Broadcast Encryption with Improved Resource Utilization.

Abstract

Broadcast networks have a bandwidth of O(N 1 / 3 A pairing-based broadcast encryption scheme for N users with parameters of size n can be used. A pairing-based ciphertext-prescribed attribute-based encryption (CP-ABE) scheme for a class of polynomials of degree 3 can be implemented with compact parameters. The public key, ciphertext, and private key contain O(n) group elements, where n is the input length of the function. This construction achieves adaptive security against unbounded collusion and relies on the (bilateral) k-Lin assumption on prime-order bilinear groups.

Description

[Technical field]

[0001] This disclosure provides a method for solving O(N 1 / 3 ) for a pairing-based broadcast encryption scheme with a size parameter. [Background technology]

[0002] In ciphertext-policy attribute-based encryption (CP-ABE), a ciphertext ct is associated with a predicate f and a message m, a key sk is associated with an attribute x, and decryption returns m if x satisfies f. Broadcast encryption is a special case of CP-ABE where the predicate is specified by a set S ⊆ [N] and decryption returns m if x ∈ S. In both cases, we require security against unbounded collusion, in that an adversary who sees the ciphertext as well as the private key for any number of attributes x1, x2, … cannot learn anything about m unless some of these attributes satisfy f.

[0003] Broadcast encryption has been an active area of ​​research since its introduction in the 1990s, with the main goal being to obtain schemes with short parameters, specifically short ciphertexts ct and short public keys mpk. Previous work includes pairing-based broadcast encryption schemes with constant-size ciphertexts (ignoring contributions from the set S) and secret keys, but these schemes have large public keys mpk that are linear in the total number of users N, and furthermore, decryption requires access to mpk. To address these shortcomings, the schemes can be modified to achieve public keys of size O(√N) at the expense of ciphertexts of size O(√N). Further work has shown how to achieve parameters of size O(√N) (i.e., |mpk|+|ct|+|sk|=O(√N)) under the standard k-Lin assumption, improving on the q-type assumptions while further strengthening the security guarantee from selection security to adaptive security.

[0004] Other previous work has constructed broadcast encryption schemes with parameters of size poly(logN) from pairings and LWE. Nevertheless, the following fundamental problem remains open: Can a broadcast encryption scheme with parameters of size o(√N) (i.e., |mpk|+|ct|+|sk|=o(√N)) be constructed (only) from pairings?

[0005] Traditional methods for pairing-based broadcast encryption require |ct|·max{|sk|,|mpk|}=Ω(N), which implies a bound in Ω(√N) on the parameter size. Moreover, we show that this is essentially optimal for a large class of methods for pairing-based broadcast encryption, and that breaking the √N barrier requires substantially new ideas. Summary of the Invention [Problem to be solved by the invention]

[0006] The present invention relates to broadcast encryption, as well as attribute-based encryption schemes. [Means for solving the problem]

[0007] This invention breaks the long-standing barrier of √N, and achieves O(N 1 / 3 The work includes a pairing-based broadcast encryption scheme with a parameter of size o(√N) that achieves adaptive security against unbounded collusion and relies on a bilateral k-Lin assumption on bilinear groups of prime order. Furthermore, the construction offers a range of tradeoffs between ciphertext size and key size. Prior to this work, it was not known how to achieve a parameter of size o(√N) with choice security, even with q-type assumptions or general bilinear groups.

[0008] More generally, the present invention provides n (More generally, Zp n ), where the public key, ciphertext, and private key contain O(n) group elements, and the scheme also achieves adaptive security against unbounded collusion under the bilateral k-Lin assumption. Then, the broadcast encryption scheme is derived as a direct corollary. The set membership in S∈[N] is {0,1} O(N^(1 / 3)) Prior to this work, CP-ABE schemes with size O(n) parameters from pairings were only known for the class of polynomials of degree 2.

[0009] The design of our scheme departs rather significantly from existing pairing-based ABE schemes in that it exploits the power of “quadratic reconstruction”. The idea is that it takes O(N 1 / 3 It has previously been used to construct an information-theoretic private-key counterpart of the broadcast construction (formally called conditional disclosure of secrets for indexes, CDS) with a parameter of size 1. However, this scheme only works over fields of characteristic 2, which is incompatible with bilinear group arithmetic "in exponentials". Instead, we provide a new technique for instantiating quadratic reconstruction with reference to functional encryption for polynomials of degree 2.

[0010] In various embodiments, a computer-implemented method, computing device, and computer-readable storage medium are disclosed. In one exemplary embodiment for encrypting a message as a ciphertext for transmission to multiple recipients over a broadcast network, the computer-implemented method, computing device, and computer-readable storage medium include receiving, at a broadcast module, a set of authorized recipients S, the set of authorized recipients identifying a set of recipients that have permission to recover the broadcast message, where S is a subset of {1, 2, ..., N}, where n is a number between n 3 ≧N, where N is the total number of possible recipients of the message; generating a public key mpk at an authority, the public key mpk being derived from three vectors of n random group elements in a first source group, [v]1, [w1]1, and [w2]1, a random group element [v0]1 in the first source group, and a random group element [α] in a target group. T receiving, in the broadcast module, the public key mpk from the authority; receiving or creating a message M for encryption; and encoding the set of authorized recipients S as a polynomial of degree 3, the polynomial of degree 3 having a coefficient vector f equal to a characteristic vector of the set of recipients S, the vector f having a length n 3 using a vector of n group elements [w2]1 from the public key mpk to yield a digest of n group elements by sampling a random vector w3 of n integers modulo p and cryptographically compressing the vector f; generating a ciphertext for a message M by sampling a random scalar s, multiplying the random scalar s by the digest, the vector w3, and the public key mpk and concatenating the outputs of the multiplication to form a ciphertext; and sending the ciphertext to the authorized recipients identified in the set S.

[0011] A further embodiment comprises:

number

[0012] Further embodiments may include instructions for decrypting the ciphertext by a receiver to recover the broadcast message, the decryption including the steps of: receiving, at a receiver module, the ciphertext and a set of authorized receivers over a broadcast network from a remote broadcast module, the ciphertext further including a digest, the digest further including information about a polynomial; receiving a key from a remote authority module, the key including a group element; checking if the receiver is in the set of authorized receivers; and computing the degree 3 polynomial having a coefficient vector f equal to a characteristic vector of receiver set S, the degree 3 polynomial having a coefficient vector f equal to a characteristic vector of receiver set S, the vector f being of length n 3 recovering the broadcast message by evaluating the polynomial with the digest using group elements in a pairing algorithm; and storing the recovered broadcast message for further processing in the receiver module. [Brief description of the drawings]

[0013] The accompanying drawings, which are included to provide a further understanding, are incorporated in and constitute a part of this specification, illustrate the disclosed embodiments and, together with the description, serve to explain the principles of the disclosed embodiments. [Figure 1] 1 is a block diagram illustrating a multimedia communication system suitable for use in various embodiments. [Diagram 2]1 illustrates an exemplary computer-implemented method for the claimed broadcast encryption scheme. [Diagram 3] 1 illustrates an exemplary computer system architecture for implementing the claimed systems and methods. [Figure 4] Further details of an exemplary computer system architecture for implementing the claimed systems and methods are provided. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Technical Overview An overview of our construction is disclosed here.

number

number

[0015] We consider the asymmetric bilinear group of prime order p

number

number

number

[0016] We make extensive use of tensor products, which allow for a more compact description of our schemes and avoid triple sums to compute polynomials of degree 3. Furthermore, as our schemes become more and more complex, we replace scalars with vectors, whereby some scalar-vector products naturally transition into tensor products of two vectors and some others into vector-matrix products.

[0017] Roadmap Here, two candidate CP-ABE schemes for degree-3 polynomials are described. The first one is |mpk|=O(n 2 ), |ct|=O(n), |sk|=O(n) In contrast, the traditional construction based on degree 2 polynomials achieves |ct|=O(n 2) or |sk|=O(n 2 ) is required. The second one is a variant of the first one with |mpk|=O(n), thus achieving a parameter size of O(n).

[0018] In the following, we explain how to modify this second candidate to obtain our final CP-ABE scheme, which achieves parameter size of O(n) as well as adaptive safety under the bi-k-Lin assumption.

[0019] CP-ABE for polynomials of degree 2

number

number

[0020] The decryption uses the following:

number

[0021] According to the dual-system encryption method, security boils down to showing that M can be hidden given a single ciphertext-key pair. In particular, it is sufficient to show that

number

number

[0022] First candidate: CP-ABE Parameter Size |mpk|=O(n 2 ), |ct|=O(n), |sk|=O(n) A candidate CP-ABE is disclosed for polynomials of degree 3 with

[0023] To arrive at this scheme, first,

number

number

[0024] To achieve sk=O(n), we compute the above formula using

number

number

[0025] Compressing mpk To arrive at a CP-ABE scheme with parameters of size O(n), we compress mpk in the previous scheme as follows: instead of having a pick w3 set up, the encryptor samples a random w3. This reduces the

number

number

[0026] Second candidate: CP-ABE A candidate CP-ABE scheme with parameters of size O(n) is disclosed, where terms not present in the previous scheme are shaded.

number

[0027] Final CP-ABE Here we explain how we arrive at our final CP-ABE for a class of degree-3 polynomials that achieves adaptive security against unbounded collusion under the k-Lin assumptions on G1, G2 and the bilateral k'-Lin assumptions (k ≥ 1, k' ≥ 2).

number

[0028] Where:

number

[0029] notation By s ← S we denote the fact that s is picked uniformly at random from a finite set S. To show that the two distributions are statistically indistinguishable,

number

number

[0030] Tensor product

number

[0031] The mixed product property for tensor products states that:

number

[0032] A useful corollary of the mixed product property is that for any pair of row vectors u,v∈Z n The following is stated regarding this.

number

[0033] We adopt the convention that matrix multiplication takes precedence over tensor multiplication. Thus,

number

[0034] Bilinear groups of prime order

number

[0035] Recall the matrix Diffie-Hellman (MDDH) assumption on G1[?]: Assumption 1 (MDDH d k,l Assumptions) Let k, l, d ∈ N. For all PPT adversaries A, if the following advantage function is negligible in λ, then MDDH can be used. d k,l The assumption holds true.

number

[0036] The bilateral MDDH assumption is defined similarly using the advantage function.

number

[0037] Note that for k=1, the bilateral MDDH and bilateral k-Lin assumptions are false. In the disclosed embodiment, the advantage function

number

[0038] Attribute-Based Encryption We define attribute-based encryption in the framework of key encapsulation. An attribute-based encryption scheme for a predicate P(·,·) consists of four algorithms (Setup, Enc, KeyGen, Dec).

number

number

number

number

[0039] In the disclosed scheme, ke m ∈ G T which can then be hashed to {0,1} λ become.

[0040] Correctness For all (x,y)∈X×Y such that P(x,y)=1, Pr[(ct,kem)←Enc(mpk,x);Dec(sk,y,ct,x)=kem)]=1 Here, the probability is (mpk,msk)←Setup(1 λ ,X,Y) and Enc coins are taken.

[0041] Definition of Safety For a stateful adversary A, we define the following advantage function:

number

[0042] CP-ABE for polynomials of degree 3 where

number

[0043] Broadcast Encryption where

number

[0044] CP-ABE for polynomials of degree 3 Here, we present an adaptively secure CP-ABE for degree-3 polynomials against unrestricted collusion under the k-Lin and bilateral k'-Lin assumptions on G1, G2, where k ≥ 1, k' ≥ 2. Our scheme:

number

number

[0045] Scheme

number

number

number

number

[0046] Size N 1 / 3 Broadcast encryption of For every n1n2n3 ≥ N, there exists a set membership in S ⊆ [N].

number

number

[0047] File System Implementation The inventive scheme can be configured for efficiency. The inventive scheme can be instantiated using the common BLS12-381 curve where |G1| is 48 bytes and |G2| is 96 bytes. File sharing in an encrypted file system is a non-limiting example of an application for the inventive broadcast encryption. Windows EFS has a 256KB limit in the file header for EFS metadata and supports a maximum of 800 individual users. Assuming 32-bit user IDs, 1000 users can be supported with a file header (S,ct) of size 4×1000+82×48=7936 bytes. Here, each user holds a private key of size 67×96=6432 bytes. Results are improved by setting n1=20, n2=10, n3=5, which gives a header of size 4×1000+72×48=7456 bytes and a private key of size 57×96=5482 bytes. However, since N=1000 is rather small, a broadcast encryption scheme with O(√N) parameters also achieves similar performance, i.e., a file header of size 4×1000+66×48=7168 and a secret key of size 68×96=6528 bytes.

[0048] System Implementation Various embodiments may be implemented within a variety of communication systems, networks, and / or mobile multimedia broadcast systems, an example of which is shown in Figure 1. In particular, Figure 1 illustrates a communication system in which a mobile receiver device 102 may receive content from a multimedia broadcast network 104, a unicast network 106, or via the Internet 108. A typical multimedia broadcast network 104 includes multiple broadcast transmitters 112 controlled by a mobile broadcast network control center / broadcast operations center (BOC) 114. The multimedia broadcast network 104 broadcasts content from the broadcast transmitters 112 as mobile broadcast transmissions 113 for reception by the mobile receiver device 102. Within the BOC 114 there may be one or more servers 110 for managing the content broadcasts, which provide connectivity to the Internet 108.

[0049] In addition to the multimedia broadcast network 104, the mobile receiver device 102 may communicate via a unicast network 106, such as a cellular telephone network, a WiFi network (not shown), WiMAX, etc. A typical cellular telephone network includes multiple cellular base stations 116 coupled to a network operations center 118. The network operations center 118 operates to connect voice and data calls between the mobile receiver device 102 and other network destinations, such as via telephone land lines (e.g., a POTS network, not shown) and the Internet 108.

[0050] Communication between the mobile receiver device 102 and the unicast network 106 may be accomplished via a two-way wireless communication link 115, such as LTE, 4G, 3G, CDMA, TDMA, and other cellular telephony technologies. Such a two-way wireless communication link 115 may enable a user to stream multimedia content to a receiver device (e.g., a mobile device).

[0051] To facilitate Internet data communications (e.g., streaming video feeds), the unicast network 106 typically includes one or more servers 120 coupled to or located within a network operations center 118 that provides connectivity to the Internet 108. The mobile receiver device 102 may further connect to the Internet 108 via a wired connection when available, in which case the Internet 108 may act as a unicast network. The mobile receiver device 102 may also receive non-broadcast content over the Internet 108 using well-known conventional web-based access protocols.

[0052] In general, operations for receiving and rendering content by a receiver device (e.g., the mobile receiver device 102 discussed above) may be divided into separate and independent groups or categories of operations, and each group or category of operations may be assigned to a layer (e.g., physical layer, data link layer, etc.). At each of these layers, various hardware and / or software components may implement functions commensurate with the role assigned to that layer. For example, media streams (e.g., broadcast, point-to-point, etc.) are typically received at the physical layer, which may include radio receivers, buffers, and processing components that perform operations to demodulate, recognize symbols in radio frequency (RF) signals, and perform other operations to extract raw data from the received RF signals.

[0053] 2 illustrates an exemplary computer-implemented method for the claimed broadcast encryption scheme. In the illustrated exemplary embodiment, the setup routine generates a master public key (MPK) 270 and provides it to the broadcast authority 210. The key operations 245, 255, 265 may be performed at a centralized or trusted authority or third party, which may or may not be associated with or controlled by the broadcast authority 210. The setup routine 245 also generates a master private key (MSK) 250. The setup routine 245 may be called by a private key generator (PKG) 255. The PKG 255 generates a system master public key MPK 250 and a system master private key MSK 250, makes the MPK publicly available and keeps the MSK private. The key generation routine 265 receives the MPK and MSK, as well as user identification information 275, and outputs a private key 280 for each particular user.

[0054] The broadcast authority 210 then performs encryption 215 using the MPK 270, which is then used as the ciphertext for the broadcast message 220. The broadcast message is then provided over a broadcast channel 225, which may take any wired or wireless form as described herein. The ciphertext is received by a registered recipient 230. The registered recipient is provided with some key material 280 in association with an identification 275 provided to the key generation module 265. Based on the identification 275, the recipient may be provided with a private key 280. Using the private key, the registered recipient may perform decryption 235 of the broadcast ciphertext and generate the resulting broadcast message 240.

[0055] 3 and 4 illustrate an exemplary computer system useful for implementing various embodiments described in this disclosure. Various embodiments may be implemented using one or more computer systems, such as, for example, computer system 500 illustrated in FIG 3. One or more computer systems 500 may be used, for example, to implement any of the embodiments discussed herein, as well as combinations and subcombinations thereof.

[0056] Computer system 500 may include one or more processors (also referred to as central processing units, processing devices, or CPUs), such as processor 504. Processor 504 may be connected to a communications infrastructure 506 (e.g., a bus, etc.).

[0057] Computer system 500 may also include user input / output devices 503, such as a monitor, keyboard, pointing device, etc., that may communicate with a communications infrastructure 506 through a user input / output interface 502. One or more of the processors 504 may be a graphics processing unit (GPU). In one embodiment, a GPU may be a processor that is a specialized electronic circuit designed to process mathematically intensive applications. GPUs may have an efficient parallel structure for parallel processing of large blocks of data, such as the mathematically intensive data common in computer graphics applications, images, video, etc.

[0058] The computer system 500 may also include a main memory 508, such as a random access memory (RAM). The main memory 508 may include one or more levels of cache. The main memory 508 may store therein control logic (i.e., computer software, instructions, etc.) and / or data. The computer system 500 may also include one or more secondary storage devices or memories 510. The secondary memory 510 may include, for example, a hard disk drive 512 and / or a removable storage device or drive 514. The drive 514 may interact with a removable storage unit 518. The drive 518 may include a computer usable or readable storage device that stores computer software (control logic) and / or data. The drive 514 reads from and / or writes to the removable storage unit 518.

[0059] The secondary memory 510 may include other apparatus, devices, components, means, or other approaches for allowing computer programs and / or other instructions and / or data to be accessed by the computer system 500. Such means, devices, components, apparatus, or other approaches may include, for example, a removable storage unit 522 and an interface 520. Examples of removable storage units 522 and interfaces 520 may include a program cartridge and a cartridge interface, a removable memory chip (such as an EPROM or PROM) and associated sockets, a memory stick and a USB port, a memory card and associated memory card slot, and / or any other removable storage unit and associated interface.

[0060] The computer system 500 may further include a communication interface 524 (e.g., a network interface). The communication interface 524 may enable the computer system 500 to communicate and interact with any combination of external devices, external networks, external entities, etc. (individually and collectively referred to as remote devices, networks, entities 528). For example, the communication interface 524 may allow the computer system 500 to communicate with external or remote devices, networks, entities 528 over a communication path 526. The communication path may be wired and / or wireless (or a combination thereof) and may include any combination of a LAN, a WAN, the Internet, etc. Control logic and / or data may be transmitted to and from the computer system 500 over the communication path 526.

[0061] Computer system 500 may be any one or any combination of a personal digital assistant (PDA), a desktop workstation, a laptop or notebook computer, a netbook, a tablet, a smartphone, a smartwatch or other wearable device, an appliance, part of the Internet of Things, and / or an embedded system, to name a few non-limiting examples.

[0062] Computer system 500 may be a client or server computing device that accesses or hosts any application and / or data through any delivery paradigm, including, but not limited to, remote or distributed cloud computing solutions, local or on-premise software ("on-premise" cloud-based solutions), an "as a service" model (e.g., Content as a Service (CaaS), Digital Content as a Service (DCaaS), Software as a Service (SaaS), Managed Software as a Service (MSaaS), Platform as a Service (PaaS), Desktop as a Service (DaaS), Framework as a Service (FaaS), Backend as a Service (BaaS), Mobile Backend as a Service (MBaaS), Infrastructure as a Service (IaaS), etc.), and / or a hybrid model including any combination of the foregoing examples or other service or delivery paradigms.

[0063] 4 illustrates an exemplary machine of computer system 900 upon which a set of instructions may be executed to cause the machine to perform any one or more of the operations described herein. In alternative implementations, the machine may be connected (e.g., networked) to other machines in a LAN, an intranet, an extranet, and / or the Internet. The machine may operate in the capacity of a server or a client machine in a client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or a client machine in a cloud computing infrastructure or environment.

[0064] The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a web appliance, a server, a network router, switch or bridge, a specialized application or network security appliance or device, or any device capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by the machine. Additionally, although a single machine is shown, the term "machine" should also be construed to include any collection of machines that individually or jointly execute a set (or sets) of instructions to perform any one or more of the methodologies described herein.

[0065] The exemplary computer system 900 includes a processing unit 902, a main memory 904 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM), etc.), a static memory 906 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device 918, which communicate with each other via a bus 930.

[0066] Processing device 902 represents one or more processing devices, such as a microprocessor, a central processing unit, or the like. More specifically, a processing device may be a Complex Instruction Set Computing (CISC) microprocessor, a Reduced Instruction Set Computing (RISC) microprocessor, a Very Long Instruction Word (VLIW) microprocessor, or a processor implementing other instruction sets or a processor implementing a combination of instruction sets. Processing device 902 may be one or more special purpose processing devices, such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, or the like. Processing device 902 is configured to execute instructions 926 to perform the operations and steps described herein.

[0067] The computer system 900 may further include a network interface device 908 for communicating over a network 920. The computer system 900 may also include a video display unit 910, an alphanumeric input device 912 (e.g., a keyboard), a cursor control device 914 (e.g., a mouse), a graphics processing unit 922, a signal generating device 916 (e.g., a speaker), a graphics processing unit 922, a video processing unit 928, and an audio processing unit 932.

[0068] The data storage device 918 may include a machine-readable medium 924 (also known as a computer-readable storage medium) having stored thereon one or more sets of instructions 926 (e.g., software instructions) that embody any one or more of the operations described herein. The instructions 926 may also reside, completely or at least partially, within the main memory 904 and / or within the processing unit 902 during execution thereof by the computer system 900, where the main memory 904 and the processing unit 902 also constitute machine-readable storage media.

[0069] In one example, the instructions 926 include instructions for implementing operations and functions corresponding to the disclosed subject matter. Although the machine-readable storage medium 924 is shown to be a single medium in the exemplary implementation, the term "machine-readable storage medium" should be interpreted to include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and / or servers) that store the one or more sets of instructions 926. The term "machine-readable storage medium" should also be interpreted to include any medium that can store or encode a set of instructions 926 for execution by a machine, causing the machine to perform any one or more of the operations of the present disclosure. Thus, the term "machine-readable storage medium" should be interpreted to include, but is not limited to, solid-state memory, optical media, and magnetic media.

[0070] Some portions of the detailed description are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of operations leading to a desired result. The operations require physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, signs, terms, numbers, or the like.

[0071] It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. As is evident from the above discussion, unless otherwise indicated, throughout this document discussions utilizing terms such as "identify" or "determine" or "execute" or "perform" or "collect" or "create" or "transmit" are understood to refer to the actions and processes of a computer system or similar electronic computing device that manipulate and transform data represented as physical (electronic) quantities in the computer system's registers and memory into other data that are similarly represented as physical quantities in the computer system's memory or registers or other such information storage devices.

[0072] The present disclosure also relates to an apparatus for performing the operations herein. This apparatus may be specially constructed for the intended purposes, or may include a computer selectively activated or reconfigured by a computer program stored in said computer. Such a computer program may be stored on a computer-readable storage medium, such as, but not limited to, a floppy disk, an optical disk, a CD-ROM and a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic or optical card, or any type of medium suitable for storing electronic instructions, each of which may be coupled to a computer system bus.

[0073] The operations and examples presented herein are not inherently related to any particular computer or other apparatus. Various types of systems may be used with programs in accordance with the teachings of the present application. Alternatively, it may prove convenient to construct a more specialized apparatus to perform the operations. Structures for a variety of these systems will be found in the description herein. In addition, the present disclosure is not described with reference to any particular programming language. It will be understood that a variety of programming languages ​​may be used to implement the teachings of the present disclosure as described herein.

[0074] The present disclosure may be provided as a computer program product or software that may include a machine-readable medium having instructions stored thereon that may be used to program a computer system (or other electronic device) to perform a process according to the present disclosure. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a machine-readable (e.g., computer-readable) medium includes machine (e.g., computer) readable storage media such as read-only memory ("ROM"), random access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory devices, and the like.

[0075] In some embodiments, a tangible, non-transitory apparatus or article of manufacture that includes a tangible, non-transitory computer usable or readable medium having control logic (software) stored thereon may also be referred to herein as a computer program product or program storage device, including, but not limited to, a tangible article of manufacture that embodies computer system 500, main memory 508, secondary memory 510, and removable storage units 518 and 522, as well as any combination of the above. Such control logic, when executed by one or more data processing devices (such as computer system 500), may cause such data processing devices to operate as described herein.

[0076] Based on the teachings contained herein, it will be apparent to one of ordinary skill in the art how to make and use embodiments of the present disclosure using data processing devices, computer systems, and / or computer architectures other than those shown in Figures 3 and 4. In particular, embodiments may operate with software, hardware, and / or operating system implementations other than those described herein.

[0077] It is understood that the Detailed Description section, and not any other sections, is intended to be used to interpret the claims, as the other sections may describe one or more, but not all, exemplary embodiments contemplated by the inventors, and thus are not intended to limit the scope of the disclosure or the appended claims in any way.

[0078] Although the present disclosure describes exemplary embodiments for exemplary fields and applications, it should be understood that the present disclosure is not limited thereto. Other embodiments and modifications thereof are possible and are within the scope and spirit of the present disclosure. For example, without limiting the generality of this paragraph, the embodiments are not limited to the software, hardware, firmware, and / or entities shown in the drawings described herein. Moreover, the embodiments (whether or not explicitly described herein) have significant utility for fields and applications beyond the examples described herein.

[0079] The embodiments are described herein with functional building blocks that illustrate implementations of specified functions and their relationships. The boundaries of these functional building blocks are arbitrarily defined herein for convenience of description. Alternative boundaries may be defined so long as the specified functions and relationships (or equivalents) are appropriately performed. Alternative embodiments may also execute functional blocks, steps, operations, methods, etc. using orders different from those described herein.

[0080] References herein to "one embodiment," "an embodiment," "an exemplary embodiment," or similar phrases indicate that the described embodiment may include a particular feature, structure, or characteristic, but not all embodiments necessarily include that particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Moreover, when a particular feature, structure, or characteristic is described in the context of an embodiment, it is within the knowledge of one of ordinary skill in the art to incorporate such feature, structure, or characteristic in other embodiments, whether or not explicitly mentioned or described herein. Additionally, some embodiments may be described using the terms "coupled" and "connected," and variations thereof. These terms are not necessarily intended as synonyms for each other. For example, some embodiments may be described using the terms "connected" and / or "coupled" to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term "coupled" can also mean that two or more elements are not in direct contact with each other, but still cooperate or interact with each other.

[0081] The breadth and scope of the present disclosure should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents. In the foregoing specification, implementations of the present disclosure have been described with reference to specific exemplary implementations thereof. It will be apparent that various modifications can be made thereto without departing from the broader spirit and scope of the implementations of the present disclosure as set forth in the following claims. Thus, the specification and drawings should be regarded in an illustrative and not a restrictive sense.

Claims

1. 1. A method for encrypting a message as a ciphertext for transmission over a broadcast network to multiple recipients, the method comprising: receiving, at the broadcast module, a set of authorized recipients S, the set of authorized recipients identifying a set of recipients (230) that have permission to recover the broadcast message (240), where S is a subset of {1, 2, ..., N}, where n is a number between n and n; 3 an integer such that N is greater than or equal to the total number of possible recipients of the message; A step of generating a public key mpk (250) in an authority, said public key mpk (250) being a) a pairing group, the pairing group including a first source group, a second source group, and a target group; b) A vector [v] as n random group elements from the first group of sources. 1 , [w 1 ] 1 , and [w 2 ] 1 and, c) a random group element [v 0 ] 1 and, d) A random group element [α] from the target group. T and receiving, in the broadcast module, the public key mpk (250) from the authority; receiving or preparing a message M for encryption (215); encoding the set of authorized recipients S as a polynomial of degree 3, the polynomial of degree 3 having a coefficient vector f equal to a characteristic vector of the set of recipients S, the vector f having length n 3 and A vector of n group elements from the public key mpk [w 2 ] 1 and a random vector w of n integers modulo p. 3 yielding a digest of the n group elements by sampling f and cryptographically compressing the vector f; [0010] generating a ciphertext of the message M by transmitting the ciphertext and the set of authorized recipients S to a recipient over the broadcast network. method.

2. and executing instructions for decrypting (235) the ciphertext by a recipient to recover the broadcast message (240), the instructions comprising: receiving, at a receiver module, the ciphertext and the set of authorized recipients S from the remote broadcast module over the broadcast network, the ciphertext further comprising a digest, the digest further comprising information about the polynomial; receiving a private key from a remote authority module, the private key including group elements from the second group of sources; checking whether the recipient is in a set of authorized recipients; calculating the degree 3 polynomial having a coefficient vector f equal to a characteristic vector of the authorized recipient set S, the degree 3 polynomial having a coefficient vector f equal to a characteristic vector of the authorized recipient set S, the vector f having a length of n 3 and recovering the broadcast message by evaluating the polynomial with the digest using the group elements in a pairing algorithm; and storing the recovered broadcast message for further processing in the receiver module. The method of claim 1.

3. 1. A system for encrypting a message as a ciphertext for transmission over a broadcast network to multiple recipients, the system comprising: a network communication interface configured to communicate over a wired or wireless network; a set of processing circuitry coupled to the network communication interface, the processing circuitry comprising: receiving a set of authorized recipients S, the set of authorized recipients identifying a set of recipients that have permission to recover the broadcast message, where S is a subset of {1, 2, ..., N}, where n is a number between n 3 an integer such that N is greater than or equal to the total number of possible recipients of the message; generating a public key mpk at an authority, said public key mpk comprising: a) a pairing group, the pairing group including a first source group, a second source group, and a target group; b) A vector [v] as n random group elements from the first group of sources. 1 , [w 1 ] 1 , and [w 2 ] 1 and, c) a random group element [v 0 ] 1 and, d) A random group element [α] from the target group. T and receiving the public key mpk from the authority; receiving or preparing a message M for encryption; encoding the set of authorized recipients S as a polynomial of degree 3, the polynomial of degree 3 having a coefficient vector f equal to a characteristic vector of the set of recipients S, the vector f having length n 3 and A vector of n group elements from the public key mpk [w 2 ] 1 and a random vector w of n integers modulo p. 3 yielding a digest of the n group elements by sampling f and cryptographically compressing the vector f; [0025] generating a ciphertext of the message M by and transmitting the ciphertext and the set of authorized recipients S to a recipient over the broadcast network. system.

4. and further configured to decrypt the ciphertext by a recipient to recover the broadcast message, the recovery comprising: receiving, at a receiver module, the ciphertext and the set of authorized recipients S from a remote broadcast module over the broadcast network, the ciphertext further comprising a digest, the digest further comprising information regarding the polynomial; receiving a private key, the private key including group elements from the second group of sources; checking whether the recipient is in a set of authorized recipients; calculating the degree 3 polynomial having a coefficient vector f equal to a characteristic vector of the authorized recipient set S, the degree 3 polynomial having a coefficient vector f equal to a characteristic vector of the authorized recipient set S, the vector f having a length of n 3 and recovering the broadcast message by evaluating the polynomial with the digest using the group elements in a pairing algorithm; and storing the recovered broadcast message for further processing in the receiver module. The system of claim 3.

5. A computer-readable storage medium storing computer-executable instructions which, when executed by one or more computing devices, configure the one or more computing devices to perform the method of claim 1 or 2.

Images