non-limiting, unless the preceding step must be performed logically and temporally before the next step. That is to say, except for the exceptional cases mentioned above, even if the process described in the following stage is performed before the process described in the preceding stage, it does not affect the essence of the invention and the scope of the right should be defined regardless of the order of the stages. &Quot; A " or " B " is defined herein to mean not only selectively pointing to either A or B, but also including both A and B. It is also to be understood that the term "comprising " is intended to encompass further including other elements in addition to the elements listed as being included.

As used herein, the term "module" refers to a logical combination of general purpose hardware and software that performs its functions.

Only essential components necessary for explanation of the present invention are described in this specification, and components not related to the essence of the present invention are not mentioned. And should not be construed in an exclusive sense that includes only the recited elements, but should be interpreted in a non-exclusive sense to include other elements as well.

The present invention is implemented by an electronic computing device such as a computer capable of electronic computation, and the mathematical computation and computation of each step of the present invention to be described later can be applied to a coding method and / Lt; RTI ID = 0.0 &

As used herein, the term "value" is defined as the notion of a wide range of vectors and matrices as well as scalar values.

Fig. 1 shows an example of an environment in which the present invention is executed. The controlled device 1 includes a body portion 10, a driving portion 20, a driving control portion 30, and a sensor portion 40. The controlled device 1 may be, for example, a drone, an autonomous vehicle, or a plant. The body portion 10 is a portion that performs an electronic or mechanical operation by the operation of the driving portion 20. [ The driving unit 20 receives the control signal of the driving control unit 30 and provides an operation signal to the body 10. The sensor unit 40 is a part for collecting basic information for the operation of the controlled device 1. [ The basic information may be information that is collected through a sensor, such as a speed, an altitude, a temperature, and the like, and may be input when a control signal is generated.

The sensor unit 40 includes an encryption module 45. The encryption module 45 encrypts the basic information collected by the sensor unit 40 in the same manner. The basic information encrypted in the same format is transmitted to the central control unit 2 through the communication network 3.

The drive control unit 30 includes a decryption module 35. The decryption module 35 decrypts the encrypted control signal transmitted from the central control unit 2. [ As described later, it is possible to determine whether the encrypted control signal transmitted from the central control unit 2 is forged or not.

1, the basic information collected by the sensor unit 40 is transmitted to the central control unit 2 in the same encryption state, and the central control unit 2 performs calculation based on the same basic information that has been encrypted, The control signal can be generated. Since the central control unit 2 does not have a decryption key, even if a malicious hacker attacks the central control unit 2, it can not obtain basic information or decrypt the generated control signal.

However, there is a possibility that a third party takes the basic information provided in the same encrypted form, operates it in an encrypted state, and transmits the encrypted encrypted control signal to the drive control unit 30. Controlling the controlled device 1 by receiving such a forged control signal may cause a great danger or may be a threat to the controlled device 1. [

The present invention confirms whether a control signal is forged or falsified through a method as described below, and eliminates the danger or threat by not using the control signal when judged as a forged control signal. The present invention can also discriminate whether or not the cipher text itself is forged or altered.

FIG. 2 is a flowchart of a method for determining whether or not an operation is forged or falsified according to the present invention.

)에 따라서 암호문의 선형공간(C)와 메시지의 선형공간(M)이 정해지고, 메시지 공간(M)에서 암호문의 공간(C)으로 보내는 역함수가 존재하는 선형비밀함수(s) 및 비밀키(K)가 정해진다.Prior to execution of the forgery / alteration determination method,

The linear space C of the ciphertext and the linear space M of the message are determined in accordance with the secret key S and the linear secret function s and secret key s in which the inverse function is sent from the message space M to the space C of the ciphertext, K) is determined.

In determining the forgery of the ciphertext itself, a set of ciphertexts (C) and a set of messages (M) are defined, and a secret function (s) in which an inverse function is sent from the message set M to the set of ciphertexts The secret key K is determined.

로 정해지고, 메시지의 선형 공간은

로 정해질 수 있으며, 이 경우 선형비밀함수 s는 예를 들어 다음과 같이 정해질 수 있다.The linear space of a cipher

, And the linear space of the message is

, And in this case the linear secret function s can be defined, for example, as:

로 정해지고, 메시지의 선형 공간은

로 정해진다.When judging the forgery of the cipher text itself, a set of ciphertexts

, And the linear space of the message is

Respectively.

Secret matrix A: k by k matrix

The secret matrix H: (n-k) by k matrix

The secret function (s) when judging the forgery and falsification of the cipher text itself can be determined as shown in Equation (1).

)를 생성한다.In step 200, the encryption module 45 sends a message of the basic information collected by the sensor unit 40 to the linear space of the ciphertext (or the set when the ciphertext itself is judged to be fake) by using the secret function s Encode the encoded message (

).

If you use the above example secret function, the encoding message is generated as follows.

The encryption module 45 associates the unique ID of the message with the random vector generated using the pseudo-random number function F _K using the secret key K as follows (step 205).

A random vector is included in a set of ciphertexts or a linear space (C), and is expressed as "random element ".

The unique id of a message can be extracted in a large space with an extremely small probability of overlapping with each other as an arbitrary value assigned to each message.

F _K may be a hash function using the secret key K, and may use other known pseudo-random function. The id _j refers to the unique id number of the j-th message (m _j). The pseudo-random number function F _K is shared by the encryption module 45 and the decryption module 35.

)를 다음과 같이 생성한다.In step 210, the encoded message in step 200 is masked using the random vector generated in step 205 to generate an encrypted message

) Is generated as follows.

는 인코딩 메시지에 더해졌지만, 선형 연산이라면 다른 방식으로 예를 들어 인코딩 메시지에 뺄셈으로 연산하여 마스킹할 수도 있다.From the top masking

May be added to the encoding message, but may be masked in a different way if it is a linear operation, for example, by subtracting it from the encoding message.

)를 다음과 같이 산출한다(단계 215).Upon receiving the masked message, the central control unit 2 computes the encrypted message and generates a control signal

) Is calculated as follows (step 215).

는 제어신호의 생성을 위한 선형 함수 f의 계수를 의미한다.

Means the coefficient of the linear function f for generation of the control signal.

c 'is calculated as a control signal in the encrypted state, and then the central control unit 2 transmits the control signal to the drive control unit 30. [

The calculation of the control signal as described above is not indispensable when judging the forgery or falsification of the cipher text itself.

)를 생성하여, 메시지의 고유 번호(id)와 랜덤 벡터를 대응시킨다(단계 220).The decryption module 35 of the drive control unit 30 uses the same pseudo-random number function F _K as the encryption module 45 to generate a random vector

And associates a unique number (id) of the message with a random vector (step 220).

The decryption module 35 removes the masking as follows to calculate a verification vector (step 225).

)를 산출한다.If the masking is performed as shown in Equation (4), the masking is removed as follows and the verification vector

).

The masking may be performed as shown in Equation (7) instead of Equation (4).

)는 다음 수학식과 같이 산출된다.If this is the case,

) Is calculated according to the following equation.

)는 다음과 같이 산출할 수 있다.If the masking is determined as shown in Equation (4), a masking-free verification vector (

) Can be calculated as follows.

)는 다음과 같이 산출할 수 있다.If the masking is as shown in Equation 7,

) Can be calculated as follows.

The decryption module 35 calculates the plaintext control signal m 'by decoding the received encrypted control signal c' using the inverse function of the secret function s (step 230).

According to the above-described embodiment, the decoded control signal is calculated by the following equation.

가 아니라

이 입력되어 평문 메시지

으로 복호화된다.In the case of judging the forgery or falsification of the cipher text itself,

Not

This is a plain text message

.

)가 비밀함수(s)의 치역에 있는지 여부를 검증식을 통해서 확인하고(단계 235), 검증식이 참인 경우에만 복호화된 제어 신호를 출력해서 사용하며(단계 245), 검증식이 참이 아니면 제어 신호의 출력을 금지한다.Without using the calculated control signal directly, the verification vector (

(Step 235). If the verification expression is true, the decrypted control signal is output and used (step 245). If the verification expression is not true, the control signal Is prohibited.

)가 비밀함수(s)의 치역에 있는지 여부를 검증식을 통해서 확인하고, 검증식이 참인 경우에만 암호문의 위변조되지 않은 것으로 판단한다.In the case of judging the forgery or falsification of the cipher text itself,

) Is in the range of the secret function (s) through a verification formula, and judges that the ciphertext is not forged or falsified only when the verification expression is true.

According to an exemplary embodiment as described above, the verification equation is as follows.

The verification equation for judging the forgery or falsification of the cipher text itself is as follows.

If the third party seizes the basic information encrypted in the middle and transmits the forged control signal to the decryption module or forge the cipher text itself, the above verification equation (Expression 12 or Expression 13) can not be true .

In the above embodiment, the decryption module 35 needs to calculate the verification equation such as Equation 6 or 8, but in order to reduce the calculation amount of the decryption module 35 according to the design specification, the following modified embodiment may be considered have.

The amount of computation can be reduced by precomputing and storing the random vector corresponding to the message id that satisfies the following relation:

Here, G _K denotes a pseudo-random number function such as a hash function using the secret key K, and id denotes a unique value given to the control signal input to the decryption module 35.

)를 계산할 필요 없이 의사 난수 함수 G_K를 이용해서 제어 신호의 id에 대해서 랜덤 벡터(

)를 생성할 수 있다.In this embodiment, the decoding module 35, which receives the control signal,

) Of the control signal using the pseudo-random number function G _K without using the random vector (

Can be generated.

)를 다음과 같이 산출한다.The decryption module 35 decrypts the verification vector (

) Is calculated as follows.

)는

가 된다.Whether or not the verification vector exists in the range of the secret function, and outputs the decrypted control signal only when the verification vector is true. If the random vector is subtracted from the masking step,

)

.

)를 암호화 모듈(45)에 저장하여 마스킹에 사용하고, 복호화 모듈(35)은 매번 랜덤 벡터를 계산하지 않아도 되므로 효율적일 수 있다.If a limited number of control communications are performed, a random vector ("

) Is stored in the encryption module 45 and used for masking, and the decryption module 35 does not have to calculate the random vector every time, so it can be efficient.

When the computing module 45 has insufficient computing capability in this embodiment, a separate computing unit 50 is provided to allow the computing unit 50 to perform computation, and the computation result is transmitted to the central control unit 2, . ≪ / RTI > Such an embodiment is shown in Fig.

)를 산출하고, 이 값을 중앙 제어부(2)로 전달한다.In this embodiment, the arithmetic unit 50 receives basic information from the sensor unit 40, and calculates pseudo-random number functions F _K and G _K using the following equation

), And transfers this value to the central control unit 2.

In the above-described embodiment, the process of calculating the encrypted basic information message is according to Equation 5. In this embodiment, however, the central control unit 2 calculates the control signal through the following calculation.

The verification process is performed in the same manner as in the above embodiment.

According to the present invention, the matrices A and H constituting the secret function (s) are the secret matrix, and the k-dimensional message enters the secret space according to Equation (2).

로서 극히 낮은 확률이다. 따라서 비밀행렬을 알지 못하는 해커가 의도적으로 신호를 주입하거나 변조한 경우에는 랜덤 벡터를 이용한 마스킹을 제거했을 때 비밀 공간에 들어있지 않게 되고, 검증식을 통과할 수 없다.The probability that a hacker who does not know the matrices A and H can make an element on the secret space

Which is an extremely low probability. Therefore, when a hacker who does not know the secret matrix intentionally injects or modulates a signal, when the masking using the random vector is removed, it is not included in the secret space and can not pass the verification equation.

While the present invention has been described with reference to the accompanying drawings, it is to be understood that the scope of the present invention is defined by the claims that follow, and should not be construed as limited to the above-described embodiments and / or drawings. It is to be expressly understood that improvements, changes and modifications that are obvious to those skilled in the art are also within the scope of the present invention as set forth in the claims.

1: controlled device
2:
3: Network
10:
20:
30:
35: Decryption module
40:
45: Encryption module

Claims (7)

A system comprising an information collecting unit for collecting basic information, an encryption module for encrypting basic information, a decryption module for receiving and decrypting a ciphertext as a result value of the encryption module, and a body to be controlled based on the decrypted data, A method for determining whether a cipher text is forged or not,
Security Arguments (

A set of ciphertexts (C) and a set of messages (M) are defined in accordance with a set of ciphertexts and a secret function (s) having an inverse function is set as a secret function (s) K) is set,
A first step in which the encryption module performs encoding to send a message as a set of ciphertexts using a secret function (s)
The encryption module is a unique identifier (id) is assigned to a message, respectively, and a second step of corresponding the random element of the ciphertext set (C) of the produced by the pseudo-random number function (F _K) using the secret key (K) ,
The encryption module encrypts the encoding message generated in the first step by using the random element generated in the second step,

A third step of generating,
And a fourth step of the decryption module verifying the forgery and corruption of the ciphertext,
In the fourth step,
A fourth step of associating each unique number id of the message with a random element of the set of ciphertexts C using a pseudo-random number function using the secret key K,
A fourth step of removing masking using the random element generated in step 4-1,
A fourth step of decrypting the message using an inverse function of the secret function,
And a fourth step of verifying whether the value obtained by removing the masking in the step 4-2 is in the range of the secret function and outputting the decrypted value in the step 4-3 only when the value is true.
How to determine whether a ciphertext is corrupted or altered.
The method according to claim 1,
A set of ciphertext

, A set of messages

Lt; / RTI >
The secret function (s)

(A: k by k matrix in which the inverse matrix exists, H: (nk) by k matrix)
How to determine whether a ciphertext is corrupted or altered.
A decryption module for receiving and decoding the operation result value of the central control unit; and a decryption module for decrypting the received decryption result, A method for determining whether a calculation of a central control unit is forged or not in a system including a body part controlled based on data,
Security Arguments (

, A secret linear function (s) having an inverse function is set as a secret linear function (s) to be sent from a message space to a space of a cipher text in a linear space (C) of a cipher text and a linear space , In the environment where the secret key K is set,
A first step of the encoding module performing encoding to send the message to the space of the cipher text using the secret linear function (s)
And a second step of the encryption module corresponding to the unique number (id) is assigned to each message, the pseudo-random number function (F _K) a random element in the area of the ciphertext generated by using the secret key (K),
The encryption module encrypts the encoding message generated in the first step by using a random element in the space of the cipher text generated in the second step,

A third step of generating,
The central control unit performs a linear operation on the encrypted value masked in the third step to generate an encrypted control signal

);
And a fifth step of the decryption module verifying the forgery and alteration of the operation,
In the fifth step,
A fifth step of associating the unique number id of each message with a random element in the space C of the ciphertext using a pseudo-random number function using the secret key K,
A fifth step of removing masking using the random element generated in step 5-1,
Decrypting the control signal using an inverse function of the secret linear function;
And a fifth step of verifying whether the value obtained by removing the masking in the step 5-2 is in the range of the secret linear function and outputting the decoded value in the step 5-3 only when the value is true.
How to determine whether the operation is up / modulating.
The method of claim 3,
The linear space of a cipher

, The linear space of the message

Lt; / RTI >
The secret linear function (s)

(A: k by k matrix in which the inverse matrix exists, H: (nk) by k matrix)
How to determine whether the operation is up / modulating.
The method of claim 4,
The third step is to send the encoded message (

) To a random vector (

;

) To add or subtract the encryption value (

≪ / RTI >
The encrypted control signal of the fourth step (

)

(f _j is a coefficient of a linear function)
In operation 5-2,
When the random vector is added in the third step,

, And when the random vector is subtracted from the third stage

Removing the masking by means of the mask,
In step 5-3, the decoded value (

)silver

Lt; / RTI >
The step of verifying whether or not the secret function is in the range of the secret function in operation 5-4,

Is < RTI ID = 0.0 > true, < / RTI &
How to determine whether the operation is up / modulating.
The method of claim 4,
If the encryption module is a random vector (

;

; G _K is a pseudo-random number function using a secret key such as F _K )
The third step is to send the encoded message (

) To a random vector (

;

) To add or subtract the encryption value (

≪ / RTI >
The encrypted control signal of the fourth step (

)

(f _j is a coefficient of a linear function)
In operation 5-2,
Decryption module uses the pseudo-random number function (GK) to generate a random vector

In the case where a random vector is added in the third step, a verification vector (

). When the random vector is subtracted in the third step, the verification vector (

),
In step 5-3, the decoded value (

)silver

Lt; / RTI >
The step of verifying whether or not the secret function is in the range of the secret function in operation 5-4,

Is < RTI ID = 0.0 > true, < / RTI &
How to determine whether the operation is up / modulating.
The method of claim 4,
Wherein the system further comprises an operation unit,
If the encryption module is a random vector (

;

; G _K is a pseudo-random number function using a secret key such as F _K ,
The arithmetic operation is performed on the vector values F _k and G _K (

And a seventh step of transmitting the calculated value to the central control unit,
The third step is to send the encoded message (

) To a random vector (

;

) To add or subtract the encryption value (

≪ / RTI >
The encrypted control signal of the fourth step (

)

(f _j is a coefficient of a linear function)
In operation 5-2,
Decryption module uses the pseudo-random number function (GK) to generate a random vector

In the case where a random vector is added in the third step, a verification vector (

). When the random vector is subtracted in the third step, the verification vector (

),
In step 5-3, the decoded value (

)silver

Lt; / RTI >
The step of verifying whether or not the secret function is in the range of the secret function in operation 5-4,

Is < RTI ID = 0.0 > true, < / RTI &
How to determine whether the operation is up / modulating.

Images