KR20170074195A - Forward secure non-interactive key exchange method from indistinguishability obfuscation - Google Patents

Abstract

A non-interactive key exchange method is disclosed. The non-interactive key exchange method includes the steps of the server generating a public parameter that includes a first pseudorandom number generation function, a second pseudorandom number generation function and an obfuscation machine, the first terminal including a first initial private key and a first public key The second terminal generates a second initial private key and a second public key, the first terminal updates a first private key, which is a private key of the first terminal, and the second terminal, Updating the second private key, which is a private key of the second terminal, and the first terminal generating a first shared key using the second public key, the first private key and the system time, And the terminal generating the second shared key using the first public key, the second private key, and the system time.

Description

[0001] DESCRIPTION [0002] FORWARD SECURE NON-INTERACTIVE KEY EXCHANGE METHOD FROM INDISTINGUISHABILITY OBFUSCATION [

The embodiment according to the concept of the present invention relates to a non-interactive key exchange method, and more particularly to a key exchange method that satisfies forward security designed by indistinguishability obfuscation, To a non-interactive key exchange method capable of increasing system efficiency by minimizing management costs by eliminating public parameters for key update.

Indistinguishability obfuscation.

Obfuscation aims to design the program so that its internal operating procedures can not be grasped. The 'black box obfuscator', a powerful form of obfuscation, has proven to be impossible to design mathematically. What is defined in the later refined form is incomprehensible obfuscation. It is known that two obfuscated programs can not be distinguished when obfuscating two original programs that perform the same function by using incompatible sexually obfuscation. Recently, researches on the development of cryptographic primitive using indiscriminatable obfuscation are actively underway in the academic world.

Non-interactive Key Exchange.

The non-interactive key exchange scheme can exchange keys without any additional transmission, assuming that the other party's public key is known. In the absence of representative objects or entities for key exchange, the overall throughput within a system for performing a generic key exchange is proportional to the square of the number of users. In addition, even when the public key and the private key are updated for maintenance and repair of security in the system, the transmission amount for key exchange has a continuous influence on the transmission efficiency in the system. Therefore, reducing the number of transmissions and transmissions contributes greatly to the efficiency of the system. In particular, non-interactive key exchange is a key exchange protocol that can be used for environments that are subject to full traffic in the system or sensitive to the number of transmissions because it is possible to exchange keys without prior transmission.

Forward secrecy.

The forward security in key exchange means that the security of the session key established before the user's private key is guaranteed is guaranteed.

In an existing key exchange scheme, users must create an ephemeral private key and an ephemeral public key before exchanging keys to satisfy the forward security. And exchanges the temporary key information with the session key generation process. Therefore, even if the user's private key is exposed, the attacker can not guess the session key information if he / she does not know the temporary private key used in the previous session key.

In the non-interactive key exchange, which requires no pre-transmission, the private key is updated periodically at a predetermined period in order to satisfy the forward safety, so that even if the private key after the update is exposed, If the key is not known, the session key information can not be inferred.

Pointcheval et al. (Forward Secure Non-Interactive Key Exchange).

의 사이즈를 갖는다.Pointcheval et al. Proposed a non - interactive key exchange scheme that satisfies all - directional security. Pointcheval et al. Proposed a method using a multilinear map to update the user 's private key to satisfy the forward safety. In this technique, the lifetime of the system is fixed. When N is the lifetime of the system, the public parameters for updating the private key are

.

D. Pointcheval and O. Sanders, Forward Secure Non-Interactive Key Exchange, 9th International Conference on Security and Cryptography for Networks (SCN `14), LNCS 8642, pages 21-39. (2014)

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it is an object of the present invention to provide a non-interactive key exchange method that maximizes efficiency by eliminating system lifetime constraints of a non-interactive key exchange technology satisfying all-directional safety and minimizing disclosure parameters.

A non-interactive key exchange method according to an embodiment of the present invention includes: generating a public parameter including a first pseudo random number generation function, a second pseudo random number generation function, and an obfuscation machine; Generating a first private key and a first public key, generating a second initial private key and a second public key by the second terminal, updating the first private key, which is the private key of the first terminal, , The second terminal updating a second private key that is a private key of the second terminal, and the first terminal transmitting the first public key, the first private key, And the second terminal generating the second shared key using the first public key, the second private key, and the system time.

A non-interactive key exchange method according to another embodiment of the present invention includes the steps of: a first terminal generating a first initial private key and a first public key; And generating the shared key using the second public key, the first private key and the time information of the second terminal received from the second terminal, 1 public key is generated by the first terminal creating a first shared key generation program and causing the first terminal to obfuscate the first shared key generation program using the obfuscation machine included in the disclosure parameters disclosed by the server Wherein the first shared key generating program is an obfuscated first shared key generating program generated through a step of generating a shared key.

According to the non-interactive key exchange method according to the embodiment of the present invention, the transmission efficiency can be increased by minimizing the transmission amount in the key exchange, and it is possible to perform the pre-operation without the response of the other party by the non-interactive key exchange protocol .

In addition, according to the present invention, it is possible to minimize the damage in case of a security incident by satisfying all-directional safety, and there is no restriction on the life span of the system, and there is no disclosure parameter for updating the private key.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In order to more fully understand the drawings recited in the detailed description of the present invention, a detailed description of each drawing is provided.
1 shows an example of a shared key generation program generated by a user terminal.
FIG. 2 illustrates a non-interactive key exchange system according to an embodiment of the present invention.
3 is a functional block diagram of the first terminal shown in FIG.
4 is a flowchart illustrating a key exchange method performed on the non-interactive key exchange system shown in FIG.

It is to be understood that the specific structural or functional description of embodiments of the present invention disclosed herein is for illustrative purposes only and is not intended to limit the scope of the inventive concept But may be embodied in many different forms and is not limited to the embodiments set forth herein.

The embodiments according to the concept of the present invention can make various changes and can take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. It should be understood, however, that it is not intended to limit the embodiments according to the concepts of the present invention to the particular forms disclosed, but includes all modifications, equivalents, or alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example, without departing from the scope of the right according to the concept of the present invention, the first element may be referred to as a second element, The component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like are used to specify that there are features, numbers, steps, operations, elements, parts or combinations thereof described herein, But do not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings attached hereto.

First, the algorithm used in the non-interactive key exchange method according to an embodiment of the present invention is as follows.

알고리즘은 시스템 관리자가 공개 파라미터를 생성하는 알고리즘이다.One.

The algorithm is an algorithm in which system administrators generate public parameters.

알고리즘은 사용자가 시스템 공개 파라미터로부터 자신의 초기 개인키와 공개키(난독화된 프로그램

)를 생성하는 알고리즘이다.2.

The algorithm allows the user to determine from his system public parameters his initial private key and public key (obfuscated program

). ≪ / RTI >

알고리즘은 사용자가 자신의 개인키를 시스템 시간(Time Period)에 따라 업데이트하는 알고리즘이다.3.

The algorithm is an algorithm in which a user updates his / her private key according to a system time period.

알고리즘은 상대방과의 공유키를 생성하는 알고리즘으로 상대방의 공개키와 자신의 개인키 그리고 당시의 시스템 시간 정보를 통해 공유키를 계산한다. 이 때 자신이 생성한 공유키와 상대방이 생성한 공유키가 동일하여야 한다.4.

The algorithm is an algorithm that generates a shared key with the other party. It computes the shared key through the public key of the other party, its own private key, and the system time information at that time. At this time, the shared key generated by the user and the shared key generated by the other party should be the same.

Hereinafter, specific operations for each algorithm (or each step) will be described in detail.

1. Setup Steps

)을 수행하여 두 종류의 의사 난수 생성기(Pseudo Random Generator) 또는 의사 난수 생성 함수를 생성한다. 상기 의사 난수 생성 함수는 제1 의사 난수 생성 함수(

)와 제2 의사 난수 생성 함수(

)를 포함할 수 있다. 그리고, 상기 시스템 관리자는 구분불가능성 난독화 머신(

)을 생성한다. 상기 구분불가능성 난독화 머신은 구분불가능성 난독화 프로그램으로 명명될 수도 있다.The system administrator can use the configuration step or configuration algorithm (

) To generate two kinds of pseudo random number generators or pseudo random number generation functions. Wherein the pseudo-random number generation function is a first pseudo-random number generation function

) And a second pseudo-random number generation function (

). And, the system administrator can use the machine which can not distinguish the obfuscation machine (

). The indiscriminatory obfuscation machine may be called an indistinguishable obfuscation program.

), 상기 제2 의사 난수 생성 함수(

) 및 상기 구분불가능성 난독화 머신(

)을 시스템 파라미터(

)로 설정하고 시스템 파라미터(

)를 사용자들에게 공개할 수 있다. 상기 시스템 파라미터(

)는 공개 파라미터로 명명될 수도 있다.Wherein the system manager is operable to generate the first pseudo-random number generation function (

), The second pseudo-random number generation function (

) And the non-distinguishable obfuscation machine (

) To the system parameters (

) And set the system parameter (

) To the users. The system parameters (

) May be named as a public parameter.

2. Key generation step

는 키 생성 단계 또는 키 생성 알고리즘(

)을 수행하여 초기 개인키와 공개키를 생성한다. 알고리즘의 구체적인 과정은 다음과 같다. 사용자

는 초기 개인키

를 생성하고 도 1에 도시된 바와 같은 공유키 생성 프로그램(

)을 생성한다.user

Is a key generation step or a key generation algorithm (

) To generate an initial private key and a public key. The concrete procedure of the algorithm is as follows. user

The initial private key

And generates a shared key generation program (FIG. 1)

).

가 생성한 공유키 생성 프로그램(

)은 다른 사용자들의 개인키(

)와 시스템 시간(

)을 입력으로 공유키(

)를 계산한다. 다음으로, 사용자

는 생성한 공유키 프로그램을 구분불가능성 난독화 머신을 사용하여 난독화한다. 난독화된 공유키 생성 프로그램(

)은 사용자

의 공개키로 사용된다.user

The shared key generation program (

) Is the private key of other users (

) And system time (

) As a shared key (

). Next,

Obfuscates the generated shared key program using an indistinguishable obfuscated machine. Obfuscated shared key generator (

) Is a user

Is used as a public key.

3. Update steps

) 모든 사용자들은 자신의 개인키를 업데이트 단계 또는 업데이트 알고리즘(

)을 수행하여 업데이트한다. 개인키 업데이트 알고리즘은 다음과 같다. 이전 시간의 개인키를 입력으로 의사 난수 생성 함수를 연산한 결과를 다음 시간의 개인키로 사용한다. 즉,

. 이때 사용되는 의사 난수 생성 함수는 시스템 파라미터(

)에 포함된 제1 의사 난수 생성 함수이거나 제2 의사 난수 생성 함수일 수 있으나, 키를 교환하는 양 당사가가 동일한 난수 생성 함수를 사용하여야 한다.Every time the system changes time (

) Every user has his or her private key in the update phase or update algorithm (

). The private key update algorithm is as follows. Input the private key of the previous time, and use the result of the operation of the pseudo-random number generation function as the private key of the next time. In other words,

. The pseudo-random number generation function used in this case is a system parameter

) Or a second pseudo-random number generation function, but both parties exchanging keys must use the same random number generation function.

4. Shared key generation step

는 사용자

의 공개키(난독화된 프로그램

)에 자신의 개인키

와 시간 정보

를 입력으로 계산하여 결과값

을 시간

에서의 공유키로 사용한다.user

User

Public key (obfuscated program

) To his private key

And time information

Is calculated as an input, and the resultant value

Time

As shown in FIG.

Correctness

가 사용자

의 공개키와 자신의 개인키 그리고 시간 정보

를 입력으로 계산한 공유키 값이다.Here are the users

User

≪ / RTI > public key < RTI ID = 0.0 >

Is a shared key value calculated as an input.

가 사용자

의 공개키와 자신의 개인키 그리고 시간 정보

를 입력으로 계산한 공유키 값이다.Here are the users

User

≪ / RTI > public key < RTI ID = 0.0 >

Is a shared key value calculated as an input.

Eventually, both users can generate the same shared key.

2 shows a key exchange system according to an embodiment of the present invention.

Referring to FIG. 2, the key exchange system 10 includes a server 100, a first terminal 300, and a second terminal 500. Although only two terminals are shown in FIG. 2, the key exchange system may include two or more terminals.

)를 생성하고 생성된 시스템 파라미터(

)를 공개할 수 있다. 실시 예에 따라 시스템 파라미터(

)는 서버(100)에 의해 제1 단말기(300)와 제2 단말기(500)로 송신될 수도 있다.The server 100, which may be referred to as a configuration server or the like, performs a configuration step or a configuration algorithm to determine system parameters (or public parameters,

) And generates the generated system parameters (

). The system parameters (< RTI ID = 0.0 >

May be transmitted by the server 100 to the first terminal 300 and the second terminal 500.

Each of the first terminal 300 and the second terminal 500 generates an initial private key and a public key using a key generation algorithm, updates a private key using an update algorithm, Key can be generated.

The first terminal 300 and the second terminal 500 may be a personal computer, a tablet PC, a notebook, a net-book, an e-reader, a personal digital assistant assistant, a portable multimedia player (PMP), an MP3 player, an MP4 player, or a handheld device such as a mobile phone or a smart phone .

3 is a functional block diagram of the first terminal shown in FIG.

1 to 3, the first terminal 300 includes a key generation unit 310, a shared key generation unit 330, and an update unit 350.

)와 공개키를 생성한다. 상기 공개키는 난독화된 프로그램으로써 소정의 입력에 대응하는 공유키를 출력할 수 있다. 즉, 상기 공개키는 도 1에 의해 정의되는 공유키 생성 프로그램을 시스템 파라미터(

)에 포함된 난독화 머신(

)을 이용한 난독화 동작의 결과이다. 생성된 공개키는 키 생성부(310)에 의해 제2 단말기(500)로 송신될 수 있다.The key generation unit 310 performs a key generation step or a key generation algorithm to generate an initial private key of the first terminal 300

) And a public key. The public key may be an obfuscated program and may output a shared key corresponding to a predetermined input. That is, the public key stores the shared key generation program defined by FIG. 1 as a system parameter

) Included in the obfuscation machine (

). ≪ / RTI > The generated public key may be transmitted to the second terminal 500 by the key generation unit 310.

The shared key generating unit 330 may generate the shared key using the shared key generating step or the shared key generating algorithm. That is, the shared key generation unit 330 may generate the shared key by inputting the private key of the first terminal 300 and the system time information to the public key of the second terminal received from the second terminal 500 .

The update unit 350 may update the private key of the first terminal 300 according to the system time using an update step or an update algorithm.

Each of the configurations of the first terminal 300 shown in FIG. 3 indicates that it is functionally and logically separable, and does not necessarily mean that each configuration is divided into separate physical devices or written in separate codes. May be easily deduced by the average expert in the field of the present invention.

Also, in this specification, "part" may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, the module may mean a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and does not necessarily mean a physically connected code or a kind of hardware.

The function and structure of the second terminal 500 are the same as those of the first terminal 300, and a detailed description thereof will be omitted.

4 is a flowchart illustrating a key exchange method performed on the key exchange system shown in FIG.

)를 생성하고(S100), 생성된 시스템 파라미터(

)를 공개하거나 제1 단말기(300) 또는 제2 단말기(500)로 송신할 수 있다(S120).The server 100 uses the setting algorithm to determine the system parameters (

(S100), and generates the generated system parameter (

May be disclosed or transmitted to the first terminal 300 or the second terminal 500 (S120).

)를 이용하여 공개키를 생성하고(S220, S320), 생성된 공개키를 교환할 수 있다(S240, S340). 즉 제1 단말기(300)는 제1 단말기의 공개키를 공개하거나 제2 단말기(500)로 송신하고, 제2 단말기(500)는 제2 단말기의 공개키를 공개하거나 제1 단말기(300)로 송신할 수 있다.Each of the first terminal 300 and the second terminal 500 can generate an initial private key (S200, S300). In addition, each of the first terminal 300 and the second terminal 500 includes a system parameter

(S220, S320), and the generated public key can be exchanged (S240, S340). That is, the first terminal 300 discloses the public key of the first terminal or transmits the public key of the first terminal to the second terminal 500, the second terminal 500 discloses the public key of the second terminal, Can be transmitted.

Next, each of the first terminal 300 and the second terminal 500 may generate a shared key by performing a shared key generation algorithm (S260, S360). At this time, the shared key generated by the first terminal 300 and the shared key generated by the second terminal 500 are the same.

Also, each of the first terminal 300 and the second terminal 500 may periodically update the private key using an update algorithm. According to an embodiment, the operation of updating the private key may be performed prior to the operation of generating the shared key.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

100: Server
300: first terminal
310:
330: Shared key generation unit
350: Update section
500: second terminal

Claims (6)

Generating a public parameter including a first pseudorandom number generation function, a second pseudo random number generation function and an obfuscation machine;
The first terminal generating a first initial private key and a first public key, and the second terminal generating a second initial private key and a second public key;
Updating the first private key of the first terminal by the first terminal and updating the second private key of the second terminal by the second terminal; And
Wherein the first terminal generates the first public key using the second public key, the first private key and the system time, and the second terminal generates the first public key, the second private key, And generating a second shared key using the second shared key.
Non - interactive key exchange method.
The method according to claim 1,
Wherein the first public key comprises:
Generating a first shared key generation program by the first terminal; And
Wherein the first terminal is an obfuscated first shared key generation program generated through obfuscation of the first shared key generation program using the obfuscation machine,
Wherein the second public key comprises:
Generating a second shared key generation program by the second terminal; And
Wherein the second terminal is an obfuscated second shared key generation program generated through obfuscation of the second shared key generation program using the obfuscation machine,
Non - interactive key exchange method.
The method according to claim 1,
Wherein the first terminal updates the first private key using the first pseudo-random number generating function or the second pseudo random number generating function,
Wherein the second terminal updates the second private key using the first pseudorandom number generation function or the second pseudorandom number generation function,
Non - interactive key exchange method.
The first terminal generating a first initial private key and a first public key;
The first terminal updating a first private key that is a private key of the first terminal; And
The first terminal generating a shared key using the second public key of the second terminal, the first private key, and the time information received from the second terminal,
Wherein the first public key comprises:
Generating a first shared key generation program by the first terminal; And
Wherein the first terminal is an obfuscated first shared key generation program generated through obfuscation of the first shared key generation program using an obfuscation machine included in a public parameter disclosed by the server,
Non - interactive key exchange method.
5. The method of claim 4,
Wherein the disclosure parameter comprises a first pseudorandom number generation function, a second pseudo random number generation function and the obfuscation machine,
Wherein the first terminal updates the first private key by calculating the first pseudo-random number generating function or the second pseudo random number generating function with the first private key as an input,
Non - interactive key exchange method.
5. The method of claim 4,
Wherein the second public key comprises:
Generating a second shared key generation program by the second terminal; And
Wherein the second terminal is an obfuscated first shared key generation program generated through obfuscation of the first shared key generation program using the obfuscation machine,
Non - interactive key exchange method.

Images