User key management method for broadcast encryption (BE)

• US 20060159270A1
• Filed: 11/23/2005
• Published: 07/20/2006
• Est. Priority Date: 12/30/2004
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Urivskiy, Alexei V., Chmora, Andrey L.
• Granted Patent: US 8,054,973 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A broadcast encryption (BE) for acquiring an encryption key which is used to decrypt a session key by a node receiving services, with less computation overhead. A plurality of subgroups, each consisting of at least one of a plurality of nodes, are generated, and layers are formed according to a number of nodes which form the subgroup. Prime numbers are assigned to the subgroups not to overlap one another, and a subgroup at an upper layer is connected with a subgroup, which includes nodes forming the subgroup of the upper layer, at a lower layer. A prime number assigned to a subgroup at an upper layer, a prime number assigned to an unconnected subgroup at the same layer, and a prime number assigned to a subgroup at a lower layer, are re-assigned to each subgroup, and an encryption key which is generated from the re-assigned prime numbers is assigned to the each group.

Claims

1. An encryption key management method for a broadcast encryption (BE), comprising:

generating a plurality of subgroups, each subgroup consisting of at least one of a plurality of nodes, and forming layers according to a number of nodes which form the subgroup;

assigning prime numbers to the subgroups not to overlap one another, and connecting a subgroup at an upper layer with a subgroup, which includes nodes forming the subgroup of the upper layer, at a lower layer; and

re-assigning a prime number assigned to a subgroup at an upper layer, a prime number assigned to an unconnected subgroup at the same layer, and a prime number assigned to a subgroup at a lower layer, to each of the subgroups, and assigning an encryption key which is generated from the re-assigned prime numbers to each of the subgroups.

2. The encryption key management method of claim 1, wherein a virtual management node is located at the top of the layers to manage subgroups consisting of one node.

3. The encryption key management method of claim 1, wherein, if a number of nodes is N, the subgroup is one of a subgroup consisting of the management node, subgroups consisting of one node, subgroups consisting of two nodes, . . . , and subgroups consisting of (N−

1) nodes.

4. The encryption key management method of claim 3, wherein the subgroups are split into at least two groups, and encryption keys which are derived using intrinsic functions are assigned to the split groups.

5. The encryption key management method of claim 4, wherein the split groups include the subgroup consisting of the management node, and the subgroups consisting of one node.

6. The encryption key management method of claim 5, wherein each of the nodes is assigned encryption keys equal to the number of the split groups.

7. The encryption key management method of claim 1, wherein, if a revoked node is included in the nodes, a session key is encrypted using an encryption key which is assigned to a subgroup consisting of nodes other than the revoked node.

8. The encryption key management method of claim 1, wherein each of the nodes is assigned an encryption key which is derived using an exponential function having the re-assigned prime numbers as an exponent.