Method for protecting payload data

One or more tangible, non-transitory, computer-readable media storing instructions that, when executed by at least one processor, cause the at least one processor to perform operations comprising:

• generating a public key set (PK) supporting asymmetric bilinear pairings based on a first generator (P1) selected from a first cyclic group (G1), on a second generator (P2) selected from a second cyclic group (G2) different to the first cyclic group (G1), on a first random number (α) and on a second random number (Υ), wherein a number of elements of the public key set (PK) depends on a predefined number (n) of consumers;
• generating a number of receiver device keys (DKi) based on the public key set (PK), on the second random number (Υ) and on the predefined number (n) of consumers, wherein the number of receiver device keys (DKi) is equal to or smaller than the predefined number (n) of consumers and wherein a size of each of the receiver device keys (DKi) is independent of the number (n) of consumers;
• distributing, via a secure communication channel, the receiver device keys (DKi) to respective devices including a receiver device;
• generating a provider key (K) based on the public key set (PK), on an encryption random number (t), on the first random number (α) and on the predefined number (n) of consumers and storing the provider key (K) in a provider device;
• generating an envelope (ENV) based on the public key set (PK), on the encryption random number (t) and on the predefined number (n) of consumers and storing the envelope (ENV) in the provider device and distributing, via a one-to-many communication channel, the envelope (ENV) to the respective devices including the receiver device;
• generating a receiver key, which corresponds to the provider key (K), based on the distributed envelope (ENV) and a first receiver device key distributed to the receiver device;
• performing at least one of encrypting or signing payload data employing the provider key (K) for producing protected payload data;
• distributing, via the one-to-many communication channel, the protected payload data to the respective devices including the receiver device;
• and
• processing, the protected payload data employing the receiver key, wherein the processing includes at least one of decrypting or authenticating.

A provider device for a one-to-many communication network, wherein the provider device comprises

• a processor,
• memory and instructions stored on the memory,
• wherein a public key set (PK) supporting asymmetric bilinear pairings for a predefined security level is generated by the provider device or a trusted entity based on a first generator (P1) selected from a first cyclic group (G1), on a second generator (P2) selected from a second cyclic group (G2) different to the first cyclic group (G1), on a first random number (α) and on a second random number (Υ), wherein a number of elements of the public key set (PK) depends on a predefined number (n) of consumers,
• wherein a number of receiver device keys (DKi) are generated by the provider device or the trusted entity based on the public key set (PK), on the second random number (Υ) and on the predefined number (n) of consumers, wherein the number of receiver device keys (DKi) is equal or smaller than the predefined number (n) of consumers and wherein a size of each of the receiver device keys (DKi) is independent of the number (n) of consumers,
• wherein the receiver device keys (DKi) are distributed to respective devices of a plurality of devices, including at least one receiver device, and wherein the instructions, when executed by the processor, are configured to cause the processor to perform operations comprising:
• communicating with the plurality of devices including the at least one receiver device via a one-to-many communication channel;
• storing a provider key (K) that is generated by the provider device or the trusted entity based on the public key set (PK), on an encryption random number (t), on the first random number (α) and on the predefined number (n) of consumers;
• storing an envelope (ENV) that is generated by the provider device or the trusted entity based on the public key set (PK), on the encryption random number (t) and on the predefined number (n) of consumers;
• distributing, via the one-to-many communication channel, the envelope (ENV) to the respective devices including the at least one receiver device;
• performing at least one of encrypting or signing payload data employing the provider key (K) for producing protected payload data;
• and
• distributing, via the one-to-many communication channel, the protected payload data to the respective devices including the at least one receiver device.

A receiver device for a one-to-many communication network, wherein the receiver device comprises

• a processor,
• memory and instructions stored on the memory,
• wherein a public key set (PK) supporting asymmetric bilinear pairings for a predefined security level is generated based on a first generator (P1) selected from a first cyclic group (G1), on a second generator (P2) selected from a second cyclic group (G2) different to the first cyclic group (G1), on a first random number (α) and on a second random number (Υ), wherein a number of elements of the public key set (PK) depends on a predefined number (n) of consumers,
• wherein a number of receiver device keys (DKi) are generated based on the public key set (PK), on the second random number (Υ) and on the predefined number (n) of consumers, wherein the number of receiver device keys (DKi) is equal or smaller than the predefined number (n) of consumers and wherein a size of each of the receiver device keys (DKi) is independent of the number (n) of consumers, and wherein the instructions, when executed by the processor, are configured to cause the processor to perform operations comprising:
• receiving, via a secure communication channel, a respective receiver device key from the number of receiver device keys (DKi);
• receiving communications from a provider device via a one-to-many communication channel;
• receiving, via the one-to-many communication channel, an envelope (ENV);
• generating a receiver key based on the respective receiver device key and the received envelope (ENV), the receiver key corresponding to a provider key (K) of the provider device;
• receiving, via the one-to-many communication channel, protected payload data, which are encrypted and/or signed by the provider device employing the provider key (K);
• and
• processing, including at least one of decrypting or authenticating, the protected payload data employing the receiver key.

A communication system for a one-to-many communication network, the communication system comprising a provider device and a receiver device,

• wherein the receiver device comprises a first processor, first memory and first instructions stored on the first memory, and wherein the provider device comprises a second processor, second memory, and second instructions stored on the second memory,
• wherein a public key set (PK) supporting asymmetric bilinear pairings for a predefined security level is generated by the provider device or a trusted entity based on a first generator (P1) selected from a first cyclic group (G1), on a second generator (P2) selected from a second cyclic group (G2) different to the first cyclic group (G1), on a first random number (α) and on a second random number (Υ), wherein a number of elements of the public key set (PK) depends on a predefined number (n) of consumers,
• a number of receiver device keys (DKi) are generated by the provider device or the trusted entity based on the public key set (PK), on the second random number (Υ) and on the predefined number (n) of consumers, wherein the number of receiver device keys (DKi) is equal or smaller than the predefined number (n) of consumers and wherein a size of each of the receiver device keys (DKi) is independent of the number (n) of consumers,
• the receiver device keys (DKi) are distributed to respective devices of a plurality of devices, including the receiver device, and wherein the second instructions, when executed by the second processor, are configured to cause the second processor to perform operations comprising:
• communicating with the plurality of devices including the receiver device via a one-to-many communication channel;
• storing a provider key (K) that is generated by the provider device or the trusted entity based on the public key set (PK), on an encryption random number (t), on the first random number (α) and on the predefined number (n) of consumers;
• storing an envelope (ENV) that is generated by the provider device or the trusted entity based on the public key set (PK), on the encryption random number (t) and on the predefined number (n) of consumers;
• distributing, via the one-to-many communication channel, the envelope (ENV) to the respective devices including the receiver device;
• performing at least one of encrypting or signing payload data employing the provider key (K) for producing protected payload data;
• and
• distributing, via the one-to-many communication channel, the protected payload data to the respective devices including the receiver device, and
• wherein the first instructions, when executed by the first processor, are configured to cause the first processor to perform operations comprising:
• receiving, via a secure communication channel, a respective receiver device key from the number of receiver device keys (DKi);
• receiving communications from the provider device via the one-to-many communication channel;
• receiving, via the one-to-many communication channel, the envelope (ENV);
• generating a receiver key based on the received device key and the received envelope (ENV), the receiver key corresponding to the provider key (K) of the provider device;
• receiving, via the one-to-many communication channel, the protected payload data, which are encrypted and/or signed by the provider device employing the provider key (K);
• and
• processing, including at least one of decrypting or authenticating, the protected payload data employing the receiver key.

A trusted entity for a communication system with a one-to-many communication network, wherein the trusted entity comprises

• a processor,
• memory, and instructions stored on the memory, wherein the instructions, when executed by the processor, are configured to cause the processor to perform operations comprising:
• generating a public key set (PK) supporting asymmetric bilinear pairings for a predefined security level based on a first generator (P1) selected from a first cyclic group (G1), on a second generator (P2) selected from a second cyclic group (G2) different to the first cyclic group (G1), on a first random number (α) and on a second random number (Υ), wherein a number of elements of the public key set (PK) depends on a predefined number (n) of consumers;
• generating a number of receiver device keys (DKi) based on the public key set (PK), on the second random number (Υ) and on the predefined number (n) of consumers, wherein the number of receiver device keys (DKi) is equal or smaller than the predefined number (n) of consumers and wherein a size of each of the receiver device keys (DKi) is independent of the number (n) of consumers;
• distributing, via a secure communication channel, the receiver device keys (DKi) to respective receiver devices;
• generating a provider key (K) based on the public key set (PK), on an encryption random number (t), on the first random number (α) and on the predefined number (n) of consumers;
• generating an envelope (ENV) based on the public key set (PK), on the encryption random number (t) and on the predefined number (n) of consumer, wherein each of the receiver device keys (DKi) together with the envelope (ENV) enable the respective receiver devices to generate a respective receiver key, which corresponds to the provider key;
• providing the provider key (K) to a provider device;
• and
• providing the envelope (ENV) to the respective receiver devices or to the provider device.