Back to results
US 12,388,801 B2Granted
Broadcast encryption with improved resource utilization
AssigneeNTT Research, Inc.
InventorHoeteck Wee
Life of this patent
Estimating the term…
Abstract
A broadcast network can use a pairing-based broadcast encryption scheme for N users with O(N1/3)-sized parameters. A pairing-based ciphertext-policy attribute-based encryption (CP-ABE) scheme for the class of degree 3 polynomials can be implemented with compact parameters. The public key, ciphertext and secret keys comprise O(n) group elements, where n is input length for the function. The constructions achieve adaptive security against unbounded collusions, and rely on the (bilateral) k-Lin assumption in prime-order bilinear groups.
Claims9
A method for encrypting a message for transmitting over a broadcast network to multiple recipients as a ciphertext, the method comprising:
- receiving an authorized recipient set S at a broadcast module, wherein the authorized recipient set identifies a set of recipients with permission to recover a broadcast message, wherein S is a subset of {1, 2, . . . , N}, wherein n is an integer such that n3≥N, and wherein N is the total number of possible recipients of the message;
- generating a public key mpk at an authority, the public key mpk comprising:
- a) a pairing group, the pairing group further comprising a first source group, a second source group, and a target group,
- b) vectors [v]1, [w1]1 and [w2]1 as n random group elements from the first source group,
- c) a random group element [ν0]1 from the first source group, and
- d) a random group element a [α]T from the target group;
- receiving the public key mpk at the broadcast module from the authority;
- receiving or creating a message M for encryption;
- encoding the authorized recipient set S as a degree 3 polynomial,
- wherein the degree 3 polynomial has a coefficient vector f equal to a characteristic vector of the recipient set S, and wherein the vector f has a length n3;
- cryptographically compressing the vector f using the vector [w2]1 of n group elements from the public key mpk and by sampling a random vector w3 of n integers modulo p resulting in a digest of n group elements;
- generating a ciphertext of message M by:
- (a) sampling a random scalar s;
- (b) multiplying the random scalar s with the digest, the vector w3 and the public key mpk;
- (c) concatenating the output of the multiplying to form the ciphertext;
- (d) multiplying the random scalar s by [α]T to derive [αs]T;
- (e) masking message M with [αs]T;
- and
- transmitting the masked message as a ciphertext and the authorized recipient set S to recipients on the broadcast network.
16 more elements
A system for encrypting a message for transmitting over a broadcast network to multiple recipients as a ciphertext, comprising:
- a network communication interface configured to communicate over a wired or wireless network;
- a set of processing circuits coupled to the network communication interface, the processing circuits comprising modules configured for:
- receiving an authorized recipient set S, wherein the authorized recipient set identifies a set of recipients with permission to recover a broadcast message, wherein S is a subset of {1, 2, . . . , N}, wherein n is an integer such that n3≥N, and wherein N is the total number of possible recipients of the message;
- generating a public key mpk at an authority, the public key mpk comprising:
- a) a pairing group, the pairing group further comprising a first source group, a second source group, and a target group,
- b) vectors [v]1, [w1]1 and [w2]1 as n random group elements from the first source group,
- c) a random group element [ν0]1 from the first source group, and
- d) a random group element [α]T from the target group;
- receiving the public key mpk from the authority;
- receiving or creating a message M for encryption;
- encoding the authorized recipient set S as a degree 3 polynomial, wherein the degree 3 polynomial has a coefficient vector f equal to a characteristic vector of the recipient set S, and wherein the vector f has a length n3;
- cryptographically compressing the vector f using the vector [w2]1 of n group elements from the public key mpk and by sampling a random vector w3 of n integers modulo p resulting in a digest of n group elements;
- generating a ciphertext of message M by:
- (a) sampling a random scalar s;
- (b) multiplying the random scalar s with the digest, the vector w3 and the public key mpk;
- (c) concatenating the output of the multiplying to form the ciphertext
- (d) multiplying the random scalar s by [α]T to derive [αs]T;
- (e) masking message M with [αs]T;
- and
- transmitting the masked message as a ciphertext and the authorized recipient set S to recipients on the broadcast network S.
17 more elements
A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed by one or more processors of a computing device, configure the one or more processors to perform instructions for encrypting a message for transmitting over a broadcast network to multiple recipients as a ciphertext, the instructions comprising:
- receiving an authorized recipient set S at a broadcast module, wherein the authorized recipient set identifies a set of recipients with permission to recover a broadcast message, wherein S is a subset of {1, 2, . . . , N}, wherein n is an integer such that n3≥N, and wherein N is the total number of possible recipients of the message;
- generating a public key mpk at an authority, the public key mpk comprising:
- a) a pairing group, the pairing group further comprising a first source group, a second source group, and a target group,
- b) vectors [v]1, [w1]1 and [w2]1 as n random group elements from the first source group,
- c) a random group element [ν0]1 from the first source group, and
- d) a random group element [α]T from the target group;
- receiving the public key mpk at the broadcast module from the authority;
- receiving or creating a message M for encryption;
- encoding the authorized recipient set S as a degree 3 polynomial,
- wherein the degree 3 polynomial has a coefficient vector f equal to a characteristic vector of the recipient set S, and wherein the vector f has a length n3;
- cryptographically compressing the vector f using the vector [w2]1 of n group elements from the public key mpk and by sampling a random vector w3 of n integers modulo p resulting in a digest of n group elements;
- generating a ciphertext of message M by:
- (a) sampling a random scalar s;
- (b) multiplying the random scalar s with the digest, the vector w3 and the public key mpk;
- (c) concatenating the output of the multiplying to form the ciphertext;
- (d) multiplying the random scalar s by [α]T to derive [αs]T;
- (e) masking message M with [αs]T;
- and
- transmitting the masked message as a ciphertext and the authorized recipient set S to recipients on the broadcast network.
16 more elements
Dependencies are inferred from the claim text.