Tree-Based Symmetric Key Broadcast Encryption ... - Google Sites

“Tree-Based Symmetric Key Broadcast Encryption” (Thesis Defense)

Sanjay Bhattacherjee ISI, Kolkata; ENS-Lyon

Supervisor: Prof. Palash Sarkar ISI, Kolkata

Date: 8th October, 2015

Outline

Preliminaries Background Our Contributions Conclusion

Symmetric Key Encryption

Alice

Bob


Alice

Bob

M = “Nandan, 6:30pm”

Insecure Communication Channel


Alice

Oscar



Bob


Alice

Bob

Oscar



K

K Enc

Dec


Alice

Bob

Oscar




K

K Enc

Dec


Alice

Bob

Oscar



K


K

C ← E(M, K )

Enc

Dec


Alice

Bob

Oscar



K

C ← E(M, K )

Enc


C = “KNQXGAQWJGJFOI”

K Dec


Alice

Bob

Oscar



K

C ← E(M, K )

Enc



M ← E −1 (C, K )

Dec

K


Alice

Bob

Oscar



K

C ← E(M, K )

Enc




M ← E −1 (C, K )

Dec

K


Alice

Bob

Oscar



K

C ← E(M, K )

Enc




M ← E −1 (C, K )

Dec

K

One Alice → Many Bobs?

Alice


Alice

n (Bobs and Oscars)


privileged

Alice

n (Bobs and Oscars)


privileged

Alice

revoked

n (Bobs and Oscars)

Pay-TV center → Subscribers

Broadcasting Center (Tata Sky, Dish TV, etc.)



n Users


privileged users


n Users


privileged users

Broadcasting Center (Tata Sky, Dish TV, etc.) revoked users

n Users

DRM in Blu-ray/DVD discs

(Copyrighted) Content Production House



n Users


legitimate player


n Users


legitimate player

pirated player


n Users

Basic Schemes N : set of all users u1 , . . . , un ; R: set of revoked users;

n = |N | r = |R|


S = {Si : Si ⊆ N }

n = |N | r = |R|


n = |N | r = |R|

S = {Si : Si ⊆ N } Singleton Set Scheme S = {{u1 }, . . . , {un }} I

Each user is assigned a unique key.

O(1)

I

M has to be encrypted for each user in N \ R.

O(n − r )


n = |N | r = |R|

S = {Si : Si ⊆ N } Singleton Set Scheme S = {{u1 }, . . . , {un }} I

Each user is assigned a unique key.

O(1)

I

M has to be encrypted for each user in N \ R.

O(n − r )

Power Set Scheme S = {{u1 }, . . . , {u1 , u2 }, . . . , {u1 , . . . , un−1 }, . . . , N } I

Each subset of users is assigned a unique key.

O(2n )

I

M is encrypted only once for the set N \ R ∈ S.

O(1)

Subset Cover Framework [NNL01] 1. Initiation I

Choose the collection

S = {S1 , . . . , Sw }; Si ⊆ N .



S = {S1 , . . . , Sw }; Si ⊆ N . I

Assign key Li to each Si ∈ S I

Only u ∈ Si gets Li



S = {S1 , . . . , Sw }; Si ⊆ N . I

Assign key Li to each Si ∈ S I

Only u ∈ Si gets Li

2. Encryption Broadcast Message

(sent in sessions)

Message Block M

Subset Cover Framework [NNL01] 2. Encryption (M, R) For each session (with privileged users N \ R):

Subset Cover Framework [NNL01] 2. Encryption (M, R) For each session (with privileged users N \ R): I

Find the Subset Cover Sc = {Si1 , . . . , Sih }


Find the Subset Cover Sc = {Si1 , . . . , Sih } ⊂ S such that

N \ R = Si1 ∪ · · · ∪ Sih I

Encrypt:



N \ R = Si1 ∪ · · · ∪ Sih I

Encrypt: I

M with random Ks ;



N \ R = Si1 ∪ · · · ∪ Sih I

Encrypt: I I

M with random Ks ; Ks with Lij of each Sij ∈ Sc



N \ R = Si1 ∪ · · · ∪ Sih I

Encrypt: I I

M with random Ks ; Ks with Lij of each Sij ∈ Sc FKs (M)



N \ R = Si1 ∪ · · · ∪ Sih I

Encrypt: I I

M with random Ks ; Ks with Lij of each Sij ∈ Sc FKs (M)

ELi1 (Ks )

···

ELih (Ks )



N \ R = Si1 ∪ · · · ∪ Sih I

Encrypt: I I

M with random Ks ; Ks with Lij of each Sij ∈ Sc FKs (M) body

ELi1 (Ks )

··· header

ELih (Ks )

Subset Cover Framework [NNL01]

3. Decryption FKs (M)

For u ∈ Sij where Si,j ∈ Sc I

Find ELi (Ks ) in the header j

ELi1 (Ks )

···

ELih (Ks )




Find ELi (Ks ) in the header

I

EL−1 (ELi (Ks )) ij j

j

Ks ←

ELi1 (Ks )

···

ELih (Ks )




Find ELi (Ks ) in the header

I

Ks ←

EL−1 (ELi (Ks )) ij j

I

M ← FK−1 (FKs (M)) s

j

ELi1 (Ks )

···

ELih (Ks )

Parameters of Interest I

|Sc | = h: header length (costliest parameter) Example: Pay-TV bandwidth cost



I

|Iu |: user storage (may be costly) Example: High-end military receivers



I

|Iu |: user storage (may be costly) Example: High-end military receivers

I I

Encryption time Decryption time Example: TV set-top box booting time

Applications of BE I I

Pay-TV, CableLabs standard. AACS: Disney, Intel, Microsoft, Panasonic, Warner Bros., IBM, Toshiba and Sony.

Blu-ray Disc Manufacturer

Player Manufacturer




I

Player Manufacturer

Military Broadcasts I I

Global Broadcast Service (US) Joint Broadcast System (Europe)




I

Military Broadcasts I I

I I

I I I

Player Manufacturer

Global Broadcast Service (US) Joint Broadcast System (Europe)

File Sharing in Encrypted File Systems. Mailing list encryption: [BGW05] OpenPGP functions as a BE system Online content sharing and distribution [BBW06] eCommerce: trade secret broadcasts ...

Why NOT use Public-Key BE?

Efficiency!!! (decryption time, hence cost)


The collection S

S = {S1, . . . , Sw }; Si ⊆ N

The collection S

S = {S1, . . . , Sw }; Si ⊆ N I

determines the header length h (through the cover generation algorithm) Subset Cover Sc = {Si1 , . . . , Sih } ⊂ S such that N \ R = Si1 ∪ · · · ∪ Sih

The collection S

S = {S1, . . . , Sw }; Si ⊆ N I


I

determines the user storage |Iu | (through the key assignment and distribution algorithm)

The collection S

S = {S1, . . . , Sw }; Si ⊆ N I


I

determines the user storage |Iu | (through the key assignment and distribution algorithm)

I

determines the encryption and decryption time (through the key assignment and distribution algorithm)

Two types of S

I

Subset Difference {1}, {3}, {6, 7, 8}

I

Punctured Interval {1, 3, 6}, {7, 8} Dalit Naor, Moni Naor, and Jeffery Lotspiech. Revocation and tracing schemes for stateless receivers. In Joe Kilian, editor, CRYPTO, volume 2139 of Lecture Notes in Computer Science, pages 41–62. Springer, 2001. Nam-Su Jho and Jung Yeon Hwang and Jung Hee Cheon and Myung-Hwan Kim and Dong Hoon Lee and Eun Sun Yoo. One-Way Chain Based Broadcast Encryption Schemes. In Ronald Cramer, editor, EUROCRYPT, volume 3494 of Lecture Notes in Computer Science, pages 559–574. Springer, 2005.

Outline Preliminaries Background NNL-SD: Initiation Define SNNL−SD Key Assignment Key Distribution

NNL-SD: Encryption Halevy-Shamir Layered SD Other Related Works Our Contributions Paper 1: Arbitrary n; Detailed Analysis Paper 2: Layering; Minimizing Storage Paper 3: k -ary Generalization Paper 4: Assured Savings on Communication Conclusion

Preliminaries Background NNL-SD: Initiation Define SNNL−SD Key Assignment Key Distribution


Subset Difference (SD) Scheme [NNL01] Naor-Naor-Lotspiech (2001) I

Patented

I

Used in the AACS standard

Subset Difference (SD) Scheme [NNL01] Naor-Naor-Lotspiech (2001) I

Patented

I

Used in the AACS standard 0 1

2

3 7 15

8 16

5

4

17

9 18

19

10 20

21

6

11 22

23

13

12 24

25

Assumed n = 2`0

26

27

14 28

29

30

Collection SNNL−SD has:

Collection SNNL−SD has: I

For all internal nodes i



I

For all corresponding nodes j(6= i) in the subtree Ti



I

For all corresponding nodes j(6= i) in the subtree Ti Si,j = Ti \ Tj



I

For all corresponding nodes j(6= i) in the subtree Ti Si,j = Ti \ Tj

Ti

Tj

All users that are in Ti but not in Tj



Key Assignment Key for Si,j :

Key Assignment Key for Si,j : I

Assign random seedi to each internal node i

I

Pseudo-random generator (PRG): G : {0, 1}k → {0, 1}3k G(seed) = GL (seed)||GM (seed)||GR (seed)



I

Pseudo-random generator (PRG): G : {0, 1}k → {0, 1}3k G(seed) = GL (seed)||GM (seed)||GR (seed)



I

Pseudo-random generator (PRG): G : {0, 1}k → {0, 1}3k G(seed) = GL (seed)||GM (seed)||GR (seed) seedi



I

Pseudo-random generator (PRG): G : {0, 1}k → {0, 1}3k G(seed) = GL (seed)||GM (seed)||GR (seed) seedi

j



I

Pseudo-random generator (PRG): G : {0, 1}k → {0, 1}3k G(seed) = GL (seed)||GM (seed)||GR (seed) seedi GL (seedi )

j

GR (seedi )



I

Pseudo-random generator (PRG): G : {0, 1}k → {0, 1}3k G(seed) = GL (seed)||GM (seed)||GR (seed) seedi GL (seedi ) GL (GL (seedi ))

GR (seedi ) GR (GL (seedi ))

j



I



j

seedi,j = GR (GL (GL (seedi )))



I



j




I



j


Li,j = GM (seedi,j )



I



j


Li,j = GM (seedi,j )

Key of Si,j : Li,j = GM (seedi,j )



User Storage User u stores: for every ancestor i (at level `), the derived seeds of nodes “falling-off” from the path between i and u, derived from seedi .

Figure: Secrets stored by u

User Storage User u stores: for every ancestor i (at level `), the derived seeds of nodes “falling-off” from the path between i and u, derived from seedi . seedi

u


User Storage User u stores: for every ancestor i (at level `), the derived seeds of nodes “falling-off” from the path between i and u, derived from seedi . seedi GR (seedi )

u


User Storage User u stores: for every ancestor i (at level `), the derived seeds of nodes “falling-off” from the path between i and u, derived from seedi . seedi GR (seedi ) GR (GL (seedi ))

u


User Storage User u stores: for every ancestor i (at level `), the derived seeds of nodes “falling-off” from the path between i and u, derived from seedi . seedi GR (seedi ) GR (GL (seedi )) GR (GL (GL (seedi )))

u



`

GR (GL (GL (seedi )))

u

GR (GL (GL (GL (seedi ))))



`


u


1+ Figure: Secrets stored by u


`


u


1+2+ Figure: Secrets stored by u


`


u


1 + 2 + · · · + `0 = Figure: Secrets stored by u


`


u


1 + 2 + · · · + `0 = Figure: Secrets stored by u

`0 (`0 +1) 2



Subset Cover Finding Algorithm Given R, find Sc = {Si1 ,j1 , . . . , Sih ,jh }

Subset Cover Finding Algorithm Given R, find Sc = {Si1 ,j1 , . . . , Sih ,jh } such that Si1 ,j1 ∪ . . . ∪ Sih ,jh = N \ R


Sc = {


Sc = {


Sc = {


Sc = {


i1

j1

Sc = {

Si ,j 1 1

i2

Si ,j 2 2

j2


i1

j1

Sc = S{S , Si2 ,j2 , i1 ,j1{ c =

Si ,j 1 1

i2

Si ,j 2 2

j2


i1

j1

Sc = S{S , Si2 ,j2 , i1 ,j1{ c =

Covered

Si ,j 1 1

i2

Si ,j 2 2

j2


i1

j1

Sc = S{S , Si2 ,j2 , i1 ,j1{ c =

Covered

Si ,j 1 1

i2

Si ,j 2 2

j2


i1

j1

Sc = S{S , Si2 ,j2 , i1 ,j1{ c =

Covered

Si ,j 1 1

i2

Si ,j 2 2

j2


i3 i4 i1

j3

Si ,j 4 3

j1

Sc = S{S , Si2 ,j2 , i1 ,j1{ c =

Covered

Si ,j 1 1

i2

Si ,j 2 2

j2


i3 i4 i1

j3

Si ,j 4 3

j1

Covered

Si ,j 1 1

Sc S=c {S = S{S S1{i,2 ,jS2 i,2 ,jS2 i,4 ,j3 , i1c,j1 = i,1 ,j

i2

Si ,j 2 2

j2


i3 i4

j3

Si ,j 4 3

Covered j1

i1

Covered

Si ,j 1 1


i2

Si ,j 2 2

j2


i5 i3 i4

j3

Si ,j 4 3

Covered j1

i1

Covered

Si ,j 1 1


i2

Si ,j 2 2

j2


i5 i3 i4

j3

Si ,j 4 3

Covered j1

i1

Covered

Si ,j 1 1

ScS= = {S = {S ,,jS , S{,,SS, S ,, . ., .} = cS c {S i1 ,jS 1i1 c 1 i1i2,j,j12i2 ,j2 i2i4,j,j23i4 ,j3

i2

Si ,j 2 2

j2

NNL-SD Parameters

For n users out of which r are revoked: I

User storage: O(log2 (n)).

I

Maximum header length: 2r − 1.

I

Maximum decryption time: O(log n).



Layered Subset Difference Scheme [HS02]

Halevy-Shamir (CRYPTO, 2002): “special levels” Special Levels 0

4 1

15

8 16

5

4

7 0

2

3

2

17

9 18

19

10 20

21

6

11 22

23

13

12 24

25

26

27

14 28

29

30

Using layering (with special levels), SHS−LSD ⊂ SNNL−SD .

Layered Subset Difference Scheme [HS02]

Halevy-Shamir (CRYPTO, 2002): “special levels” Special Levels 0

4 Layer 2

1

Layer 1 15

8 16

5

4

7 0

2

3

2

17

9 18

19

10 20

21

6

11 22

23

13

12 24

25

26

27

14 28

29

30

Using layering (with special levels), SHS−LSD ⊂ SNNL−SD .

Layered SD subsets Which Si,j ∈ SHS−LSD ? I

If i is at a special level: for all j in T i , Si,j ∈ SHS−LSD

I

If i is not at a special level: for all j in T i that are in the same layer as i, Si,j ∈ SHS−LSD



I

If i is not at a special level: for all j in T i that are in the same layer as i, Si,j ∈ SHS−LSD Ti

Tj



I

If i is not at a special level: for all j in T i that are in the same layer as i, Si,j ∈ SHS−LSD Ti special level

Tj

Layered SD subsets Si,j ∈ SNNL−SD \ SHS−LSD if I

i is not at a special level

I

and i and j are not in the same layer



I


How to cover these subsets?



I


How to cover these subsets? SPLIT!!! Ti special level Tk

Tj

Subsets in SSD \ SLSD are split into: Si,j = Si,k ∪ Sk ,j .

Layered SD Scheme I

Key for Si,k is Li,k = GM (GL (seedi ))

I

Key for Sk ,j is Lk ,j = GM (GR (GL (seedk ))) seedi k

special level

GR (seedi )

seedi,k = GL (seedi ) Li,k = GM (seedi,k ) seedk k GL (seedk )

GR (seedk ) j

seedk ,j = GR (GL (seedk ))

Lk ,j = GM (seedk ,j )

LSD Parameters

NNL-SD scheme: I

User storage needed: O(log2 (n)).

I

Maximum Header Length: 2r − 1.

I

Decryption Time: O(log n).

HS-LSD scheme: I

User Storage needed: O(log3/2 n).

I

Maximum header length: 4r − 2.

I

Decryption Time: O(log n).



Other SD-based Schemes [GoodrichST04] Stratified SD I

Key assignment: Left and right preorder tree traversals

I

O(log n) storage; O(n) decryption time

I

Double header length

[FukushimaKTS08] 3-ary tree SD “However, in a general a-ary tree with a ≥ 4,... our hash chain approach fails... Thus, the construction of a coalition resistant a-ary SD method with reasonable communication, computation, and storage overhead is an open issue.”

[WangYL14] Balanced Double SD I

Published after I submitted my thesis

I

We have better results now

Analysis of SD scheme [ParkB06] I

Generating function for N(n, r , h)

I

Mean header length: “complex to compute and difficult to gain insight from”

[EagleOPR08] I

Small standard deviations

[MartinMW09] I

Maximum header length



Complete Tree SD (CTSD) Scheme

Question: What happens when n 6= 2`0 ? Answer: Add dummy users to get to the next power of two. I

If the dummy users are considered revoked, then the effect on the header length is disastrous.

I

If the dummy users are privileged, the situation is better but, there is still a measurable effect on the header length.

Solution: Use a complete binary tree. I

“Completes” (and also subsumes) the NNL-SD scheme to work for any number of users.

I

Conceptually simple; working out the details is a bit involved.

CTSD Scheme: Header Length Analysis (n, r )-revocation A choice of r revoked users out of total n users For each (n, r )-revocation, h ∈ {1, . . . , hmax }

N(n, r , h) #(n, r )-revocations for which the the header length is h.

CTSD Scheme: Header Length Analysis (n, r )-revocation A choice of r revoked users out of total n users For each (n, r )-revocation, h ∈ {1, . . . , hmax }

N(n, r , h) #(n, r )-revocations for which the the header length is h. How to compute N(n, r , h)? The only known method would I enumerate all possible n (n, r )-revocations r I

run the cover finding algorithm for each

I

count the number of (n, r )-revocations leading to a header of size h.

Recurrence relation for N(n, r , h) I

P N(λi , r1 , h1 ) = T (λi , r1 , h1 ) + j∈IN(i) T (λj , r1 , h1 − 1) where IN(i) is the set of all internal nodes in the subtree T i excluding the node i.

I

T (λi , r1 , h1 ) = Ph1 Pr1 −1 0 0 0 0 r 0 =1 h0 =0 N(λ2i+1 , r , h ) × N(λ2i+2 , r1 − r , h1 − h ) where λ2i+1 (respectively λ2i+2 ) is the number of leaves in the left (respectively right) subtree of T i .

T (λi , r1 , h1 )

r1 < 0

r1 = 0

r1 = 1

r1 > n

0 0

0 0

0 0

2 ≤ r1 < n 0 from rec.

r1 = n

h1 = 0 h1 ≥ 1

1 0

0 0

N(λi , r1 , h1 )

r1 < 0

r1 = 0

r1 = 1

2 ≤ r1 < n

r1 = n

r1 > n

h1 = 0 h1 = 1 h1 > 1

0 0 0

0 1 0

0 n 0

0 from rec. from rec.

1 0 0

0 0 0

Table: Boundary conditions on T (n, r , h) and N(n, r , h).

Computing N(n, r , h) Dynamic Programming: I

N(n, r , h) can be computed in O(r 2 h2 log n + rh log2 n) time and O(rh log n) space.

I

N(n, r , h) for all possible h can be computed in O(r 4 log n + r 2 log n) time and O(r 2 log2 n) space.

I

N(n, r , h) for all possible r and h can be computed in O(n4 log n + n2 log2 n) time and O(n2 log n) space.

I

N(i, r , h) for 2 ≤ i ≤ n and all possible r and h can be computed in O(n5 + n3 log n) time and O(n3 ) space.

The combinatorics behind the cover generation algorithm was well captured! (for n ~125)

Using N(n, r , h): Maximum Header Length

Theorem The maximum header length in the CTSD method for n users is hmax = min(2r − 1, n2 , n − r ). I I

For the NNL-SD scheme, the bound of 2r − 1 was known. Complete (refined) picture: I I I

if r ≤ n/4, hmax = 2r − 1; if n/4 < r ≤ n/2, hmax = n/2; and for r > n/2, hmax = n − r .

Using N(n, r , h): More analysis nr The value of n for which the header length of 2r − 1 is achieved with r revoked users. I

Obtained a complete characterization of nr .

Generating Function I

Similar to that of [PB06]

Probabilities and Expectation I

For n ~125

I

Compute probabilities of h ∈ {1, . . . , hmax }

I

Compute expected value Hn,r

Expected Header Length Random experiment Select a random subset of revoked users R from N (Select a random (n, r )-revocation).

Event: Node i generates a subset Si,j I

i = 1 if S ∈ S for some j; Xn,r c i,j

I

i = 0 otherwise. Xn,r 0 1 n−1 h = Xn,r + Xn,r + · · · Xn,r =

n−1 X

i Xn,r

i=0

Hn,r : expected header length for (n, r )-revocations. Hn,r =

n−1 X i=0

i ]= E[Xn,r

n−1 X i=0

i = 1] Pr[Xn,r

Hn,r for all SD based schemes

This technique has been useful for other SD-based schemes:

Hn,r =

n−1 X

i Pr[Xn,r = 1]

i=0

For the NNL-SD scheme: Computing Hn,r requires O(r log n) time and O(1) space.

Hn,r for the NNL-SD Scheme

Theorem: For all n ≥ 1, r ≥ 1, the expected header length Hn,r ↑ Hr , as n increases through powers of two, where Hr = 3r − 2 − 3 ×

r −1 X i=1

r Hr /r

2 1.25

3 1.25

! k i k) i (2 − 3 1 i X + (−1)k − . k (2k − 1) 2 k =1

4 1.2455

5 1.2446

6 1.2448



Halevy-Shamir LSD Scheme Special Levels `0 = 4

0

d1 = 2

1 `1 = 2

d2 = 2 15

9

8 16

5

4

7 `2 = 0

2

3

17

18

19

10 20

21

6

11 22

23

13

12 24

25

26

27

14 28

29

[HS02]: “The root is considered to be at a special level, p and in addition we consider every level of depth k · log (n) for k = 1 . . . log (n) as special (wlog, we assume that these numbers are integers).” n = 2`0 with `0 = 4, 9, 16, 25 only?

30

Layering Strategy

A choice of special levels is called a layering strategy.

General layering strategy ` I

Layering strategy ` = (`0 , . . . , è ): I I

I

has e + 1 special levels `0 > `1 > . . . > è−1 > è = 0.

Layering strategy d = (d1 , . . . , de ) I I

di = ì − ì−1 is a layer length In general, the layer lengths need not be (almost) equal.

Extending the HS Scheme Residual bottom layer Write `0 = d(e − 1) + p where 1 ≤ p ≤ d. Then the special levels are `0 , `0 − d, `0 − 2d, . . ., ` − d(e − 1), 0.

Balanced layering or extended-HS (eHS) Write `0 = d(e − 1) + p = (e − d + p)d + (d − p)(d − 1). Define the layer lengths from the top to be (d, . . . , d , d − 1, . . . , d − 1). | {z } | {z } e−d+p

d−p

Layering Strategy and User Storage

Layering strategy: ` = (`0 , . . . , è )

storage0 (`) =

e−1 X i=0

e−1

ì +

1X (ì − ì+1 )(ì − ì+1 − 1). 2 i=0

storage0 (`0 , `1 , . . . , è ) (`0 − `1 )(`0 − `1 − 1) = `0 + + storage0 (`1 , . . . , è ). 2

Storage Minimal Layering SML0 (`0 ) A layering strategy which minimizes the user storage among all layering strategies.

#SML0 (`0 ) User storage required by SML0 (`0 ).

#SML0 (`0 ) = #SML0 (e, `0 ) =

min #SML0 (e, `0 );

1≤e≤`0

min storage0 (`0 , `1 , . . . , è )

(`0 ,...,è )

Dynamic programming algorithm to compute #SML0 (`0 ): O(`30 ) time and O(`20 ) space.

Root at a Non-Special Level [HS02]: “The root is considered to be at a special level, and ...”

Making root level `0 non-special: I

storage1 (`) = storage0 (`) − `1 . Hence, user storage decreases.

I

0 = 1] is small. Pr[Xn,r Hence, negligible increase in the expected header size.

SML1 (`0 ): SML with non-special root. #SML1 (`0 ): corresponding user storage.

Examples of SML

Suppose there are 228 users, i.e., `0 = 28 (a good estimate as per the CableLabs website) Scheme Name NNL-SD: eHS: SML0 : SML1 :

Layering ` (28,0) (28,22,16,10,5,0) (28,21,15,10,6,3,1,0) (22,16,11,7,4,2,0)

Storage |Iu | 406 146 140 119

Other Results

Complete Tree LSD scheme Maximum Header Length I

hmax = min (4r − 2,

I

hmax = min (4r − 3,

n n2 2

, n − r ) if root is non-special. , n − r ) if root is special.

Expected Header Length: I

The splitting of subsets complicates the analysis.

I

O(r log2 n) time and O(1) space.

Constrained Minimization I

I

For a given r , the contribution of level `max = `0 − log2 r to the header is maximum. As r ↑, `max ↓. Hence, I

I

Depending on the application, fix a value of rmin and set `max = `0 − log2 rmin . Let ` = {`max , 0}.


I


I


Result: Hn,r close to that of NNL-SD, but, with lower user storage.


I


I


`max = `0 − log2 r



I


I


`max = `0 − log2 r


A CML Example

n = 228 and rmin = 210 . Scheme NNL-SD: eHS: CML:

Layering ` (28,0) (28,22,16,10,5,0) (23, 18,0)

|Iu | 406 146 219

Hn,r (normalized with NNL-SD) (1.00, 1.00, 1.00, 1.00, 1.00, 1.00, 1.00, 1.00, 1.00, 1.00) (1.69, 1.63, 1.64, 1.67, 1.69, 1.72, 1.73, 1.74, 1.75, 1.75) (1.14, 1.08, 1.04, 1.03, 1.01, 1.01, 1.00, 1.00, 1.00, 1.00)

Header lengths for 10 equispaced values of r from 210 to 214 normalized by the header length of the NNL-SD scheme.



k -ary tree SD seedi i

Li,{j} = G100 (seedi )

G010 (seedi )

j j1

G001 (seedi )

j2

Li,{j ,j } = G011 (Li,{j} ) 1 2

Figure: Key of Si,{j1 ,j2 } is G000 (Li,{j1 ,j2 } ) = G000 (G011 (G100 (seedi ))).

User storage 1 + (2

k −1

− 1)

`0 X `=1

`=1+

`0 (`0 + 1) k −1 (2 − 1) 2

... reduced using additional tree structure (constructed using cyclotomic cosets mod 2k − 1)

k -ary tree SD: Results I

Why k -ary trees? I

|S| ↑ =⇒ (Hn,r ↓, |Iu | ↑)


Why k -ary trees? I

|S| ↑ =⇒ (Hn,r ↓, |Iu | ↑)

always?


Why k -ary trees? I I

|S| ↑ =⇒ (Hn,r ↓, |Iu | ↑) Hierarchy of Optimization

always?



I

always?

Header length analysis I I

I


hmax = min (2r − 1, dn/k e, n − r ) Algorithm to compute Hn,r (for n = k `0 ) O(r log n) space; O(1) time

Reducing user storage I I

Using cyclotomic cosets modulo 2k − 1 An additional tree structure T (k )



I

I

I

I


Complete Tree for arbitrary number of users Layering I

I

hmax = min (2r − 1, dn/k e, n − r ) Algorithm to compute Hn,r (for n = k `0 ) O(r log n) space; O(1) time

Reducing user storage I

I

always?

Header length analysis I

I


Storage Minimal Layering

Header length simulation study (for n 6= k `0 )

k -ary tree SD: Header length and user storage n

103

105

107

k

usk

2 3 4 5 6 7 8 2 3 4 5 6 7 8 2 3 4 5 6 7 8

55 56 60 90 120 180 340 153 132 180 216 336 378 714 300 240 312 396 540 810 1224

MHLk /r (1.10, 0.98, 0.72) (1.27, 1.06, 0.72) (1.21, 0.96, 0.59) (1.11, 0.84, 0.50) (1.03, 0.73, 0.42) (0.95, 0.65, 0.36) (0.86, 0.58, 0.32) (1.11, 0.97, 0.71) (1.27, 1.06, 0.72) (1.20, 0.96, 0.59) (1.11, 0.84, 0.49) (1.02, 0.73, 0.41) (0.94, 0.65, 0.36) (0.87, 0.58, 0.31) (1.11, 0.97, 0.71) (1.27, 1.06, 0.72) (1.20, 0.96, 0.59) (1.11, 0.84, 0.49) (1.02, 0.73, 0.41) (0.94, 0.65, 0.36) (0.87, 0.58, 0.31)

n

104

106

108

k

usk

2 3 4 5 6 7 8 2 3 4 5 6 7 8 2 3 4 5 6 7 8

105 90 112 126 252 270 510 210 182 220 270 432 648 952 378 306 420 468 792 990 1530

MHLk /r (1.11, 0.97, 0.71) (1.26, 1.07, 0.72) (1.20, 0.96, 0.59) (1.11, 0.84, 0.49) (1.02, 0.73, 0.41) (0.94, 0.65, 0.36) (0.86, 0.58, 0.31) (1.11, 0.97, 0.71) (1.27, 1.07, 0.72) (1.20, 0.96, 0.59) (1.11, 0.84, 0.49) (1.02, 0.73, 0.41) (0.94, 0.65, 0.36) (0.87, 0.58, 0.31) (1.11, 0.97, 0.71) (1.27, 1.06, 0.72) (1.20, 0.96, 0.59) (1.11, 0.84, 0.49) (1.02, 0.73, 0.41) (0.94, 0.65, 0.36) (0.87, 0.58, 0.31)

Table: MHLk /r for r = (0.1n, 0.2n, 0.4n).

k -ary tree SD

k δk

3 0.44

4 0.19

5 0.11

6 0.07

7 0.05

8 0.04

Table: Values of the threshold δk .

16 < 0.01



a-ABTSD scheme

I

SNNL−SD ⊂ Sa−ABTSD I

Augment trees of height a (with k = 2a leaf nodes)

a-ABTSD scheme

I

SNNL−SD ⊂ Sa−ABTSD I I

Augment trees of height a (with k = 2a leaf nodes) (Better?) Hierarchy of Optimization

a-ABTSD scheme

I

SNNL−SD ⊂ Sa−ABTSD I I

I

Header length analysis I

I

Augment trees of height a (with k = 2a leaf nodes) (Better?) Hierarchy of Optimization hmax = min (2r − 1, dn/k e, n − r )

Reducing user storage I I


I

Complete Tree for arbitrary number of users

I

Header length simulation study

a-ABTSD: Header length and user storage

n 103

105

107

a

usa (n)

MHLa /r

1 2 3 4 1 2 3 4 1 2 3 4

55 145 1279 115247 153 425 4233 432123 300 852 8902 950634

(1.11, 0.97, 0.71) (0.96, 0.78, 0.53) (0.75, 0.53, 0.31) (0.52, 0.31, 0.16) (1.11, 0.97, 0.71) (0.96, 0.78, 0.53) (0.75, 0.53, 0.31) (0.52, 0.30, 0.16) (1.11, 0.97, 0.71) (0.96, 0.78, 0.53) (0.75, 0.53, 0.31) (0.52, 0.30, 0.16)

n 104

106

108

a

usa (n)

1 2 3 4 1 2 3 4 1 2 3 4

105 287 2757 271629 210 590 6024 629652 378 1080 11428 1234578

MHLa /r (1.11, 0.97, 0.71) (0.96, 0.78, 0.53) (0.75, 0.53, 0.31) (0.52, 0.30, 0.16) (1.11, 0.97, 0.71) (0.96, 0.78, 0.53) (0.75, 0.53, 0.31) (0.52, 0.30, 0.16) (1.11, 0.97, 0.71) (0.96, 0.78, 0.53) (0.75, 0.53, 0.31) (0.52, 0.30, 0.16)

Table: MHLa /r for three different choices of r namely, r = (0.1n, 0.2n, 0.4n).

a-ABTSD performance

with b = 2a − 1 and c = `0 .

(a, b, c)-ABTSD

with a = 5 and c = `0 .

(a, b, c)-ABTSD

with b = 2a − 1.


Implementations

Schemes: I

NNL-SD, HS-LSD and all new schemes

Analysis: I

Header length algorithms

I

User storage algorithms

I

...

What this thesis is NOT about

Asymptotic Improvements

What this thesis is ALL about

Combinatorial and Probabilistic Analysis

What this thesis is ALL about

Combinatorial and Probabilistic Analysis Obtaining Hierarchies of Optimization

Summary of Contributions I

What if n 6= 2`0 ?

1, 2, 3, 4 Use dummy users or complete trees?


What if n 6= 2`0 ?

1, 2, 3, 4 Use dummy users or complete trees? I

Analysis of SD-based schemes?


What if n 6= 2`0 ?


Analysis of SD-based schemes? 1 N(n, r , h)


What if n 6= 2`0 ?


Analysis of SD-based schemes? 1 N(n, r , h) 1 Generating function [PB06]


What if n 6= 2`0 ?



1 N(n, r , h) 1 Generating function [PB06] 1, 2, 3, 4 Maximum and Mean Header Lengths (Hn,r )? I

In [PB06]: too complicated!!! (approximations)


What if n 6= 2`0 ?





1 Upper bound on Hn,r ?


What if n 6= 2`0 ?





1 Upper bound on Hn,r ? I I

1.38r (sketchy proof [NNL01]) 1.25r (empirical [NNL01]) - theoretical analysis?


What if n 6= 2`0 ?






I


Choice of S: |S| ↑ or |S| ↓?


What if n 6= 2`0 ?






I


Choice of S: |S| ↑ or |S| ↓? 2 Storage minimal layering


What if n 6= 2`0 ?






I


Choice of S: |S| ↑ or |S| ↓? 2 Storage minimal layering 2 Constrained minimization layering


What if n 6= 2`0 ?






I


Choice of S: |S| ↑ or |S| ↓? 2 Storage minimal layering 2 Constrained minimization layering 3 k -ary tree SD scheme


What if n 6= 2`0 ?






I


Choice of S: |S| ↑ or |S| ↓? 2 2 3 4

Storage minimal layering Constrained minimization layering k -ary tree SD scheme (a, b, c)-ABTSD scheme

|S|

Intuition: Choice of S: |S| ↑ or |S| ↓

|S|

Intuition: Choice of S: |S| ↑ or |S| ↓

Singleton Set scheme

|S|

Intuition: Choice of S: |S| ↑ or |S| ↓ Power Set scheme


|S|


NNL-SD scheme


|S|


NNL-SD scheme HS-LSD scheme Singleton Set scheme

|S|



|S|



|S|



|S|



|S|



a-ABTSD schemes (for different values of a)

|S|




k -SD schemes (for different values of k )

|S|




k -SD schemes (for different values of k )

Publications Sanjay Bhattacherjee and Palash Sarkar. Complete tree subset difference broadcast encryption scheme and its analysis. Des. Codes Cryptography, 66(1-3):335–362, 2013. Sanjay Bhattacherjee and Palash Sarkar. Concrete analysis and trade-offs for the (complete tree) layered subset difference broadcast encryption scheme. IEEE Transactions on Computers, 63(7): 1709–1722, 2014. Sanjay Bhattacherjee and Palash Sarkar. Tree based symmetric key broadcast encryption. J. Discrete Algorithms, 34: 78–107, 2015. Sanjay Bhattacherjee and Palash Sarkar. Reducing communication overhead of the subset difference scheme. IEEE Transactions on Computers, to appear. Sanjay Bhattacherjee and Palash Sarkar. Implementations related to the above papers, https://drive.google.com/ folderview?id=0B7azs7qqqdS0UnB5aHp3WmJwcDQ&usp=sharing_eil. Uploaded on 13th August, 2014.

Open Questions

Schemes:

Open Questions

Schemes: I

More hierarchies of optimization?

Open Questions

Schemes: I


I

Practical scheme with hmax < r

Open Questions

Schemes: I


I


I

Stateless as well as forward secure?

I

...

Analysis:

Open Questions

Schemes: I


I


I

Stateless as well as forward secure?

I

...

Analysis: I

Non-uniform distribution of revoked users?

I

...

Acknowledgement

I

Prof. Palash Sarkar

I

Friends

I

Family

Desirable Properties

Fully Collusion Resistant



Dynamic revocation



Stateless / Stateful

Dynamic revocation



Dynamic revocation


Traitor Tracing



Dynamic revocation

Dynamic joining / leaving of users


Traitor Tracing

Assigning seeds to users

Figure: From one derived seed, keys of many subsets can be generated

Assigning seeds to users Ti

u Ti

u Figure: From one derived seed, keys of many subsets can be generated

Assigning seeds to users Ti Tj

u Ti



u Ti



u Ti

Tj u Figure: From one derived seed, keys of many subsets can be generated


u Ti

Tj u Figure: From one derived seed, keys of many subsets can be generated

Assigning seeds to users Ti

u Ti


Assigning seeds to users Ti Tj u Ti





u Tj Figure: From one derived seed, keys of many subsets can be generated


u Tj Figure: From one derived seed, keys of many subsets can be generated

Tree-Based Symmetric Key Broadcast Encryption ... - Google Sites

Tree-Based Symmetric Key Broadcast Encryption ... - Google Sites

Suggest Documents

Tree Based Symmetric Key Broadcast Encryption

Tree-Based Symmetric Key Broadcast Encryption - Google Sites

Symmetric Public-Key Encryption

Bridging Broadcast Encryption and Group Key Agreement

Symmetric Public-Key Encryption - Academic Commons - Columbia ...

Comparison of Symmetric Key Encryption Algorithms - IJRIT

Symmetric Key Encryption Technique: A Cellular ...

Comparison of Symmetric Key Encryption Algorithms - IJRIT

A SYMMETRIC KEY FULLY HOMOMORPHIC ENCRYPTION

A New Symmetric Key Encryption Algorithm Using

Symmetric Key Image Encryption Scheme with Key ... - CiteSeerX

Multi-service Oriented Broadcast Encryption - Google Sites

Broadcast Encryption - Semantic Scholar

Broadcast Encryption Using Probabilistic Key Distribution - Journal of ...

Broadcast Encryption versus Public-Key Cryptography in ... - JHU CS

An Efficient Public-Key Attribute-Based Broadcast Encryption Scheme ...

On-Chip Lookup Tables for Fast Symmetric-Key Encryption - PALMS ...

Symmetric-Key Homomorphic Encryption for Encrypted Data Processing

A Comparative Survey on Symmetric Key Encryption Techniques

Secret Key Establishment for Symmetric Encryption over ... - IAENG

Secrecy and Performance Analysis of Symmetric Key Encryption ...

Error Free E-Messaging Technique using Symmetric Key Encryption ...

Symmetric Key Encryption Technique - ScienceDirect.comwww.researchgate.net › publication › fulltext › Symmetri

Broadcast Encryption Scheme with Personalized