Keywords

1 Introduction

Many security protection schemes [1–11, 14] have been developed for an individual multicast group. Some schemes address secure group communications by using secure filter [1–4] to enhance performance of the key management. Wu et al. [4] proposed a key agreement to securely deliver a group key to specific members efficiently. The system conceals the group key within a polynomial consisting of the common keys shared with the members. In the Wu et al.’s scheme, the polynomial is called as a secure filter. Through their scheme, only the legitimate group members can derive a group key generated by a central authority on a public channel. Nevertheless, for the dynamic membership, the scheme is suffered from the differential attack which we describe later. The dynamic membership means the addition and subtraction of the group members. Naturally, the membership changes by the reason caused by network failure or explicit membership change (application driven) [5, 6]. If an adversary collects the secure filters broadcasted among the group members, as the membership changes, the group keys sent to the group members with the secure filter will be discovered through the differential attack [11].

The secure multicast key agreement (SMKA) scheme is proposed in this paper, which is a kind of secure filter to resist against the differential attack. The proposed secure filter is based on the properties of a cryptographically secure one-way hash function. Moreover, the complexity of the modified secure filter is almost the same with the complexity of the original one.

The rest of this paper consists of the following parts. The Sect. 2 gives an overview of the secure filter and the differential attack against the secure filter for the dynamic membership. The Sect. 3 introduces our scheme. The Sect. 4 gives the security proof of our scheme. Then we conclude our scheme in the Sect. 5.

2 The Secure Filter and the Differential Attack

2.1 Wu et al.’s Scheme

In Wu et al.’s Scheme [4], assume that there is a central authority which is in charge of distributing a group key to the group members, denoted as G, where G = [M 1, M 2, ···M n ] in which the M i indicates i-th group member. The M i shares a common key k i with the central authority. As the central authority starts to send a group key s to the members in the G, the central authority computes the secure filter as follows.

$$ f(x) = \prod\limits_{{i = 1,k_{i} \in K}}^{n} {(x - h(k_{i} ))} + s \, \bmod p $$
$$ = \sum\limits_{i = 1}^{n} {a_{i} x^{i} } \, \bmod p $$

Then the central authority broadcasts the coefficient of each item. For the M i , upon receiving the coefficients, he can derive s by computing f(h(k i )). Any adversary can not derive the s because he doesn’t know any k i , where i = [1, 2, ···, n].

2.2 A Differential Attack on Wu et al.’s Scheme

The differential attack utilizes the linear relationship of the coefficients in the secure filter to compromise the group keys. The differential attack is described as follows. Assume that an adversary, Ad, where Ad ∉ G. The Ad collects each secure filter used to send a group key at each session which means a period of the time for the membership unchanged. Observe that the coefficients of the secure filter, we learn the relationship as follows.

$$ \begin{aligned} a_{n} & = 1 \, \bmod p, \\ a_{n - 1} & = \sum\limits_{i = 1}^{{C_{1}^{n} }} {h(x_{i} )} \, \bmod p, \\ a_{n - 2} & = \sum\limits_{i = 1,i \ne j}^{{C_{2}^{n} }} {h(x_{i} )} h(x_{j} ) \, \bmod p, \\ & \;\, \vdots \\ \end{aligned} $$

The coefficients of the secure filter are the linear relationship of the secure factors. As membership changes, the differential value of the coefficients will disclose the secure factors in the secure filter. For example, as the M 3 is excluded from the group, which may be caused by network failure, then the central authority re-computes the following secure filter to refresh the group key, where n′ means the membership as the M 3 is excluded below.

$$ f'(x) = \prod\limits_{{i = 1,k_{i} \in K,i \ne 3}}^{n'} {(x - h(x_{i} ))} + s' \, \bmod p $$
$$ = \sum\limits_{i = 1}^{n'} {a_{i} x^{i} } \, \bmod p $$

For the coefficient a n′-1, the adversary can compute a n-1 - a n′-1 to derive h(x 3). Through the h(x 3), the adversary can derive the previous group keys through the preceding secure filters. Moreover, as the M 3 returns into the group, the central authority will refresh the group key through another secure filter composed of the secure factor h(x 3). Then the adversary who already derives the h(x 3) through the differential attack can derive any group key as long as the M 3 is in the group.

3 Our Scheme

In this section, we introduce our scheme. First, we define the environment and notation. And then we introduce our scheme. The notations used in the rest of this paper are shown in Table 1.

Table 1. Notations
Full size table

3.1 SMKA Scheme

The secure multicast key agreement (SMKA) scheme is proposed in this section. Assume that there are n group members at the session t. The set of these group members at the session t is denoted as G t , where G t  = [M 1, M 2, ···, M n ]. The M i denotes i-th group member, where i ∊ [1, 2, ···, n]. The set of the common keys is denoted as K t , where K t  = [k 1, k 2, ···, k n ]. Before the CA starts to send the group key s t for the session t to the members in the G t , the CA generates a random number c t . Then the CA computes the secure factors below.

$$ x_{i} = h(k_{i} ||c_{t} ), $$
(1)

where k i  ∊ K t and i = {1, 2, ···, n}. Next, the CA generates a group key s t and calculates the modified secure filter below.

$$ f_{t} (x) = \prod\limits_{i = 1}^{n} {(x - x_{i} )} + s_{t} \, \bmod p. $$
(2)

Then the CA can derive the extension of the f t (x) as following.

$$ f_{t} (x) = a_{n} x_{n} + a_{n - 1} x_{n - 1} + \cdots + a_{0} \, \bmod p. $$
(3)

The CA broadcasts the set of the coefficients, denoted as A, and c t , where A = [a n , a n-1, ···, a 0]. After receiving the A and the c t , the group member M i compute the secure factor, x i through the procedure of (1) with the common key k i and c t . Next, the M i derive s t by calculating f t (x i ) = f t (h(k i ||c t )). In the next session t + 1, the CA generates a new random number c t+1 and repeats the procedures of (1) to (3) to send the secret s t+1 to the G t+1, where the G t+1 may not be the same as G t .

4 Security and Complexity Analyses

In this section, we show that the modified secure filter can resist against the differential attack. Moreover, we proof that the modified secure filter can also prevent from the subgroup key attack [13, 14] which could compromise other common keys through factorizing algorithm [15].

Proposition 1.

A cryptographically secure hash function h(·) has the properties: intractability, randomness, collision-free, unpredictability.

The Proposition 1 is assumed commonly on cryptography [15]. The intractability means that, for only given a hash value y, where y = h(x), the value of x is intractable. The randomness means that, for a variable x, the elements in the set of the result y = h(x), denoted as Y, are uniformly distributed. The collision free means that, given y, where y = h(x), the probability of discovering x′, where x ≠ x′, that h(x) equals h(x′) is negligible. The unpredictability means that hash functions exhibit no predictable relationship or correlation between inputs and outputs.

Theorem 1.

An adversary cannot discover the group keys through the differential attack.

Proof:

Assume that an adversary can know the membership of the group exactly. He records the distinct membership at different session. For the session t, the adversary can collect the modified secure filter below.

$$ f_{t} (x) = a_{n} x_{n} + a_{n - 1} x_{n - 1} + \cdots + a_{0} \, \bmod p. $$
(4)

The coefficient of f t (x) can be derived below.

$$ a_{n} = \sum\limits_{i = 1}^{n} {h(x_{i} ||c_{t} )} \, \bmod p, $$
(5)
$$ a_{n - 1} = \sum\limits_{i = 1,i \ne j}^{{C_{2}^{n} }} {h(x_{i} ||c_{t} )h(x_{j} ||c_{t} )} \, \bmod p, $$
$$ \vdots $$

For any session t′, where t′ ≠ t, the adversary can discover another modified secure filter for different membership in which the number of group member is n′ below.

$$ f_{t'} (x) = a_{{n^{'} }} x_{{n^{'} }} + a_{{n^{'} - 1}} x_{{n^{'} - 1}} + \cdots + a_{0}^{'} \, \bmod p. $$
(6)

The coefficient of f t′ (x) can be presented below.

$$ a_{n'} = \sum\limits_{i = 1}^{n'} {h(x_{i} ||c_{t'} )} \, \bmod p, $$
(7)
$$ a_{n' - 1} = \sum\limits_{i = 1,i \ne j}^{{C_{2}^{n'} }} {h(x_{i} ||c_{t'} )h(x_{j} ||c_{t'} )} \, \bmod p, $$
$$ \vdots $$

According to the Proposition 1, we can learn that the coefficients in (5) and (7) are predictable for an adversary. Therefore, it induces that the adversary cannot predict the linear relationship between these coefficients. Hence, the adversary cannot engage the differential attack successfully to compromise the group key distributed within a secure filter. □

Theorem 2.

A legitimate group member cannot discover other common keys shared between the CA and other group members.

Proof:

According to the Proposition 1, assume that a legitimate group member has enough ability to factorize the value of f t (0) and discover the other secure factors of the f t (x); he only can discover the hash values not tractable to the common keys. Therefore, the common keys cannot be discovered by the adversary. Then we prove that the modified secure filter can resist against the subgroup key attack.

According to Theorems 1 and 2, we proof that the modified secure filter can resist against the differential attack as well as the subgroup key attack [13, 14]. □

5 Conclusions

In this paper, the navel key agreement scheme by using the new secure filter to improve the robustness in order to support the security functionality on dynamically changing members in the Wu’s secure filter [4]. The proposed secure filter is based on the properties of a cryptographically secure hash function. Via the security analysis, we proved that the modified secure filter can resist against the differential attack. Moreover, the modified secure filter can prevent from the subgroup key attack. The modified secure filter almost has the same complexity with the original secure filter. For a group communication, the dynamic membership is an unavoidable issue. Though the secure filter proposed in [4] gave a simple and robustness distribution scheme for the group secret, it is suffered from the problems of the dynamic membership. The modified secure filter can enhance the secure filter for the dynamic membership and keep the efficiency.