1. Scalable Secure Bidirectional Group Communication Yitao Duan and John Canny http://www.cs.berkeley.edu/~duan Berkeley Institute of Design Computer Science Division University of California, Berkeley

2. Outline Secure bidirection group communication Model, security definitions, etc. The Duan-Canny (DC) multicast encryption construction Extension of DC and the new SBGC scheme Construction, complexity, security, GDI, etc.

3. Group Communication Center Members n members, up to t < n may need to be evicted

4. Multicast Center Members

5. Aggregation Center Members

6. Security Challenges Confidentiality and authenticity Different challenges for the two modes Multicast: single sender, authenticity easy Aggregation: single receiver, confidentiality easy So we will focus on confidentiality for multicast and authenticity for aggregation

7. Security Properties: Multicast Non-group Confidentiality: non-group members can’t access Forward Confidentiality: deleted members can’t have access after deletion Collusion Freedom: no subset of deleted users should be able to decrypt future group communication Backward Confidentiality: new members can’t access old data

8. Security Properties: Aggregation Non-group Authenticity: non-group members can’t generate group messages Forward Authenticity: deleted member can’t generate group messages Collusion Freedom: no subset of t or less active members, nor any subset of deleted members, should be able to forge messages that the center accepts as originated from another member not in the colluding subset Backward Authenticity: a user added at time τ should not have the ability to forge messages that the center accepts as coming from a member who was in the group before τ.

9. Secure Multicast LKH:[Wallner et al., Wong et al.] Asymmetric key based schemes Traitor tracing [CFN94] Broadcast encryption [FN93, BGW05, etc] Duan-Canny: construstion O(1) member key, O(t) center key, O(t) message Members don ’ t have to participate in every re-key operation K 3.8 K 3.1 K 3.2 K 3.3 K 3.4 K 3.5 K 3.6 K 3.7 K 2.1 K 2.2 K 2.3 K 2.4 K 1.1 K 1.2 K0K0 M1M1 M2M2 M5M5 M4M4 M3M3 M6M6 M7M7 M8M8 Keys Assigned to M 1 Member Leaf Node Root Node + Use symmetric key crypto + O(logn) storage, message - Members stateful

10. Aggregation Authentication: What don’t Work Well Pair-wise secret between center and each of the members Works but not scalable Using the traffic encryption key (TEK) Global Authenticate using PRGN(ID i ) IDs are public information Identity Based Signature Complex setting: trusted KGC Message authentication separate from membership authentication: Center has to store list of legitimate users. O(n) storage overhead

11. Our Results Extended a new multicast enc. to support temporal security in both multicast and aggregation Membership authentication is embedded in message authentication. Aggregation message authentication also serves as membership authentication. Center doesn’t need keep a list of legal members O(t) center storage, O(t) message, O(1) member storage The scheme can be made to protect group dynamics information (GDI)

12. Duan-Canny Construction [DC06] Center Members x1x1 x2x2 x3x3 xnxn... x n+1, x n+2, …, x n+t (y, x)  y, x 1, …, x n, x n+1, …, x n+t

13. Duan-Canny Construction c = E y ( m ) φ = { c, D( x n+1, c ), D( x n+2, c ), …, D( x n+t, c )} m = η (D( x i, c ), D( x n+1, c ), D( x n+2, c ), …, D( x n+t, c )) Encryption: Decryption: DC construction preserves or improves the security of the underlying threshold cryptosystem (e.g. IND-CCA) Decrypting t times using revoked users keys

14. Extensions Alternating Bit DC (ABDC) to evict more than t members In-place update for backward confidentiality Novel use of its key structure for authenticating aggregation messages Protecting GDI

15. In-place Update ξ x f(ξ) 123 n

16. In-place Update ξ x f(ξ) 123 n δ n+1

17. DC Construction: Key Structure Center Members x1x1 x2x2 x3x3 xnxn... x n+1, x n+2, …, x n+t

18. DC Construction: Key Structure Center Members x1x1 x2x2 x3x3 xnxn... x n+1, x n+2, …, x n+t, x n+t+1

19. DC Construction: Key Structure Center Members x1x1 x2x2 x3x3 xnxn... x n+1, x n+2, …, x n+t, x n+t+1

20. Authenticating Aggregation Messages and Group Membership

21. Protecting Group Dynamics Information (GDI) An issue raised by [Sun et al 04] Info about group size, join, departure rate, etc., leaked by multicast rekey messages – a problem for almost all existing multicast schemes Batch rekeying and phantom users to fix – don’t really work well

22. Protecting GDI Why is it hard? Size of rekey message dependent on group size Insider can separate rekey messages for member join from those for member departure Our scheme Message size O(t) So we only need to mix join and departure Members are given random indexes. Use a mixing pool to mix join and departure Center storage becomes O(n) – all other schemes same even w/o protecting GDI

23. Summary Defined models and security for bidirectional group communication Extended the DC multicast cryptosystem for backward and authentication security O(t) center storage, message size, O(1) member storage Protecting GDI

24. More Info duan@cs.berkeley.edu http://www.cs.berkeley.edu/~duan Thank You!