Abstract:
A group key management approach based on linear geometry is disclosed. The approach includes the following steps: step 1: a group controller selects a mapping f and a finite field F; each group member selects a m-dimensional private vector over the finite field F, and sends it to the group controller via secure channel; step 2: the group controller selects a mapping parameter in the finite field F randomly, and maps the private vectors of all the group members into a new set of vectors by using the mapping f according to the mapping parameter; step 3: the group controller selects a random number k in the finite field F as a group key, and constructs a system of linear equations by using the new set of vectors and the group key; the group controller computes the central vector, and sends the central vector and the mapping parameter to all the group members via open channel; step 4: after the group members receive the central vector and the mapping parameter, the private vector of each group member is mapped to a new vector in a vector space according to the mapping parameter, and the group key is obtained by calculating the inner product of the new vector and the central vector. This invention requires small memory and little computation, has high security property, and is effective against brute-force attacks.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to the field of group key management in network security technology, and in particular to a group key management approach based on linear geometry. 
       BACKGROUND OF THE INVENTION 
       [0002]    With the rapid development of Internet technology and the popularization of multicast, group-oriented applications, such as video conference, network games, and video on demand, etc., play more and more important roles. How to protect the communication security of these applications is a critical problem. A secure group communication system should not only provide data confidentiality, user authentication, and information integrity, but also good scalability. For a secure group communication system, a secure, efficient, and robust group key management approach is essential. 
         [0003]    These days, there are various approaches in key management of the secure group communication. The typical schemes are for example Group Key Management Protocol (GKMP), Secure Lock (SL), Logical Key Hierarchy (LKH), etc. 
         [0004]    Group Key Management Protocol (GKMP) is a scheme that extends directly from unicast to multicast communication. In this scheme, it is assumed that a secure channel exists between the Group Controller (GC) and each group member. Initially, the GC selects a group key K 0  and distributes this key to all group members via the secure channel. When a new member joins, the GC selects a new group key K N , and encrypts the new group key with the old group key to obtain K′=E K     N   (K 0 ), then broadcasts K′ to the entire group. Moreover, the GC sends K N  to the joining new member via the secure channel between the GC and the new member. Obviously, this scheme is not scalable, and there is no solution to keep the forward secrecy property when a member leaves the group, except to recreate an entirely new group without containing that member. 
         [0005]    The Secure Lock (SL) scheme takes advantage of Chinese Remainder Theorem (CRT) to construct a secure lock to combine all the re-keying messages into one when the group key is updated. However, the CRT is a time-consuming operation. The SL scheme is efficient only when the number of users in a group is small, since the time to compute the lock and the length of the lock (hence the transmission time) is proportional to the number of users. 
         [0006]    The Logical Key Hierarchy (LKH) scheme adopts tree structure to organize keys. The GC maintains a virtual tree, and the nodes in the tree are assigned keys. The key held by the root of the tree is the group key. The internal nodes of the tree hold key encryption keys (KEK). Keys at leaf nodes are possessed by different members. Each member is assigned the keys along the path from its leaf to the root. When a member joins or leaves the group, its parent node&#39;s KEK and all KEKs held by nodes in the path to the root should be changed. Therefore, the number of keys which need to be changed for a joining or leaving is O(2×log 2  n), and the number of encryptions is O(2×log 2  n). If a great deal of members join or leave the group, then the re-keying overhead will increase proportionally to the number of members changed. In addition, there are some other schemes that adopt tree structures, for example, OFT (One-way Function Tree), OFCT(One-way Function Chain Tree), Hierarchical a-ary Tree with Clustering, Efficent Large-Group Key, etc. These schemes are similar to the LKH or can be regarded as improvements to the LKH. 
       SUMMARY OF THE INVENTION 
       [0007]    It is a first object of the present invention to provide a group key management approach based on linear geometry, which requires small memory and little computation, and is effective against brute-force attacks. 
         [0008]    It is a second object of the present invention to provide a further group key management approach based on linear geometry, which requires small memory and little computation, has high security property, and is effective against brute-force attacks. 
         [0009]    The first object of the present invention is achieved by the following technical solution: 
         [0010]    a group key management approach based on linear geometry comprises the following steps: 
         [0011]    step 1: a group controller selects a mapping f and a finite field F for use by a group (all computations in the group are performed over the finite field); suppose there are n members in the group, each group member selects a m-dimensional private vector over the finite field F, and sends the m-dimensional private vector to the group controller via secure channel; the group controller assigns and sends a serial number to each member, and receives the m-dimensional private vector of each member and keeps secret; wherein m, n are positive integers, and 2≦m≦n; 
         [0012]    step 2: the group controller selects a mapping parameter in the finite field F randomly, and maps private vectors of all the members into a new set of vectors via the mapping f according to the mapping parameter, if the set of vectors is linearly dependent, then the mapping parameter is reselected to perform remapping, or return to the step 1 to make each member reselect a private vector, until the new set of vectors is linearly independent; 
         [0013]    step 3: the group controller selects a random number in the finite field F as a group key, and constructs a system of linear equations by using the new set of vectors and the group key; the group controller computes the unique solution of the system of linear equations which is called central vector, and the central vector and the mapping parameter are broadcasted or multicasted by the group controller to all the group members via open channel; 
         [0014]    step 4: after the group members receive the central vector and the mapping parameter, the private vector of each group member is mapped to a new vector in the vector space according to the mapping parameter, and the group key is obtained by calculating the inner product of the new vector and the central vector. 
         [0015]    Preferably, the step 1 is implemented by the following: 
         [0016]    the group controller selects a mapping f and a finite field F for use by a group; each member selects a m-dimensional private vector over the finite field F, and sends the m-dimensional private vector to the group controller via secure channel; wherein m is a positive integer, and 2≦m≦n; 
         [0017]    the group controller assigns and sends a serial number u i  to each member, and receives the m-dimensional private vector V i =(v i,1 ,v i,2 , . . . , v i,m ) of each member and keeps secret, wherein i=1, . . . , n; 
         [0018]    the step 2 is implemented by the following: 
         [0019]    the group controller selects a mapping parameter r in the finite field F randomly, and maps private vectors V i =(v i,1 ,v i,2 , . . . , v i,m ) of all the members u i  into a new set of vectors via the mapping f according to the mapping parameter r: 
         [0020]    for each member u i , where i=1,2, . . . , m: 
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 1 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 2 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       2 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 m 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       m 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0021]    for each member u i , where i=m+1, . . . , n: 
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 1 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 
                   i 
                   - 
                   m 
                   + 
                   2 
                 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       2 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 i 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       m 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0022]    in this way, the group controller obtains a new set of vectors over the finite field F: 
         [0023]    for each member u i , where i=1,2, . . . , m: 
         [0000]        X   i =( x   i,1   ,x   i,2   , . . . ,x   i,n ), wherein  x   i,m+1   , . . . ,x   i,n  are all 0; 
         [0024]    for each member u i , where i=m+1, . . . , n: 
         [0000]        X   i =( x   i,1   ,x   i,2   , . . . ,x   i,n ), wherein  x   i,2   , . . . ,x   i,i−m+1  and  x   i,i+1   , . . . ,x   i,n  are all 0; 
         [0025]    the group controller judges whether X 1 , X 2  . . . , X n  are linearly independent, and if they are linearly independent, then proceed to the step 3; otherwise, return to the step 2, or return to the step 1 to allow the group member to reselect a private vector; (since r is a random number, it is easily to obtain a set of vectors X 1 , X 2  . . . , X n  that are linearly independent); 
         [0026]    the step 3 is implemented by the following: 
         [0027]    the group controller selects a random number K in the finite field F as a group key, and constructs a system of linear equations by using the new set of vectors and the group key: 
         [0028]    suppose a 1 ,a 2 , . . . , a n  are unknown parameters, and the group controller solves the central vector A=(a 1 ,a 2 , . . . , a n ) from the following system of linear equations: 
         [0000]    
       
         
           
             { 
             
               
                 
                   
                     
                       
                         
                           
                             x 
                             
                               1 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         
                           
                             x 
                             
                               1 
                               , 
                               2 
                             
                           
                            
                           
                             a 
                             2 
                           
                         
                         + 
                         … 
                         + 
                         
                           
                             x 
                             
                               1 
                               , 
                               n 
                             
                           
                            
                           
                             a 
                             n 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               2 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         
                           
                             x 
                             
                               2 
                               , 
                               2 
                             
                           
                            
                           
                             a 
                             2 
                           
                         
                         + 
                         … 
                         + 
                         
                           
                             x 
                             
                               2 
                               , 
                               n 
                             
                           
                            
                           
                             a 
                             n 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     … 
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               n 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         
                           
                             x 
                             
                               n 
                               , 
                               2 
                             
                           
                            
                           
                             a 
                             2 
                           
                         
                         + 
                         … 
                         + 
                         
                           
                             x 
                             
                               n 
                               , 
                               n 
                             
                           
                            
                           
                             a 
                             n 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
               
                 
             
           
         
       
     
         [0029]    this system of linear equations can be represented in vector form: X×A T =K T    
         [0030]    wherein T represents the transpose of the matrix, the vector K=(k,k, . . . k), the vector A=(a 1 ,a 2 , . . . , a n ), and the matrix 
         [0000]    
       
         
           
             
               X 
               = 
               
                 
                   [ 
                   
                     
                       
                         
                           X 
                           1 
                         
                       
                     
                     
                       
                         
                           X 
                           2 
                         
                       
                     
                     
                       
                         … 
                       
                     
                     
                       
                         
                           X 
                           n 
                         
                       
                     
                   
                   ] 
                 
                 = 
                 
                   [ 
                   
                     
                       
                         
                           x 
                           
                             1 
                             , 
                             1 
                           
                         
                       
                       
                         
                           x 
                           
                             1 
                             , 
                             2 
                           
                         
                       
                       
                         … 
                       
                       
                         
                           x 
                           
                             1 
                             , 
                             n 
                           
                         
                       
                     
                     
                       
                         
                           x 
                           
                             2 
                             , 
                             1 
                           
                         
                       
                       
                         
                           x 
                           
                             2 
                             , 
                             2 
                           
                         
                       
                       
                         … 
                       
                       
                         
                           x 
                           
                             2 
                             , 
                             n 
                           
                         
                       
                     
                     
                       
                         … 
                       
                       
                         … 
                       
                       
                         … 
                       
                       
                         … 
                       
                     
                     
                       
                         
                           x 
                           
                             n 
                             , 
                             1 
                           
                         
                       
                       
                         
                           x 
                           
                             n 
                             , 
                             2 
                           
                         
                       
                       
                         … 
                       
                       
                         
                           x 
                           
                             n 
                             , 
                             n 
                           
                         
                       
                     
                   
                   ] 
                 
               
             
             ; 
           
         
       
     
         [0031]    since X 1 ,X 2  . . . , X n  are linearly independent vectors and the determinant of the coefficient matrix |X|≠0, this system of linear equations has the unique solution. 
         [0032]    the central vector A=(a 1 ,a 2 , . . . , a n ) and the mapping parameter r are broadcasted or multicasted by the group controller to all the group members via open channel; 
         [0033]    the step 4 is implemented by the following: 
         [0034]    after the group members receive the central vector A=(a 1 ,a 2 , . . . , a n ) and the mapping parameter r, the private vector of each group member u i  is mapped to a new vector in the vector space according to the mapping parameter r: 
         [0035]    for the group member u i , where i=1,2, . . . , m: 
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 1 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 2 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       2 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 m 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       m 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0036]    that is to say: 
         [0037]    X i =(x i,1 ,x i,2 , . . . ,x i,n ), wherein x i,m+1 , . . . , x i,n  are all 0; 
         [0038]    for the member u i , where i=m+1, . . . , n: 
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 1 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 
                   i 
                   - 
                   m 
                   + 
                   2 
                 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       2 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 i 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       m 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0039]    that is to say: 
         [0040]    X i =(x i,1 ,x i,2 , . . . , x i,n ), wherein x i,2 , . . . , x i,i−m+1  and x i,i+1 , . . . , x i,n  are all 0; 
         [0041]    then the group member u i  can calculate the group key k via the equation below, i.e. the inner product of the vector X i  and the central vector A=(a 1 ,a 2 , . . . , a n ) 
         [0000]        k=X   i   ×A   T   =x   i,1   a   1   +x   i,2   a   2   + . . . +x   i,n   a   n , wherein  T  is the transpose of the matrix; 
         [0042]    when a new member joins in the group, the group key management approach based on linear geometry further includes: 
         [0043]    step 5, when new members join in the group, each new member selects a m-dimensional private vector over the finite field F, and sends the m-dimensional private vector to the group controller via secure channel; the group controller assigns and sends a serial number to each new member, and receives the m-dimensional private vector of each new member and keeps secret; 
         [0044]    repeat the steps 2 to 4. 
         [0045]    When group members need to leave the group, the group key management approach based on linear geometry further includes: 
         [0046]    step 5, when group members need to leave the group, each member that needs to leave the group applies to the group controller for leaving the group; the group controller deletes the private vectors of the leaving members, and reassigns serial numbers for the remaining members according to the size order of the subscripts of the current members, and sends the serial numbers to all members via open channel; 
         [0047]    repeat the steps 2 to 4. 
         [0048]    When there are new members want to join in the group and members want to leave the group simultaneously, the group key management approach based on linear geometry further includes: 
         [0049]    step 5, when there are new members want to join the group and members want to leave simultaneously, each new member selects a m-dimensional vector over the finite field F and sends the m-dimensional vector to the group controller via secure channel; the members want to leave the group apply to the group controller for leaving the group, and then the group controller deletes the private vector of each leaving member and reassigns serial numbers to the remaining members according to the size order of the subscripts of the current members, and assigns a serial number to each new member; the m-dimensional private vector of the new member is received by the group controller and kept secret; then the subscripts of all members are broadcasted to all members via open channel; 
         [0050]    repeat the steps 2 to 4. 
         [0051]    Preferably, the m-dimensional private vector is a two-dimensional private vector. 
         [0052]    Preferably, the group key management approach based on linear geometry further includes auto update: if no member joins or leaves the group in a preset period, then the group controller will update the group key periodically, the group controller reselects the mapping parameter and the group key and calculates the central vector, and the central vector and the mapping parameter are broadcasted or multicasted to all members by the group controller via open channel. 
         [0053]    Preferably, suppose the mapping f can be represented by z=f(w,y), where w,y,zεF, the main function of the mapping f is randomization, and the mapping f conforms to the following characteristics: 
         [0054]    1) it is easy to calculate z=f (w,y) if w, y are known; 
         [0055]    2) it is difficult to calculate w if only z and y are known; if z and w are known, it is also difficult to compute y from z=f(w,y); it is difficult to compute w i  from z i =f (w i ,y i ), though a series of z i  and y i  is obtained; and it is also difficult to compute y i  from z i =f (w i ,y i ), though a series of z i  and w i  is obtained. 
         [0056]    The second object of the present invention is achieved by the following technical solution: 
         [0057]    a group key management approach based on linear geometry comprises the following steps: 
         [0058]    step 1: a group controller selects a mapping f and a finite field F for use by a group (all computations in the group are performed over the finite field); suppose there are n members in the group, each member selects a m-dimensional private vector over the finite field F, and sends the m-dimensional private vector to the group controller via secure channel; the group controller assigns and sends a serial number to each member, and receives the m-dimensional private vector of each member and keeps secret; wherein m, n are positive integers, and 2≦m≦n+1; 
         [0059]    step 2: after the group controller receives the private vectors of all members, the group controller itself also selects a m-dimensional private vector, and the group controller selects a mapping parameter in the finite field F randomly, and maps the private vector of the group controller and the private vectors of all the members into a new set of vectors via the mapping f according to the mapping parameter; if the set of vectors is linearly dependent, then the mapping parameter is reselected to perform remapping, or return to step 1 to make each member reselect a private vector, until the new set of vectors is linearly independent; 
         [0060]    step 3: the group controller selects a random number in the finite field F as a group key, and constructs a system of linear equations by using the new set of vectors and the group key; the group controller computes the unique solution of the system of linear equations which is called central vector, and the central vector and the mapping parameter are broadcasted or multicasted by the group controller to all the group members via open channel; 
         [0061]    step 4: after the group members receive the central vector and the mapping parameter, the private vector of each group member is mapped to a new vector in the vector space according to the mapping parameter, and the group key is obtained by calculating the inner product of the new vector and the central vector. 
         [0062]    Preferably, the step 1 is implemented by the following: 
         [0063]    the group controller selects a mapping f and a finite field F for use by a group; each member selects a m-dimensional private vector over the finite field F, and sends the m-dimensional private vector to the group controller via secure channel; wherein m is a positive integer, and 2≦m≦n+1; 
         [0064]    the group controller assigns and sends a serial number U i  to each member, and receives the m-dimensional private vector V i =(v i,0 ,v i,1 , . . . , v i,m−1 ) of each member and keeps secret, wherein i=1, . . . , n; 
         [0065]    the step 2 is implemented by the following: 
         [0066]    the group controller selects random numbers v 0,0 ,v 0,1 , . . . , v 0,m−1  in the finite field F, and constructs a m-dimensional private vector of itself V 0 =(v 0,0 ,v 0,1 , . . . , v 0,m−1 ); the group controller selects a mapping parameter r in the finite field F, and maps private vectors V i =(v i,0 ,v i,1 , . . . , v i,m−1 ) of all the members u i  and the m-dimensional private vector of itself V 0 =(v 0,0 ,v 0, , . . . , v 0,m−1 ) into a new set of vectors via the mapping f according to the mapping parameter r: 
         [0067]    for the private vector of the group controller itself V 0 =(v 0,0 ,v 0,1 , . . . , v 0,m−1 ), the group controller computes: 
         [0000]    
       
         
           
             
               x 
               
                 0 
                 , 
                 0 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       0 
                       , 
                       0 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 0 
                 , 
                 1 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       0 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 0 
                 , 
                 
                   m 
                   - 
                   1 
                 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       0 
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0068]    for the private vectors V i =(v i,0 ,v i,1 , . . . , v i,m−1 ) of the member u i , where i=1,2, . . . , m−1, the group controller computes: 
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 0 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       0 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 1 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 
                   m 
                   - 
                   1 
                 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0069]    for the private vectors V i =(v i,0 ,v i,1 , . . . , v i,m−1 ) of the member u i , where i=m,m+1, . . . , n, the group controller computes: 
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 0 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       0 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 
                   i 
                   - 
                   m 
                   + 
                   2 
                 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 . 
                 i 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0070]    in this way, the group controller obtains a new set of vectors over the finite field F: 
         [0071]    the new vector X 0  obtained after the mapping of the private vector of the group controller is: 
         [0000]        X   0 =( x   0,0   ,x   0,1   , . . . , x   0,n ), wherein  x   0,m   , . . . , x   0,n  are all 0; 
         [0072]    for the new vector X i  of the group member u i , where i=1,2, . . . , m−1; 
         [0000]        X   i =( x   i,0   ,x   i,1   , . . . , x   i,n ), wherein  x   i,m   , . . . , x   i,n  are all 0; 
         [0073]    for the new vector X i  of the group member u i , where i=m,m+1, . . . , n: 
         [0000]        X   i =( x   i,0   ,x   i,1   , . . . , x   i,n ), wherein  x   i,1   , . . . , x   i,i−m+1  and  x   i,i+1   , . . . , x   i,n  are all 0; 
         [0074]    the group controller judges whether X 0 ,X 1  . . . , X n  are linearly independent, if they are linearly independent, then proceed to the step 3; otherwise, return to the step 2, or return to the step 1 to allow the group members to reselect private vectors; (since r is a random number, it is easily to obtain a set of vectors X 0 ,X 1  . . . , X n  that are linearly independent); 
         [0075]    the step 3 is implemented by the following: 
         [0076]    the group controller selects a random number K in the finite field F as a group key, and constructs a system of linear equations by using the new set of vectors and the group key: 
         [0077]    suppose a 1 ,a 2 , . . . , a n  are unknown parameters, and the group controller solves the central vector A=(a 0 ,a 1 , . . . , a n ) from the following system of linear equations: 
         [0000]    
       
         
           
             { 
             
               
                 
                   
                     
                       
                         
                           
                             x 
                             
                               0 
                               , 
                               0 
                             
                           
                            
                           
                             a 
                             0 
                           
                         
                         + 
                         
                           
                             x 
                             
                               0 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         … 
                         + 
                         
                           
                             x 
                             
                               0 
                               , 
                               n 
                             
                           
                            
                           
                             a 
                             n 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               1 
                               , 
                               0 
                             
                           
                            
                           
                             a 
                             0 
                           
                         
                         + 
                         
                           
                             x 
                             
                               1 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         … 
                         + 
                         
                           
                             x 
                             
                               1 
                               , 
                               n 
                             
                           
                            
                           
                             a 
                             n 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     … 
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               n 
                               , 
                               0 
                             
                           
                            
                           
                             a 
                             0 
                           
                         
                         + 
                         
                           
                             x 
                             
                               n 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         … 
                         + 
                         
                           
                             x 
                             
                               n 
                               , 
                               n 
                             
                           
                            
                           
                             a 
                             n 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
               
                 
             
           
         
       
     
         [0078]    this system of linear equations is represented in vector form: X×A T =K T    
         [0079]    wherein the vector K=(k,k, . . . , k), the vector A=(a 0 ,a h1 , . . . , a n ), the matrix 
         [0000]    
       
         
           
             
               X 
               = 
               
                 
                   [ 
                   
                     
                       
                         
                           X 
                           0 
                         
                       
                     
                     
                       
                         
                           X 
                           1 
                         
                       
                     
                     
                       
                         … 
                       
                     
                     
                       
                         
                           X 
                           n 
                         
                       
                     
                   
                   ] 
                 
                 = 
                 
                   [ 
                   
                     
                       
                         
                           x 
                           
                             0 
                             , 
                             0 
                           
                         
                       
                       
                         
                           x 
                           
                             0 
                             , 
                             1 
                           
                         
                       
                       
                         … 
                       
                       
                         
                           x 
                           
                             0 
                             , 
                             n 
                           
                         
                       
                     
                     
                       
                         
                           x 
                           
                             1 
                             , 
                             0 
                           
                         
                       
                       
                         
                           x 
                           
                             1 
                             , 
                             1 
                           
                         
                       
                       
                         … 
                       
                       
                         
                           x 
                           
                             1 
                             , 
                             n 
                           
                         
                       
                     
                     
                       
                         … 
                       
                       
                         … 
                       
                       
                         … 
                       
                       
                         … 
                       
                     
                     
                       
                         
                           x 
                           
                             n 
                             , 
                             0 
                           
                         
                       
                       
                         
                           x 
                           
                             n 
                             , 
                             1 
                           
                         
                       
                       
                         … 
                       
                       
                         
                           x 
                           
                             n 
                             , 
                             n 
                           
                         
                       
                     
                   
                   ] 
                 
               
             
             ; 
           
         
       
     
         [0080]    since X 0 ,X 1  . . . , X n  are linearly independent vectors and the determinant of the coefficient matrix |X|≠0, this linear system of linear equations has the unique solution; 
         [0081]    the central vector A=(a 0 ,a 1 , . . . , a n ) and the mapping parameter r are broadcasted or multicasted by the group controller to all the group members via open channel; 
         [0082]    the step 4 is implemented by the following: 
         [0083]    after the group members receive the central vector A=(a 0 ,a 1  . . . , a n ) and the mapping parameter r, the private vector of the group member is mapped to a new vector in the vector space according to the mapping parameter r: 
         [0084]    for the group member u i , where i=1,2, . . . , m−1: 
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 0 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       0 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 1 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 
                   m 
                   - 
                   1 
                 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
     
         [0085]    that is to say: 
         [0000]        X   i =( x   i,0   ,x   i,1   , . . . , x   i,n ), wherein  x   i,m   , . . . , x   i,n  are all 0;       for the group member u i , where i=m,m+1, . . . , n:         
         [0000]    
       
         
           
             
               x 
               
                 i 
                 , 
                 0 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       0 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 
                   i 
                   - 
                   m 
                   + 
                   2 
                 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       1 
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           … 
         
       
       
         
           
             
               x 
               
                 i 
                 , 
                 i 
               
             
             = 
             
               f 
                
               
                 ( 
                 
                   
                     v 
                     
                       i 
                       , 
                       
                         m 
                         - 
                         1 
                       
                     
                   
                   , 
                   r 
                 
                 ) 
               
             
           
         
       
       
         
           
             that is to say: 
           
         
       
     
         [0000]        X   i =( x   i,0   ,x   i1   , . . . x   i,n ), wherein  x   i,1   , . . . , x   i,i−m+1  and  x   i,i+1   , . . . , x   i,n  are all 0; 
         [0088]    then the group member u i  can calculate the group key k via the equation below, i.e. the inner product of the vector X i  and the central vector A=(a 0 , a 1 , . . . , a n ) 
         [0000]        k=X   i   ×A   T   =x   i,0   a   0   +x   i,1   a   1   + . . . +x   i,n   a   n  wherein  T  is the transpose of the matrix; 
         [0089]    when new members join the group, the group key management approach based on linear geometry further includes: 
         [0090]    step 5, when new members join in the group, each new member selects a m-dimensional private vector in the finite field F, and sends the m-dimensional private vector to the group controller via secure channel; the group controller assigns and sends a serial number to each new member, and receives the m-dimensional private vector of each new member and keeps secret; 
         [0091]    repeat the steps 2 to 4. 
         [0092]    When group members need to leave the group, the group key management approach based on linear geometry further includes: 
         [0093]    step 5, when group members need to leave the group, each member that needs to leave the group applies to the group controller for leaving the group; the group controller deletes the private vectors of the leaving members, and reassigns serial numbers for the remaining members according to the size order of the subscripts of the current members, and sends the serial numbers to all members via open channel; 
         [0094]    repeat the steps 2 to 4. 
         [0095]    When there are new members want to join in the group and members want to leave the group simultaneously, the group key management approach based on linear geometry further includes: 
         [0096]    step 5, when new members want to join the group and members want to leave simultaneously, each new member selects a m-dimensional vector in the finite field F and sends the m-dimensional vector to the group controller via secure channel; the members that want to leave the group apply to the group controller for leaving the group, and then the group controller deletes the private vector of each leaving member and reassigns serial numbers to the remaining members according to the size order of the subscripts of the current members, and assigns a serial number to each new member; the m-dimensional vector of the new member is received by the group controller and kept secret; then the subscripts of all members are broadcasted to all members via open channel; 
         [0097]    repeat the steps 2 to 4. 
         [0098]    Preferably, the m-dimensional private vector is a two-dimensional private vector. 
         [0099]    Preferably, the group key management approach based on linear geometry further includes auto update: if no member joins or leaves the group in a preset period, then the group controller will update the group key periodically, the group controller reselects the mapping parameter and the group key and calculates the central vector, and the central vector and the mapping parameter are broadcasted or multicasted to all members by the group controller via open channel. 
         [0100]    Preferably, suppose the mapping f can be represented by z=f(w,y), where w,y,zεF, the main function of the mapping f is randomization, and the mapping f conforms to the following characteristics: 
         [0101]    1) it is easy to calculate z=f(w,y) if w, y are known; 
         [0102]    2) it is difficult to compute w if only z and y are known; if z and w are known, it is also difficult to compute y from z=f (w,y); it is difficult to compute w i  from z i =f(w i ,y i ), though a series of z i  and y i  is obtained; and it is also difficult to compute y i  from z i =f(w i ,y i ), though a series of z, and w, is obtained. 
         [0103]    Comparing with the prior art, the present invention has the following advantages: 
         [0104]    Firstly, the storage of each member and the computation cost of the group controller are reduced. In the preferred scheme, if we fix m=2, each member needs to store only two-dimensional private vector of itself, that is to say, only 2 L bit storage space is required (L is the bit size of each element in the finite field F), and the computation cost of each member consists of mapping the private vector of itself to a new vector in the space according to the mapping parameter and computing the group key, and this includes two mapping operations, two multiplications and one addition over the finite field. It can be seen that the storage space and computation cost of each member is fixed, and will not increase as the group size increases. Moreover, the group controller needs to store the private vectors of the entire group, the storage space required is 2 nL (n is the quantity of the group members, and L is the bit size of each element in the finite field), and the main computation of the group controller is to compute the central vector; because the coefficient matrix is sparse and can be easily converted into a triangle matrix, the computation is very easy accordingly. Therefore, the computation cost and the storage space of the group controller increases linearly only as the group grows. 
         [0105]    Secondly, the computation of the group controller can be easily parallelized. If the group controller operates on a multi-core processor platform, then it is very easy to enable the computation of the group controller to be parallel by using the current popular parallel computing library, which takes the advantage of the multi-core processor. 
         [0106]    Thirdly, the secure channel is required only when a group member registers for the first time and a new member joins the group, and in other situations, only the open channel is required. This is because during the initialization of the group, the private vector is sent by the group member to the group controller via the secure channel, and at this time, the group has not yet been established, the secure channel is needed in order to ensure the security of the private vector. After then, the group controller only needs to send the central vector A and the mapping parameter r to all the group members, and because the vector A and r are both public, it is not necessary to keep secret, the secure channel is not required, and the open channel can be used for broadcasting and multicasting. 
         [0107]    Fourthly, the method of the present invention is independent of other cryptography methods. The security of the present invention is based on the linear geometry theory over the finite field, only simple mapping operation and basic operation over the finite field is used during the process of computing the group key, and it does not rely on other traditional cryptography methods including asymmetric cryptography, symmetric cryptography, and hash function. In this way, the possibility that the present invention is attacked by other aspects is reduced. Even if the traditional cryptography methods are broken, the security provided by the present invention will not be affected. 
         [0108]    Fifthly, forward and backward secrecy is provided. The group key k is randomly selected, and k will be changed each time the group members join or leave. Even if the group key is exposed for a period of time, non-members will not know the group key for the next time period. Therefore, the forward and backward secrecy can be guaranteed. 
         [0109]    Sixthly, the attack from the group members or non-members can be effectively avoided. The group key k is obtained by computing the inner product of the private vector X i  of the group member and the central vector A published by the group, while X i  is generated by the mapping f by using the private vector V i  of the group member and the mapping parameter r. For any non-member, X i  is unable to be computed if the private vector V i  is illegitimate, and thus the group key k can not be obtained. Any group member or non-member can not derive the private vector of other group members, since the private vector of each group member is sent to the group controller via the secure channel. Therefore, any non-member or other group members can not derive the private vector of the group member. 
         [0110]    Finally, brute force attack to explore the group key is extremely difficult: the group key k is randomly selected from the finite field F. As long as the number of elements in the field is greater than a certain constant, e.g. 2 128 , then it will be very difficult to explore the group key by brute force attack. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0111]      FIG. 1  is a schematic diagram of a secure group communication system according to a first embodiment of the present invention; 
           [0112]      FIG. 2  is a schematic diagram showing that the group controller selects the finite field and the mapping f for the group use, and each group member sends the private vector to the group controller, according to the first embodiment; 
           [0113]      FIG. 3  is a schematic diagram showing that the group controller computes the central vector through the mapping parameter and the group key, according to the first embodiment; 
           [0114]      FIG. 4  is a schematic diagram showing that the group controller sends the mapping parameter and the central vector to the group members, according to the first embodiment; 
           [0115]      FIG. 5  is a schematic diagram showing that the group members compute the mapping parameter and the central vector, according to the first embodiment; 
           [0116]      FIG. 6  is a schematic diagram showing that the group controller and the group members form the group, according to the first embodiment; 
           [0117]      FIG. 7  is a schematic diagram showing a secure group communication system according to a fifth embodiment of the present invention; 
           [0118]      FIG. 8  is a schematic diagram showing that the group controller selects the finite field and the mapping f for the group use, and each group member sends the private vector to the group controller, according to the fifth embodiment; 
           [0119]      FIG. 9  is a schematic diagram showing that the group controller computes the central vector through the mapping parameter and the group key, according to the fifth embodiment; 
           [0120]      FIG. 10  is a schematic diagram showing that the group controller sends the mapping parameter and the central vector to the group members, according to the fifth embodiment; 
           [0121]      FIG. 11  is a schematic diagram showing that the group members compute the mapping parameter and the central vector, according to the fifth embodiment; 
           [0122]      FIG. 12  is a schematic diagram showing that the group controller and the group members form the group, according to the fifth embodiment. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0123]    The invention will be further described in detail in the following embodiments accompanying the drawings. It will nevertheless be understood that no limitation of the scope of the invention is thereby intended. 
       Embodiment 1 
       [0124]    Referring to  FIG. 1 , a typical secure group communication system includes a group controller (GC) and four group users U 1 , U 2 , U 3  and U 4 . The group controller is connected to each user via interne. 
         [0125]    As shown in  FIG. 2 , during the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0126]    step 1, group members U 1 , U 2 , U 3 , U 4  want to join the group, the group member U 1  selects three private random numbers v 1,1 ,v 1,2 ,v 1,3 εF in the finite field F and constructs the 3  three-dimensional vector V 1 =(v 1,1 ,v 1,2 ,v 1,3 ), the group member U 2  also selects three private random numbers v 2,1 ,v 2,2, ,v 2,3 εF and constructs the three-dimensional vector V 2 =(v 2,1 ,v 2,2 ,v 2,3 ), the group member U 3  also selects three private random numbers v 3,1 ,v 3,2 ,v 3,3 εF and constructs the three-dimensional vector V 3 =(v 3,1 ,v 3,2 ,v 3,3 ), and the group member U 4  also selects three private random numbers v 4,1 ,v 4,2 ,v 4,3 εF and constructs the three-dimensional vector V 4 =(v 4,1 ,v 4,2 ,v 4,3 ). The group members U 1 , U 2 , U 3  and U 4  send the vectors V 1 =(v 1,1 ,v 1,2 ,v 1,3 ), V 2 =(v 2,1 ,v 2,2 ,v 2,3 ). V 3 =(v 3,1 ,v 3,2 ,v 3,3 ) and V 4 =(v 4,1 ,v 4,2 ,v 4,3 ) to the group controller. 
         [0127]    The group controller assigns the serial number u 1  to the group member U 1 , the serial number u 2  to the group member U 2 , the serial number u 3  to the group member U 3 , and the serial number u 4  to the group member U 4 . The group controller sends these serial numbers to the corresponding group members via secure channel, and receives the three-dimensional private vector V i =(v i,1 ,v i,2 ,v i,3 ) of each group member and keeps secret, wherein i=1,2,3,4. 
         [0128]    Step 2, as shown in  FIG. 3 , the group controller (GC) receives the private vectors V 1 , V 2 , V 3 , V 4  of the group members U 1 , U 2 , U 3  and U 4 , and selects a random number r in the finite field F as the mapping parameter, and maps the three-dimensional private vectors V i =(v i,1 ,v i,2 ,v i,3 ) of all the members u i  into a new set of vectors via the mapping f: 
         [0129]    for each member u i  (i=1,2,3), the group controller computes: 
         [0000]        x   1,1   =f ( v   1,1   ,r ) 
         [0000]        x   1,2   =f ( v   1,2   ,r ) 
         [0000]        x   1,3   =f ( v   1,3   ,r ) 
         [0000]        x   2,1   =f ( v   2,1   ,r ) 
         [0000]        x   2,2   =f ( v   2,2   ,r ) 
         [0000]        x   2,3   =f ( v   2,3   ,r ) 
         [0000]        x   3,1   =f ( v   3,1   ,r ) 
         [0000]        x   3,2   =f ( v   3,2   ,r ) 
         [0000]        x   3,3   =f ( v   3,3   ,r ) 
         [0000]    for each member u i , where i=4, the group controller computes: 
         [0000]        x   41   =f ( v   4,1   ,r ) 
         [0000]        x   4,3   =f ( v   4,2   ,r ) 
         [0000]        x   4,4   =f ( v   4,3   ,r ) 
         [0130]    in this way, the group controller obtains a new set of vectors over the finite field F: 
         [0131]    for the new vector X 1  of the group member u i  (where i=1, 2, 3): 
         [0000]        X   i =( x   i,1   ,x   i,2   ,x   i,3 ,0), wherein x i,4  is 0; 
         [0132]    for the new vector X 4  of the group member u 4 : 
         [0000]        X   4 =( x   4,1 ,0 ,x   4,3   ,x   4,4 ) 
         [0133]    The group controller judges whether X 1 ,X 2 ,X 3 ,X 4  are linearly independent, and if they are independent, then proceed to the step 3, otherwise, return to the step 2. Since r is a random number, it is easy to obtain a set of vectors X 1 ,X 2 ,X 3 ,X 4  that are linearly independent. 
         [0134]    Step 3, the group controller selects a random number kεF as a group key, and constructs a system of linear equations by using the new set of vectors and the group key: 
         [0135]    suppose a 1 ,a 2 ,a 3 ,a 4  are unknown parameters, and the group controller computes the central vector A=(a 1 ,a 2 ,a 3 ,a 4 ) from the following system of linear equations: 
         [0000]    
       
         
           
             { 
             
               
                 
                   
                     
                       
                         
                           
                             x 
                             
                               1 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         
                           
                             x 
                             
                               1 
                               , 
                               2 
                             
                           
                            
                           
                             a 
                             2 
                           
                         
                         + 
                         
                           
                             x 
                             
                               1 
                               , 
                               3 
                             
                           
                            
                           
                             a 
                             3 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               2 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         
                           
                             x 
                             
                               2 
                               , 
                               2 
                             
                           
                            
                           
                             a 
                             2 
                           
                         
                         + 
                         
                           
                             x 
                             
                               2 
                               , 
                               3 
                             
                           
                            
                           
                             a 
                             3 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               3 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         
                           
                             x 
                             
                               3 
                               , 
                               2 
                             
                           
                            
                           
                             a 
                             2 
                           
                         
                         + 
                         
                           
                             x 
                             
                               3 
                               , 
                               3 
                             
                           
                            
                           
                             a 
                             3 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               4 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                         + 
                         
                           
                             x 
                             
                               4 
                               , 
                               3 
                             
                           
                            
                           
                             a 
                             3 
                           
                         
                         + 
                         
                           
                             x 
                             
                               4 
                               , 
                               4 
                             
                           
                            
                           
                             a 
                             4 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
               
                 
             
           
         
       
     
         [0136]    this system of linear equations is represented in vector form: X×A T =K T    
         [0137]    wherein the vector K=(k,k,k,k), A=(a 1 ,a 2 ,a 3 ,a 4 ), the matrix 
         [0000]    
       
         
           
             X 
             = 
             
               
                 [ 
                 
                   
                     
                       
                         X 
                         1 
                       
                     
                   
                   
                     
                       
                         X 
                         2 
                       
                     
                   
                   
                     
                       
                         X 
                         3 
                       
                     
                   
                   
                     
                       
                         X 
                         n 
                       
                     
                   
                 
                 ] 
               
               = 
               
                 [ 
                 
                   
                     
                       
                         x 
                         
                           1 
                           , 
                           1 
                         
                       
                     
                     
                       
                         x 
                         
                           1 
                           , 
                           2 
                         
                       
                     
                     
                       
                         x 
                         
                           1 
                           , 
                           3 
                         
                       
                     
                     
                       0 
                     
                   
                   
                     
                       
                         x 
                         
                           2 
                           , 
                           1 
                         
                       
                     
                     
                       
                         x 
                         
                           2 
                           , 
                           2 
                         
                       
                     
                     
                       
                         x 
                         
                           2 
                           , 
                           3 
                         
                       
                     
                     
                       0 
                     
                   
                   
                     
                       
                         x 
                         
                           3 
                           , 
                           1 
                         
                       
                     
                     
                       
                         x 
                         
                           3 
                           , 
                           2 
                         
                       
                     
                     
                       
                         x 
                         
                           3 
                           , 
                           3 
                         
                       
                     
                     
                       0 
                     
                   
                   
                     
                       
                         x 
                         
                           4 
                           , 
                           1 
                         
                       
                     
                     
                       0 
                     
                     
                       
                         x 
                         
                           4 
                           , 
                           3 
                         
                       
                     
                     
                       
                         x 
                         
                           4 
                           , 
                           4 
                         
                       
                     
                   
                 
                 ] 
               
             
           
         
       
     
         [0000]    since the determinant of the coefficient matrix |X|≠0, this linear system of linear equations has the unique solution A=(a 1 ,a 2 ,a 3 ,a 4 ), and A=(a 1 ,a 2 ,a 3 ,a 4 ) is the central vector. 
         [0138]    As shown in  FIG. 4 , the group controller broadcasts the central vector A=(a 1 ,a 2 ,a 3 ,a 4 ) and the mapping parameter r to the group members U 1 , U 2 , U 3 , U 4  via open channel. 
         [0139]    Step 4, as shown in  FIG. 5 , after the group members U 1 , U 2 , U 3  and U 4  receive the central vector A=(a 1 ,a 2 ,a 3 ,a 4 ) and the mapping parameter r, a new vector is computed according to the mapping parameter r: 
         [0140]    for the group member u i  (i=1, 2, 3): 
         [0000]        x   1,1   =f ( v   1,1   ,r ) 
         [0000]        x   1,2   =f ( v   1,2   ,r ) 
         [0000]        x   1,3   =f ( v   1,3   ,r ) 
         [0000]        x   2,1   =f ( v   2,1   ,r ) 
         [0000]        x   2,2   =f ( v   2,2   ,r ) 
         [0000]        x   2,3   =f ( v   2,3   ,r ) 
         [0000]        x   3,1   =f ( v   3,1   ,r ) 
         [0000]        x   3,2   =f ( v   3,2   ,r ) 
         [0000]        x   3,3   =f ( v   3,3   ,r ) 
         [0141]    for the group member u i , where i=4: 
         [0000]        x   4,1   =f ( v   4,1   ,r ) 
         [0000]        x   4,3   =f ( v   4,2   ,r ) 
         [0000]        x   4,4   =f ( v   4,3   ,r ) 
         [0142]    then, U 1  calculates the group key k=x 1,1 a 1 +x 1,2 a 2 +x 1,3 a 3 , U 2  calculates the group key k=x 2,1 a 1 +x 2,2 a 2 +x 2,3 a 3 , U 3  calculates the group key k=x 3,1 a 1 +x 3,2 a 2 +x 3,3 a 3 , U 4  calculates the group key k=x 4,1 a 1 +x 4,3 a 3 +x 4,4 a 4 , the calculated result k of the U 1  is identical to the calculated results k of the U 2 , U 3  and U 4 . 
         [0143]    As shown in  FIG. 6 , after the above steps, a group with the group members U 1 , U 2 , U 3  and U 4  is established. 
         [0144]    If no member joins or leaves the group in a preset period, then the group controller will update the group key periodically, i.e. repeat the step 2 to step 4. 
       Embodiment 2 
       [0145]    Suppose the secure group communication system includes a group controller (GC) and five group users U 1 , U 2 , U 3 , U 4  and U 5 . The group controller is connected to each user via internet. During the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0146]    Step 1, the group member U 4  applies to the group controller for leaving the group; 
         [0147]    the group controller deletes the private vector V 4  of the leaving member, and reassigns serial numbers u i  for the remaining members according to the size order of the subscripts of the current members, wherein i=1,2,3,4; the group controller sends the serial numbers to all members via open channel, and the private vectors of the group members currently stored by the group controller are V 1 ,V 2 ,V 3 ,V 4 ; 
         [0148]    Other steps are identical to the steps 2 to 4 of the Embodiment 1. 
       Embodiment 3 
       [0149]    Suppose the secure group communication system includes a group controller (GC) and two group users U 1  and U 2 . The group controller is connected to each user via internet. During the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0150]    Step 1, group members U 3 , U 4  want to join the group, the group member U 3  selects three private random numbers v 3,1 ,v 3,2 ,v 3,3 εF and constructs the three-dimensional vector V 3 =(v 3,1 ,v 3,2 ,v 3,3 ), and sends the vector V 3 =(v 3,1 ,v 3,2 ,v 3,3 ) to the group controller via secure channel; the group member U 4  also selects three private random numbers v 4,1 ,v 4,2 ,v 4,3 εF and constructs the three-dimensional vector V 4 =(v 4,1 ,v 4,2 ,v 4,3 ), and sends the vector V 4 =(v 4,1 ,v 4,2 ,v 4,3 ) to the group controller via secure channel. 
         [0151]    The group controller assigns the serial number u 3  to the group member U 3 , and sends the serial number u 3  to this group member, and receives the private vector V 3 =(v 3,1 ,v 3,2 ,v 3,3 ) of this group member and keeps secret; the group controller assigns the serial number u 4  to the group member U 4 , and sends the serial number u 4  to this group member, and receives the private vector V 4 =(v 4,1 ,v 4,2 ,v 4,3 ) of this group member and keeps secret; therefore, the private vectors currently stored by the group controller are V 1 ,V 2 ,V 3 ,V 4 . 
         [0152]    Other steps are identical to the steps 2 to 4 of the Embodiment 1. 
       Embodiment 4 
       [0153]    Suppose the secure group communication system includes a group controller (GC) and three group users U 1 , U 2  and U 3 . The group controller is connected to each user via interne. 
         [0154]    During the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0155]    Step 1, if the group member U 2  wants to leave the group and the new group members U 4  and U 5  want to join the group, the new group members U 4  and U 5  select a three-dimensional vector respectively over the finite field F, and send the vectors to the group controller via secure channel. 
         [0156]    The group controller deletes the private vector V 2  of the leaving member U 2 , and reassigns a subscript serial number i to allow the original group member U 3  to be changed into u 2 , and the corresponding vector is V 2 =(v 2,1 ,v 2,2 ,v 2,3 ). The group controller assigns serial numbers u 3  and u 4  respectively to the new members U 4  and U 5 , in this way, the U 4  becomes u 3  in the group and the corresponding vector is V 3 =(v 3,1 ,v 3,2 ,v 3,3 ), while the U 5  becomes u 4  in the group and the corresponding vector is V 4 =(v 4,1 ,v 4,2 ,v 4,3 ). The group controller sends the serial numbers to all members via open channel, and the private vectors of the group members currently stored by the group controller are V 1 , V 2 , V 3 , V 4 . 
         [0157]    Other steps are identical to the steps 2 to 4 of the Embodiment 1. 
       Embodiment 5 
       [0158]    Referring to  FIG. 7 , a typical secure group communication system includes a group controller (GC) and three group users U 1 , U 2  and U 3 . The group controller is connected to each user via internet. 
         [0159]    As shown in  FIG. 8 , during the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0160]    Step 1, group members U 1 , U 3 , U 4  want to join the group, the group member U 1  selects two private random numbers v 1,0 ,v 1,1 εF and constructs the two-dimensional vector V 1 =(v 1,0 ,v 1,1 ); the group member U 2  also selects two private random numbers v 2,0 ,v 2,1 εF and constructs the two-dimensional vector V 2 =(v 2,0 ,v 2,1 ); and the group member U 3  also selects two private random numbers v 3,0 ,v 3,1 εF and constructs the two-dimensional vector V 3 =(v 3,0 ,v 3,1 ). The U 1 , U 2  and U 3  send the vectors V 1 =(v 1,0 ,v 1,1 ), V 2 =(v 2,0 ,v 2,1 ), and V 3 =(v 3,0 ,v 3,1 ) to the group controller via secure channel. 
         [0161]    The group controller assigns the serial number u 1  to the group member U 1 , the serial number u 2  to the group member U 2 , and the serial number u 3  to the group member U 3 ; the group controller sends the above-mentioned serial numbers to the corresponding group members via secure channel, and receives the two-dimensional private vector V i =(v i,0 ,v i,1 ) of each group member and keeps secret, wherein i=1,2,3; 
         [0162]    Step 2, as shown in  FIG. 9 , after receiving the private vectors V 1 , V 2 , V 3  of the group members U 1 , U 2  and U 3 , the group controller selects random numbers v 0,0 ,v 0,1 , rεF in the finite field F, wherein r is the mapping parameter, v 0,0 ,v 0,1  construct the private vector of the group controller V 0 =(v 0,0 ,v 0,1 ) and V 0  is stored by the group controller. 
         [0163]    The group controller maps the private vector of itself and the private vectors of all group members according to the mapping parameter to form a new set of vectors: 
         [0164]    for the private vector V 0 =(v 0,0 ,v 0,1 ) of the group controller itself, the group controller computes: 
         [0000]        x   0,0   =f ( v   0,0   ,r ) 
         [0000]        x   0,1   =f ( v   0,1   ,r ) 
         [0165]    for the group member u i  (i=1), the group controller computes: 
         [0000]        x   1,0   =f ( v   1,0   ,r ) 
         [0000]        x   1,1   f =( v   1,1   ,r ) 
         [0166]    the group controller judges whether x 0,0 x 1,1 −x 0,1 x 1,o =0 is established, and if yes, then return to reselect the random numbers v 0,0 , v 0,1 , rεF; if not, then proceed to the next step: 
         [0167]    for the group member u i  (where i=2, 3), the group controller computes: 
         [0000]        x   2,0   =f ( v   2,0   ,r ) 
         [0000]        x   2,2   =f ( v   2,1   ,r ) 
         [0000]        x   3,0   =f ( v   3,0   ,r ) 
         [0000]        x   3,3   =f ( v   3,1   ,r ) 
         [0168]    in this way, the group controller obtains a new set of vectors over the finite vector F: 
         [0169]    for the new vector X 0  obtained after the mapping of the private vector of the group controller: 
         [0000]        X   0 =( x   0,0   ,x   0,1 ,0,0) 
         [0170]    for the new vector X 1  of the group member u 1 : 
         [0000]        X   1 =( x   1,0   ,x   1,1 ,0,0) 
         [0171]    for the new vector X i  of the group member u i , where i=2,3: 
         [0000]        X   2 =( x   2,0 ,0 ,x   2,2 ,0) 
         [0000]        X   3 =( x   3,0 ,0,0, x   3,3 ) 
         [0172]    The group controller judges whether X 0 , X 1 , X 2 , X 3  are linearly independent, and computes |X|=(x 0,0 x 1,1 −x 0,1 x 1,0 )x 2,2 x 3,3 , and if it is not zero, then X 0 , X 1 , X 2 , X 3  are linearly independent. If they are linearly dependent, then reselect the random numbers v 0,0 ,v 0,1 , rεF and compute X 0 , X 1 , X 2 , X 3 , otherwise, proceed to the next step. Since it meets the requirement of x 0,0 x 1,1 −x 0,1 x 1,0 ≠0, as long as x i,i ≠0(i=2,3), then |X|0. Therefore, it is easy to obtain a set of vectors X 0 , X 1 , X 2 , X 3  that are linearly independent according to the random number r and the mapping f. 
         [0173]    Step 3, the group controller selects a random number kεF as the group key. Suppose a 0 ,a 1 , . . . , a n  are unknown variables, the group controller computes the central vector A=(a 0 ,a 1 , . . . , a n ) from the following system of linear equations: 
         [0000]    
       
         
           
             { 
             
               
                 
                   
                     
                       
                         
                           
                             x 
                             
                               0 
                               , 
                               0 
                             
                           
                            
                           
                             a 
                             0 
                           
                         
                         + 
                         
                           
                             x 
                             
                               0 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               1 
                               , 
                               0 
                             
                           
                            
                           
                             a 
                             0 
                           
                         
                         + 
                         
                           
                             x 
                             
                               1 
                               , 
                               1 
                             
                           
                            
                           
                             a 
                             1 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               2 
                               , 
                               0 
                             
                           
                            
                           
                             a 
                             0 
                           
                         
                         + 
                         
                           
                             x 
                             
                               2 
                               , 
                               2 
                             
                           
                            
                           
                             a 
                             2 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
                 
                   
                     
                       
                         
                           
                             x 
                             
                               3 
                               , 
                               0 
                             
                           
                            
                           
                             a 
                             0 
                           
                         
                         + 
                         
                           
                             x 
                             
                               3 
                               , 
                               3 
                             
                           
                            
                           
                             a 
                             3 
                           
                         
                       
                       = 
                       k 
                     
                   
                 
               
                 
             
           
         
       
     
         [0174]    this system of linear equations can be represented in vector form: X×A T =K T    
         [0175]    wherein the vector K=(k,k,k,k), the vector A=(a 0 ,a 1 ,a 2 ,a 3 ), the matrix 
         [0000]    
       
         
           
             X 
             = 
             
               
                 [ 
                 
                   
                     
                       
                         X 
                         0 
                       
                     
                   
                   
                     
                       
                         X 
                         1 
                       
                     
                   
                   
                     
                       
                         X 
                         2 
                       
                     
                   
                   
                     
                       
                         X 
                         3 
                       
                     
                   
                 
                 ] 
               
               = 
               
                 [ 
                 
                   
                     
                       
                         x 
                         
                           0 
                           , 
                           0 
                         
                       
                     
                     
                       
                         x 
                         
                           0 
                           , 
                           1 
                         
                       
                     
                     
                       0 
                     
                     
                       0 
                     
                   
                   
                     
                       
                         x 
                         
                           1 
                           , 
                           0 
                         
                       
                     
                     
                       
                         x 
                         
                           1 
                           , 
                           1 
                         
                       
                     
                     
                       0 
                     
                     
                       0 
                     
                   
                   
                     
                       0 
                     
                     
                       0 
                     
                     
                       
                         x 
                         
                           2 
                           , 
                           2 
                         
                       
                     
                     
                       0 
                     
                   
                   
                     
                       0 
                     
                     
                       0 
                     
                     
                       0 
                     
                     
                       
                         x 
                         
                           3 
                           , 
                           3 
                         
                       
                     
                   
                 
                 ] 
               
             
           
         
       
     
         [0176]    Because the determinant of the coefficient matrix X|≠0, this linear system of linear equations has the unique solution A=(a 0 ,a 1 ,a 2 ,a 3 ), and A=(a 0 ,a 1 ,a 2 ,a 3 ) is the central vector. 
         [0177]    As shown in  FIG. 10 , the group controller broadcasts the central vector A=(a 0 ,a 1 ,a 2 ,a 3 ) and the mapping parameter r to the group members U 1 , U 2  and U 3  via open channel. 
         [0178]    Step 4, as shown in  FIG. 11 , after the group members U 1 , U 2  and U 3  receive A=(a 0 ,a 1 ,a 2 ,a 3 ) and the mapping parameter r, new vectors are computed according to the mapping parameter r: 
         [0000]        x   1,0   =f ( v   1,0   ,r ) 
         [0000]        x   1,1   =f ( v   1,1   ,r ) 
         [0000]        x   2,0   =f ( v   2,0   ,r ) 
         [0000]        x   2,2   =f ( v   2,1   ,r ) 
         [0000]        x   3,0   =f ( v   3,0   ,r ) 
         [0000]        x   3,3   =f ( v   3,1   ,r ) 
         [0179]    then, the group member U 1  computes the group key k=x 1,0 a 0 +x 1,1 a 1 , the group member U 2  computes the group key k=x 2,0 a 0 +x 2,2 a 2 , the group member U 3  computes the group key k=x 3,0 a 0 +x 3,3 a 3 . It is obvious that the group key k calculated by the group member U 1  is identical to the group keys k calculated by the group members U 2  and U 3 . 
         [0180]    As shown in  FIG. 12 , a group with group members U 1 , U 2  and U 3  is established after the above steps. 
         [0181]    If no member joins or leaves the group in a preset period, then the group controller will update the group key periodically, that is to say, repeat the steps 2 to 4. 
       Embodiment 6 
       [0182]    Suppose the secure group communication system includes a group controller (GC) and four group users U 1 , U 2 , U 3  and U 4 . The group controller is connected to each user via interne. During the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0183]    Step 1, if the group member U 4  applies to the group controller for leaving the group; 
         [0184]    the group controller deletes the private vector V 4  of the leaving member, and reassigns serial number u i  for the remaining members according to the size order of the subscripts of the current members, wherein i=1,2,3; the group controller sends the serial numbers to all members via open channel, and the private vectors of the group members currently stored by the group controller are V 1 ,V 2 ,V 3 ; 
         [0185]    Other steps are identical to the steps 2 to 4 of the Embodiment 5. 
       Embodiment 7 
       [0186]    Suppose the secure group communication system includes a group controller (GC) and two group users U 1  and U 2 . The group controller is connected to each user via internet. During the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0187]    Step 1, when a new group member U 3  wants to join the group, the new group member U 3  selects a private vector over the finite field F, and sends it to the group controller via secure channel 
         [0188]    The group controller assigns a serial number u 3  to the new group member U 3  and sends the serial number to this group member, and then receives the private vector V 3 =(v 3,0 ,v 3,1 ) of this group member and keeps secret. Therefore, the private vectors currently stored by the group controller store are V 1 ,V 2 ,V 3 . 
         [0189]    Other steps are identical to the steps 2 to 4 of the Embodiment 1. 
       Embodiment 8 
       [0190]    Suppose the secure group communication system includes a group controller (GC) and three group users U 1 , U 2  and U 3 . The group controller is connected to each user via internet. 
         [0191]    During the initialization of the group, the group controller selects a mapping f and a finite field F for use by the group, all computations in the group are performed over the finite field, and the mapping f uses a pseudo random number generator. 
         [0192]    Step 1, if the group member U 2  wants to leave the group and a new group member U 4  wants to join the group, the new group member U 4  selects a two-dimensional vector over the finite field F, and sends the vector to the group controller via secure channel. 
         [0193]    The group controller deletes the private vector V 2  of the leaving member U 2 , and reassigns a subscript serial number i to allow the original group member U 3  to change into u 2 , and the corresponding vector is V 2 =(v 2,0 ,v 2, ). The group controller assigns serial numbers u 3  to the new member U 4 , in this way, the U 4  becomes u 3  in the group and the corresponding vector is V 3 =(v 3,0 ,v 3,1 ). The group controller sends the serial numbers to all members via open channel, and the private vectors of the group members currently stored by the group controller are V 1 ,V 2 ,V 3 . 
         [0194]    Other steps are identical to the steps 2 to 4 of the Embodiment 5. 
         [0195]    It should be emphasized that the above-described embodiments can be combined freely. Many variations and modifications may be made to the above-described embodiment(s) of the invention without departing substantially from the spirit and principles of the invention. All such modifications and variations are intended to be included herein within the scope of this disclosure and the present invention and protected by the following claims.