Abstract: A tag generation method for generating tags used in data packets in a broadcast encryption system is provided. The method includes detecting at least one revoked leaf node; setting a node identification (node ID) assigned to at least one node among nodes assigned node IDs at a layer 0 and to which the at least one revoked leaf node is subordinate, to a node path identification (NPID) of the at least one revoked leaf node at the layer 0; generating a tag list in the layer 0 by combining the NPID of each of the at least one revoked leaf nodes at the layer 0 in order of increment of node IDs of the corresponding at least one revoked leaf nodes; and generating a tag list in a lowest layer by repeatedly performing the setting and generation operation down to the lowest layer.

Abstract: A content protection method includes generating content protection information regarding a content to be protected by a content producer, and generating a content name indicating a location of the content in content name based networks based on the content protection information. The content protection information may include at least one of marking information indicating whether the content is protected and policy information indicating a disclosure range of the content.

Abstract: A node apparatus and method are described to prevent overflow of a pending interest table (PIT) in a name based network system. The node apparatus and method increases a number of PITs to correspond to a number of interface units so that the PITs match the interface units, respectively, and stores a request message flowing in per interface unit in the matching PITs. In addition, when a capacity used at each of the PITs exceeds a threshold, the node apparatus and method transmits a traffic control message for traffic control through respectively matching interface units to prevent overflow of the PITs.

Abstract: An apparatus and method for video watermarking are provided. The apparatus and method include receiving a bit stream encoded by a video encoder by a spatial domain information analyzer and extracting information from a spatial domain of an image with respect to code words forming the bit stream, grouping the code words for each segmented domain by a domain classifier based on the information from the spatial domain, determining a sign of the each segmented domain by a domain sign determiner and inserting a watermark in the each segmented domain according to the sign determined by the domain sign determiner by a watermark bit inserter.

Abstract: Provided are methods and a validation system that includes a signature device and a verification device for verifying a content. The signature device may generate verification information for each segment of a divided content and may generate signature information to verify the integrity of each segment and whether a corresponding segment is a part of a content. When a segment is received, the verification device may verify integrity of the segment and whether the segment is a part of the content, based on the verification information and the signature value received from the signature device.

Abstract: An apparatus for generating a key for access control of content in a distributed environment network is provided. The apparatus includes a first key distributor configured to generate first encrypted keys by encrypting a first key corresponding to a key for write authorization using each public key of members having write authorization among members included in an access control list including information of at least one user and distribute the access control list and information about access authorization and the first encrypted keys to the members having write authorization, and a second key distributor configured to generate second encrypted keys by encrypting a second key corresponding to a key for read authorization using the first key using each public key of members having read authorization among members included in the access control list and distribute the access control list and second encrypted keys to the members having read authorization.

Abstract: An apparatus for generating a key for access control of content in a distributed environment network is provided. The apparatus includes a first key distributor configured to generate first encrypted keys by encrypting a first key corresponding to a key for write authorization using each public key of members having write authorization among members included in an access control list including information of at least one user and distribute the access control list and information about access authorization and the first encrypted keys to the members having write authorization, and a second key distributor configured to generate second encrypted keys by encrypting a second key corresponding to a key for read authorization using the first key using each public key of members having read authorization among members included in the access control list and distribute the access control list and second encrypted keys to the members having read authorization.

Abstract: A combination-based broadcast encryption method includes: assigning by a server a base group of different combinations to each user; producing and sending secret information for each user by using as a base the base group allocated to each user; producing and sending an inverse-base parameter value through calculations with integers used to produce the base group and key value information of one or more privileged users; and deriving a group key by using the key value information of the privileged users, encrypting a session key by using the derived group key, and sending the encrypted session key to each user. Accordingly, each user is assigned a different base through a combination, thereby having security against collusion attacks.

Abstract: Provided is an apparatus and method of a portable terminal authenticating another portable terminal. The portable terminal may receive a seed generated by the other portable terminal, issue an authentication certificate generated using the seed to the other portable terminal, authenticate the other portable terminal based on the authentication certificate, and provide a secure communication.

Abstract: A node device and method are described to prevent overflow of a pending interest table (PIT). When excessive request messages are received through a particular interface, the node device and method transmits a traffic control message to control a transmission interval of the request messages, which are transmitted to a corresponding interface.

Abstract: An attack detection apparatus includes a window size change unit configured to change a size of a window to be applied to traffic, and an abnormal state detection unit configured to detect an abnormal state of the traffic to which the changed window is applied.

Abstract: An apparatus and method for generating a key for a broadcast encryption. The apparatus includes a node secret generator for managing a user that receives broadcast data in a tree structure and for generating a unique node secret for each node in the tree structure. The apparatus also includes an instant key generator for temporarily generating an instant key used at all nodes in common in the tree structure, and a node key generator for generating a node key for each node by operating the node secret generated at the node secret generator and the instant key generated at the instant key generator. Thus, key update can be efficiently achieved.

Abstract: A system encrypts a name of content stored in a node of a hierarchical structure. A content receiving node encrypts a name of a predetermined node among names of nodes included in a content name, such as by using a hash function, and transmits the encrypted content name to receive the stored content. A relay node receives the content name including the encrypted name of the node and decrypts the encrypted name of the node, such as by using a reference table. The relay node uses the decrypted node name to relay the content request to the content storage node. Since the content name is encrypted, content routing may be performed without disclosing information associated with a hierarchical structure in which the content is stored.

Abstract: A tag generation method for generating tags used in data packets in a broadcast encryption system is provided. The method includes detecting at least one revoked leaf node; setting a node identification (node ID) assigned to at least one node among nodes assigned node IDs at a layer 0 and to which the at least one revoked leaf node is subordinate, to a node path identification (NPID) of the at least one revoked leaf node at the layer 0; generating a tag list in the layer 0 by combining the NPID of each of the at least one revoked leaf nodes at the layer 0 in order of increment of node IDs of the corresponding at least one revoked leaf nodes; and generating a tag list in a lowest layer by repeatedly performing the setting and generation operation down to the lowest layer.

Abstract: A method for authorizing an off-line image device to play contents in use of a recording medium, including recording an encrypted key on a recording medium; recording contents on the recording medium using the encrypted key; and recording information as to a play right to play the contents recorded on the recording medium. Thus, the off-line image device can be authorized to play contents in use of the recording medium. As a result, the off-line image device can play contents that are recorded on the recording medium and must be authorized to play the contents.

Abstract: A rekey index generation method and a rekey index generation apparatus are provided. The rekey index generation method includes inserting join information to a first field of a rekey index when new members join a group; and inserting node numbers, corresponding to each of the new members, into a second field of the rekey index for a receiver to select a necessary key from among transmitted encoded keys.

Abstract: Provided is an apparatus to transmit and receive data, and a method thereof. A data transmission apparatus may generate a first cryptogram and a second cryptogram by encrypting a message authentication code to be transmitted, using a plurality of encryption keys, and may transmit the generated first cryptogram and the second cryptogram to a data reception apparatus.

Abstract: A method of generating prevention and control data to verify validity of data to be transmitted, and an apparatus to perform the method, the method including generating the prevention and control data according to composing information of the data to be transmitted, and transmitting the prevention and control data along with the data to be transmitted to verify the validity of the data to be transmitted.

Abstract: A user key management method for a broadcast encryption includes assigning node path identifiers (IDs) to nodes arranged in sequence; assigning random seed value keys to the nodes according to the node path IDs; generating key values by repeatedly applying a hash function to the assigned random seed value keys; and assigning the generated key values to the nodes in sequence. Accordingly, it is possible to reduce the transmission overhead that is most important matter in the broadcast encryption to less than the number of the revoked users. Further, there is an advantage that the transmission overhead of the exemplary embodiments of the present invention is remarkably reduced compared with the Subset Difference method.

Abstract: A user key management method for a broadcast encryption includes assigning node path identifiers (IDs) to nodes arranged in sequence; assigning random seed value keys to the nodes according to the node path IDs; generating key values by repeatedly applying a hash function to the assigned random seed value keys; and assigning the generated key values to the nodes in sequence. Accordingly, it is possible to reduce the transmission overhead that is most important matter in the broadcast encryption to less than the number of the revoked users. Further, there is an advantage that the transmission overhead of the exemplary embodiments of the present invention is remarkably reduced compared with the Subset Difference method.