A reverse firewall method suitable for broadcast encryption

Abstract

The application discloses a reverse firewall method suitable for broadcast encryption and belongs to the technical field of information security. The method deploys a reverse firewall at a key generation center KGC and an encryptor in a broadcast encryption protocol to resist backdoor attacks. The specific steps include the following: firstly, the KGC initializes system public parameters and broadcasts the re-randomized public parameters to all participants, including the encryptor and the decryptor; secondly, the KGC generates a key pair of the encryptor and the decryptor; then, the encryptor generates ciphertext by running an encryption algorithm by using the re-randomized public parameters and the decryptor set, and sends the ciphertext header to the decryptor after re-randomization; finally, if the decryptor is in the selected set, the decryptor calculates a session key by using the public parameters, the ciphertext header and the private key to perform decryption, so that the privacy information of the participants cannot be leaked to an attacker, and thus the privacy leakage prevention of the overall broadcast encryption method is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security technology, and particularly relates to a reverse firewall method suitable for broadcast encryption. BACKGROUND

[0002] Internal attacks can not only steal a large amount of user privacy, but also are extremely difficult to be detected by third-party professional institutions. By tampering with the password algorithm and implanting backdoors, the security of the algorithm can be destroyed, leading to the leakage of private information, and the global wide monitoring can be achieved. Researchers have found that such attack means can break various cryptographic algorithms, including encryption, digital signature and key exchange, with a non-negligible probability advantage, showing its high harmfulness.

[0003] In order to successfully resist such attacks, scholars have proposed the concept of "cryptographic reverse firewall". The reverse firewall not only can maintain the security and functionality of the original protocol, but also has the property of preventing leakage. In addition, the reverse firewall is transparent and "untrusted" third party. "Untrusted" means that the reverse firewall can only handle the public access information of the user, but the algorithm of the reverse firewall is not subverted by the internal attacker.

[0004] With the increase of data volume, users tend to outsource data to cloud servers. How to guarantee the privacy of data on public clouds has become a problem to be solved. Broadcast encryption provides an efficient method for multi-user data sharing, and is widely used in pay TV, digital rights protection and blockchain, etc. Fiat et al. [Broadcast encryption[C]. Advances in Cryptology–CRYPTO 1993, Springer: 480–491.] proposed the concept of broadcast encryption. Broadcast encryption is an encryption technology that supports secure sharing of data among multiple users over an insecure public channel, and is suitable for one-to-many secure transmission scenarios. The working mode of broadcast encryption is as follows: the data owner first selects a group of receivers, runs the broadcast encryption algorithm, and publishes the encrypted ciphertext to the public channel. All users listening to the channel can obtain the ciphertext, but only authorized users can correctly decrypt it using the decryption key, and unauthorized users cannot obtain any plaintext information from the ciphertext. Due to the limitations of symmetric broadcast encryption, research on broadcast encryption in recent years has mainly focused on public key broadcast encryption. Naor et al. [Efficient trace and revoke schemes[C]. Financial Cryptography 2000, Springer: 1–20.] first proposed the concept of public key broadcast encryption (PKBE). In 2002, Dodis et al. [Public key broadcast encryption for stateless receivers, in Digital Rights Management[C]. ACM CCS-9 Workshop 2002 Revised Papers. Springer: 61–80.] applied the subset difference method to provide a conversion from symmetric broadcast encryption to public key broadcast encryption. In addition, the paper also proposes a public key broadcast encryption scheme with fixed length public key. Boneh et al. [Collusion resistant broadcast encryption with short ciphertexts and private keys[C]. Advances in Cryptology–CRYPTO 2005, Springer: 258–275.] proposed the first fully collusion-resistant public key broadcast encryption scheme, BWG scheme, using bilinear technology. In the first scheme construction, the length of the ciphertext and the private key is fixed, but the length of the public key increases linearly with the number of data receivers. The ciphertext length and public key length of the second scheme construction have a sub-linear size.

[0005] Bellare et al. [Security of Symmetric Encryption against Mass Surveillance[C]. Advances in Cryptology–CRYPTO 2014, Springer: 1-19.] mainly studied the resistance of symmetric encryption schemes against mass surveillance. The authors focused on algorithm substitution attacks (ASA), which replace the real encryption algorithm with a tampered one. Bellare et al. [Mass-surveillance without the State: Strongly Undetectable Algorithm-Substitution Attacks. [C] Computer and Communications Security 2015, ACM: 1431-1440.] proposed new ASA attack methods, which are more powerful than previous attacks. The authors pointed out that previous attacks could only break randomized schemes with specific properties, while new attacks could break all randomized schemes. In addition, new attacks are stateless and meet the standard of strong undetectability. This shows that ASA is a more threatening attack than previously thought.

[0006] To solve this problem, Mironov et al. [Cryptographic reverse firewalls [C]. Advances in Cryptology–EUROCRYPT 2015, Springer: 657-686.] first proposed the concept of cryptographic reverse firewalls (CRF) and defined that reverse firewalls need to have three properties: maintain functionality, preserve security, and prevent leakage. Maintain functionality means that reverse firewalls can resist subversion attacks by re-randomizing the transmitted information without changing the original algorithm functionality. Preserve security means that the scheme with reverse firewalls retains the security properties of the original underlying protocol. Prevent leakage means that users send information implanted with backdoors, but reverse firewalls can make the backdoors ineffective. In addition, reverse firewalls should be "transparent" to the participants of the cryptographic protocol, i.e., reverse firewalls have no impact on the functionality of the underlying cryptographic scheme. In addition, reverse firewalls should be semi-honest, i.e., reverse firewalls honestly run the algorithm, but should not know the user's privacy.

[0007] However, the existing broadcast encryption method cannot guarantee the security of the private information under the threat of backdoor attack, and therefore it is necessary to propose a reverse firewall method based on broadcast encryption to solve this problem. SUMMARY

[0008] The purpose of the present application is to realize a reverse firewall method suitable for broadcast encryption to enhance the ability of broadcast encryption to resist backdoor attack.

[0009] The technical solution adopted by the present application is:

[0010] A reverse firewall method suitable for broadcast encryption, the method comprising the following steps:

[0011] Step 1, the key generation center KGC initializes the system public parameters, and broadcasts the re-randomized system public parameters to all participants based on the reverse firewall deployed in the KGC, wherein the participants include the encryptor and the decryptor;

[0012] Step 2, the KGC generates a key pair for the encryptor and the decryptor, and then returns the private key to the decryptor;

[0013] Step 3, the reverse firewall deployed on the encryptor side re-randomizes the broadcasted system public parameters, and the encryptor generates ciphertext based on the re-randomized system public parameters, the decryptor set and the message to be encrypted, and sends it to the decryptor; and the reverse firewall deployed on the encryptor side re-randomizes the header of the generated ciphertext, and then sends the re-randomized ciphertext header to the decryptor;

[0014] Step 4, the decryptor in the decryptor set calculates the session key based on the system public parameters, the ciphertext header and its own private key; and decrypts the received ciphertext based on the session key.

[0015] Further, in step 4, it also includes feedback of the decryption result, i.e. outputting correct plaintext data or an identifier representing decryption failure, such as.

[0016] Further, the KGC initialization system specifically includes:

[0017] Input system security parameters λ and the maximum number of decryptors that the system can accommodate n, and the KGC selects cyclic multiplicative groups G1 and G2 of prime order p and a bilinear mapping e: G1 × G1 → G2.

[0018] The KGC generates a random number and as the master private key MSK of the KGC, wherein represents the finite field Z p ={0,1,…,p-1} obtained by removing zero from the finite field, and the parameter v=gγ , where i∈[n]∪(n+1,2n], [n] represents the set [1,n]. After this, the KGC sets the public parameter PP={G1,G2,e,p,v,g,g i , and sends the public parameter PP to the reverse firewall W KGC deployed in the KGC.

[0019] Further, the reverse firewall W KGC deployed in the KGC re-randomizes the system public parameter, and the re-randomization algorithm of the reverse firewall W KGC is as follows:

[0020] After receiving the public parameter PP, the reverse firewall W KGC re-randomizes the public parameter PP. The re-randomization algorithm of the reverse firewall W f is as follows: where i∈[n]∪(n+1,2n], [n] represents the set [1,n], so as to obtain the re-randomized public parameter PP', and the re-randomized public parameter PP'={v',g',g i '} is sent to all participants (including the KGC) at the same time.

[0021] Further, step 2 specifically includes:

[0022] After obtaining the re-randomized public parameter PP' of the reverse firewall W KGC , the KGC calculates the private key d i of the decrypter by using the parameters g i ' and γ in the re-randomized public parameter PP'. where i represents a certain decrypter, i∈[1,n], and the private key d Enc of the decrypter is sent to the corresponding decrypter.

[0023] Further, in step 3, the re-randomization algorithm of the firewall W Enc and the encryption algorithm based on the re-randomized system public parameter, the decrypter set and the message to be encrypted run by the encrypter to generate the ciphertext specifically include:

[0024] (1) The reverse firewall W Enc deployed in the encrypter re-randomizes the re-randomized public parameter PP' again after obtaining the re-randomized public parameter PP'. The re-randomization algorithm of the reverse firewall W β is as follows: and saves β, and re-randomizes g”=g' β ,v”=v' i by using β.​where i∈[n]∪(n+1,2n], [n] represents the set [1,n], and the public parameter PP" of the second re-randomization is PP" ={v",g",g i "}. The public parameter PP" of the second re-randomization is sent to the encryptor. i

[0025] (2) The encryptor generates a random number Then, the session key K is calculated by combining the parameters in the public parameter PP" of the second re-randomization, K=e(g n ) t Meanwhile, the parameters C0 and C1 in the ciphertext header H=(C0,C1) are calculated, C0=g t and C1=(v"·Π j∈S g n+1-j ) t where S is the set of authorized decryptors, and the ciphertext header H=(C0,C1) is output to the reverse firewall W Enc .

[0026] Further, in step 3, the reverse firewall W Enc re-randomizes the generated ciphertext header, which specifically includes:

[0027] The reverse firewall W Enc re-randomizes the generated ciphertext header by using the previously saved random number β to obtain the re-randomized ciphertext header H'=(C'0,C'1) and output it to the decryptor.

[0028] Further, step 4 specifically includes:

[0029] The decryptor uses its corresponding private key d i , the re-randomized ciphertext header H', and the public parameter PP' of the re-randomization to calculate the session key K=e(g i ',C'1) / e(d i ·Π j∈S,j≠i g n+1-j+i ,C'0), where i represents the decryptor.

[0030] The decryptor uses the key K to run the decryption algorithm to decrypt the ciphertext, and outputs the correct plaintext data or an identifier representing decryption failure, such as.

[0031] The technical solution provided by the present application at least brings the following beneficial effects:

[0032] ​The application is a reverse firewall method suitable for broadcast encryption, which constructs a reverse firewall for the key generation center and encryptor in the protocol, so as to ensure that the privacy of all participants is not leaked even if there is an internal attacker and a backdoor is embedded in the algorithm. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort.

[0034] Figure 1 A processing process schematic diagram of a reverse firewall method suitable for broadcast encryption provided by the embodiment of the present application;

[0035] Figure 2 A flowchart of system public parameters initialized in the embodiment of the present application;

[0036] Figure 3 A flowchart of key generation and encryption and decryption in the embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be described in detail and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings can be arranged and designed using different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not only to limit the scope of the claimed present application, but only to represent selected embodiments of the present application.

[0038] The specific implementation process of the reverse firewall method suitable for broadcast encryption provided by the embodiment of the present application includes:

[0039] The KGC sets the master private key MSK of the KGC, which is used to generate the public parameter PP, as shown in the following formula: Figure 1 As shown in the following formula, the reverse firewall of the KGC re-randomizes the public parameter PP, and sends the re-randomized public parameter PP' to all participants; after that, the KGC generates the private key using the re-randomized public parameter PP' and sends it to the corresponding decryptor. Even if the KGC uses an initialization algorithm with a backdoor, the re-randomization of the KGC reverse firewall makes it impossible for the attacker to distinguish between the honest behavior and the subversive behavior of the KGC, not to mention extracting the privacy.

[0040] Further, Figure 1 The reverse firewall W Enc deployed at the encrypter is also shown. Enc The ciphertext header generated by the encrypter is re-randomized. Due to the re-randomization of the reverse firewall, it is guaranteed that even if the encrypter uses a backdoored random number generator, the internal attacker cannot extract any privacy information about the encrypter from the re-randomized message. The method provided by the embodiment of the present application has anti-leakage, and the privacy information of the participants in the protocol will not be leaked even if any party (KGC, encrypter, decrypter) is embedded with a backdoor.

[0041] In one embodiment, referring to Figure 1 , Figure 2 and Figure 3 , the specific implementation steps of the reverse firewall method provided by the embodiment of the present application for broadcast encryption include:

[0042] (1) Initialization:

[0043] (1.1) Input system security parameter λ and the maximum number of decrypters that the system can accommodate n, and KGC selects cyclic multiplicative group G1 and G2 of prime order p and bilinear mapping e: G1x G1→ G2.

[0044] (1.2) KGC generates random numbers and as the master secret key MSK of KGC, where represents the finite field Z p ={0,1,…,p-1} obtained by removing zero from the finite field, and calculates the parameter v=g γ , where i∈[n]∪(n+1,2n], [n] represents the set [1,n]. After that, KGC sets the public parameter PP={G1,G2,e,p,v,g,g i} and sends the public parameter PP to the reverse firewall W KGC deployed at the KGC.

[0045] (1.3) After receiving the public parameter PP, the reverse firewall W KGC re-randomizes the public parameter PP. KGC Randomly selects random numbers Re-randomize g' = g f , v' = v f , where i∈[n]∪(n+1,2n], [n] represents the set [1,n], thereby obtaining the re-randomized PP', and sending the re-randomized PP'={v',g',g iIt is sent to all participants of the protocol (including KGC) simultaneously.

[0046] (2) Key generation:

[0047] (2.1) KGC gets the inverse firewall W KGC after getting the re-randomized public parameter PP', it uses the parameter g I and γ to calculate the private key of the decrypter d where i represents a decrypter, i∈[1,n], and sends the private key of the decrypter d i to the corresponding decrypter.

[0048] (3) Encryption:

[0049] (3.1) The inverse firewall W Enc deployed at the encrypter re-randomizes the re-randomized public parameter PP' again after getting the re-randomized public parameter PP'. Enc Randomly selects a random number β and saves β, and re-randomizes g" = g' β , v" = v' β , where i∈[n]∪(n+1,2n], [n] represents the set [1,n], gets the twice re-randomized public parameter PP" = {v", g", g i "}, and sends the twice re-randomized public parameter PP" to the encrypter.

[0050] (3.2) The encrypter generates a random number Then, it calculates the session key K = e(g"1,g n ) t , and calculates the parameters C0 = g t and C1 = (v"·Π j∈S g n+1-j ) t in the ciphertext header H = (C0,C1) simultaneously, where S is the set of authorized decrypters, and outputs the ciphertext header H = (C0,C1) to the inverse firewall W Enc .

[0051] (3.3) The inverse firewall W Enc re-randomizes using the previously saved random number β to get the re-randomized ciphertext header H' = (C'0,C'1) and outputs it to the decrypter.

[0052] (4) Decryption

[0053] (4.1) The decrypter uses its corresponding private key di , the re-randomized ciphertext header H', the session key K = e(g i ', C'1) / e(d i ·Π j∈S,j≠i g n+1-j+i ,C'0), where i represents the decrypter.

[0054] (4.2) The decrypter runs the decryption algorithm with the key K to decrypt the ciphertext CM, and outputs the correct plaintext data or an identifier representing decryption failure, such as.

[0055] In the embodiments of the present application, the functionality is verified as follows:

[0056] The method proposed by us has the function of maintaining functionality, and can be verified by verifying the correctness of the formula:

[0057]

[0058]

[0059] The present application discloses a kind of reverse firewall method suitable for broadcast encryption.This method is by deploying reverse firewall to KGC and encrypter in broadcast encryption protocol to resist backdoor attack.Whether internal attacker subverts any participant in protocol, the method proposed in the embodiments of the present application can guarantee that the privacy information of participant is not leaked to internal attacker, so as to realize the privacy leakage prevention of overall broadcast encryption method.The method proposed in the embodiments of the present application can realize that even if encrypter and KGC use subverted algorithm (algorithm tampered by internal attacker), the privacy information of participant is not leaked to attacker compared with ordinary broadcast encryption method.

[0060] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; And these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

[0061] The above only describes some embodiments of the present application. For ordinary skilled in the art, without departing from the inventive concept, a number of modifications and improvements can be made, which are within the scope of protection of the present application.

Claims

1. A reverse firewall method suitable for broadcast encryption, characterized in that, The method comprises the following steps: Step 1, a key generation center (KGC) initializes system public parameters, and re-randomizes the system public parameters based on a reverse firewall deployed in the KGC and then broadcasts the re-randomized system public parameters to all participants, wherein the participants include an encryptor and a decryptor; Step 2, the KGC generates a key pair of the encryptor and the decryptor, and then returns a private key in the key pair to the decryptor; Step 3, a reverse firewall deployed in the encryptor first re-randomizes the broadcasted public parameters, and then the encryptor generates ciphertext based on the re-randomized system public parameters, a set of decryptors and a message to be encrypted, and sends the ciphertext to the decryptor; and the reverse firewall deployed in the encryptor re-randomizes a header of the generated ciphertext, and then sends the re-randomized header of the ciphertext to the decryptor; Step 4, a decryptor in the set of decryptors calculates a session key based on the system public parameters, the header of the ciphertext and the private key of the decryptor; and decrypts the received ciphertext based on the session key; In the step 1, the KGC initializes the system public parameters, and the initializing specifically comprises: inputting system security parameters λ and a maximum number of decryptors n that can be accommodated by the system, and the KGC selects a cyclic multiplicative group G1 and G2 of a prime number p and a bilinear mapping e: G1×G1→G2; KGC generates random number and MSK, where denotes the finite field Z p = {0,1,...,p-1} without zero; Based on the current generated random number γ, a parameter v = g γ , where i ∈ [n] ∪ (n + 1, 2n], [n] represents the set [1, n]; KGC sets system public parameters PP = {G1, G2, e, p, v, g, g i} and sends the public parameters PP to the reverse firewall W KGC deployed at the KGC; Based on the deployment of KGC reverse firewall W KGC The re-randomization of the system public parameter is specifically: Reverse firewall W KGC Upon reception of the public parameter PP, the public parameter PP is re-randomized: W KGC A random number is chosen uniformly at random Re-randomize g' = g f v' = v f , where i ∈ [n] ∪ (n + 1, 2n], [n] represents the set [1, n]; The obtained rerandomized common parameters PP' = {v', g', g'} are then used to... i }Send to all participants simultaneously; Step 2 specifically comprises: the KGC obtains the inverse firewall W KGC After re-randomizing the system public parameter PP', the parameter g' in it is used to calculate the private key of the decrypter i and γ where i represents a certain decrypter, and i∈[1, n], and the private key d i of the decrypter is sent to the corresponding decrypter; In the step 3, the re-randomization of the reverse firewall and the generation of the ciphertext by the encryptor based on the re-randomized system public parameters, the set of decryptors and the message to be encrypted specifically comprise: (1) Deploy a reverse firewall W at the encryption party Enc After obtaining the re-randomized system public parameter PP', re-randomize the re-randomized system public parameter PP' again: W Enc Uniformly randomly select a random number Save β, and re-randomize the parameter g" = g 'β , v" = v 'β , Obtain the twice re-randomized system public parameter PP" = {v", g", g" i}, where i ∈ [n] ∪ (n+1, 2n], [n] represents the set [1, n], and send the twice re-randomized system public parameter PP" = {v", g", g" i} to the encrypter; (2) the encrypter generates a random number The session key K = e(g"1, g" n ) t is calculated from the parameters in the system public parameter PP" combined with the twice re-randomization. ”t At the same time, the parameters C0= g j∈ and C1= (v"·Π S g" n+1-j ) t are calculated in the ciphertext header H = (C0, C1), and the ciphertext header H = (C0, C1) is output to the reverse firewall W Enc ; In step 3, the generated ciphertext header is re-randomized based on the reverse firewall deployed at the encrypter side, specifically including: the reverse firewall W Enc Re-randomization using the previously saved random number β The re-randomized ciphertext header H' = (C'0, C'1) is obtained and output to the decrypter. Step 4 specifically includes: the decrypter uses its corresponding private key d i , the re-randomized ciphertext header H', and the re-randomized system public parameter PP' to calculate the session key K = e(g i ', C'1) / e(d i ·Π j∈S,j≠i g n+1-j+i ,C'0), where i represents the decrypter; the decrypter decrypts the received ciphertext by running the decryption algorithm through the session key K.

2. The method of claim 1, wherein, In the step 4, the method further comprises a decryption result feedback, that is, outputting correct plaintext data or an identifier representing a decryption failure.

Images