Method for attribute based broadcast encryption with permanent revocation

• US 9,413,528 B2
• Filed: 08/22/2012
• Issued: 08/09/2016
• Est. Priority Date: 08/24/2011
• Status: Active Grant

• Current Assignee: Ben Gurion University of The Negev, Sami Shamoon College Of Engineering
• Original Assignee: Ben Gurion University of The Negev
• Inventors: Dolev, Shlomi, Gilboa, Niv, Kopeetsky, Marina
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): NGUYEN, NGOC THACH D
• Application Number:
  US14/239,580
• Publication Number:
  US 20140226816A1
• Time in Patent Office: 1,448 Days
• Field of Search: 380/255
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14

Abstract

The invention is a method for broadcast encryption that allows a broadcaster to send encrypted data to a set of users such that only a subset of authorized users can decrypt said data. The method comprises modifications to the four stages of the basic Cipher-text Policy Attribute-Based Encryption techniques. The method can be adapted to transform any Attribute-Based Encryption scheme that supports only temporary revocation into a scheme that supports the permanent revocation of users.

Claims

1. A method of modifying the four stages of the Cipher-text Policy Attribute-Based Encryption (CP-ABE) method that allows a broadcaster to send encrypted data to a set of users such that only a subset of authorized users can decrypt the data, wherein the method supports permanent revocation of users;

the modified CP-ABE method comprising;

a) in the setup stage—

the broadcaster adds a secret random component CTRε

Z_p to random secrets α

,β

ε

Z_p included in a master key MK, which is used to produce a public key PK;

b) in the key generation stage—

a component E_i=e(g,g)<sup>ri·

CTR</sup>, which securely encapsulates the random control component CTR, is added to a set of attributes of a user that encodes the state of each user U_i to generate the secret private key SK that the broadcaster sends to U_i, wherein g is a random generator of a bilinear group G₀ of prime order p, e;

G₀×

G₀→

G₁ is a proper bilinear map, r_i is a random number chosen from Z_p is a different random integer for each user, and CTRε

Z_p is the global state;

c) in the encrypt stage;

the broadcaster uses an algorithm that includes a random secret for sharing sε

z_p to construct a ciphertext, the global secret key is encrypted by the private keys of the subset of authorized users, the broadcaster updates the global state by

CTR=CTR+s

and the broadcaster updates s upon a revocation event as

s₂₌₋

s−

CTR mod p

and shares s₂ with non-revoked users from an updated set of attributes; and

d) in the decrypt stage;

user i computes a parameter

A_i=e(g,g)^ris

and then user i updates its local state by

E_i=E_i·

A_i=e(g,g)^riCTR·

e(g,g)^ris=e(g,g)^ri(CTR+s).

2. The method of claim 1 in which, if one or more users is admitted to or revoked from the subset of authorized users, thereby forming a new subset of authorized users:

a) the broadcaster updates the random control component to a new random control component;

thereby,

b) changing the master key and the state of each user and their private keys;

thereby,

c) changing the global secret key to a new global secret key, which is encrypted by the private keys of said new subset of authorized users;

thereby,

d) only allowing users in said new subset of authorized users to decrypt ciphertext that has been encrypted by said broadcaster using an algorithm that includes said new global secret key; and

therefore,

e) only allowing users in said new subset of authorized users to use said new global secret key.