Patent Publication Number: US-9419798-B2

Title: Public encryption method based on user ID

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims priority under 35 U.S.C. §119 to South Korean Patent Application No. 10-2013-0082745 filed on Jul. 15, 2013, in the Korean Intellectual Property Office, the disclosure of which is incorporated herein by reference in its entirety. 
     TECHNICAL FIELD 
     The present disclosure relates to a public encryption method based on user ID, and more particularly, to a public encryption method based on user ID, which allows easy communication using a public key whose contents may be checked by an inherent ID of a user. 
     BACKGROUND 
     In a general public key system, each user terminal for performing private communication generates its private key and public key in a pair, and communication is available only when an opponent terminal for performing private communication obtains a proper public key. At this time, a user who has obtained the public key of the opponent terminal for performing communication receives a signature for the obtained public key from a trusted third party and uses the same as a certificate of the public key in order to prove that the obtained public key is proper. 
     Since the public key certificate connects the public key with justification to the identity of its owner, the user terminal trusts the public key obtained from the opponent terminal by means of the public key certificate, thereby performing communication with the opponent terminal. 
     However, when the public key certificate is discarded, the certificate-based public key system should maintain a discarded certificate list for a certain period or continuously manage such a discarded certificate, which consumes management time and costs. 
     SUMMARY 
     The present disclosure is directed to providing a public encryption method based on user ID, which may easily perform private communication between user terminals without executing a separate public key certifying process through a trusted third party by encrypting a public key with an inherent ID of a user. 
     In one aspect, there is provided a public encryption method based on user ID, which includes: setting, by a key generation server, at least one public parameter and master key used for generating a private key; receiving, by the key generation server, an inherent ID of a user from a receiving terminal, generating a private key based on the public parameter, the master key and the ID, and transmitting the generated private key to the receiving terminal; receiving, by a transmitting terminal, the public parameter and the ID from the key generation server, encrypting a message to generate a ciphertext, and transmitting the generated ciphertext to the receiving terminal; and receiving, by the receiving terminal, the ciphertext and the private key, and decrypting the ciphertext based on the received private key to obtain a message. 
     The setting of at least one public parameter and master key, by the key generation server, may include: receiving a security constant from the outside, arbitrarily selecting a first generator and a second generator among generators belonging to an elliptical curve group having the security constant as an input value, and selecting an arbitrary element among elements belonging to the elliptical curve group; selecting an arbitrary random number and setting as a master key; calculating a function value by applying the first generator, the second generator and the master key to a bilinear function; and setting a public parameter including at least one of the first generator, the second generator, the arbitrary element and the function value of the bilinear function. 
     The generating of a private key and transmitting of the generated private key to the receiving terminal, by the key generation server, may include: arbitrarily selecting a first random number; generating a first private key based on the second generator, the master key, the arbitrary element and the first random number; generating a second private key based on the first generator and the first random number; hashing the first private key and the second private key to generate a first tag value; generating a third private key based on the value obtained by hashing the ID, the arbitrary element, the first tag value and the first random number; and generating a private key including the first private key, the second private key and the third private key and transmitting the private key to the receiving terminal. 
     The encrypting of a message to generate a ciphertext, by the transmitting terminal, may include: arbitrarily selecting a second random number; generating a first ciphertext based on the function value of the bilinear function, the second random number and the message; generating a second ciphertext based on the first generator and the second random number; hashing the first ciphertext and the second ciphertext to generate a second tag value; generating a third ciphertext based on the value obtained by hashing the ID, the arbitrary element, the second tag value and the second random number; and generating a ciphertext including the first ciphertext, the second ciphertext and the third ciphertext and transmitting the ciphertext to the receiving terminal. 
     The decrypting of the ciphertext to obtain a message, by the receiving terminal, may include: hashing the first private key and the second private key among private keys received from the key generation server to calculate a first tag value; hashing the first ciphertext and the second ciphertext among ciphertexts received from the transmitting terminal to calculate a second tag value; determining whether the first tag value is identical to the second tag value; determining whether the function value of the bilinear function to which the values obtained by hashing the second ciphertext and the ID, the arbitrary element and the calculated second tag value are applied is identical to a function value of a bilinear function to which the first generator and the third ciphertext are applied; calculating a decrypting parameter based on the function value of the bilinear function to which the second ciphertext and the first private key are applied, the function value of the bilinear function to which the second ciphertext and the third private key are applied, the function value of the bilinear function to which the second private key and the third ciphertext are applied, the first tag value and the second tag value; and splitting the first ciphertext by the decrypting parameter to obtain a message. 
     In another aspect, there is provided a public encryption method based on user ID, which includes: setting, by a key generation server, at least one public parameter and master key used for generating a private key; receiving, by the key generation server, an inherent ID of a user from a receiving terminal, generating a private key based on the public parameter, the master key and the ID, and transmitting the generated private key to the receiving terminal; generating, by a transmitting terminal, a session key based on the public parameter, encrypting a message based on the generated session key, and then generating a ciphertext; and receiving, by the receiving terminal, the generated ciphertext, calculating a session key, and then decrypting the ciphertext based on the generated session key to obtain a message. 
     The setting of at least one public parameter and master key, by the key generation server, may include: receiving a security constant from the outside, arbitrarily selecting a first generator and a second generator among generators belonging to an elliptical curve group having the security constant as an input value, and selecting an arbitrary element among elements belonging to the elliptical curve group; selecting an arbitrary random number and setting as a master key; calculating a function value by applying the first generator, the second generator and the master key to a bilinear function; and setting a public parameter including at least one of the first generator, the second generator, the arbitrary element and the function value of the bilinear function. 
     The generating of a private key and transmitting of the generated private key to the receiving terminal, by the key generation server, may include: arbitrarily selecting a first random number; generating a first private key based on the second generator, the master key, the arbitrary element and the first random number; generating a second private key based on the first generator and the first random number; hashing the first private key and the second private key to generate a first tag value; generating a third private key based on the value obtained by hashing the ID, the arbitrary element, the first tag value and the first random number; and generating a private key including the first private key, the second private key and the third private key and transmitting the private key to the receiving terminal. 
     The generating of a ciphertext based on the session key, by the transmitting terminal, may include: arbitrarily selecting a second random number; generating a session key based on the function value of the bilinear function and second random number; generating a fourth ciphertext by applying the session key and the message to a symmetric-key algorithm; generating a second tag value based on the fourth ciphertext, the first generator and the second random number; and generating a ciphertext based on the first generator, the second random number, the value obtained by hashing the ID, the arbitrary element and the second tag value. 
     The decrypting of the ciphertext based on the session key to obtain a message, by the receiving terminal, may include: hashing the first private key and the second private key among private keys received from the key generation server to calculate a first tag value; hashing the fourth ciphertext and the second ciphertext among ciphertexts received by the transmitting terminal to calculate a second tag value; determining whether the first tag value is identical to the second tag value; calculating a decrypting parameter based on the function value of the bilinear function to which the second ciphertext and the first private key are applied, the function value of the bilinear function to which the second ciphertext and the third private key are applied, the function value of the bilinear function to which the second private key and the third ciphertext are applied, the first tag value and the second tag value; applying the decrypting parameter to a symmetric-key cipher algorithm to obtain a session key; and applying the session key and the fourth ciphertext to a symmetric-key algorithm to obtain a message. 
     The public encryption method based on user ID according to the present disclosure may allow efficient communication by using an inherent ID of a user as a public key, since a process for certifying the public key through a trusted third party is not needed. 
     In addition, the public encryption method based on user ID according to the present disclosure may reduce time and costs required for continuously maintaining or managing a discarded certificate list, since a certificate for a public key through a trusted third party is not used. 
     Moreover, the public encryption method based on user ID according to the present disclosure may allow the identity of a user, who is to perform communication, to be easily checked by checking a public key, since the ID of the user is used as the public key. 
     Further, the public encryption method based on user ID according to the present disclosure may reduce time and costs required for constructing a public key structure since a complicated PKI (Public Key Infrastructure) need not be constructed. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram showing a system for implementing a public encryption method based on user ID according to an embodiment of the present disclosure. 
         FIG. 2  is a flowchart for illustrating a public encryption method based on user ID according to another embodiment of the present disclosure. 
         FIG. 3  is a flowchart for illustrating a detailed procedure of the operation for setting a public parameter and a master key, depicted in  FIG. 2 . 
         FIG. 4  is a flowchart for illustrating a detailed procedure of the private key generating operation, depicted in  FIG. 2 . 
         FIG. 5  is a flowchart for illustrating a detailed procedure of the operation for generating a ciphertext for a message, depicted in  FIG. 2 . 
         FIG. 6  is a flowchart for illustrating a detailed procedure of the ciphertext decrypting operation, depicted in  FIG. 2 . 
         FIG. 7  is a flowchart for illustrating a public encryption method based on user ID according to another embodiment of the present disclosure. 
         FIG. 8  is a flowchart for illustrating a detailed procedure of the operation for encrypting a message with a session key, depicted in  FIG. 7 . 
         FIG. 9  is a flowchart for illustrating a detailed procedure of the operation for decrypting a ciphertext with a session key, depicted in  FIG. 7 . 
         FIG. 10  is a table which shows the computational costs of the present disclosure. 
         FIG. 11  is a table which shows efficiency comparison of computation between the present disclosure and existing techniques in consideration of security loss. 
     
    
    
     
       
         
           
               
             
               
                   
               
               
                 [Detailed Description of Main Elements] 
               
               
                   
               
             
            
               
                   
               
            
           
           
               
               
               
            
               
                   
                 120: key generation server 
                 140: transmitting terminal 
               
               
                   
                 160: receiving terminal 
               
               
                   
               
            
           
         
       
     
     DETAILED DESCRIPTION OF EMBODIMENTS 
     Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that a person skilled in the art can easily implement the present disclosure. However, the present disclosure may be implemented in various ways, without being limited to the embodiments herein. 
       FIG. 1  is a block diagram showing a system for implementing a public encryption method based on user ID according to an embodiment of the present disclosure. 
     As shown in  FIG. 1 , a for implementing the public encryption method based on user ID according to the present disclosure includes a key generation server  120 , a transmitting terminal  140  and a receiving terminal  160 . 
     The key generation server  120  sets at least one public parameter and master key used for generating a private key. In detail, the key generation server  120  receives a security constant from the outside, arbitrarily selects a first generator and a second generator among generators belonging to an elliptical curve group having the security constant as an input value, selects an arbitrary element among elements belonging to the elliptical curve group, selects an arbitrary random number and sets as a master key, calculates a function value by applying the first generator, the second generator and the master key to a bilinear function, and sets a public parameter including at least one of the first generator, the second generator, the arbitrary element and the function value of the bilinear function. 
     In addition, the key generation server  120  receives an inherent ID of a user from a receiving terminal  160 , generates a private key based on the public parameter, the master key and the ID, and transmits the generated private key to the receiving terminal  160 . In other words, the key generation server  120  arbitrarily selects a first random number, generates a first private key based on the second generator, the master key, the arbitrary element and the first random number, generates a second private key based on the first generator and the first random number, hashes the first private key and the second private key to generate a first tag value, generates a third private key based on the value obtained by hashing the ID, the arbitrary element, the first tag value and the first random number, and generates a private key including the first private key, the second private key and the third private key and transmits the private key to the receiving terminal  160 . 
     The transmitting terminal  140  receives the public parameter and the ID from the key generation server  120 , encrypts a message to generate a ciphertext, and transmits the generated ciphertext to the receiving terminal. In detail, the transmitting terminal  140  arbitrarily selects a second random number, generates a first ciphertext based on the function value of the bilinear function, the second random number and the message, generates a second ciphertext based on the first generator and the second random number, hashes the first ciphertext and the second ciphertext to generate a second tag value, generates a third ciphertext based on the value obtained by hashing the ID, the arbitrary element, the second tag value and the second random number, and generates a ciphertext including the first ciphertext, the second ciphertext and the third ciphertext and transmits the ciphertext to the receiving terminal  160 . 
     The receiving terminal  160  receives the ciphertext and the private key and decrypts the ciphertext based on the received private key to obtain a message. In detail, the receiving terminal  160  hashes the first private key and the second private key among private keys received from the key generation server  120  to calculate a first tag value, hashes the first ciphertext and the second ciphertext among ciphertexts received from the transmitting terminal  140  to calculate a second tag value, determines whether the first tag value is identical to the second tag value, determines whether the function value of the bilinear function to which the values obtained by hashing the second ciphertext and the ID, the arbitrary element and the calculated second tag value are applied is identical to a function value of a bilinear function to which the first generator and the third ciphertext are applied, calculates a decrypting parameter based on the function value of the bilinear function to which the second ciphertext and the first private key are applied, the function value of the bilinear function to which the second ciphertext and the third private key are applied, the function value of the bilinear function to which the second private key and the third ciphertext are applied, the first tag value and the second tag value, and splits the first ciphertext by the decrypting parameter to obtain a public key. 
     Hereinafter, the public encryption method based on user ID according to the present disclosure will be described in detail with reference to  FIG. 2 . 
       FIG. 2  is a flowchart for illustrating a public encryption method based on user ID according to another embodiment of the present disclosure. 
     As shown in  FIG. 2 , in the public encryption method based on user ID according to the present disclosure, first, the key generation server  120  sets at least one public parameter and master key used for generating a private key (S 210 ). 
     After that, the key generation server  120  receives an inherent ID of a user from the receiving terminal  160 , generates a private key based on the public parameter, the master key and the ID, and transmits the generated private key to the receiving terminal  160  (S 220 ). 
     Subsequently, the transmitting terminal  140  receives the public parameter and the ID from the key generation server  120 , encrypts a message to generate a ciphertext, and transmits the generated ciphertext to the receiving terminal  160  (S 230 ). 
     Accordingly, the receiving terminal  160  receives the ciphertext and the private key, and decrypts the ciphertext based on the received private key to obtain a message (S 240 ). 
     Hereinafter, each operation of the above method will be described in detail with reference to  FIGS. 3 to 6 . 
       FIG. 3  is a flowchart for illustrating a detailed procedure of the operation for setting a public parameter and a master key. 
     First, G,Ĝ used in the present disclosure represents a cyclic group having a prime number p as an order, and G,Ĝ represents a generator in each elliptical curve group. 
     As shown in  FIG. 3 , the key generation server  120  receives a security constant λεZ +  from the outside, arbitrarily selects a first generator gεG and a second generator ĝεĜ among generators belonging to an elliptical curve group G,Ĝ having an order of p with the security constant λ as an input value, and selects an arbitrary element ûεĜ, among elements belonging to the elliptical curve group (S 211 ). 
     In addition, the key generation server  120  selects a cryptographic hash function H 1 :{0,1}*→Ĝ, H 2 :{0,1}*→Z p . 
     Subsequently, the key generation server  120  arbitrarily selects a random number αεZ p  and sets the random number as a master key msk=αεZ p  (S 212 ). 
     After that, the key generation server  120  applies the first generator g, the second generator ĝ, the master key α and the bilinear function e:G×Ĝ→G t , selected above, the Equation 1 below to calculate a function value of a bilinear function (S 213 ).
 
 A=e ( g,ĝ ) α   Equation 1
 
     Accordingly, the key generation server  120  sets a public parameter params=(g,ĝ,û,A)εG×Ĝ 2 ×G t  including at least one of the first generator g, the second generator ĝ and the arbitrary element û, selected in Operation S 211 , and the function value A of the bilinear function, calculated in Operation S 213  (S 214 ). 
       FIG. 4  is a flowchart for illustrating a detailed procedure of the private key generating operation. 
     As shown in  FIG. 4 , as the public parameter and the master key are set as described above, the key generation server  120  selects a first random number rεZ p  (S 221 ). 
     After that, the key generation server  120  applies the second generator ĝ, the master key α, the arbitrary element û, and the first random number r selected in Operation S 221  to Equation 2 below to generate a first private key d 0  among all private keys for encrypting the public key (S 222 ).
 
 d   0   =ĝ   α   û   r   Equation 2
 
     In addition, the key generation server  120  applies the first generator g and the first random number r to Equation 3 below to generate a second private key d 1  (S 223 ).
 
 d   1   =g   r   Equation 3
 
     Subsequently, the key generation server  120  hashes the first private key d 0  generated in Operation S 222  and the second private key d 1  generated in Operation S 223  like Equation 4 below to generate a first tag k  value (S 224 ).
 
tag c   =H   2 ( c   0   ,c   1 )ε Z   p   Equation 4
 
     The key generation server  120  applies the value obtained by hashing the ID id of the receiving terminal  160 , the arbitrary element û, the first tag value tag k  and the first random number r to Equation 5 below to generate a third private key d 2 .
 
 d   2 =( H   1 ( id ) û   tag     k   ) r   Equation 5
 
     Accordingly, the key generation server  120  generates a private key d id =(d 0 , d 1 , d 2 ) including the first private key d 0 , the second private key d 1  and the third private key d 2  and transmits the private key to the receiving terminal  160  (S 226 ). 
       FIG. 5  is a flowchart for illustrating a detailed procedure of the operation for generating a ciphertext for a public key. 
     As shown in  FIG. 5 , the transmitting terminal  140  arbitrarily selects a second random number sεZ p  (S 231 ). 
     After that, the transmitting terminal  140  applies the function value A of the bilinear function calculated in the public parameter and master key setting operation, the second random number s selected in Operation S 231 , and the message M, to Equation 6 below to generate a first ciphertext c 0  among all ciphertexts of the message M, (S 232 ).
 
 c   0   =A   s   ·M,   Equation 6
 
     In addition, the transmitting terminal  140  applies the first generator g selected in the public parameter and master key setting operation and the second random number s selected in Operation S 231  to Equation 7 below to generate a second ciphertext c 1  (S 233 ).
 
 c   1   =g   s   Equation 7
 
     After that, the transmitting terminal  140  hashes the first ciphertext c 0  generated in Operation S 232  and the second ciphertext c 1  generated in Operation S 233  like Equation 8 below to generate a second tag value tag c  (S 234 ).
 
tag c   =H   2 ( c   0   ,c   1 )ε Z   p   Equation 8
 
     Subsequently, the transmitting terminal  140  applies the value obtained by hashing the ID id of the receiving terminal  160 , the arbitrary element û, the second tag value tag c  and the second random number s to Equation 9 below to generate a third ciphertext c 2  (S 235 ).
 
 c   2 =( H   1 ( id ) û   tag     c   ) s   Equation 9
 
     After that, the transmitting terminal  140  generates all ciphertexts c id =(c 0 ,c 1 ,c 2 )εG t ×G×Ĝ for the message M, including the first ciphertext c 0  generated in Operation S 232 , the second ciphertext c 1  generated in Operation S 233  and the third ciphertext c 2  generated in Operation S 232  and transmits the ciphertexts to the receiving terminal  160 . 
       FIG. 6  is a flowchart for illustrating a detailed procedure of the ciphertext decrypting operation. 
     As shown in  FIG. 6 , first, the receiving terminal  160  hashes the first private key d 0  and the second private key d 1  among private keys d id =(d 0 ,d 1 ,d 2 ) received from the key generation server  120  like Equation 4 below to calculate a first tag value tag k  (S 241 ).
 
tag k   =H   2 ( d   0   ,d   1 )  Equation 4
 
     In addition, the receiving terminal  160  hashes the first ciphertext c 0  and the second ciphertext c 1  among ciphertexts c id =(c 0 ,c 1 ,c 2 ) received from the transmitting terminal  140  like Equation 8 below to calculate a second tag value tag c  (S 242 ).
 
tag c   =H   2 ( c   0   ,c   1 )  Equation 8
 
     After that, the receiving terminal  160  determines whether the first tag value tag k  calculated in Operation S 241  is identical to the second tag value tag c  calculated in Operation S 242  (S 243 ). 
     If the first tag value tag k  is identical to the second tag value tag c , it is determined that decrypting the ciphertext for the public key is failed. 
     However, if the first tag value tag k  is different from the second tag value tag c , like Equation 10 below, the receiving terminal  160  determines whether the function value of the bilinear function e to which the value obtained by hashing the ID id of the second ciphertext c 1 , the arbitrary element û, and the calculated second tag value tag c  are applied is identical to a function value of a bilinear function e to which the first generator g and the third ciphertext c 2  are applied (S 244 ).
 
 e ( c   1   ,H   1 ( id ) û   tag     c   )= ?   e ( g,c   2 )  Equation 10
 
     At this time, if the function value of the bilinear function e to which the value obtained by hashing the ID id of the second ciphertext c 1 , the arbitrary element û, and the calculated second tag value tag c  are applied is not identical to the function value of the bilinear function e to which the first generator g and the third ciphertext c 2  are applied, it is determined that decrypting the ciphertext for the message is failed. 
     After that, the receiving terminal  160  applies the function value of the bilinear function e to which the second ciphertext c 1  and the first private d 0  key are applied, the function value of the bilinear function e to which the second private key d 1  and the third ciphertext c 2  are applied, the function value of the bilinear function e to which the second ciphertext c 1  and the third private key d 2  are applied, the first tag value tag k  and the second tag value tag c  to Equation 11 below to calculate a decrypting parameter x. 
     
       
         
           
             
               
                 
                   x 
                   = 
                   
                     ( 
                     
                       
                         1 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 1 
                               
                               , 
                               
                                 d 
                                 0 
                               
                             
                             ) 
                           
                         
                       
                       · 
                       
                         
                           ( 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     d 
                                     1 
                                   
                                   , 
                                   
                                     c 
                                     2 
                                   
                                   , 
                                 
                                 ) 
                               
                             
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     1 
                                   
                                   , 
                                   
                                     d 
                                     2 
                                   
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                         
                           1 
                           
                             
                               tag 
                               c 
                             
                             - 
                             
                               tag 
                               k 
                             
                           
                         
                       
                     
                     ) 
                   
                 
               
               
                 
                   Equation 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   11 
                 
               
             
           
         
       
     
     Accordingly, the receiving terminal  160  obtains a message M by splitting the first ciphertext c 0  by the decrypt parameter x. 
     In addition, regarding the encryption of a public key by using a user ID as described above, a method for encrypting a message by encapsulating a session key will be described in detail. 
       FIG. 7  is a flowchart for illustrating a public encryption method based on user ID according to another embodiment of the present disclosure. 
     As shown in  FIG. 7 , in the public encryption method based on user ID according to the present disclosure, first, the key generation server  120  sets at least one public parameter and master key used for generating a private key (S 310 ). 
     Subsequently, the key generation server  120  receives an inherent ID of a user from the receiving terminal  160 , generates a private key based on the public parameter, the master key and the ID, and transmits the generated private key to the receiving terminal  160  (S 320 ). 
     After that, the transmitting terminal  140  generates a session key based on the public parameter, encrypts a message based on the generated session key, and then generates a ciphertext (S 330 ). 
     Therefore, the receiving terminal  160  receives the generated ciphertext, calculates a session key, and then decrypts the ciphertext based on the generated session key to obtain a message (S 340 ). 
     Hereinafter, with reference to  FIGS. 8 and 9 , the public encryption method based on user ID according to another embodiment of the present disclosure will be described in detail. 
     In particular, the operations for the key generation server  120  to set a public parameter and a master key and generate a private key are identical to the above description depicted in  FIGS. 3 and 4 , and thus are not described in detail here. 
       FIG. 8  is a flowchart for illustrating a detailed procedure of the operation for encrypting a message with a session key. 
     As shown in  FIG. 8 , the transmitting terminal  140  arbitrarily selects a second random number sεZ p  (S 331 ). 
     Subsequently, the transmitting terminal  140  applies the function value A of the bilinear function calculated in the public parameter and master key setting operation and the second random number s selected in Operation S 331  to Equation 7 below to generate a session key K (S 332 ).
 
 K=A   s   εG   t   Equation 7
 
     After that, the transmitting terminal  140  applies the calculated session key K and the message M to a symmetric-key algorithm like Equation 13 below to calculate a fourth ciphertext (S 333 ).
 
 C   M =SymEnc( K,M )  Equation 13
 
     Subsequently, the transmitting terminal  140  hashes the fourth ciphertext C M , the first generator g and the second random number s like Equation 14 below to generate a second tag value tag c  (S 334 ).
 
tag c   =H   2 ( C   M   ,g   s )  Equation 14
 
     Accordingly, the transmitting terminal  140  applies the first generator g, the second random number s, the value obtained by hashing the ID id, the arbitrary element û and the second tag value tag c  to Equation 15 below to generate a ciphertext C id  (S 335 ).
 
 C   id =( C   M   ,C   1   ,C   2 )=( G   M   ,g   s ,( H   1 ( id ) û   tag     c   ) s )  Equation 15
 
       FIG. 9  is a flowchart for illustrating a detailed procedure of the operation for decrypting a ciphertext with a session key. 
     As shown in  FIG. 9 , the receiving terminal  160  hashes the first private key d 0  and the second private key d 1  among private keys d id =(d 0 ,d 1 ,d 2 ) received from the key generation server  120  like Equation 4 below to calculate a first tag value tag k  (S 341 ).
 
tag k   =H   2 ( d   0   ,d   1 )  Equation 4
 
     The receiving terminal  160  hashes the fourth ciphertext C M  and the second ciphertext c 1  among ciphertexts C id =(C M ,C 1 ,C 2 ) received from the transmitting terminal  140  like Equation 8 below to calculate a second tag value tag c  (S 342 ).
 
tag c   =H   2 ( C   M   ,C   1 )  Equation 8
 
     The receiving terminal  160  determines whether the first tag value tag k  is identical to the second tag value tag c  (S 343 ). 
     At this time, if the first tag value tag k  is identical to the second tag value tag c , it is determined that decrypting the ciphertext for the public key is failed. 
     However, if the first tag value tag k  is not identical to the second tag value tag c , the receiving terminal  160  applies the function value of the bilinear function e to which the second ciphertext c 1  and the first private key d 0  are applied, the function value of the bilinear function e to which the second private key d 1  and the third ciphertext c 2  are applied, the function value of the bilinear function e to which the second ciphertext c 1  and the third private key d 2  are applied, the first tag value tag k  and the second tag value tag c  to Equation 11 below to calculate a decrypting parameter x (S 344 ). 
     
       
         
           
             
               
                 
                   x 
                   = 
                   
                     ( 
                     
                       
                         1 
                         
                           e 
                           ⁡ 
                           
                             ( 
                             
                               
                                 c 
                                 1 
                               
                               , 
                               
                                 d 
                                 0 
                               
                             
                             ) 
                           
                         
                       
                       · 
                       
                         
                           ( 
                           
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     d 
                                     1 
                                   
                                   , 
                                   
                                     c 
                                     2 
                                   
                                   , 
                                 
                                 ) 
                               
                             
                             
                               e 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     c 
                                     1 
                                   
                                   , 
                                   
                                     d 
                                     2 
                                   
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                         
                           1 
                           
                             
                               tag 
                               c 
                             
                             - 
                             
                               tag 
                               k 
                             
                           
                         
                       
                     
                     ) 
                   
                 
               
               
                 
                   Equation 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   11 
                 
               
             
           
         
       
     
     Accordingly, the receiving terminal  160  obtains a session key K by applying the calculated decrypting parameter x to a symmetric-key cipher algorithm (S 345 ). 
     The receiving terminal  160  applies the session key K and the fourth ciphertext C M  to a symmetric-key algorithm to obtain a message M (S 346 ). 
     Seeing main features of the public encryption method based on user ID according to the present disclosure, it may be understood that the ID of a user is not combined with a master private key. 
     In particular, when comparing structures of the ciphertext and the private key, it may be found that the second private key d 1 =(H 1 (id)û tag     k   ) r  and the third ciphertext c 2 =(H 1 (id)û tag     c   ) s  have the same structure. 
     Accordingly, in the present disclosure, even though the private key and the ciphertext have the same ID in the public key decrypting operation, since 1/tag c −tag k  is operated only when the first tag value tag k  is not identical to the second tag value tag c , a normal message M may be calculated only when the first tag value tag k  used in generating a private key is different from the second tag value tag c  used in operating a ciphertext. 
     Hereinafter, computational costs of the present disclosure and an existing technique will be described with reference to Table  1  in  FIG. 10 . 
     In order to check the computational costs determining criterion of the present disclosure and the existing technique, depending on the kind and security level of oval curves, SS80 (a supersingular oval curve having a bit security level), MNT80 (an MNT oval curve having a bit security level of 80), and MNT128 (an MNT oval curve having a bit security level of 128) have been put into consideration. 
     Computational costs vary depending on exponentiation, the number of operations of a bilinear function, and the operation of a hash function having an oval curve group as a range. The exponentiation may be more efficiently computed through pre-operation if the base is always fixed, in comparison to general exponentiation. In addition, the operation of a bilinear function forms a greatest part in the overall computational costs, and the computational costs may be performed efficiently since the ratio of two bilinear maps is operated relatively few, for example once or twice, between bilinear functions. 
     Table  2  in  FIG. 11  shows efficiency comparison of computation between the present disclosure and existing techniques in consideration of security loss. 
     As shown in Table  2  in  FIG. 11 , seeing the present disclosure and the existing techniques based on the computational costs when a private key is generated, it may be found that the present disclosure performs operations  28  times, but the existing techniques perform operation  100  to  1000  times. Therefore, in the present disclosure, the computational costs are reduced to be ⅕ to 1/50 of those of the existing techniques. 
     It may be found that the computational cost reduction of the present disclosure is found not only during the private key generating process but also during the encrypting and decrypting processes. 
     In addition, the public encryption method based on user ID may be stored on a computer-readable recording medium on which a program for the execution by a computer is recorded. At this time, the computer-readable recording medium includes all kinds of recording devices on which data readable by a computer system can be stored. The computer-readable recording device includes, for example, ROM, RAM, CD-ROM, DVD±ROM, DVD-RAM, a magnetic tape, a floppy disk, a hard disk, an optical data storage or the like. In addition, the computer-readable recording medium may be distributed to computers connected via a network so that computer-readable codes may be stored and executed in a distribution way. 
     The public encryption method based on user ID according to the present disclosure may allow efficient communication by using an inherent ID of a user as a public key, since a process for certifying the public key through a trusted third party is not needed. 
     In addition, the public encryption method based on user ID according to the present disclosure may reduce time and costs required for continuously maintaining or managing a discarded certificate list, since a certificate for a public key through a trusted third party is not used. 
     Moreover, the public encryption method based on user ID according to the present disclosure may allow the identity of a user, who is to perform communication, to be easily checked by checking a public key, since the ID of the user is used as the public key. 
     Further, the public encryption method based on user ID according to the present disclosure may reduce time and costs required for constructing a public key structure since a complicated PKI (Public Key Infrastructure) need not be constructed. 
     While the exemplary embodiments have been shown and described, it will be understood by those skilled in the art that various changes in form and details may be made thereto without departing from the spirit and scope of the present disclosure as defined by the appended claims.