Reverse firewall method suitable for broadcast encryption

Abstract

The invention discloses a reverse firewall method suitable for broadcast encryption, and belongs to the technical field of information security. According to the method provided by the invention, the backdoor attack is resisted by deploying the reverse firewall at the key generation center KGC and the encryptor in the broadcast encryption protocol. The method comprises the specific steps that firstly, a KGC initializes system public parameters, rerandomizes the system public parameters and broadcasts the system public parameters to all participants, and the participants comprise an encryptor and a decryptor; secondly, the KGC generates a key pair of the encryptor and the decryptor; then, the encryptor runs an encryption algorithm by using the re-randomized public parameter and the decryptor set to generate a ciphertext, re-randomizes the header of the ciphertext and sends the re-randomized header to the decryptor; and finally, if the decryptor is in the selected set, decrypting by using the public parameter, the ciphertext header and the private key to calculate the session key, and ensuring that the privacy information of the participant is not leaked to the attacker, thereby realizing the privacy leakage prevention of the overall broadcast encryption method.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a reverse firewall method suitable for broadcast encryption. Background Art

[0002] Internal attacks can not only steal a large amount of user privacy, but are also extremely difficult to be detected by third-party professional organizations. By tampering with the cryptographic algorithm and implanting a backdoor, the security of the algorithm can be destroyed, resulting in the leakage of private information and enabling extensive monitoring around the world. Researchers have found that this type of attack method has a non-negligible probability advantage in breaking various cryptographic algorithms, including encryption, digital signatures, and key exchange, showing its extremely high harmfulness.

[0003] In order to successfully resist such attacks, scholars have proposed the concept of "cryptographic reverse firewall". The reverse firewall can not only maintain the security and functionality of the original protocol, but also has the property of preventing leakage. In addition, the reverse firewall is a transparent and "untrusted" third party. "Untrusted" means that the reverse firewall can only process the user's public in and out information, but the algorithm of the reverse firewall has not been subverted by internal attackers.

[0004] As the amount of data increases, users tend to outsource data to cloud servers. How to ensure data privacy on the public cloud has become an urgent problem to be solved. Broadcast encryption provides an efficient method for multi-user data sharing and is widely used in fields such as pay TV, digital copyright protection and blockchain. Fiat et al. [Broadcast encryption [C]. Advances in Cryptology–CRYPTO 1993, Springer: 480-491.] proposed the concept of broadcast encryption. Broadcast encryption is an encryption technology that supports secure sharing of multi-user data on an insecure public channel and is suitable for one-to-many secure transmission scenarios. The working method of broadcast encryption is as follows: the data owner first selects a group of receivers, runs the broadcast encryption algorithm, and publishes the encrypted ciphertext to the public channel. All users who monitor the channel can obtain the ciphertext, but only authorized users can use the decryption key to correctly decrypt it, and unauthorized users cannot obtain any plaintext information from the ciphertext. Due to the large limitations of symmetric broadcast encryption, research on broadcast encryption in recent years has mainly focused on public key broadcast encryption. Naor et al. [Efficient trace and revoke schemes [C]. Financial Cryptography 2000, Springer: 1-20.] first proposed the concept of public key broadcast encryption (PKBE). In 2002, Dodis et al. [Public key broadcast encryption for stateless receivers, in Digital Rights Management [C]. ACM CCS-9 Workshop 2002 Revised Papers. Springer: 61–80.] applied the subset difference method to provide a conversion from symmetric broadcast encryption to public key broadcast encryption. In addition, the paper also proposed a public key broadcast encryption scheme with a fixed-length public key. Boneh et al. [Collusion resistant broadcast encryption with short ciphertexts and privatekeys [C]. Advances in Cryptology–CRYPTO 2005, Springer: 258–275.] used bilinear technology to propose the first public key broadcast encryption scheme that is completely resistant to collusion, namely the BWG scheme. In the first scheme they proposed, the length of the ciphertext and private key is fixed, but the length of the public key grows linearly with the number of data recipients. The second scheme has a sublinear size of the ciphertext and public key lengths.

[0005] Bellare et al. [Security of Symmetric Encryption against MassSurveillance[C].Advances in Cryptology–CRYPTO 2014,Springer:1-19.] mainly studied the resistance of symmetric encryption schemes to surveillance behavior in large-scale surveillance. The article focuses on algorithm substitution attacks (ASA), that is, replacing the real encryption algorithm with a tampered encryption algorithm. Bellare et al. [Mass-surveillancewithout the State:Strongly Undetectable Algorithm-Substitution Attacks.[C]Computer and Communications Security 2015,ACM:1431–1440.] proposed new ASA attack methods that are more powerful than previous attacks. The article points out that previous attacks can only destroy randomization schemes with specific properties, while the new attack can destroy all randomization schemes. In addition, the new attack is stateless and meets the standard of strong undetectability. This shows that ASA is a more threatening attack than previously thought.

[0006] In order to solve this problem, Mironov et al. [Cryptographic reverse firewalls [C]. Advances in Cryptology–EUROCRYPT 2015, Springer: 657-686.] first proposed the concept of Cryptographic Reverse Firewalls (CRF) and defined three properties that reverse firewalls need to have: maintaining functionality, retaining security, and preventing leakage. Maintaining functionality means that the reverse firewall can achieve anti-subversion attack without changing the original algorithm function by re-randomizing the transmitted information. Retaining security means that the scheme after adding the reverse firewall retains the security characteristics of the original underlying protocol. Preventing leakage means that the user sends information implanted with a backdoor, but the reverse firewall can make the backdoor invalid. In addition, the reverse firewall should be "transparent" to the participants of the cryptographic protocol, that is, the reverse firewall has no effect on the function of the underlying cryptographic scheme. In addition, the reverse firewall should also be semi-honest, that is, the reverse firewall runs the algorithm honestly but should not know the user's privacy.

[0007] However, the existing broadcast encryption methods cannot guarantee the security of private information under the threat of backdoor attacks. Therefore, it is necessary to propose a reverse firewall method based on broadcast encryption to solve this problem. Summary of the invention

[0008] The purpose of the present invention is to realize a reverse firewall method suitable for broadcast encryption to enhance the ability of broadcast encryption to resist backdoor attacks.

[0009] The technical solution adopted by the present invention is:

[0010] A reverse firewall method applicable to broadcast encryption, the method comprising the following steps:

[0011] Step 1: The key generation center KGC initializes the system public parameters, and re-randomizes the system public parameters based on the reverse firewall deployed on the KGC and broadcasts them to all participants, including encryptors and decryptors;

[0012] Step 2: KGC generates a key pair for the encryptor and decryptor, and then returns the private key to the decryptor;

[0013] Step 3: The reverse firewall deployed on the encryptor side re-randomizes the broadcast system public parameters. The encryptor then runs the encryption algorithm based on the re-randomized system public parameters, the decryptor set and the message to be encrypted to generate the ciphertext and sends it to the decryptor. The generated ciphertext header is re-randomized based on the reverse firewall deployed on the encryptor side, and the re-randomized ciphertext header is sent to the decryptor.

[0014] Step 4: The decryptor in the decryptor set calculates the session key based on the system public parameters, the ciphertext header and its own private key; and decrypts the received ciphertext based on the session key.

[0015] Furthermore, in step 4, decryption result feedback is also included, that is, correct plaintext data is output or an identifier representing a decryption failure, such as ⊥.

[0016] Furthermore, the KGC initialization system specifically includes:

[0017] Input the system security parameter λ and the maximum number of decryptors n that the system can accommodate, KGC selects the cyclic multiplicative groups G1 and G2 with prime order p and the bilinear map e:G1×G1→G2.

[0018] KGC generates random numbers and As the master private key MSK of KGC, Represents a finite field Z p = {0, 1, ..., p-1} remove zero to obtain the finite field, and calculate the parameter v = gγ , where i∈[n]∪(n+1,2n], [n] represents the set [1,n]. After that, KGC sets the public parameters PP={G1,G2,e,p,v,g,g i}, and send the public parameter PP to the reverse firewall W deployed on KGC KGC .

[0019] Furthermore, based on the reverse firewall W deployed on KGC KGC The specific steps for re-randomizing the system public parameters are as follows:

[0020] Reverse Firewall KGC After receiving the public parameters PP, the public parameters PP are re-randomized. KGC Uniformly randomly select random numbers Re-randomization g' = g f , v'=v f , where i∈[n]∪(n+1,2n], [n] represents the set [1,n], thus obtaining the re-randomized public parameter PP', and the re-randomized public parameter PP'={v',g',g i '}Sent to all participants (including KGC) at the same time.

[0021] Furthermore, step 2 specifically includes:

[0022] KGC gets the reverse firewall W KGC After re-randomizing the public parameter PP', use the parameter g i ' and γ calculate the decryptor's private key Where i represents a decryptor, i∈[1,n], and the decryptor's private key d i Sent to the corresponding decryptor.

[0023] Furthermore, in step 3, firewall W Enc The re-randomization algorithm and the encryptor running the encryption algorithm based on the re-randomized system public parameters, the decryptor set and the message to be encrypted to generate the ciphertext specifically include:

[0024] (1) Reverse firewall W deployed on the encryption side Enc After obtaining the re-randomized public parameter PP', the re-randomized public parameter PP' is re-randomized again. Enc Uniformly randomly select random numbers And save β, use β to re-randomize g" = g' β ,v"=v' β , where i∈[n]∪(n+1,2n], [n] represents the set [1,n], and the public parameter PP”={v”,g”,g i ”}, and the public parameter PP” after the second re-randomization is i ”} is sent to the encryptor.

[0025] (2) The encryptor generates a random number Then, the session key K = e(g"1, g" is calculated by combining the parameters in the public parameter PP" after the second re-randomization. n ) t , and calculate the parameter C0=g in the ciphertext header H=(C0,C1)" t and C1=(v”·Π j∈S g” n+1-j ) t , where S is the set of authorized decryptors, and outputs the ciphertext header H = (C0, C1) to the reverse firewall W Enc .

[0026] Furthermore, in step 3, based on the reverse firewall W deployed on the encryptor side Enc The re-randomization of the generated ciphertext header specifically includes:

[0027] Reverse Firewall Enc Re-randomize using the previously saved random number β The re-randomized ciphertext header H'=(C'0, C'1) is obtained and output to the decryptor.

[0028] Furthermore, step 4 specifically includes:

[0029] The decryptor uses its corresponding private key d i , re-randomized ciphertext header H', and use the re-randomized public parameter PP' to calculate the session key K = e(g i ',C'1) / e(d i ·Π j∈S,j≠i g n+1-j+i ,C'0), where i represents the decryptor.

[0030] The decryptor uses the key K to run the decryption algorithm to decrypt the ciphertext and output the correct plaintext data or an identifier indicating a decryption failure, such as ⊥.

[0031] The technical solution provided by the present invention brings at least the following beneficial effects:

[0032] The present invention is a reverse firewall method suitable for broadcast encryption, which builds a reverse firewall for the key generation center and encryptor in the protocol, thereby ensuring that even if there is an internal attacker, the privacy of all participants will not be leaked when a backdoor is embedded in the algorithm. The method of the present invention enhances the ability of broadcast encryption to resist backdoor attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0034] Figure 1 A schematic diagram of a processing process of a reverse firewall method applicable to broadcast encryption provided by an embodiment of the present invention;

[0035] Figure 2 This is a flow chart of system common parameters initialized in an embodiment of the present invention;

[0036] Figure 3 The flowchart of key generation, encryption and decryption in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] To make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described in detail and completely in conjunction with the drawings in the implementation of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings can be arranged and designed using different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present invention.

[0038] The specific implementation process of a reverse firewall method applicable to broadcast encryption provided by an embodiment of the present invention includes:

[0039] KGC sets the master private key MSK of KGC to generate the public parameter PP, such as Figure 1 As shown in Figure 1, KGC's reverse firewall re-randomizes the public parameter to PP' and sends the re-randomized public parameter PP' to all participants; after that, KGC uses the re-randomized public parameter PP' to generate the private key and sends it to the corresponding decryptor. Even if KGC uses an initialization algorithm with a backdoor, the re-randomization of KGC's reverse firewall makes it impossible for attackers to distinguish between KGC's honest behavior and subversive behavior, let alone extract privacy from it.

[0040] also, Figure 1 The reverse firewall W deployed on the encryptor is also shown. Enc The operating mechanism of W Enc The ciphertext header generated by the encryptor is re-randomized. Due to the re-randomization of the cryptographic reverse firewall, it is ensured that even if the encryptor uses a random number generator with a backdoor, the internal attacker cannot extract any private information about the encryptor from the re-randomized message. The method proposed in the embodiment of the present invention is resistant to leakage. Even if any party (KGC, encryptor, decryptor) is embedded with a backdoor, the private information of the participants in the protocol will not be leaked.

[0041] In one embodiment, see Figure 1 , Figure 2 and Figure 3 The specific implementation steps of a reverse firewall method suitable for broadcast encryption provided by an embodiment of the present invention include:

[0042] (1) Initialization:

[0043] (1.1) Input the system security parameter λ and the maximum number of decryptors n that the system can accommodate. KGC selects the cyclic multiplicative groups G1 and G2 with prime order p and the bilinear map e:G1×G1→G2.

[0044] (1.2) KGC generates random numbers and As the master private key MSK of KGC, Represents a finite field Z p = {0, 1, ..., p-1} remove zero to obtain the finite field, and calculate the parameter v = g γ , where i∈[n]∪(n+1,2n], [n] represents the set [1,n]. After that, KGC sets the public parameters PP={G1,G2,e,p,v,g,g i}, and send the public parameter PP to the reverse firewall W deployed on KGC KGC .

[0045] (1.3) Reverse Firewall W KGC After receiving the public parameters PP, the public parameters PP are re-randomized. KGC Uniformly randomly select random numbers Re-randomization g' = g f , v'=v f , where i∈[n]∪(n+1,2n], [n] represents the set [1,n], thus obtaining the re-randomized PP', and re-randomizing PP'={v',g',g i'}Sent to all parties involved in the agreement (including KGC) at the same time.

[0046] (2) Key generation:

[0047] (2.1) KGC obtains the reverse firewall W KGC After re-randomizing the public parameter PP', use the parameter g' I and γ to calculate the decryptor's private key Where i represents a decryptor, i∈[1,n], and the decryptor's private key d i Sent to the corresponding decryptor.

[0048] (3) Encryption:

[0049] (3.1) Reverse firewall W deployed on the encryption side Enc After obtaining the re-randomized public parameter PP', the re-randomized public parameter PP' is re-randomized again. Enc Uniformly randomly select random numbers And save β, use β to re-randomize g" = g' β ,v"=v' β , where i∈[n]∪(n+1,2n], [n] represents the set [1,n], and the public parameter PP”={v”,g”,g i ”}, and send the twice-randomized public parameter PP” to the encryptor.

[0050] (3.2) The encryptor generates a random number Then, the session key K = e(g"1, g" is calculated by combining the parameters in the twice-randomized public parameter PP" n ) t , and calculate the parameter C0=g in the ciphertext header H=(C0,C1)" t and C1=(v”·Π j∈S g” n+1-j ) t , where S is the set of authorized decryptors, and outputs the ciphertext header H = (C0, C1) to the reverse firewall W Enc .

[0051] (3.3) Reverse Firewall W Enc Re-randomize using the previously saved random number β The re-randomized ciphertext header H'=(C'0, C'1) is obtained and output to the decryptor.

[0052] (4) Decryption

[0053] (4.1) The decryptor uses its corresponding private key di , re-randomized ciphertext header H', using the re-randomized public parameter PP' to calculate the session key K = e(g i ',C'1) / e(d i ·Π j∈S,j≠i g n+1-j+i ,C'0), where i represents the decryptor.

[0054] (4.2) The decryptor uses the key K to run the decryption algorithm to decrypt the ciphertext CM and output the correct plaintext data or an identifier indicating a decryption failure, such as ⊥.

[0055] In the embodiment of the present invention, the functional verification is as follows:

[0056] The proposed method maintains functionality, which can be verified by verifying the correctness of the formula:

[0057]

[0058]

[0059] The present invention discloses a reverse firewall method suitable for broadcast encryption. The method defends against backdoor attacks by deploying a reverse firewall on the KGC and the encryptor in the broadcast encryption protocol. Regardless of whether an internal attacker subverts any participant in the protocol, the method proposed in the embodiment of the present invention can ensure that the privacy information of the participant will not be leaked to the internal attacker, thereby achieving the privacy leakage prevention of the overall broadcast encryption method. Compared with the ordinary broadcast encryption method, the method proposed in the embodiment of the present invention can achieve that even if the encryptor and the KGC use a subverted algorithm (algorithm tampered by the internal attacker), the privacy information of the participant will not be leaked to the attacker.

[0060] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0061] The above are only some embodiments of the present invention. For those skilled in the art, several modifications and improvements can be made without departing from the creative concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A reverse firewall method suitable for broadcast encryption, characterized in that: The following steps are involved: Step 1: The key generation center KGC initializes the system public parameters, and re-randomizes the system public parameters based on the reverse firewall deployed on the KGC and broadcasts them to all participants, including encryptors and decryptors; Step 2: KGC generates a key pair for the encryptor and decryptor, and then returns the private key to the decryptor; Step 3: The reverse firewall deployed on the encryptor side re-randomizes the broadcast system public parameters. The encryptor then runs the encryption algorithm based on the re-randomized system public parameters, the decryptor set and the message to be encrypted to generate the ciphertext and sends it to the decryptor. The generated ciphertext header is re-randomized based on the reverse firewall deployed on the encryptor side, and the re-randomized ciphertext header is sent to the decryptor. Step 4: The decryptor in the decryptor set calculates the session key based on the system public parameters, the ciphertext header and its own private key; and decrypts the received ciphertext based on the session key.

2. The method according to claim 1, characterized in that The KGC initialization system public parameters specifically include: Input the system security parameter λ and the maximum number of decryptors n that the system can accommodate, KGC selects the cyclic multiplicative groups G1 and G2 with prime order p and the bilinear map e:G1×G1→G2; KGC generates random numbers and As the master private key MSK of KGC, Represents a finite field Z p = the finite field obtained by removing zero from {0,1,…,p-1}; Calculate the parameter v=g based on the currently generated random numbers γ and a γ , The parameter i∈[n]∪(n+1,2n], [n] represents the set [1,n]; KGC sets the system public parameters PP = {G1, G2, e, p, v, g, g i }, and send the system public parameter PP to the reverse firewall W deployed on KGC KGC .

3. The method according to claim 2, characterized in that Based on the reverse firewall W deployed on KGC KGC The specific steps for re-randomizing the system public parameters are as follows: Reverse Firewall KGC After receiving the system public parameter PP, re-randomize it: W KGC Uniformly randomly select random numbers Re-randomization parameter g' = g f , v'=v f , Where i∈[n]∪(n+1,2n], [n] represents the set [1,n]; Then the obtained re-randomized system public parameters PP'={v',g',g i '}Sent to all parties simultaneously.

4. The method according to claim 3, characterized in that Step 2 specifically includes: KGC gets the reverse firewall W KGC After the re-randomized system public parameters PP', based on the parameters g i ' and γ calculate the decryptor's private key Where i is the decryptor identifier, and i∈[1,n], and the decryptor's private key d i Sent to the corresponding decryptor.

5. The method according to claim 4, characterized in that In step 3, the re-randomization of the reverse firewall and the encryptor running the encryption algorithm based on the re-randomized system public parameters, the decryptor set and the message to be encrypted to generate the ciphertext specifically include: (1) Reverse firewall W deployed on the encryption side Enc After obtaining the re-randomized system public parameter PP', the re-randomized system public parameter PP' is re-randomized again: Enc Uniformly randomly select random numbers And save β, and use the random number β to re-randomize the parameters The system public parameters PP” = {v”, g”, g i ”}, where i∈[n]∪(n+1,2n], [n] represents the set [1,n], and the system public parameters PP”={v”,g”,g i ”}Send to the encryptor; (2) The encryptor generates a random number Combined with the parameters in the twice-randomized system public parameter PP", the session key K = e(g'1', g' n ') t , and calculate the parameter C0=g in the ciphertext header H=(C0,C1)" t and C1=(v”·Π j∈ S g' n ' +1-j ) t , where S is the set of authorized decryptors, and outputs the ciphertext header H = (C0, C1) to the reverse firewall W Enc .

6. The method according to claim 5, characterized in that In step 3, the re-randomization of the generated ciphertext header based on the reverse firewall deployed on the encryptor side specifically includes: Reverse Firewall Enc Beta re-randomization based on saved random numbers The re-randomized ciphertext header H'=(C'0, C'1) is obtained and output to the decryptor.

7. The method according to claim 6, characterized in that Step 4 specifically includes: The decryptor uses its corresponding private key d i , re-randomized ciphertext header H', and use the re-randomized system public parameter PP' to calculate the session key K = e(g i ',C'1) / e(d i ·Π j∈S,j≠i g n+1-j+i ,C'0), where i is the decryptor identifier; The decryptor runs the decryption algorithm with the session key K to decrypt the received ciphertext.

8. The method according to claim 1, characterized in that In step 4, decryption result feedback is also included, that is, the correct plaintext data or an identifier representing a decryption failure is output.

Images