Method and system for performing broadcast encryption with revocation capability

Abstract

A broadcast encryption method that allows a broadcaster to send encrypted content to a set of users such that only a subset of authorized users can decrypt the content, and to perform both temporary and permanent revocation of users. Accordingly, during a Setup stage, a Key Service generates a public key and a Master Secret Key (MSK) and sends the Public Parameters PP used to generate the public key to a broadcaster and to all users. The broadcaster uses the Public Parameters PP to create a message M, with which the broadcaster encrypts the content, and further creates a Cipher Text (CT), which is sent to all users. During a Key Gen stage, whenever a user wishes to decrypt the message M for decrypting the content, the user sends a request with his ID1 to the Key Service. The Key Service generates a corresponding secret key SKID1 and the secret key SKID1 is sent to the user ID1 via a secure data channel. During a Decrypt stage, the user uses the secret key SKID1, to decrypt the Cipher Text (CT) and obtain the message M. During a Revoke stage of k users (k=1, 2, 3, . . . ) a State Update Message (SUM) which is sent to all users, is provided and each user updates his state with the SUM he received, such that the k users having identities ID1, ID2, . . . IDk will not be able to update their state and will be permanently revoked, while all the remaining users being admitted users will be able to update their state and will not be revoked. Temporary revocation is done by inserting a list of IDs (ID1, ID2, . . . IDk) to be revoked into the CT.

Description

FIELD OF THE INVENTION

The invention relates to the field of broadcast communication networks. Specifically the invention relates to the field of broadcast encryption with both temporary and permanent revocation capability.

BACKGROUND OF THE INVENTION

In broadcast encryption a single broadcaster can send encrypted messages to a group of users so that only authorized users can decrypt the messages. Such message may be for example, a secret key for decrypting content, such as a movie, which should be available for decryption only for subscribers (users) who paid a required fee to the content provider. Since the introduction of broadcast encryption there has been a great deal of work on extending the framework of broadcast encryption, thereby improving its security and optimizing its performance.

One of the factors driving interest in broadcast encryption is its commercial importance in content distribution, e.g. television networks. Historically, such networks were developed and administered by a single broadcaster who distributed both content and keys to registered users. In this setting, symmetric-key encryption is normally used, in which the broadcaster holds all the keys of the receivers.

A more flexible system allows separating between the key distribution and content distribution functions. In this setting, a single key manager generates and distributes keys to all users (subscribers), but multiple content providers can directly send encrypted content to users. The benefits of such an approach include lower barriers of entry for both key providers and content providers and potentially greater choice and lower cost for users. However, the separation of functions typically rules out symmetric-key encryption since the key manager would not want to share all the system's keys with a content provider.

Public-key broadcast encryption solves this problem by separating the keys into a public key and secret keys. The public key allows a content provider to encrypt content and the secret keys allow each authorized user to decrypt content.

Broadcast encryption schemes differ in the way that they determine authorized users. Upon joining the system (e.g., during a registration stage), a user is authorized to receive a subset of the distributed content (for example, a package of sports channels). This authorization is enforced by the keys that the key manager provides to the user. The key manager can decide to expand the subset of the content for which the user is authorized by providing additional keys. However, reducing the user's authorization or completely revoking that authorization requires a revocation procedure that invalidates the user's decryption keys.

Revocation in broadcast encryption schemes can generally be divided into two types, temporary revocation and permanent revocation. Typical revocation schemes for broadcast encryption are limited either to temporary revocation only or to permanent revocation only, often without explicitly stating the difference. However, in practice, both types of revocation are important.

Temporary Revocation

In temporary revocation, authorization is attached to a specific encrypted message and therefore revoking a user does not extend to subsequent messages. When using temporary revocation, the broadcaster must know which user will be able to decrypt the transmitted content and which user will not, and encrypt the content accordingly. Temporary revocation is required for example, when a user wishes to remain a subscriber, but does not want to receive a specific content (e.g., sports channels). In this case, he will be temporary revoked and will not be able to decrypt messages that are related to sports channels. However, a revoked user is temporarily revoked in each message and the public key that is used for encryption must contain the information who will and who will not be able to decrypt and therefore, when more and more users are revoked or authorized, the encryption (public) key becomes larger and larger. Also, temporary revocation approach suffers from two drawbacks. The first drawback is performance penalty, since the complexity of sending a message keeps growing as a function of historical revocations. The other drawback is that when the roles of key management and content distribution are separate, it may not be possible for a broadcaster to keep track of every revoked user. In addition, temporary revocation requires maintaining long lists of subscribers, which introduce substantial overhead both during encryption and decryption, as well as security problems (since these lists may leak is adversaries get access to them).

Permanent Revocation

In permanent revocation, the key manager revokes the authorization of a user, thereby preventing him from decrypting future messages (it is practically equivalent to taking back hardware from the user, such as his set-top box).

Permanent revocation may be the consequence of a user canceling his subscription and is therefore, a common feature of real-world broadcast encryption systems. A motivating example for temporary revocation is when a content provider distributes an encryption key for some premium content (e.g., a televised pay-per-view event), only to users who paid for the content. Subsequently, the content is broadcasted to all users in the system, but only the users who received the content key can decrypt it. In encryption schemes that use permanent revocation, the public key that is used for encryption is independent of the number of users (subscribers) which should be revoked. Also, each time a broadcaster starts encrypting a new content (e.g., a movie), encryption is made with respect to a current state. When a broadcaster wishes to determine which user will remain a subscriber and who will be revoked (e.g., if he stopped paying the required subscription fee), he can send a message containing state parameters to all users and as a result, only users that paid the fee will be able to update their state and remain subscribers and all the others will be revoked. This message is sent to all users every time the broadcaster wishes to revoke users. In order to remain a subscriber, upon receiving the message, each user must update his state. This way, all users that stopped paying the required subscription fee will be permanently revoked and will not be able to decrypt the message or any subsequent messages (unless performing the required registration process, like any new subscriber).

The security of broadcast encryption can be loosely defined as the property of non-authorized users being unable to decrypt ciphertexts and can be typically reduced to the security of a cryptographic primitive. Security definitions for broadcast security, differ in modeling the adversary. One feature of the adversary model is the number of users that the adversary may corrupt. Most broadcast encryption schemes assume that the adversary can control multiple users (possibly, an unbounded number of them) and therefore, require collusion resistance (i.e. require that even a coalition of unauthorized users working together cannot decrypt ciphertexts). A second feature determines whether the adversary (and the associated security proof) is adaptive or is only selective. An adaptive adversary decides dynamically which users to corrupt while in the selective setting the adversary selects the set of corrupted users before the key manager sets system parameters.

The performance of broadcast encryption is measured by the size of the objects in the system and the time required to perform the algorithms in the scheme as a function of the n users in the system and the number of revoked users. The measured objects include encryption and decryption keys, ciphertext length and messages for user revocation, which are part of the ciphertext in the case of temporary revocation and are separate from the ciphertext, for permanent revocation.

The performance of different broadcast encryption schemes is sometimes difficult to compare because each optimizes different measures. For example, the simplest broadcast encryption scheme involves encrypting a plaintext message separately with each authorized user's symmetric/public key. In this scheme, the encryption key, ciphertext length and time to perform encryption are O(n−r) for n users in the system and r revoked users. However, all other measures are O(1) and revocation is especially trivial for all users actually requiring less work for the key manager and broadcaster.

Important broadcasting parameters in these broadcasting schemes are the size of the public key that is used for encryption, the size of the secret key used for decryption and the size of the content. It is desired that encryption will require as less data traffic, as possible.

WO 2013/027206 discloses a method for broadcast encryption that allows a broadcaster to send encrypted data to a set of users such that only a subset of authorized users can decrypt said data. The method comprises modifications to the four stages of the basic Cipher-text Policy Attribute-Based Encryption techniques. It then claimed that the method can be adapted to transform any Attribute-Based Encryption scheme that supports only temporary revocation into a scheme that supports the permanent revocation of users.

According to this method, a part of each decryption key will be dynamic and each time a message is sent to a user, the key is updated, such that only users that should not be permanently revoked will be able to update his state (the broadcaster sends to each user a private key that includes the attributes of the user and a component that includes the state of the user, which is a function of a random control component that is frequently updated from the moment that the user completed a registration process and became a subscriber).

Another problem with the method proposed by WO 2013/027206 is related to security, since there may be collusion between an authorized subscriber who received the secret key for decryption (who is able to update his state) and a revoked subscriber. In this case, the revoked subscriber can learn from the authorized subscriber what should be the new updated state and continue decrypting, like he has been never revoked.

It is clear that permanent revocation alone is not sufficient, since there are situations when a broadcaster wishes to revoke a user just temporarily. Therefore, both types of revocations are required.

It is therefore an object of the present invention to provide a broadcast encryption scheme that overcomes the drawbacks of typical revocation schemes for broadcast encryption.

It is another object of the present invention to provide a broadcast encryption scheme that enables both temporary and permanent revocation, while keeping performance that is as good as broadcast encryption systems that achieve either temporary revocation or permanent revocation, separately.

It is another object of the present invention to provide a broadcast encryption scheme that enables both temporary and permanent revocation but prevent revoked users from decrypting messages, even in case of collusion between revoked users and users who can decrypt.

Other objects and advantages of the invention will become apparent as the description proceeds.

SUMMARY OF THE INVENTION

A broadcast encryption method that allows a broadcaster to send encrypted content to a set of users such that only a subset of authorized users can decrypt the content, and to perform both temporary and permanent revocation of users, comprising the following steps:

• • a) during a Setup stage:
    • a.1) a KeyService generates a public key and a Master Secret Key (MSK) and sends the Public Parameters PP used to generate the public key to a broadcaster and to all users;
    • a.2) the broadcaster uses the Public Parameters PP to create a message M, with which the broadcaster encrypts the content, and further creates a CipherText (CT), which is sent to all users;
  • b) during a KeyGen stage:
    • b.1) whenever a user wishes to decrypt the message M for decrypting the content, the user sends a request with his ID1 to the KeyService;
    • b.2) the KeyService generates a corresponding secret key SK_ID1;
    • b.3) the secret key SK_ID1 is sent to the user ID1 via a secure data channel;
  • c) during a Decrypt stage, the user uses the secret key SK_ID1, to decrypt the CipherText (CT) and obtain the message M; and
  • d) during a Revoke stage of k users (k=1, 2, 3, . . . ):
    • d.1) providing a State Update Message (SUM) which is sent to all users;
    • d.2) allowing each user to update his state with the SUM he received, such that the k users having identities ID1, ID2, . . . ID_k will not be able to update their state and will be permanently revoked, while all the remaining users being admitted users will be able to update their state and will not be revoked.
    • In one aspect, temporary revocation is performed by inserting a list of IDs (ID₁, ID₂, . . . ID_k) to be revoked into the CT. The revocation scheme may be Cipher-text Policy Attribute-Based Encryption (CP-ABE). The CP-ABE scheme further includes permanent revocation parameters, which are directed to specific users.
    • The CP-ABE scheme may further include permanent revocation parameters, which are directed to specific attributes of specific users.
    • A user can decrypt the ciphertext only if he is not one of the temporarily revoked users.
    • Revocation may be carried our using a Public Key Revocation Scheme, consisting of:
  • a) a Setup(λ) algorithm, which for a security parameter λ:
    • a.1) chooses a bilinear group G of prime order p such that |p|≥λ.
    • a.2) chooses random generators g, w∈G, random exponents α,γ,b∈Z_p and sets ST=1.
    • a.3) randomly chooses a function ϕ⁸ from F_λ, a pseudo-random family of permutations over Z_p, wherein the Master secret key MSK is MSK=(α,b,γ,w,ST,ϕ), and the public parameters PP are PP=(g,g^bST,g^b2ST,w^b,e(g,g)^αST).
  • b) a KeyGen(MSK, ID) algorithm, which for Given a user identity ID∈Z_p and the master secret key MSK:
    • b.1) computes=ϕ(ID)∈Z_p; and
    • b.2) sets D₁=g^−t,D₂=(g^bIDw)^t,

$D_3=\frac{1}{\alpha +b^{2}t}-\gamma ,$

• • •  D₄=g^(α+b2t)·ST,D₅=false.
    • b.3) outputs SK_ID={D₁, . . . , D₅}.
  • c) a Revoke(S,PP,MSK) algorithm, which is adapted to:
    • c.1) change the state is by sending a single message that is sent to all users in parallel; given a set S={ID₁, . . . , ID_r} of identities to revoke, the public parameters and the master secret key. The algorithm sets ST′=ST and for =1 to r, computes:

${\mathrm{ST}}^{\prime }={\mathrm{ST}}^{\prime }·\left(\alpha +b^2{t}_i\right)$ $S_{i,1}=\frac{1}{\alpha +b^2{t}_i}-\gamma ,S_{i,2}=g^{{\mathrm{ST}}^{\prime }}$

• • • c.2) whenever t_i=ϕ(ID_i), perform the following operations:
    • Update the master secret key by replacing ST with ST′;
    • Update the public parameters by replacing g^bST,g^b2ST and e(g,g)^αST with g^bST′,g^b2ST′ and e(g,g)^αST′ respectively.
    • Broadcast the key update message SUM={S_i,1,S_i,2}_i=1^r.
  • d) An UpdateKey (SK_ID,SUM,ID) algorithm, which is adapted to:
    • d.1) follow the Revoke stage and provides indication regarding how any user updated his state after receiving a Revoke message;
    • d.2) Given a key update message SUM for r revoked identities, update the secret key SK_ID.
  • e) An Encrypt(S,PP,M) algorithm for allowing the broadcaster who creates the content also encrypts it, based on the public parameters PP, a message M∈G_T and a set S of revoked identities as an input.
  • f) a Decrypt(SK_ID,CT,PP) algorithm which attempts to retrieve the message M, based on a secret key SK_ID, a ciphertext CT and the public parameters PP.

Permanent revocation of specific attributes of users may be done directly in the revocation mechanism, without the need of providing new secret keys.

A broadcast encryption system that allows a broadcaster to send encrypted content to a set of users such that only a subset of authorized users can decrypt the content, and to perform both temporary and permanent revocation of users, which comprises:

• • a) a broadcasting server, having at least one processor, for:
    • a.1) obtaining content to be distributed to the authorized users;
    • a.2) obtaining encryption and decryption keys required for encrypting the content from a KeyService server;
    • a.3) encrypting the content and distributing the content to the authorized users,
    • wherein the broadcasting and KeyService servers are adapted to:
  • b) during a Setup stage:
    • a.1) the KeyService generates a public key and a Master Secret Key (MSK) and sends the Public Parameters PP used to generate the public key to a broadcaster and to all users;
    • a.2) the broadcaster uses the Public Parameters PP to create a message M, with which the broadcaster encrypts the content, and further creates a CipherText (CT), which is sent to all users;
  • c) during a KeyGen stage:
    • c.1) whenever a user wishes to decrypt the message M for decrypting the content, the user sends a request with his ID1 to the KeyService;
    • c.2) the KeyService generates a corresponding secret key SK_ID1;
    • c.3) the secret key SK_ID1 is sent to the user ID1 via a secure data channel;
  • d) during a Decrypt stage, the user uses the secret key SK_ID1, to decrypt the CipherText (CT) and obtain the message M; and
  • e) during a Revoke stage of k users (k=1, 2, 3, . . . ):
    • e.1) providing by the KeyService, a State Update Message (SUM) which is sent to all users;
    • e.2) allowing each user to update his state with the SUM he received, such that the k users having identities ID1, ID2, . . . IDk will not be able to update their state and will be permanently revoked, while all the remaining users being admitted users will be able to update their state and will not be revoked.

In one aspect, the KeyService may operate separately from the broadcaster, and performs one or more of the following:

• • a) generating and distributing Keys both to the broadcaster and to users who became subscribers, according to their attributes;
  • b) conducting billing operations for admitted users who registered and payed for their subscription; and
  • c) using the billing data for maintaining admitted users that paid for subscription, and for revocation of users who stopped paying.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings:

FIG. 1A illustrates the flow of broadcast encryption without revocation; and

FIG. 1B illustrates the flow of broadcast encryption with permanent revocation capability, using the Revoke stage; and

FIG. 2 illustrates a broadcasting system which uses the broadcast encryption with both temporary and permanent revocation capability, according to an embodiment of the invention.

DETAILED DESCRIPTION OF THE INVENTION

Reference will now be made to an embodiment of the present invention, examples of which are provided in the accompanying figures for purposes of illustration only. One skilled in the art will readily recognize from the following description that alternative embodiments of the structures and methods exemplified herein may be employed, mutatis mutandis, without departing from the principles of the invention.

The invention proposes a broadcast encryption scheme, bases on public-key that enables both temporary and permanent revocation with performance that in every measure is as good as broadcast encryption systems that achieve either temporary revocation or permanent revocation separately.

At a high level, a broadcast encryption scheme with temporary and permanent revocation is defined as a protocol between a key manager, n receivers (or users) and an unbounded number of broadcasters. In some embodiments, the protocol includes six steps, each implemented with an algorithm: setup, key generation, encryption, decryption, (permanent) revocation and key update.

The proposed scheme may incorporate Cipher-text Policy Attribute-Based Encryption (CP-ABE—where a user has to possess a certain set of attributes in order to access data) techniques, to achieve temporary revocation. Registration of a user is done with predetermined attributes, which may be, for example, (1) a sports package and (2) watching time between 8:00 am to 2:00 pm, (3) gender and (4) age. Upon registration, these attributes may be part of the encryption, since the broadcaster may generate a formula (some logic function) from the attributes and the public encryption key will include the formula. This way, for example, only users that belong to a group of men in the age of 40-42 which are subscribers of sports package that is broadcasted between 8:00 am to 2:00 pm will be able to decrypt the message.

It is also possible to use Key Policy Attribute Based Encryption (KP-ABE) scheme. In this scheme, data is associated with the attributes for which a public key is defined for each. A broadcaster, who encrypts the data, is associated with the set of attributes to the data or message by encrypting it with a public key). In this scheme, the broadcaster encrypts with the attributes without the formula, while the decryption keys have the formula.

In one embodiment, ABE schemes may further include permanent revocation, which is directed to subscribers. For example, a user who stopped paying for the subscription will not be able to decrypt following massages, regardless its attributes.

In another embodiment, the ABE schemes may further include permanent revocation, which is directed only to specific attributes of users. This may be done by totally revoking their ability to decrypt and to provide him with a new secret key, which will allow him to decrypt messages that do not correspond to these specific attributes.

In another embodiment, the abovementioned functionality, permanent revocation of users' specific attributes can be done directly in the revocation mechanism without the need of providing new secret keys.

Description of the Revocation Process

The key manager runs a setup stage to generate system parameters including a Master Secret Key (MSK), which he retains, and a public key which is published. The key manager also performs key generation to create a secret key for each user in the system. It is assumed that a user receives the secret key in a secure, out-of-band method, e.g. by establishing a Virtual Private Network (VPN) between the key manager and the user.

A broadcaster executes the encryption algorithm which takes a set of temporarily revoked users as one of its parameters and outputs a ciphertext. A user can decrypt this ciphertext if and only if it is not one of the temporarily revoked users. The key manager performs the revocation algorithm which enables each of the non-revoked users to run key update and derive new secret keys. The revoked users will not be able to update their keys and will be unable to decrypt any ciphertexts in the future. However, it is always possible for a user to go through the key generation process again, receiving fresh keys.

The proposed scheme combines attributes from public-key temporary revocation systems and symmetric-key permanent revocation systems. A possible approach is to merge the two system types together in the sense of having each user hold independent keys for each system. The broadcaster secret shares each message and encrypts one share with the temporary revocation system and the other share with the permanent revocation system. Then a legitimate user can decrypt both shares and a revoked user will be unable to decrypt. However, this approach is not sufficiently secure when considering collusion between users who are only temporarily revoked and users who are only permanently revoked.

As an alternative to merging, the disclosed system merges the keys of the two schemes and modifies the six algorithms appropriately, to ensure correctness. It is proved that the construction is secure based on a two-step hybrid argument. The first step relies on the hardness of a novel computational problem which is formalized as the Mixed Exponent Assumption (MEA) and the second step is secure in the generic bilinear group model (disclosed, for example, in WO 2013/027206).

In this model (which is an idealized cryptographic model), an adversary can gain access only to random encoding of a group. The model includes an oracle (a virtual machine which is able to solve certain decision problems in a single operation) that executes the group operation and takes two encodings of group elements as input and outputs an encoding of a third element.

MEA is similar to discrete-log based hardness assumptions in that its input includes powers of a generator g of a group G with prime order p. The group elements in MEA (as in other hardness assumptions) are not independently chosen. There are correlations between the exponents of different group elements. Unlike other assumptions, the input of MEA also includes functions of these exponents directly in Z_p. Intuitively, any combination of the elements in G and the elements in Z_p is indistinguishable from a random element. In more detail, MEA states that the following problem is computationally hard.

Let Y∈Z_p^m be a vector of secrets, let V, U∈Z_pⁿ, let A be a n×m matrix, let F be a sequence of k multivariate polynomials over Y and let H∈G^k. Then, it is hard to distinguish between the pairs (V,H) and (U,H) if:

• • V=AY,U is randomly sampled from Z_pⁿ, H=g^{F (Y)}, i.e. if H=(h₁, . . . , h_k), F=(f₁, . . . , f_k) and Y=(y₁, . . . , y_m) then h_i=g^{fi(y1, . . . , ym)}.
  • There does not exist a low-degree, multivariate polynomial p over Z_p such that p(a₁f₁ (x₁, . . . , x_m), . . . , a_kf_k (x₁, . . . , x_m)) is the zero polynomial, where a₁, . . . , a_k are arbitrary functions of V=(v₁, . . . , v_n). If G comes equipped with a bilinear mapping, then p must be of degree two, while otherwise it must be linear.

The MEA assumption is in fact a family of assumptions indexed by a matrix and a sequence of functions. A specific member of this family with matrix A and sequence of functions F is referred as (A,F)-MEA.

The public key and each secret key are of size O(1) group elements. A ciphertext which determines the temporary revocation of r users is of length O(r) group elements and the time complexity of both encryption and decryption is O(r). Similarly, the output of the revocation algorithm, which is used for permanent revocation of r′ users is of length O(r′) and the time complexity of both the revocation and key update algorithms are O(r′).

The disclosed construction benefits performance that enables many commercial applications. One such application can be a platform for broadcasting live events, such as sports matches and concerts. Usually, content providers of such events make their profit (content, not merchandise wise) by selling tickets and recorded videos of the events. With the proposed scheme, they can also make profit by broadcasting the events in real-time and thus reach clients that are unable to attend the events (there are many reasons for that e.g., sold out or too expensive tickets, geographic distance and more). Furthermore, it may help individuals who are unable to attend such events, to enjoy the experience of watching them live at reasonable prices. Another possibility is for content providers to sell the broadcast rights to hang-out venues such as bars and restaurants that may then offer their clients a richer experience and attract more clients.

According to an embodiment of the present disclosure, a revocation scheme that supports both temporary and permanent revocations consists of six algorithms: Setup, KeyGen, Revoke, UpdateKey, Encrypt and Decrypt.

Revocation Systems

In some embodiments, both temporary and permanent revocation schemes consist of six algorithms representing six steps of the scheme: Setup, Key Generation, Revoke, Update Key, Encrypt and Decrypt.

Setup(λ) stage: The Setup algorithm input is a security parameter λ. The setup algorithm chooses a 3-linear group G of prime order p for >2^λ. It then chooses random generators g,w,h∈G and random exponents s,α,b,x_sb,x_αs1,x_α12,,{circumflex over (x)}∈Z_p. The outputs of the algorithm are the Public Parameters (PP), and the master secret key (MSK), as follows:

$\mathrm{PP}=\left(g^{\hat{x}},g^{x_{\alpha s1}{x}_{\alpha s2}\hat{x}},g^{{\mathrm{sx}}_{\mathrm{sb}}\hat{x}},g^{\frac{b}{x_{\mathrm{sb}}}},g^{\frac{x}{x_{\alpha s1}}},w^{\frac{\alpha }{x_{\alpha s2}}}\in G\right)$ MSK=(s,α,b,x_sb,x_αs1,x_αs2,,{circumflex over (x)}∈Z_p,w∈G)

KeyGen(MSK,ID) stage: Given a user identity ID∈Z_p and the master secret key MSK, the algorithm chooses random t∈Z_p. It then sets

$D_1=w^{\frac{\alpha +t}{b}};D_2=g^t;D_3={\left(w^{\mathrm{ID}}h\right)}^t;$ $S_1=g^{\frac{s}{\mathrm{ID}-}};S_2={\left(h\right)}^{\frac{s}{\mathrm{ID}-}}.$ The output of this algorithm is SK_ID={D₁,D₂,D₃,S₁,S₂}.

Revoke(S,PP,MSK) stage: Given a set S of r identities to revoke, the algorithm chooses random s₁′, . . . s_r′∈Z_p, sets s′=s₁′+ . . . +s_r′, and then for each identity ID_i∈S it sets the following variables:S_1,IDi=g^si′;S_2,IDi=(w^IDih)^si′;S_3,IDi=ID_i

The algorithm then:

1. Updates the master secret key by replacing s+S′;

2. Updates the public parameters by replacing

$\left(g^{{\mathrm{sb}}_{\mathrm{sb}}\hat{x}},g^{\frac{x}{x_{\alpha s1}}}\right)\mathrm{with}\left(g^{\left(s+s^{\prime }\right)x_{\mathrm{sb}}\hat{x}},g^{\frac{\left(s+s^{\prime }\right)}{x_{\alpha s1}}}\right)$ respectively;

3. Broadcast the state update message SUM={S_1,IDi,S_2,IDi,S_3,IDi}_i=1^r.

UpdateKey(SK_ID,SUM,ID) stage: Given a state update message SUM, the algorithm updates the secrety key SK_ID. It first checks if ID∈U_i=i^r S_3,IDi, and if so it outputs ⊥. Otherwise it calculates

$S_1^{\prime }=\prod _{i=1}^r{S}_{1,{\mathrm{ID}}_i}^{\frac{1}{\mathrm{ID}-S_{3,{\mathrm{ID}}_i}}}=\prod _{i=1}^r{g}^{\frac{s_i^{\prime }}{\mathrm{ID}-{\mathrm{ID}}_i}}$ $S_2^{\prime }=\prod _{i=1}^r{S}_{2,{\mathrm{ID}}_i}^{\frac{1}{\mathrm{ID}-S_{3,{\mathrm{ID}}_i}}}=\prod _{i=1}^r{\left(w^{{\mathrm{ID}}_i}h\right)}^{\frac{s_i^{\prime }}{\mathrm{ID}-{\mathrm{ID}}_i}}$

Finally it updates SK_ID by setting S₁=S₁·S₁′ and S₂=S₂·S₂′.

Encrypt(S,PP,M) stage: This algorithm takes as input a set S of identities to revoke, the public parameters PP and a message M∈G_T. The algorithm first chooses a random exponent x∈Z_p. Next the algorithm sets:

$C_0=M·e\left(g^{\frac{s}{x_{\alpha s1}}},{w^{\frac{\alpha }{x_{\alpha s2}}}\left(g^{x_{\alpha s1}{x}_{\alpha s2}\hat{x}}\right)}^x\right),C_1={\left(g^{\hat{x}}\right)}^x,C_2={\left(g^{{\mathrm{sx}}_{\mathrm{xb}}\hat{x}}\right)}^x$

The output of the Encrypt algorithm is the ciphertext CT={C_O,C₁,C₂}

Decrypt(SK_ID,CT,PP) stage: This algorithm is given a secret key SK_ID, a ciphertext CT and the public parameters PP. If SK_ID·revoked=true or ID is in the set of revoked users that correspond to CT, the algorithm outputs ⊥. Otherwise the algorithm begins with calculating A:

$A=\frac{e\left(S_1,D_3,C_1\right)}{e\left(S_2,D_2,C_1\right)}=\frac{e\left(g^{\frac{s}{\mathrm{ID}-}}·{\prod }_{i=1}^r{g}^{\frac{s_i^{\prime }}{\mathrm{ID}-{\mathrm{ID}}_i}},{\left(w^{\mathrm{ID}}h\right)}^t,{\left(g^{\hat{x}}\right)}^x\right)}{e\left({\left(W^{}h\right)}^{\frac{s}{\mathrm{ID}-}}·{\prod }_{i=1}^r{\left(W^{}h\right)}^{\frac{s_i^{\prime }}{\mathrm{ID}-{\mathrm{ID}}_i}},g^t,{\left(g^{\hat{x}}\right)}^x\right)}=\frac{e\left(\frac{s}{g^{\mathrm{ID}-}},{\left(w^{\mathrm{ID}}h\right)}^t,{\left(g^{\hat{x}}\right)}^x\right)·{\prod }_{i=1}^{r}e\left(e^{\frac{s_i^{\prime }}{\mathrm{ID}-{\mathrm{ID}}_i}},{\left(w^{\mathrm{ID}}h\right)}^t,{\left(g^{\hat{x}}\right)}^x\right)}{e\left({\left(W^{}h\right)}^{\frac{s}{\mathrm{ID}-}},g^t,{\left(g^{\hat{x}}\right)}^x\right)·{\prod }_{i=1}^{r}e\left({\left(W^{}h\right)}^{\frac{s_i^{\prime }}{\mathrm{ID}-{\mathrm{ID}}_i}},g^t,{\left(g^{\hat{x}}\right)}^x\right)}=\frac{{e\left(g,g,w\right)}^{\frac{\mathrm{sIDt}\hat{x}x}{\mathrm{ID}-}}}{{e\left(g,g,w\right)}^{\frac{st\hat{x}x}{\mathrm{ID}-}}}{\prod }_{i=1}^r\frac{{e\left(g,g,w\right)}^{\frac{s_i^{\prime }\mathrm{IDt}\hat{x}x}{\mathrm{ID}-{\mathrm{ID}}_i}}}{{e\left(g,g,w\right)}^{\frac{s_i^{\prime }t\hat{x}x}{\mathrm{ID}-{\mathrm{ID}}_i}}}={e\left(g,g,w\right)}^{\mathrm{st}\hat{x}x}{\prod }_{i=1}^r{e\left(g,g,w\right)}^{s_{i}t\hat{x}x}={e\left(g,g,w\right)}^{\left(s+s^{\prime }\right)t\hat{x}x}$

Finally the Decrypt algorithm calculates M:

$M=\frac{C_0·A}{e(C_2,g^{\frac{b}{x_{\mathrm{sb}}}},D_1}=\frac{M·e\left(g^{\frac{s+s^{\prime }}{x_{\alpha s1}}},w^{\frac{\alpha }{x_{\alpha s2}}},{\left(g^{x_{\alpha s1}{x}_{\alpha s2}\hat{x}}\right)}^x\right)·{e\left(g,g,w\right)}^{\left(s+s^{\prime }\right)\mathrm{tx}}}{e\left({\left(g^{s+s^{\prime })x_{\mathrm{sb}}\hat{x}}\right)}^x,g^{\frac{b}{x_{\mathrm{sb}}}},w^{\frac{\left(\alpha +t\right)}{b}}\right)}=\frac{M·{e\left(g,g,w\right)}^{\left(s+s^{\prime }\right)\alpha \hat{x}x}·{e\left(g,g,w\right)}^{\left(s+s^{\prime }\right)t\hat{x}x}}{{e\left(g,g,w\right)}^{\left(s+s^{\prime }\right)\hat{x}x\alpha +\left(s+s^{\prime }\right)\hat{x}\mathrm{xt}}}=M$

The system is required to satisfy the following correctness and security properties:

Correctness:

For all messages M, sets of identities S,S₁, . . . S_n, and all ID∉U_i=1ⁿ(S_iUS),

• • if (PP₀,MSK₀)←Setup(λ),SK_ID,0←KeyGen(MSK,ID) and for i=1, . . . , n:
  • (MSK_i,PP_i,SUM_i)←Revoke(S_i,PP_i−1,MSK_i−1)
  • SK_ID,i←UpdateKey(DK_ID,i−1,SUM_i,ID)
    • then if CT←Encrypt(S,PP_n,M) then Decrypt (SK_IDn,CT,PP_n)=M.

The security of a permanent revocation scheme is defined as a game between a challenger and an attack algorithm with the following phases:

Setup

The challenger runs the Setup algorithm with security parameter λ to obtain the Public Parameters PP and the Master Secret Key MSK. It maintains a set of identities initialized to the empty set and then sends PP to .

Key Query and Revocation

In this phase adaptively issues secret key and revocation queries. For every private key query for identity ID, the challenger adds ID to Q, runs KeyGen(MSK,ID)→SK_ID and sends to the corresponding secret key SK_ID. For every revocation query for a set S of Identities, the challenger updates Q←Q\S, runs Revoke(S,PP,MSK)→(MSK′,PP′,SUM), replaces (MSK,PP) with (MSK′,PP′) and sends to the new PP and the corresponding key update messages SUM.

Challenge

sends to the challenger a set S of identities and two messages M₁, M₂. In case S the challenger sends ⊥ to and aborts. Otherwise, the challenger flips a random coin ∈{0,1}, runs the Encrypt(S,PP,M_b) algorithm to obtain an encryption of M_b and sends it to .

Guess

outputs a guess b′∈{0,1} and wins if b=b′.

The advantage has in the security game for a permanent revocation scheme with security parameter λ is defined as Ad=|Pr[ wins]−½|.

A permanent revocation scheme is adaptively secure if for all poly-time algorithms , Ad=negl(λ).

Selective security is defined similarly, except that the revoked sets of identities are declared by the adversary before it sees the public parameters in an Init phase.

Bilinear Maps

For groups G, G_T of the same prime order p, a bilinear map e: G²→G_T satisfies:

• • 1. Bilinearity—For every g₁,g₂∈G and α∈Z_p it holds thate(g₁^α,g₂)=e(g₁,g₂^α)=e(g₁,g₂)^α
  • 2. Non-degeneracy—If g₁,g₂∈G are generators of G then e(g₁,g₂) is a generator of G_T.

G is called a (symmetric) bilinear group and G_T is called the target group.

Pseudo-Random Functions (PRFs)

Intuitively, a family of Pseudo-Random Functions is a family of functions such that a randomly chosen member of the family cannot be efficiently distinguished from a truly random function by an algorithm that observes the function's output. The following definition states the requirements of a PRF more precisely for the disclosed systems:

Let (A_λ,B_λ)_λ∈N be a sequence of pairs of domains and let F={F_λ}_λ∈N be a function ensemble such that the random variable F_λ assumes values in the set of A_λ→B_λ functions. Then F is a PRF ensemble if:

• • Pseudo-randomness. For every PPT oracle machine M:|Pr(M^Fλ(1^λ))=1−Pr(M^Uλ(1^λ))=1|<negl(λ)
  • for a negligible function negl(⋅) where U_λ is distributed uniformly over A_λ→B_λ functions.
  • Efficient computation. There are efficient PPT algorithms to sample F_λ and compute the sampled function on any input.

PRF function families can be efficiently constructed for many useful domains A_λ, B_λ including the groups Z_n=Z/nZ for any integer n. It is noted that in practice a PRF family can be instantiated by a block cipher such as AES where each function in the family corresponds to a cipher key.

Decisional MEA-Assumption

Let G be a group of primt order p with generator g, let A∈Z_p^n×m be a matrix and for a vector of formal variables X=(X₁, . . . , X_m) define a vector Y=(Y₁, . . . Y_n) by AX=Y. Let F=(f₁, . . . f_k)∈Z_p[X_i, . . . X_m]^k be a k-tuple of m-variate poynomials such that for any degree two, k-variate polynomial p and for any k polynomials ϕ₁, . . . ϕ_k∈Z_p[Y_i . . . Y_n]^k the polynomial p(ϕ₁(Y)f₁(X), . . . ϕ_k(Y)f_k(X)) is not identically zero.

The decisional (A,F)-Mixed exponent problem in G is to distinguish between the distributions on the tuples (g,y,h) and (g,u,h) which are defined as follow. Choose a random x=(x₁, . . . x_m)∈Z_p^m, compute y=A·x and h=(h₁, . . . h_k) such that (h_i=g^{fi(x1, . . . xm)} for all i and sample u∈Z_pⁿ, randomly.

An algorithm that outputs ∈{0,1} has advantage ϵ in solving the Decisional (A,F)-MEA-problem in G if |Pr[(g,A,F,y,h)=1]−Pr[(g,A,F,u,h)=1]|≥ϵ.

The Decisional (A,F)-Mixed Exponent Assumption ((A,F)-MEA) holds if any poly-time algorithm has a negligible advantage in solving the Decisional (A,F)-MEA-problem. The MEA family of assumptions is the set of all (A,F)-MEA-assumptions.

Public Key Revocation Scheme

Setup(λ) stage: The setup algorithm, given a security parameter λ, chooses a bilinear group G of prime order p such that |p|≥λ. It then chooses random generators g,w∈G, random exponents α,γ,b∈Z_p and sets ST=1. Finally, the setup algorithm randomly chooses a function ϕ⁸ from F_λ, a pseudo-random family of permutations over Z_p. The Master secret key MSK is MSK=(α,b,γ,w,ST,ϕ)), and the public parameters PP are PP=(g,g^bST,g^b2ST,w^b,e(g,g)^αST).

KeyGen(MSK, ID) stage: Given a user identity ID∈Z_p and the master secret key MSK, the KeyGen algorithm computes t=ϕ(ID)∈Z_p and sets D₁=g^−t,D₂=(g^bIDw)^t,

$D_3=\frac{1}{\alpha +b^{2}t}-\gamma ,$ D₄=g^(α+b2t)·ST, D₅=false.

The output of the KeyGen algorithm is SK_ID={D₁, . . . , D₅}.

Revoke(S,PP,MSK) stage: The revoke stage, the state is changed by sending a single message that is sent to all users in parallel. This algorithm is given a set S={ID₁, . . . ,ID_r} of identities to revoke, the public parameters and the master secret key. The algorithm sets ST′=ST and for i=1 to r it computes:

• 1. ST′=ST′·(α+b²t_i)

$2.S_{i,1}=\frac{1}{\alpha +b^2+t_i}-\gamma ,S_{i,2}=g^{{\mathrm{ST}}^{\prime }}$

Where t_i=ϕ(ID_i). The Revoke algorithm then performs the following operations:

• 1. Updates the master secret key by replacing ST with ST′;
• 2. Updates the public parameters by replacing g^bST, g^b2ST and e(g,g)^αST with g^bST′, g^b2ST′ and e(g,g)^αST′ respectively.
• 3. Broadcasts the key update message SUM={S_i,1,S_i,2}_i=1^r.UpdateKey (SK_ID,SUM,ID) Stage:

During the UpdateKey stage follows the Revoke stage and provides indication regarding how any user updated his state after receiving a Revoke message. Some users will be able to update their state and the remaining users (which should be revoked) will not.

Given a key update message SUM for r revoked identities, the algorithm updates the secret key SK_ID. It first checks if D₃∈U_i=1^r S_i,1 and if so it sets D₅=true. Otherwise, it sets h₀=D₄. Then, for i=1 to r it sets

$h_i={\left(\frac{S_{i,2}}{h_{i-1}}\right)}^{D_3-S_{i,1}}.$ Finally, the algorithm updates SK_ID by replacing D₄ with h_r.

It should be noted that h_r=g^(α+b2t)·ST where ST is the new state in the master secret key after the corresponding revocation. For example, if t=ϕ(ID) and {circumflex over (t)}=ϕ(), the the update process of SK_ID after the revocation of is:

$\begin{array}{c}{h}_1={\left(\frac{S_{1,2}}{h_0}\right)}^{D_3-S_{i,1}}\\ ={\left(\frac{g^{\alpha +b^2\hat{t}}}{g^{\alpha +b^{2}t}}\right)}^{\frac{1}{\left(\frac{1}{\alpha +b^{2}t}-\gamma \right)-\left(\frac{1}{\alpha +b^2\hat{t}}-\gamma \right)}}\\ ={\left(\frac{g^{\alpha +b^2\hat{t}}}{g^{\alpha +b^{2}t}}\right)}^{\frac{1}{\frac{\left(\alpha +b^2\hat{t}\right)-\left(\alpha +b^2\hat{t}\right)}{{}^{\left(\alpha +b^{2}t\right)\left(\alpha +b^2\hat{t}\right)}}}}\\ =g^{\left(\alpha +b^{2}t\right)\left(\alpha +b^2\hat{t}\right)}\end{array}$

Encrypt(S,PP,M) stage: During the Encrypt stage, the broadcaster who creates the content also encrypts it. The encryption algorithm takes as input the public parameters PP, a message M∈G_T and a set S of revoked identities. The algorithm first lets r=|S|, chooses r random exponents s₁, . . . , s_r∈Z_p and sets s=Σ_i=1^r s_i.

Next, the algorithm sets C₀=M·e(g,g)^αsST, C₁=g^s, and for i=1 to r sets C_i,1=ID_i, C_i,2=(g^bST)^si, C_i,3=(g^b2STIDiw^b)^si.

The output of the algorithm is CT={C_O,C₁,{C_i,1,C_i,2C_i,3}_i=1^r}.

Decrypt(SK_ID,CT,PP) stage: The decryption algorithm is given a secret key SK_ID, a ciphertext CT and the public parameters PP. First, if D₅=true or ID∈U_i=1^r C_i,1 then the algorithm outputs ⊥. Otherwise the algorithm calculates:

$A=e\left(C_1,D_4\right)=e\left(g^s,g^{\left(\alpha +b^{2}t\right)·\mathrm{ST}}\right)={e\left(g,g\right)}^{\left(\alpha \mathrm{sST}\right)}·{e\left(g,g\right)}^{b^2\mathrm{stST}}$ $\begin{array}{c}B=\prod _{i=1}^r{\left(e\left(C_{i,2},D_2\right)·e\left(C_{i,3},D_1\right)\right)}^{\frac{1}{\mathrm{ID}-C_{i,1}}}\\ =\prod _{i=1}^r{\left(e\left({\left(g^{\mathrm{bST}}\right)}^{s_i},{\left(g^{\mathrm{bID}}w\right)}^t\right)·e\left({\left(g^{b^2{\mathrm{STID}}_i}{w}^b\right)}^{S_i},g^{-t}\right)\right)}^{\frac{1}{\mathrm{ID}-{\mathrm{ID}}_i}}\\ ={e\left(g,g\right)}^{\sum _{i=1}^r\left(b^2{s}_i\mathrm{tST}\right)}\\ ={e\left(g,g\right)}^{b^2\mathrm{stST}}\end{array}$

Finally the algorithm retrieves the message:M=C₀/(A/B)Security Analysis

By simulating a sequence of the security games against an adversary, each one indistinguishable from the next, it can be proved that the disclosed revocation scheme is generically secure over bilinear groups. The first game is the original security game. In the next game the elements correspond to D₃ in the secret keys are replaced with random elements. Indistinguishably follows directly from the MEA assumption. In the next game the cipher text is changed to a random element.

Given an adversary , with non-negligible advantage ϵ=AD in the security game against the disclosed construction, a simulator is defined that plays the decisional MEA problem.

Let A=Z_p^n×(2n+q+4) be the following matrix:

$A^{n\times \left(2n+4+q\right)}=\left(\begin{array}{c}\underset{\_}{-1}\\ -1\\ ⋮\\ -1\end{array}\left|\begin{array}{c}\underset{\_}{\begin{array}{ccc}0& \dots & 0\end{array}}\\ \\ I^{n\times n}\\ \end{array}\right|0\right)$

Let (p₁′, . . . , p₇′)∈F_p[Y₁, . . . , Y_m]⁷ be the following polynomials:

$p_1^{\prime }\left(Y_1\right)=Y_1^{-1}$ $p_2^{\prime }\left(y_1,Y_2,Y_3\right)=\left(Y_1^{-1}-Y_2^{-1}\right)*Y_3^2$ $p_3^{\prime }\left(Y_1\right)=Y_1^{-2}$ $p_4^{\prime }\left(Y_1,Y_2\right)=Y_1^{-1}*Y_2^{-1}$ $p_5^{\prime }\left(Y_1,Y_2,Y_3,Y_4,Y_5\right)=\left(Y_2^{-1}*Y_4+Y_5^{-1}\right)\left(Y_1^{-1}-Y_2^{-1}\right)*Y_3^2$ $p_6^{\prime }\left(Y_1,\dots ,Y_q\right)=\sum _{i=1}^q{Y}_i^{-1}$ $p_7^{\prime }\left(Y_1,Y_2,Y_3,Y_4\right)=\left(Y_1^{-2}*Y_2+Y_3^{-1}\right)\left(Y_4^{-1}\right)$

Let F=(f₁, . . . , f_k)∈F_p[X₁, . . . X_m]^k be the following polynomials:∀_1≤i≤n f_y,i=p₁′(X_i+1)∀_1≤i≤n f_t1,i=p₂′(X_i+1,X_n+2,X_n+3)fb=p₁′(X_n+3)fb2=p₃′(X_n+3)fwb=p₄′(X_n+3,X_n+4)∀_1≤i≤n f_t2,i=p₅′(X_i+1,X_n+2,X_n+3,X_n+4+i,X_n+4)ps=f₆′(X_2n+5, . . . ,X_2n+q+4)∀_1≤i≤q f_s1,i=p₄′(X_n+3,X_2n+4+i)∀_1≤i≤q f_s2,i=p₇′(X_n+3,X_n+4+i,X_n+4,X_2n+4+i)fαs=p₆′(X_2n+5, . . . ,X_2n+q+4)p₁′(X_n+2)

receives an (A,F)-MEA challenge X=(g,A,F,T,h). It then plays the original security game against the adversary. Let τ be the number of permanent revocation requests that the adversary performs. Let ρ_i denote the number of revoked users in the i-th request. Their identities are denoted by ID_ij where i is in [1, τ] and j is in [1, ρ_i]. Similarly, ST_i,j is used to denote the state after the revocation of the j-th identity in the i-th group. Let ψ_i denote the number of secret key requests the adversary performs after the i-th permanent revocation request (ψ₀ is the number of secret key requests prior to the first revocation). the identities for which the adversary requests keys are denoted by ID_km where k is in [0, τ] and m is in [1, ψ_i] and t_k,m to denote f(ID_km). Let q denote the number of users the adversary revoke during the temporary revocation. Their identities are denoted by ID_i where i is in [1, q].

Next, the elements that the adversary learns during the security game are written, from which a computational assumption is stated. From the public parameters and revocation requests, the adversary learns

${\forall }_{i\in \left[0,\tau \right],j\in \left[1,{\rho }_i\right]}\frac{1}{{\mathrm{ST}}_{i,j}}-\gamma ,g^{{\mathrm{ST}}_{i,j}},g^{b·{\mathrm{ST}}_{i,j}},g^{b^2·{\mathrm{ST}}_{i,j}},{e\left(g,g\right)}^{\alpha ·{\mathrm{ST}}_{i,j}}$ $\mathrm{where}$ ${\mathrm{ST}}_{i,j}=\prod _{i^{\prime }=1}^i\prod _{j^{\prime }=1}^j\left(\alpha +b^2{t}_{{i^{\prime }}_{j^{\prime }}}\right).$

From the secret key requests, the adversary learns

${\forall }_{k\in \left[0,\tau \right],m\in \left[1,{\psi }_k\right]}{\mathrm{ID}}_{k_m},g^{-l_{k_m}},{\left(g^{{\mathrm{bID}}_{k_m}}w\right)}^{t_{k_m}},\frac{1}{\alpha +b^2{t}_{k_m}}-\gamma ,g^{\left(\alpha +b^2{t}_{k_m}\right){\mathrm{ST}}_{k,m}}$ ${\mathrm{ST}}_{k,m}=\prod _{k^{\prime }=1}^k\prod _{m^{\prime }=1}^{{\rho }_k^{\prime }}\left(\alpha +b^2{t}_{{k^{\prime }}_{m^{\prime }}}\right)\mathrm{where}$

Finally, from the challenge, the adversary learnsg^s,M·e(g,g)^αsSTfinal ∀_i∈[1,q](g^BSTfinal)si,(g^b2STfinalIDiw^b)^Si

where

${\mathrm{ST}}_{\mathrm{final}}=\prod _{i=1}^{\tau }\prod _{j=1}^{p_i}\left(\alpha +b^2{t}_{i_j}\right)$

For each identity ID_km the adversary obtains a key that either ID_km is revoked in one of the (τ−k) permanent revocations following the creation of , or that ID_km is revoked in the temporary revocation during the challenge phase. Thus, the next assumption captures the security of the disclosed scheme.

(n−q)-Decisional Multi-Exponent Assumption:

Let be a bilinear group of prime order p. For any (τ, ρ₁, . . . , ρ_τ, ψ₀, . . . , ψ_τ) such that Σ_k=0^τγ_k=n and Σ_i=0ρ_i=n−q the (n−q)-Decisional Multi-Exponent problem in is as follows:

A challenger chooses generators g, w∈ and random exponents,b,γ,{t_km}_{k∈[0,τ],m∈[1,ψk]}. Suppose an adversary is given X=

${\forall }_{i\in \left[0,\tau \right],j\in \left[1,{\rho }_i\right]}\{\begin{array}{c}{\mathrm{ID}}_{i_j},\\ \frac{1}{\prod _{i^{\prime }=1}^i\prod _{j^{\prime }=1}^j\left(\alpha +b^2{t}_{{i^{\prime }}_{j^{\prime }}}\right)}-\gamma ,g^{\prod _{i^{\prime }=1}^i\prod _{j^{\prime }=1}^j\left(\alpha +b^2{t}_{{i^{\prime }}_{j^{\prime }}}\right)},\\ g^{b·\prod _{i^{\prime }=1}^i\prod _{j^{\prime }=1}^j\left(\alpha +b^2{t}_{{i^{\prime }}_{j^{\prime }}}\right)},g^{b^2·\prod _{i^{\prime }=1}^i\prod _{j^{\prime }=1}^j\left(\alpha +b^2{t}_{{i^{\prime }}_{j^{\prime }}}\right)},\\ {e\left(g,g\right)}^{\alpha ·\prod _{i^{\prime }=1}^i\prod _{j^{\prime }=1}^j\left(\alpha +b^2{t}_{{i^{\prime }}_{j^{\prime }}}\right)}\end{array}{\forall }_{i\in \left[0,\tau \right],m\in \left[1,{\psi }_k\right]}\{\begin{array}{c}{\mathrm{ID}}_{k_m},g^{-t_{k_m}},{\left(g^{{\mathrm{bID}}_{k_m}}w\right)}^{t_{k_m}},\frac{1}{\alpha +b^2{t}_{k_m}}-\gamma ,\\ g^{\left(\alpha +b^2{t}_{k_m}\right)}·\prod _{k^{\prime }=1}^k\prod _{m^{\prime }=1}^{{\rho }_k^{\prime }}\left(\alpha +b^2{t}_{{k^{\prime }}_{m^{\prime }}}\right)\end{array}{g}^s{\forall }_{\ell \in \lceil 1,q\rceil }{\left(g^{b·\prod _{i=1}^{\tau }\prod _{j=1}^{{\rho }_i}\left(\alpha +b^2{t}_{i_j}\right)}\right)}^{s_{\ell }},{\left(g^{b^2·\prod _{i=1}^{\tau }\prod _{j=1}^{{\rho }_i}\left(\alpha +b^2{t}_{i_j}\right)·{\mathrm{ID}}_{\ell }}{w}^b\right)}^{s_{\ell }}$

such that

$\frac{{\left\{{\mathrm{ID}}_{k_m}\right\}}_{k\in \left[0,\tau \right],m\in \left[1,{\psi }_k\right]}}{{\left\{{\mathrm{ID}}_{i_j}\right\}}_{i\in \left[0,\tau \right],j\in \left[1,{\rho }_i\right]}\bigcup {\left\{{\mathrm{ID}}_{\ell }\right\}}_{l\in \left[1,q\right]}}=\varnothing$

Then it must be hard to distinguish

$T={e\left(g,g\right)}^{\alpha s·\prod _{i=1}^{\tau }\prod _{j=1}^{{\rho }_i}\left(\alpha +b^2{t}_{i_j}\right)}$

from a random element R∈_T. An algorithm that outputs z∈{0,1} has advantage ϵ in solving the (n−q)-Decisional Multi-Exponent problem in g if

${\mathrm{Adv}}^{\mathrm{nqdme}}\left(n,q,A\right):=\mathrm{Pr}\left[A\left(X,T={e\left(g,g\right)}^{\alpha s·\prod _{i=1}^{\tau }\prod _{j=1}^{{\rho }_i}\left(\alpha +b^2{t}_{i_j}\right)}\right)\right]-\mathrm{Pr}\left[A\left(X,T=R\right)\right]\ge ϵ$

The decision (n−q)-Decisional Multi-Exponent Assumption holds if no poly-time algorithm has a non-negligible advantage in solving the (n−q)-Decisional Multi-Exponent problem.

In the second game, uses the (A,F)-MEA challenge to simulate the security game. The random exponents chosen by the (A,F)-MEA challenger are denoted by

$x=\left(\gamma ,{\gamma }_1,\dots y_n,\frac{1}{\alpha },\frac{1}{b},\frac{1}{w},{\mathrm{ID}}_1,\dots {\mathrm{ID}}_n,\frac{1}{s_1},\dots \frac{1}{s_q}\right).$ can use h to simulate all the needed group elements since

$\begin{array}{cc}{\forall }_{1\le i\le n}& g^{p_{y,i}\left(x_{l+1}\right)}=g^{\alpha +b^2{t}_i}\\ {\forall }_{1\le i\le n}& g^{p_{t1,i}\left(x_{i+1},x_{n+2},x_{n+3}\right)}=g^{-t_i}\\ & g^{\mathrm{pb}\left(x_{n+3}\right)}=g^b\\ & g^{\mathrm{pb}2\left(x_{n+3}\right)}=g^{b^2}\\ & g^{\mathrm{pwb}\left(x_{n+3},x_{n+4}\right)}{w}^b\\ {\forall }_{1\le i\le n}& g^{p_{t{2}_i}\left(x_{i+1},x_{n+2},x_{n+3},x_{n+4+1},x_{n+4}\right)}=g^{\left({\mathrm{bID}}_i+b\right)t_i}\\ & g^{\mathrm{ps}\left(x_{2n+5},\dots ,x_{2n+q+4}\right)}=g^s\\ {\forall }_{1\le i\le q}& q^{p_{s{1}_i}\left(x_{n+3},x_{2n+4+1}\right)}=g^{{\mathrm{bs}}_i}\\ {\forall }_{1\le i\le q}& g^{p_{s2,i}\left(x_{n+3},x_{n+4+i},x_{n+4},x_{2n+4+i}\right)}=g^{\left(b^2{\mathrm{ID}}_j+b\right)s_i}\\ & {e\left(g,g\right)}^{p\alpha s\left(x_{2n+5},\dots ,x_{2n+q+4}{x}_{n+2}\right)})={e\left(g,g\right)}^{\alpha s}\end{array}$

taeks D₃ elements from T. If T=A×e these elements have the same distribution as in the real security game since

$T_i=\frac{1}{\alpha +b^2{t}_i}-\gamma .$ It follows that the simulation provided by is perfect unless T is a random element in Z_pⁿ. Assuming the MEA holds, cannot distinguish between the games.

According to one embodiment, the proposed revocation system (which supports both temporary and permanent revocation) may be separated from the broadcasting system (unlike the previous embodiments, in which the keys were part of the broadcasted content). For example, the broadcaster may encrypt the content with a public key and each user will be able to purchase the secret key from a 3^rd party (such as PayPal), to thereby become a subscriber. In this embodiment, the 3^rd party will handle all payment issues. The broadcasting system will use the payment data for maintaining users that paid (subscribers) and for updating keys for both revocations.

FIG. 1A illustrates the flow of broadcast encryption without revocation. Accordingly, during a Setup stage, a KeyService generates a public key and a Master Secret Key (MSK). The MSK is kept by the KeyService and the Public Parameters PP (used to generate the public key) are sent to the broadcaster and to all users.

When the broadcaster wishes to send the public key (in the form of a message M, with which he encrypted the content) to all users (subscribers), he uses the Public Parameters PP to create the message M and further creates a CipherText (CT), which is sent to all users. When a user wishes to decrypt the content he received, he sends a request with his ID₁ (RequestID₁) to the KeyService, which by the KeyGen stage, generates a corresponding secret key SK_ID1. The secret key SK_ID1 is sent to the user ID₁ via a secure channel. Then the user performs a Decrypt operation using secret key SK_ID1, decrypt the CipherText (CT) and obtain the message M.

FIG. 1B illustrates the flow of broadcast encryption with permanent revocation capability, using the Revoke stage. Revocation is made with respect to desired k users identities ID₁, ID₂, . . . ID_k, which should be revoked. The algorithm Revoke (MSK, {ID₁, ID₂, . . . , ID_k}) provides a State Update Message (SUM) which is sent to all users. Each user tries to update his state with the SUM he received. As a result, the k users with identities ID₁, ID₂, . . . ID_k will not be able to update their state (and therefore, will be permanently revoked). All the remaining users (admitted users) will be able to update their state and will not be revoked. At the next stage (following state update), the broadcaster will encrypt again with a CT and will send to all user. Then each user will try to decrypt the message. If for a user ID=ID₁, that user will not be able to decrypt. Otherwise, he will be able to decrypt (since the current ID is different from the past: ID≠ID₁). The permanent revocation is therefore independent of the CT.

If temporary revocation is desired, it is possible to insert a list of IDs (ID₁, ID₂, . . . ID_k), to be revoked into the CT. This way, the same flow may be used for performing temporary revocation, as well.

FIG. 2 illustrates a broadcasting system which uses the broadcast encryption with both temporary and permanent revocation capability, according to an embodiment of the invention. The broadcasting system 20 may be for example, a system of a broadcaster 23 (e.g., a satellite TV provider or a cable TV provider), which purchases content 22 (such as movies or TV programs, which are stored on a content server) from a content provider 21, encrypts is with an encryption server 24 and distributes the encrypted content to users u₁, . . . , u_n, which are admitted subscribers. As described above, the broadcaster 23 encrypts the content 22 with a public key, and is able to allow admitted users to decrypt the content they demand and pay for, as well as to remotely perform temporary or permanent revocation of users (subscribers), according to payment and subscription terms that they should fulfil, according to the schemes described above.

The proposed scheme used by the broadcasting system has the following advantages over other schemes:

• • The system uses a Public-key;
  • The system supports both Temporary and permanent revocation
  • Revocation of r users requires O(r) operations
  • A revocation message comprises O(r) group elements
  • The Ciphertext and keys are O(1) groups elements
  • The system is stateful (a stateful server remembers client data (state) from one request to the next and is more efficient because clients do not have to provide full file information every time they perform an operation)
  • The system is based on Bilinear maps and is secure in the generic bilinear group model
  • New type of security assumptions—DH-MEA

The proposed scheme is more secure, since in case of collusion between revoked users, they will not be able to decrypt. In case of collusion between revoked users and users who can decrypt, at most, they will be able to decrypt the current specific massage but not future messages, as it will require performing successful state update. It is also more efficient, since it does not require using 3-linear groups and can be performed using bi-linear groups.

The KeyService may operate separately from the broadcaster, to handle key generation, distribution, update, as well has to handle all billing issues and payment of subscribers. For example, the KeyService may generate and distribute Keys both to the broadcaster and to users who became subscribers, according to their attributes;

• • a) conducting billing operations for admitted users who registered and payed for their subscription; and
  • b) using the billing data for maintaining admitted users that paid for subscription, and for revocation of users who stopped paying.

Although embodiments of the invention have been described by way of illustration, it will be understood that the invention may be carried out with many variations, modifications, and adaptations, without exceeding the scope of the claims.

Claims

1. A broadcast encryption method that allows a broadcaster to send encrypted content to a set of users such that only a subset of authorized users can decrypt said content, and to perform both temporary and permanent revocation of users, comprising: a) during a Setup stage: a.1) a KeyService generates a public key and a Master Secret Key (MSK) and sends the Public Parameters PP used to generate said public key to a broadcaster and to all users;a.2) said broadcaster uses the Public Parameters PP to create a message M, with which said broadcaster encrypts the content, and further creates a CipherText (CT), which is sent to all users;b) during a KeyGen stage: b.1) whenever a user wishes to decrypt said message M for decrypting said content, said user sends a request with his ID1 to said KeyService;b.2) said KeyService generates a corresponding secret key SKID1;b.3) said secret key SKID1 is sent to the user ID1 via a secure data channel;c) during a Decrypt stage, said user uses said secret key SKID1, to decrypt the CipherText (CT) and obtain said message M; andd) during a Revoke stage of k users (k=1, 2, 3, . . . ): d.1 ) providing a State Update Message (SUM) which is sent to all users;d.2) allowing each user to update his state with said SUM he received, such that said k users having identities ID1, ID2, . . . IDk will not be able to update their state and will be permanently revoked, while all the remaining users being admitted users will be able to update their state and will not be revoked;wherein said revocation is carried out using a Public Key Revocation Scheme, consisting of:A) a Setup (λ) algorithm , which for a security parameter λ: A.1) chooses a bilinear group G of prime order p such that |p|≥λ;A.2) chooses random generators g, w∈G, random exponents α,γ,b∈Zp and sets ST=1,A.3) randomly chooses a function ϕ8 from Fλ, a pseudo-random family of permutations over Zp, wherein the Master secret key MSK is MS=(α,b,γ,w,ST,ϕ), and the public parameters PP are PP=(g,gbST, gb2st,wb,e(g,g,)αST);B) a KeyGen(MSK, ID) algorithm, which for Given a user identity ID∈Zp and the master secret key MSK: B.1) computes=ϕ(ID)∈Zp; andB.2) sets D1=g−t,D2=(gbIDw)t,

2. The method according to claim 1, further comprising performing temporary revocation by inserting a list of IDs (ID1, ID2, . . . IDk) to be revoked into the CT.

3. The method according to claim 1, wherein the revocation scheme is Cipher-text Policy Attribute-Based Encryption (CP-ABE).

4. The method according to claim 3, wherein the CP-ABE scheme further includes permanent revocation parameters, which are directed to specific users.

5. The method according to claim 3, wherein the CP-ABE scheme further includes permanent revocation parameters, which are directed to specific attributes of specific users.

6. The method according to claim 1, wherein a user can decrypt the ciphertext only if he is not one of the temporarily revoked users.

7. The method according to claim 1, wherein permanent revocation of specific attributes of users is done directly in the revocation mechanism, without the need of providing new secret keys.

8. A broadcast encryption system that allows a broadcaster to send encrypted content to a set of users such that only a subset of authorized users can decrypt said content, and to perform both temporary and permanent revocation of users, comprising: a) a broadcasting server, being an electronic device which is operable to: a.1) obtain content to be distributed to said authorized users;a.2) obtain encryption and decryption keys required for encrypting said content from a KeyService server;a.3) encrypt said content and distributing said content to said authorized users, wherein said broadcasting and KeyService servers are electronic devices which are operable to:b) during a Setup stage: b.1) said KeyService generates a public key and a Master Secret Key (MSK) and sends the Public Parameters PP used to generate said public key to a broadcaster and to all users;b.2) said broadcaster uses the Public Parameters PP to create a message M, with which said broadcaster encrypts the content, and further creates a CipherText (CT), which is sent to all users;c) during a KeyGen stage: c.1) whenever a user wishes to decrypt said message M for decrypting said content, said user sends a request with his ID1 to said KeyService;c.2) said KeyService generates a corresponding secret key SKID1;c.3) said secret key SKID1 is sent to the user ID1 via a secure data channel;d) during a Decrypt stage, said user uses said secret key SKID1, to decrypt the CipherText (CT) and obtain said message M; ande) during a Revoke stage of k users (k=1, 2, 3, . . .): e.1) providing by said KeyService, a State Update Message (SUM) which is sent to all users;e.2) allowing each user to update his state with said SUM he received, such that said k users having identities ID1, ID2, . . . IDk will not be able to update their state and will be permanently revoked, while all the remaining users being admitted users will be able to update their state and will not be revoked;wherein said revocation is carried out using a Public Key Revocation Scheme, consisting of:A) a Setup(λ) algorithm , which for a security parameter λ: A.1) chooses a bilinear group G of prime order p such that |p|≥λ;A.2) chooses random generators g,w∈G, random exponents α,γ,b∈Zp and sets ST=1, A.3) randomly chooses a function ϕ8 from Fλ, a pseudo-random family of permutations over Zp, wherein the Master secret key MSK is MSK=(α,b,γ,w,ST,ϕ), and the public parameters PP are PP=(g,gbST,gb2ST,wb,e(g,g,)αST);B) a KeyGen(MSK, ID) algorithm, which for Given a user identity ID∈Zp and the master secret key MSK: B.1) computes=ϕ(ID)∈Zp; andB.2) sets D1=g−1D2=(GBIDw)t,

9. The broadcast encryption system according to claim 8, in which the KeyService operates separately from the broadcaster, and performs one or more of the following: c) generating and distributing Keys both to the broadcaster and to users who became subscribers, according to their attributes;d) conducting billing operations for admitted users who registered and paid for their subscription; ande) using the billing data for maintaining admitted users that paid for subscription, and for revocation of users who stopped paying.