Improved resource utilization in broadcast encryption

Abstract

Broadcast networks have a bandwidth of O(N 1 / 3 A pairing-based broadcast encryption scheme for N users with parameters of size n can be used. A pairing-based ciphertext-prescribed attribute-based encryption (CP-ABE) scheme for a class of polynomials of degree 3 can be implemented with compact parameters. The public key, ciphertext, and private key contain O(n) group elements, where n is the input length of the function. This construction achieves adaptive security against unbounded collusion and relies on the (bilateral) k-Lin assumption on prime-order bilinear groups.

Description

Technical Field

[0001] This disclosure relates to a pairing-based broadcast encryption scheme with O(N 1 / 3 )-sized parameters that achieves adaptive security against unbounded collusions.

Background Art

[0002] In ciphertext-policy attribute-based encryption (CP-ABE), a ciphertext ct is associated with a predicate f and a message m, and a key sk is associated with an attribute x, and decryption returns m when x satisfies f. Broadcast encryption is a special case of CP-ABE where the predicate is specified by a set S ⊆ [N] and decryption returns m when x ∈ S. In either case, in addition to the ciphertext, an adversary who sees the secret keys for any number of attributes x1, x2, … does not know anything about m unless there is one that satisfies f for these attributes, and requires security against unbounded collusions.

[0003] Broadcast encryption has been an active research area since its introduction in the 1990s, and the main goal is to obtain a scheme with short parameters, especially short ciphertext ct and short public key mpk. Previous research includes pairing-based broadcast encryption schemes that use ciphertexts of a fixed size (ignoring the contribution from the set S) and secret keys, but this scheme has a large public key mpk that is linear with respect to the total number N of users, and furthermore, decryption requires access to mpk. To address these drawbacks, the scheme can be modified to achieve a public key of size O(√N) at the cost of a ciphertext of size O(√N). Further research has shown how to achieve parameters of size O(√N) (i.e., |mpk| + |ct| + |sk| = O(√N)) under the standard k-Lin assumption, improve the q-type assumption, and further strengthen the security guarantee from selective security to adaptive security.

[0004] Other prior research has constructed broadcast encryption schemes using parameters of size poly(log N) from pairing and LWE. Nevertheless, the following fundamental problem remains open. Can a broadcast encryption scheme using parameters of size o(√N) (i.e., |mpk| + |ct| + |sk| = o(√N)) be constructed from pairing (alone)?

[0005] Prior approaches for pairing-based broadcast encryption require |ct|·max{|sk|,|mpk|}=Ω(N), which implies a Ω(√N) bound on the parameter size. Moreover, this is essentially optimal for a large class of approaches for pairing-based broadcast encryption, indicating that breaking the √N barrier substantially requires new ideas. SUMMARY OF THE INVENTION PROBLEM TO BE SOLVED BY THE INVENTION

[0006] The present invention relates to broadcast encryption and attribute-based encryption schemes. MEANS FOR SOLVING THE PROBLEM

[0007] The present invention includes a pairing-based broadcast encryption scheme with parameters of size O(N 1 / 3 ) that breaks the long-standing √N barrier. This broadcast encryption scheme achieves adaptive security against unbounded collusions and relies on the bilinear k-Lin assumption in prime-order bilinear groups. Further, this construction provides a certain range of trade-off between ciphertext size and key size. Prior to this research, it was not known how to achieve parameters of size o(√N) with selective security even using q-type assumptions or general bilinear groups.

[0008] More generally, the present invention is {0,1} n (more generally Zp n This includes a CP-ABE for polynomials of degree 3 over ). Here, the public key, ciphertext, and private key contain O(n) group elements, and this scheme also achieves adaptive security against unrestricted collusion under the bilateral k-Lin assumption. Then this broadcast encryption scheme is derived as a direct corollary. The set membership in S∈[N] is {0,1} O(N^(1 / 3)) This is because it can be encoded as a polynomial of degree 3. Prior to this study, CP-ABE schemes with O(n) size parameters from pairings were known only for a class of polynomials of degree 2.

[0009] The design of the scheme of this invention deviates considerably from existing pairing-based ABE schemes by utilizing the power of "quadratic reconstruction." This idea is O(N 1 / 3 Previously used to construct an information-theoretic secret key counterpart to a broadcast construction (formally called a conditional disclosure of secrets, CDS) with a size parameter of ). However, this scheme works only on fields of characteristic 2, and it is incompatible with bilinear group operations "in exponents". Instead, the present invention provides a novel technique for instantiating quadratic reconstruction by referring to functional encryption on polynomials of degree 2.

[0010] In various embodiments, a computer-implemented method, a computing device, and a computer-readable storage medium are disclosed. In one exemplary embodiment for encrypting a message for transmission to a plurality of recipients over a broadcast network as a ciphertext, the computer-implemented method, the computing device, and the computer-readable storage medium include, in a broadcast module, receiving a set S of authorized recipients, where the set of authorized recipients identifies a set of recipients having permission to recover the broadcast message, S is a subset of {1, 2,..., N}, and n is an integer such that n 3 ≥ N, and N is the total number of possible recipients of the message, the step of; generating a public key mpk by an authority, where the public key mpk includes three vectors [v]1, [w1]1, and [w2]1 of n random group elements in a first source group, a random group element [v0]1 in the first source group, and a random group element [α] in a target group T the step of; receiving the public key mpk from the authority in the broadcast module; receiving or creating a message M for encryption; encoding the set S of authorized recipients as a polynomial of degree 3, where the polynomial of degree 3 has a coefficient vector f equal to the characteristic vector of the set of recipients S, and the vector f has length n 3 the step of; sampling a random vector w3 of n integers modulo p using a vector [w2]1 of n group elements from the public key mpk to yield a digest of n group elements and cryptographically compressing the vector f; sampling a random scalar s, multiplying the random scalar s by the digest, the vector w3, and the public key mpk, and concatenating the outputs of the multiplication to form a ciphertext to generate a ciphertext of the message M; and transmitting the ciphertext to the authorized recipients identified in the set S.

[0011] Further embodiments involve the ciphertext

number

[0012] Further embodiments may include instructions for a receiver to decrypt the ciphertext and recover the broadcast message. The decryption is a receiver module receiving a ciphertext and an authorized receiver set from a remote broadcast module through a broadcast network, wherein the ciphertext further includes a digest, the digest further includes information about a polynomial; receiving a key from a remote authority module, the key including a group element; checking whether the receiver is in the authorized receiver set; and computing the degree 3 polynomial having a coefficient vector f equal to the characteristic vector of the receiver set S, wherein the degree 3 polynomial has a coefficient vector f equal to the characteristic vector of the receiver set S, and the vector f is of length n 3 The method includes the steps of: having; restoring the broadcast message by evaluating the polynomial using the digest with group elements in a pairing algorithm; and storing the restored broadcast message for further processing in the receiver module. [Brief explanation of the drawing]

[0013] The accompanying drawings, included to provide further understanding, are incorporated into this specification and constitute part thereof, illustrating the disclosed embodiments and, together with this paper, serving to illustrate the principles of the disclosed embodiments. [Figure 1] This block diagram shows a multimedia communication system suitable for use in various embodiments. [Figure 2]This document illustrates an exemplary computer-implemented method for the claimed broadcast encryption scheme. [Figure 3] An exemplary computer system architecture for implementing the claimed system and method is shown. [Figure 4] Further details of exemplary computer system architectures for implementing the claimed system and method are provided. [Modes for carrying out the invention]

[0014] Technical Overview An overview of our construction is revealed here.

number

number

[0015] We are the asymmetric bilinear group of prime order p.

number

number

number

[0016] The tensor product is used extensively. This allows for a more compact description of the schemes of the present invention and avoids triple summation for computing polynomials of degree 3. Furthermore, as the schemes of the present invention become increasingly complex, scalars are replaced with vectors, in which some scalar-vector products naturally transition to tensor products of two vectors, and some others transition to vector-matrix products.

[0017] Roadmap Here, two candidate CP-ABE schemes for polynomials of degree 3 are described. The first one |mpk|=O(n 2 ), |ct|=O(n), |sk|=O(n) This achieves |ct|=O(n 2) or |sk|=O(n 2 ) is required. The second one is a variation of the first one where |mpk| = O(n), and thus achieves a parameter size of O(n).

[0018] Below, we will explain how to modify this second candidate to obtain the final CP-ABE scheme of the present invention, which achieves O(n) size parameters and adaptive safety under the bi-k-Lin assumption.

[0019] CP-ABE for polynomials of degree 2

number

number

[0020] Use the following for deciphering.

number

[0021] According to the dual-system encryption method, security boils down to demonstrating that M is hidden given a single ciphertext-key pair. In particular, it is sufficient to demonstrate the following:

number

number

[0022] First candidate CP-ABE Parameter size |mpk|=O(n 2 ), |ct|=O(n), |sk|=O(n) For a polynomial of degree 3 having the following properties, a candidate CP-ABE is disclosed.

[0023] To arrive at this scheme, first,

number

number

[0024] To achieve sk = O(n), the above equation is calculated using the following formula.

number

number

[0025] MPK compression To arrive at a CP-ABE scheme with O(n) size parameters, we compress the mpk in the previous scheme as follows: instead of having a set up pick w3, the ciphermachine samples a random w3. This is in the mpk.

number

number

[0026] Second candidate CP-ABE A candidate CP-ABE scheme with O(n) size parameters is disclosed. Here, terms not present in the previous scheme are shaded.

number

[0027] Final CP-ABE Here, we explain how we arrive at our final CP-ABE for a class of degree 3 polynomials that achieve adaptive safety against unrestricted collusion under the k-Lin assumption and the bilateral k'-Lin assumption (k≧1, k'≧2) in G1 and G2.

number

[0028] Here,

number

[0029] notation The expression s←S represents the fact that s is randomly and uniformly picked from a finite set S. This is used to show that the two distributions are statistically indistinguishable.

number

number

[0030] Tensor product

number

[0031] The mixed product properties of tensor products state the following:

number

[0032] A useful system of the mixed product property is any pair of row vectors u,v∈Z n Regarding this, I will state the following:

number

[0033] We adopt the convention that matrix multiplication takes precedence over tensor multiplication. Therefore,

number

[0034] bilinear groups of prime order

number

[0035] Recall the Diffie-Hellman (MDDH) matrix assumption for G1[?]: Assumption 1 (MDDH d k,l (Assumption) Let k, l, d ∈ N. If the following advantage function is negligible in λ for all PPT adversaries A, then MDDH d k,l The assumption is that it holds true.

number

[0036] The bilateral MDDH assumption is similarly defined using the advantage function.

number

[0037] Note that for k=1, the bilateral MDDH and bilateral k-Lin assumptions are false. In the disclosed embodiment, the advantage function

number

[0038] Attribute-Based Encryption Attribute-based cryptography is defined within the key encapsulation framework. The attribute-based encryption scheme for a predicate P(·,·) consists of four algorithms (Setup, Enc, KeyGen, Dec).

number

number

number

number

[0039] In the disclosed scheme, kem∈G T It can be calculated and then hashed to {0,1} λ It will become.

[0040] Correctness For all (x,y) ∈ X×Y such that P(x,y)=1, Pr[(ct,kem)←Enc(mpk,x);Dec(sk,y,ct,x)=kem)]=1 This requires that the following occurs. Here, the probability is (mpk, msk) ← Setup(1 λ This is taken for coins of type X, Y and Enc.

[0041] Definition of safety For a stateful adversary A, we define the following advantage function.

number

[0042] CP-ABE for polynomials of degree 3 Here

number

[0043] Broadcast encryption Here

number

[0044] CP-ABE for polynomials of degree 3 Here, we present an adaptively safe CP-ABE for polynomials of degree 3 for unrestricted collusion, under the k-Lin assumption and bilateral k'-Lin assumption in G1 and G2, where k≧1 and k'≧2. Our scheme is:

number

number

[0045] scheme

number

number

number

number

[0046] Size N 1 / 3 Broadcast encryption If n1n2n3≧N, then the set membership within S⊆[N] is always

number

number

[0047] File System Implementation The scheme of the present invention can be configured for efficiency. The scheme of the present invention can be instantiated using a typical BLS12-381 curve in which |G1| is 48 bytes and |G2| is 96 bytes. File sharing in an encrypted file system is a non-limiting example of the use of broadcast encryption of the present invention. Windows EFS has a 256KB limit in the file header for EFS metadata and supports up to 800 individual users. Assuming a 32-bit user ID, 1000 users can be supported with a file header (S,ct) of size 4 × 1000 + 82 × 48 = 7936 bytes. Here, each user holds a private key of size 67 × 96 = 6432 bytes. The result can be improved by setting n1=20, n2=10, n3=5, which gives a header of size 4 × 1000 + 72 × 48 = 7456 bytes and a private key of size 57 × 96 = 5482 bytes. However, since N=1000 is quite small, a broadcast encryption scheme with O(√N) parameters can achieve similar performance, namely a file header of size 4×1000+66×48=7168 and a secret key of size 68×96=6528 bytes.

[0048] System Implementation Various embodiments may be implemented within diverse communication systems, networks, and / or mobile multimedia broadcast systems, one example of which is shown in Figure 1. In particular, Figure 1 shows a communication system in which a mobile receiver device 102 can receive content from a multimedia broadcast network 104, a unicast network 106, or via the Internet 108. A typical multimedia broadcast network 104 includes a number of broadcast transmitters 112 controlled by a mobile broadcast network control center / broadcast operations center (BOC) 114. The multimedia broadcast network 104 broadcasts content from the broadcast transmitters 112 as mobile broadcast transmissions 113 for reception by the mobile receiver device 102. Within the BOC 114, there may be one or more servers 110 for managing content broadcasts, which provide connectivity to the Internet 108.

[0049] In addition to the multimedia broadcast network 104, the mobile receiver device 102 may communicate via a cellular telephone network, a WiFi network (not shown), a unicast network 106 such as WiMAX, etc. A typical cellular telephone network includes multiple cellular base stations 116 coupled to a network operations center 118. The network operations center 118 operates to connect voice and data calls between the mobile receiver device 102 and other network destinations, for example, via telephone ground lines (e.g., a POTS network, not shown) and the internet 108.

[0050] Communication between the mobile receiver device 102 and the unicast network 106 can be achieved via a bidirectional wireless communication link 115 such as LTE, 4G, 3G, CDMA, TDMA, and other cellular telephone communication technologies. Such a bidirectional wireless communication link 115 may allow a user to stream multimedia content to a receiver device (e.g., a mobile device).

[0051] To facilitate internet data communication (e.g., streaming of video feeds), the unicast network 106 typically includes one or more servers 120 connected to or located within a network operations center 118 that provides connectivity to the Internet 108. The mobile receiver device 102 may also connect to the Internet 108 via a wired connection when available, in which case the Internet 108 can function as a unicast network. The mobile receiver device 102 may also receive non-broadcast content through the Internet 108 using well-known conventional web-based access protocols.

[0052] In general, the operations for receiving and rendering content by a receiver device (e.g., the mobile receiver device 102 discussed above) may be divided into separate, independent groups or categories of operations, each of which may be assigned to a layer (e.g., physical layer, data link layer, etc.). In each of these layers, various hardware and / or software components may implement functions corresponding to the role assigned to that layer. For example, a media stream (e.g., broadcast, point-to-point, etc.) is typically received at the physical layer, which may include a radio receiver, buffers, and processing components that perform operations such as demodulation, recognition of symbols in the radio frequency (RF) signal, and other operations to extract raw data from the received RF signal.

[0053] Figure 2 shows an exemplary computer implementation of the broadcast encryption scheme described in the claims. In the illustrated exemplary embodiment, a setup routine generates a master public key (MPK) 270 and provides it to the broadcast authority 210. Key operations 245, 255, 265 may be performed in a centralized or trusted authority or third party, which may be associated with and controlled by the broadcast authority 210, or not associated with or controlled by it. The setup routine 245 also generates a master private key (MSK) 250. The setup routine 245 may be invoked by a private key generator (PKG) 255. The PKG 255 generates a system master public key MPK 250 and a system master private key MSK 250, making the MPK publicly available and keeping the MSK secret. The key generation routine 265 receives the MPK and MSK, as well as user identification information 275, and outputs a private key 280 for each specific user.

[0054] Next, the broadcast authority 210 performs encryption 215 using MPK 270, which is then used as ciphertext for the broadcast message 220. The broadcast message is then delivered through a broadcast channel 225, which can take any wired or wireless form as described in this paper. The ciphertext is received by a registered receiver 230. The registered receiver is provided with some key material 280 in relation to identification information 275 provided to the key generation module 265. Based on the identification information 275, a private key 280 can be provided to the receiver. Using the private key, the registered receiver can perform decryption 235 of the broadcast ciphertext and generate the resulting broadcast message 240.

[0055] Figures 3 and 4 show exemplary computer systems useful for implementing the various embodiments described herein. The various embodiments may be implemented using one or more computer systems, such as the computer system 500 shown in Figure 3. One or more computer systems 500 may be used, for example, to implement any of the embodiments discussed herein, as well as combinations and subcombinations thereof.

[0056] The computer system 500 may include one or more processors (also called a central processing unit, processing device, or CPU), such as a processor 504. The processor 504 may be connected to a communication infrastructure 506 (for example, a bus).

[0057] The computer system 500 may also include user input / output devices 503, such as a monitor, keyboard, and pointing device, which can communicate with a communication infrastructure 506 through a user input / output interface 502. One or more of the processors 504 may be graphics processing units (GPUs). In one embodiment, a GPU may be a processor that is a specialized electronic circuit designed to process mathematically intensive applications. A GPU may have an efficient parallel structure for parallel processing of large blocks of data, such as mathematically intensive data common in computer graphics applications, images, videos, etc.

[0058] The computer system 500 may also include main memory 508, such as random access memory (RAM). Main memory 508 may include one or more levels of cache. Main memory 508 may store control logic (i.e., computer software, instructions, etc.) and / or data. The computer system 500 may also include one or more secondary storage devices or secondary memory 510. Secondary memory 510 may include, for example, a hard disk drive 512 and / or a removable storage device or removable storage drive 514. The removable storage drive 514 may interact with a removable storage unit 518. The removable storage unit 518 may include a computer-usable or readable storage device that stores computer software (control logic) and / or data. The removable storage drive 514 reads from and / or writes to the removable storage unit 518.

[0059] The secondary memory 510 may include other instruments, devices, components, means, or other approaches for allowing computer programs and / or other instructions and / or data to be accessed by the computer system 500. Such means, devices, components, instruments, or other approaches may include, for example, a removable storage unit 522 and an interface 520. Examples of the removable storage unit 522 and interface 520 may include a program cartridge and cartridge interface, a removable memory chip (such as an EPROM or PROM) and associated socket, a memory stick and USB port, a memory card and associated memory card slot, and / or any other removable storage unit and associated interface.

[0060] The computer system 500 may further include a communication interface 524 (for example, a network interface). The communication interface 524 may enable the computer system 500 to communicate with and interact with any combination of external devices, external networks, external entities, etc. (individually and collectively referred to as remote devices, networks, entities 528). For example, the communication interface 524 may allow the computer system 500 to communicate with external or remote devices, networks, entities 528 through a communication path 526. The communication path may be wired and / or wireless (or a combination thereof) and may include any combination of LAN, WAN, Internet, etc. Control logic and / or data may be transmitted to and from the computer system 500 via the communication path 526.

[0061] Computer system 500 may be, to give some non-limiting examples, a personal digital assistant (PDA), a desktop workstation, a laptop or notebook computer, a netbook, a tablet, a smartphone, a smartwatch or other wearable device, an appliance, part of the Internet of Things, and / or an embedded system, or any combination thereof.

[0062] Computer System 500 may be a client or server computing device that accesses or hosts any application and / or data through any delivery paradigm, including but not limited to the aforementioned examples, including remote or distributed cloud computing solutions, local or on-premises software ("on-premises" cloud-based solutions), "as a service" models (e.g., Content as a Service (CaaS), Digital Content as a Service (DCaaS), Software as a Service (SaaS), Managed Software as a Service (MSaaS), Platform as a Service (PaaS), Desktop as a Service (DaaS), Framework as a Service (FaaS), Backend as a Service (BaaS), Mobile Backend as a Service (MBaaS), Infrastructure as a Service (IaaS), etc.), and / or hybrid models that include any combination of the aforementioned examples or other service or delivery paradigms.

[0063] Figure 4 shows an exemplary machine of computer system 900 on which a set of instructions can be executed to cause the machine to perform any one or more of the operations described herein. In alternative implementations, the machine may be connected to other machines in a LAN, intranet, extranet, and / or the internet (e.g., a network connection). The machine may operate as a server or client machine in a client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or client machine in a cloud computing infrastructure or environment.

[0064] A machine can be a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, web appliance, server, network router, switch or bridge, specialized application or network security appliance or device, or any device capable of executing a set of instructions (sequentially or otherwise) that specify actions to be performed by that machine. Furthermore, although a single machine is shown, the term “machine” should also be interpreted to include any collection of machines that individually or jointly execute a set (or set) of instructions to perform any one or more of the methods described herein.

[0065] An exemplary computer system 900 includes a processing unit 902, main memory 904 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM), etc.), static memory 906 (e.g., flash memory, static random access memory (SRAM), etc.), and data storage devices 918, which communicate with each other via a bus 930.

[0066] The processing unit 902 represents one or more processing units, such as a microprocessor or a central processing unit. More specifically, the processing unit may be a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing another instruction set, or a processor implementing a combination of instruction sets. The processing unit 902 may also be one or more special-purpose processing units, such as an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), or a network processor. The processing unit 902 is configured to execute instructions 926 for performing the operations and steps described herein.

[0067] The computer system 900 may further include a network interface device 908 for communication through the network 920. The computer system 900 may also include a video display unit 910, an alphanumeric input device 912 (e.g., a keyboard), a cursor control device 914 (e.g., a mouse), a graphics processing unit 922, a signal generator 916 (e.g., a speaker), another graphics processing unit 922, a video processing unit 928, and an audio processing unit 932.

[0068] The data storage device 918 may include a machine-readable medium 924 (also known as a computer-readable storage medium) in which one or more instruction sets 926 (e.g., software instructions) embodying any one or more of the operations described herein are stored. The instructions 926 may also be entirely or at least partially in the main memory 904 and / or the processing unit 902 during their execution by the computer system 900, where the main memory 904 and the processing unit 902 also constitute a machine-readable storage medium.

[0069] In one example, instruction 926 includes instructions for implementing operations and functions corresponding to the disclosed subject matter. Although the machine-readable storage medium 924 is shown as a single medium in the exemplary implementation, the term “machine-readable storage medium” should be interpreted to include a single or multiple mediums (e.g., a centralized or distributed database, and / or associated caches and / or servers) that store one or more sets of the instructions 926. The term “machine-readable storage medium” should also be interpreted to include any medium that can store or encode a set of instructions 926 for machine execution, causing a machine to perform any one or more of the operations of the Disclosed. Thus, the term “machine-readable storage medium” should be interpreted to include, but not limited to, solid-state memory, optical media, and magnetic media.

[0070] Some parts of the detailed explanation are presented with respect to algorithms and symbolic representations of operations on data bits in computer memory. These algorithmic descriptions and representations are the way that those skilled in the field of data processing technology use to most effectively communicate the content of their research to others skilled in the field. An algorithm is considered here, and also generally, to be a self-consistent sequence of actions leading to a desired result. An action is one that requires the physical manipulation of physical quantities. These quantities, though not always, are typically in the form of electrical or magnetic signals that can be stored, combined, compared, and otherwise manipulated. It has sometimes been found convenient, mainly for convention, to refer to these signals as bits, values, elements, symbols, signs, terms, numbers, etc.

[0071] However, it should be noted that all of these terms and similar terms should be associated with appropriate physical quantities and are merely convenient labels applied to those quantities. As is evident from the above discussion, unless otherwise specified, discussions throughout this paper using terms such as “identify,” “determine,” “execute,” “implement,” “collect,” “create,” or “transmit” are understood to refer to actions and processes of a computer system or similar electronic computing device that manipulate and transform data represented as physical (electronic) quantities in the registers and memory of the computer system into other data similarly represented as physical quantities in the memory or registers or other such information storage devices of the computer system.

[0072] This disclosure also relates to an apparatus for performing the operations described herein. This apparatus may be specifically constructed for the intended purpose, or may include a computer that is selectively activated or reconfigured by a computer program stored therein. Such computer programs may be stored on computer-readable storage media, such as, but not limited to, floppy disks, optical disks, CD-ROMs and magneto-optical disks, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic or optical cards, or any type of medium suitable for storing electronic instructions. These are each coupled to a computer system bus.

[0073] The operations and examples presented herein are not inherently related to any particular computer or other device. Various types of systems may be used with the programs taught herein. Alternatively, it may be convenient to construct a device more specialized for performing the operations. The structures of these diverse systems will be described herein. In addition, this disclosure is not written with reference to any particular programming language. It will be understood that a variety of programming languages ​​may be used to carry out the teachings of this disclosure as described herein.

[0074] This disclosure may be provided as a computer program product or software which may include a machine-readable medium storing instructions that can be used to program a computer system (or other electronic device) to perform the processes described herein. The machine-readable medium includes any mechanism for storing information in a form that can be read by a machine (e.g., a computer). For example, machine-readable (e.g., computer-readable) medium includes machine-readable storage media such as read-only memory ("ROM"), random-access memory ("RAM"), magnetic disk storage media, optical storage media, and flash memory devices.

[0075] In some embodiments, a tangible non-temporary device or product including a tangible non-temporary computer-usable or readable medium storing control logic (software) may also be referred to herein as a computer program product or program storage device. This includes, but is not limited to, tangible products embodying the computer system 500, the main memory 508, the secondary memory 510, and the removable storage units 518 and 522, as well as any combination thereof. When such control logic is executed by one or more data processing devices (such as the computer system 500), such data processing devices may be made to operate as described herein.

[0076] Based on the teachings contained herein, it will be obvious to those skilled in the art how embodiments of the disclosure can be constructed and used with data processing devices, computer systems, and / or computer architectures other than those shown in Figures 3 and 4. In particular, embodiments can operate with software, hardware, and / or operating system implementations other than those described herein.

[0077] It should be understood that the section describing embodiments for carrying out the invention, and not any other section, is intended to be used to interpret the claims. Other sections may describe one or more, but not all, exemplary embodiments conceived by the inventor and are therefore not intended to limit the scope of the claims of this disclosure or the appended claims in any way.

[0078] While this disclosure describes exemplary embodiments for exemplary fields and applications, it should be understood that this disclosure is not limited thereto. Other embodiments and modifications thereof are possible and fall within the scope and spirit of this disclosure. For example, without limiting the generality of this paragraph, embodiments are not limited to the software, hardware, firmware, and / or entities shown in the drawings described herein. Furthermore, embodiments (whether expressly described herein or not) may have significant utility to fields and applications beyond the examples described herein.

[0079] Embodiments described herein are illustrated using functional components that demonstrate the implementation of specified functions and their relationships. The boundaries of these functional components are arbitrarily defined herein for the sake of clarity. Alternative boundaries can be defined, provided that the specified functions and relationships (or their equivalents) are adequately performed. Furthermore, alternative embodiments may perform functional blocks, steps, operations, methods, etc., using a different order than that described herein.

[0080] References in this specification to “one embodiment,” “a particular embodiment,” “exemplary embodiment,” or similar phrases indicate that the embodiments described may include certain features, structures, or characteristics, but not all embodiments necessarily include those particular features, structures, or characteristics. Furthermore, such phrases do not necessarily refer to the same embodiments. Moreover, where certain features, structures, or characteristics are described in relation to a particular embodiment, it is within the knowledge of those skilled in the art to incorporate such features, structures, or characteristics into other embodiments, whether or not they are explicitly mentioned or described herein. Furthermore, some embodiments may be described using the expressions “combined” and “connected” and their derivatives. These terms are not necessarily intended to be synonymous with each other. For example, some embodiments may be described using the terms “connected” and / or “combined” to indicate that two or more elements are in direct physical or electrical contact with each other. However, the term “combined” can also mean that two or more elements are not in direct contact with each other but still cooperate or interact with each other.

[0081] The scope and breadth of this disclosure should not be limited by any of the exemplary embodiments described above, but should be defined solely in accordance with the following claims and their equivalents. In the above specification, implementations of the disclosure have been described with reference to their specific exemplary implementations. It will be apparent that various modifications can be made thereto without departing from the broader spirit and scope of the implementations of the disclosure described in the following claims. Thus, this specification and the drawings should be considered illustrative rather than restrictive.

Claims

1. A method for encrypting a message as ciphertext for transmission to multiple recipients over a broadcast network, the method being: In the broadcast module, the step is to receive an authorized recipient set S, the authorized recipient set identifying a set of recipients (230) who have permission to restore the broadcast message (240), where S is a subset of {1, 2, ..., N}, and n is n. 3 Step is an integer such that ≥ N, where N is the total number of possible recipients of the message; A step of generating a public key mpk(250) in a remote authority module, wherein the public key mpk(250) is a) A pairing group, the pairing group includes a first source group, a second source group, and a target group, b) A vector [v] consisting of n random group elements from the first source group. 1 [w 1 ] 1 , and [w 2 ] 1 and, c) Random group elements from the first source group [v 0 ] 1 and, d) a random group element [α] from the target group T and; The broadcast module includes the step of receiving the public key mpk(250) from the remote authority module; The broadcast module includes the steps of receiving or creating a message M for encryption (215); The broadcast module comprises the step of encoding the authorized recipient set S as a polynomial of degree 3, wherein the polynomial of degree 3 has a coefficient vector f equal to the characteristic vector of the recipient set S, and the vector f has length n 3 Having a step; In the broadcast module, a vector of n group elements [w 2 ] 1 Using this, a random vector w of n integers modulo p 3 The steps include: obtaining a digest of n group elements by sampling, and cryptographically compressing the vector f; In the aforementioned broadcast module, [Math 1] The steps include: generating the ciphertext of message M by; The broadcast module includes the step of transmitting the ciphertext and the authorized recipient set S to recipients on the broadcast network, method.

2. The process further includes having the receiver decrypt the ciphertext (235) and execute an instruction to restore the broadcast message (240), wherein the instruction is: A receiver module receives the ciphertext and the authorized receiver set S from the broadcast module through the broadcast network, wherein the ciphertext further includes a digest, and the digest further includes information relating to the polynomial; The receiver module receives a secret key from the remote authority module, the secret key comprising group elements from the second group of sources; The receiver module includes the step of checking whether the receiver is in the authorized receiver set S; The step of calculating a polynomial of degree 3 in the receiver module, wherein the polynomial of degree 3 has a coefficient vector f equal to the characteristic vector of the authorized receiver set S, and the vector f is of length n 3 Having a step; The receiver module includes the step of reconstructing the broadcast message by using the group elements in the pairing algorithm and evaluating the polynomial using the digest; For further processing in the receiver module, the receiver module is configured to perform the step of storing the recovered broadcast message in the receiver module. The method according to claim 1.

3. A system for encrypting a message as ciphertext for transmission to multiple recipients over a broadcast network, wherein the system: A network communication interface configured to communicate via a wired or wireless network; It has a set of processing circuits coupled to the network communication interface, the processing circuits being: A step of receiving an authorized recipient set S, the authorized recipient set identifying a set of recipients authorized to restore a broadcast message, where S is a subset of {1, 2, ..., N}, and n is n 3 Step is an integer such that ≥ N, where N is the total number of possible recipients of the message; A step of generating a public key mpk in a remote authority module, wherein the public key mpk is: a) A pairing group, the pairing group includes a first source group, a second source group, and a target group, b) A vector [v] consisting of n random group elements from the first source group. 1 [w 1 ] 1 , and [w 2 ] 1 and, c) Random group elements from the first source group [v 0 ] 1 and, d) A random group element [α] from the target group. T Steps including; The steps include: receiving the public key mpk from the remote authority module; The broadcast module includes the steps of receiving or creating a message M for encryption; The step of encoding the set of authorized recipients S as a polynomial of degree 3, wherein the polynomial of degree 3 has a coefficient vector f equal to the characteristic vector of the set of recipients S, and the vector f has length n 3 Having a step; The vector of n group elements [w 2 ] 1 Using this, a random vector w of n integers modulo p 3 The steps include: obtaining a digest of n group elements by sampling, and cryptographically compressing the vector f; [Math 2] The steps include: generating the ciphertext of message M by; A module having a configuration to perform the steps of sending the ciphertext and the authorized recipient set S to recipients on the broadcast network, system.

4. It is further configured for the recipient to decrypt the ciphertext and restore the broadcast message, which involves: A receiver module receives the ciphertext and the authorized receiver set S from a remote broadcast module via the broadcast network, wherein the ciphertext further includes a digest, and the digest further includes information relating to the polynomial; A step of receiving a private key, wherein the private key includes group elements from the second group of sources; The steps include: checking whether the recipient is in the authorized recipient set S; A step of calculating a polynomial of degree 3 having a coefficient vector f equal to the characteristic vector of the set of authorized recipients S, wherein the polynomial of degree 3 has a coefficient vector f equal to the characteristic vector of the set of authorized recipients S, and the vector f is of length n 3 Having a step; The steps include: reconstructing the broadcast message by using the group elements in the pairing algorithm and evaluating the polynomial using the digest; Further processing in the receiver module includes the step of storing the recovered broadcast message, The system according to claim 3.

5. A computer-readable storage medium storing computer-executable instructions that, when executed by one or more computing devices, configure the one or more computing devices to perform the method described in claim 1 or 2.

Images