Systems and methods for identity-based encryption and related cryptographic techniques

• US 20090034714A9
• Filed: 05/09/2006
• Published: 02/05/2009
• Est. Priority Date: 08/13/2001
• Status: Active Grant

• Current Assignee: Board of Trustees of the Leland Stanford Junior University (Stanford Management Co.), University of California Davis (University of California)
• Original Assignee: Board of Trustees of the Leland Stanford Junior University (Stanford Management Co.)
• Inventors: Boneh, Dan, Franklin, Matthew
• Granted Patent: US 7,634,087 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

A method and system for encrypting a first piece of information M to be sent by a sender [100] to a receiver [110] allows both sender and receiver to compute a secret message key using identity-based information and a bilinear map. In a one embodiment, the sender [100] computes an identity-based encryption key from an identifier ID associated with the receiver [110]. The identifier ID may include various types of information such as the receiver'"'"'s e-mail address, a receiver credential, a message identifier, or a date. The sender uses a bilinear map and the encryption key to compute a secret message key g_ID^r, which is then used to encrypt a message M, producing ciphertext V to be sent from the sender [100] to the receiver [110] together with an element rP. An identity-based decryption key d_ID is computed by a private key generator [120] based on the ID associated with the receiver and a secret master key s. After obtaining the private decryption key from the key generator [120], the receiver [110] uses it together with the element rP and the bilinear map to compute the secret message key g_ID^r, which is then used to decrypt V and recover the original message M. According to one embodiment, the bilinear map is based on a Weil pairing or a Tate pairing defined on a subgroup of an elliptic curve. Also described are several applications of the techniques, including key revocation, credential management, and return receipt notification.

Claims

1. A method for using identity-based encryption (IBE) to securely convey data over a communications network from a sender to a receiver, comprising:

at the sender, forming an IBE public key using a time element;

at the sender, obtaining IBE system parameters;

at the sender, encrypting the data using the IBE public key and the IBE system parameters;

at the receiver, receiving the encrypted data from the sender;

at the receiver, obtaining an IBE private key that corresponds to the IBE public key; and

at the receiver, decrypting the encrypted data using the IBE private key.

2. The method defined in claim 1 wherein encrypting the data using the IBE public key and the IBE system parameters comprises encrypting the data using the IBE public key, the IBE system parameters, and a bilinear map.

3. The method defined in claim 1 wherein the receiver has identifying information and wherein forming the IBE public key comprises forming the IBE public key using the time element and using the identifying information of the receiver.

4. The method defined in claim 1 wherein the time element includes a date and wherein forming the IBE public key at the sender comprises using the date in forming the IBE public key.

5. The method defined in claim 1 wherein the time element includes a future date and wherein forming the IBE public key at the sender comprises using the future date in forming the IBE public key.

6. The method defined in claim 1 wherein a private key generator is connected to the communications network, the method further comprising:

at the receiver, obtaining the IBE private key from the private key generator over the communications network.

7. A method for using identity-based encryption (IBE) to securely convey data over a communications network from a sender to a receiver, wherein the receiver has a credential, comprising:

at the sender, forming an IBE public key using the credential;

at the sender, obtaining IBE system parameters;

at the sender, encrypting the data using the IBE public key and the IBE system parameters;

at the receiver, receiving the encrypted data from the sender;

at the receiver, obtaining an IBE private key that corresponds to the IBE public key; and

at the receiver, decrypting the encrypted data using the IBE private key.

8. The method defined in claim 7 wherein encrypting the data using the IBE public key and the IBE system parameters comprises encrypting the data using the IBE public key, the IBE system parameters, and a bilinear map.

9. The method defined in claim 7 wherein a private key generator is connected to the communications network, the method further comprising:

at the receiver, obtaining the IBE private key from the private key generator over the communications network.

10. The method defined in claim 7 wherein a private key generator is connected to the communications network, the method further comprising:

at the private key generator, determining whether the receiver has the credential; and

if the private key generator determines that the receiver has the credential, providing the IBE private key to the receiver from the private key generator over the communications network.

11. The method defined in claim 7 wherein the receiver has identifying information and wherein forming the IBE public key comprises forming the IBE public key using the identifying information of the receiver.

12. The method defined in claim 7 wherein the receiver has an identity and wherein a private key generator is connected to the communications network, the method further comprising:

at the private key generator, receiving a request for the IBE private key from the receiver that includes information related to the credential and that includes the identity of the receiver;

at the private key generator, verifying that the credential belongs to the receiver; and

if the credential is verified as belonging to the receiver, providing the requested IBE private key to the receiver from the private key generator.

13. The method defined in claim 7 wherein the credential includes a security clearance and wherein forming the IBE public key comprises forming the IBE public key using the security clearance.

14. The method defined in claim 7 wherein the receiver has identifying information, wherein forming the IBE public key comprises forming the IBE public key using the identifying information of the receiver, and wherein encrypting the data using the IBE public key and the IBE system parameters comprises encrypting the data using the IBE public key, the IBE system parameters, and a bilinear map.

15. The method defined in claim 7 wherein the receiver has identifying information, wherein forming the IBE public key comprises forming the IBE public key using the identifying information of the receiver and a time element, and wherein encrypting the data using the IBE public key and the IBE system parameters comprises encrypting the data using the IBE public key, the IBE system parameters, and a bilinear map.

16. An identity-based cryptographic method comprising:

at a first party, forming an identity-based public key using a time element;

at the first party, performing cryptographic operations using the identity-based public key;

at a second party, obtaining an identity-based private key corresponding to the identity-based public key; and

at the second party, performing cryptographic operations using the identity-based private key.

17. The identity-based cryptographic method defined in claim 16 wherein performing the cryptographic operations using the identity-based public key comprises performing the cryptographic operations using the identity-based public key and a bilinear map.

18. An identity-based cryptographic method comprising:

at a first party, forming an identity-based public key using a credential of a second party;

at the first party, performing cryptographic operations using the identity-based public key;

at a second party, obtaining an identity-based private key corresponding to the identity-based public key; and

at the second party, performing cryptographic operations using the identity-based private key.

19. The identity-based cryptographic method defined in claim 18 wherein performing the cryptographic operations using the identity-based public key comprises performing the cryptographic operations using the identity-based public key and a bilinear map.

20. The identity-based cryptographic method defined in claim 18 further comprising:

at the second party, obtaining the identity-based private key from a private key generator over a communications network.