JP5391043B2 - Encrypted information generating device and program thereof, secret key generating device and program thereof, distribution content generating device and program thereof, content decrypting device and program thereof, and user specifying device and program thereof - Google Patents

Description

  The present invention relates to an encrypted information generating apparatus and its program, a secret key generating apparatus and its program, a distribution content generating apparatus and its program, a content decrypting apparatus and its program, which are used in a content distribution system that encrypts and distributes content, In addition, the present invention relates to a user specifying device and a program thereof.

In recent years, various contents such as video and audio have been distributed on the Internet (network).
However, when buying and selling content on the Internet, a legitimate user may circulate the content illegally, and the number of cases in which content providers are damaged is increasing. In order to address such a problem, there is a method of using an encryption technique called “trailer tracing method” as a method of identifying from which user the content distributed illegally has been distributed ( Hereinafter, referred to as “KD98 method” (see Non-Patent Document 1).

  In the KD98 method, a secret key that is a key for decrypting encrypted content is generated using a user-specific identifier and a polynomial. That is, when the polynomial is f (x), f (ID) obtained by substituting the user-specific identifier ID into the variable x is the user's secret key. For this reason, when a user illegally creates a copy of a secret key, the identifier ID used to create the secret key f (ID) is determined to identify which user has made the fraud can do. In the KD98 method, a polynomial f (x) is used to provide resistance to a system using the unauthorized person tracking method even when k unauthorized persons perform fraud (attack). Is the k-th order.

Further, in order to improve the safety of the KD98 method, the order of the polynomial f (x) is increased to (2k−1) order, and two polynomials (f ₁ (x), f ₂ (x)) are used. It has been proposed (hereinafter referred to as “DF03 method”; see Non-Patent Document 2). By increasing the degree in this way, it is possible to have resistance against an attack called a linear attack, and further by making the number of polynomials two, the attacker seems to be suspicious in advance. Not only a non-adaptive attack that forges a new key from k keys to be generated, but also an adaptive one that obtains an arbitrary k keys and forges a new key Security can be maintained against (Adaptive) attacks.

  In the system using the KD98 method, the ciphertext is composed of (k + 2) elements. Further, in the system using the DF03 method, the ciphertext is composed of (2k + 2) elements. The ciphertext of each method is added with a random power of the generation source as an element in addition to the coefficient of the polynomial.

Here, the number of elements of the DF03 ciphertext will be specifically described. In the DF03 method, as a ciphertext element, in addition to a cryptographic part that is a coefficient of a polynomial, a generator random number power is included.
Since the DF03 method has (2k × 2) coefficients of the (2k−1) -order two polynomials and uses these two coefficients together as ciphertext, the number of elements in the cipher part is ( 2k × 2) / 2 = 2k. More specifically, in the DF03 method, it is assumed that the coefficients of the terms having the same degree of the two polynomials (f ₁ (x), f ₂ (x)), for example, the coefficients of x ⁱ are a _i and b _i. Since these are synthesized using two generators (g, h) and made as one element as (g ^ai h ^bi ) ^r (r is a random number), the number of elements in the ciphertext encryption part is 2k Become.
Furthermore, in the DF03 method, two elements of values g ^r and h ^r obtained by raising the generator (g, h) to the power of a random number r are added to the ciphertext. Thus, in the DF03 method, the ciphertext is composed of (2k + 2) elements.

  On the other hand, a method is also proposed in which a ciphertext is composed of only three elements by combining “c-secure (Secure) code” (see Non-Patent Document 3) based on bilinear mapping and public key cryptography. (Hereinafter referred to as “BN08 method”, see Non-Patent Document 4).

Kaisa Nyberg, “Advances in Cryptology-EUROCRYPT’98”, Lecture Notes in Computer Science, vol1403, pp.145-157 Yvo. G. Desmedt “Public Key Cryptography-PKC’03”, LectureNotes in Computer Science, vol2567, pp.100-115 D. Boneh, J. Shaw, “Collusion-Secure Fingerprinting for Digital Data”, IEEE Trans. On Information Theory, vol.44, pp.1987-1905, 1998. “Traitor Tracing with Constant Size Ciphertext” by D. Boneh, M. Naor, Proc. Of ACM-CCS 2008, pp.501-510, 2008.

As described above, according to the KD98 method and the DF03 method, it is necessary to secretly manage and store the coefficient of the polynomial as the secret information of the provider. Here, assuming that the number of fraudulent attackers who collaborate against the system is k and the data length of one coefficient is | q | (generally, | q | is about 160 bits), KD98 In a system using the method, the secret key size of each user is | q |, and the ciphertext size is (k + 2) × | q | because the number of elements is (k + 2). Similarly, in the DF03 method, the size of the secret key is 2 × | q | and the size of the ciphertext is (2k + 2) × | q | because the number of elements is (2k + 2).
On the other hand, in the BN08 method, the size of the secret key increases in proportion to k ^2, the number of elements of the ciphertexts 3 × for a three | q | become.
That is, according to the conventional method, if the number of users to be managed increases, the secret key size or the number of ciphertext elements changes depending on the number k of unauthorized persons who collide and attack. In particular, in KD98 method and DF03 method, large number of elements of the ciphertext is proportional to k, in BN08 method, there is a problem that the size of the secret key increases in proportion to k ^2.

  The present invention has been made in view of the above-described problems. The size of the secret key held by each user is set to the number of users (or the maximum number of colluders) while maintaining the number of ciphertext elements of the BN08 method. k) an encryption information generation device and program thereof, a secret key generation device and program thereof, a distribution content generation device and program thereof, a content decryption device and program thereof, and a user, which can be set to a certain size independent of k) It is an object to provide a specific device and a program thereof.

  The present invention has been made to solve the above-mentioned problems. First, the encrypted information generating device according to claim 1 is distributed to the content decrypting device in the content distribution system for encrypting and distributing the content. A secret information for generating a user secret key and a public key corresponding to the user secret key, wherein the basic information generating means, master secret information generating means, And a public key generation unit.

In such a configuration, the encrypted information generating apparatus uses the basic information generating means to input m prime numbers (p ₁ ,..., P _m ) and m generators ( _m ) as basic information for the input positive integer m. g _1, ..., and _{g m),} and generates a prime composite number _{n (n = p 1 ... p} m) and synthesized origin elements _{g (g = g 1 ... g} m), composite number n the position number, identifies the bilinear mapping e to the group G _T from the group G to a generator of combined elements g. For example, the basic information generating means, e: as _G × G → G _T become bilinear mapping e, general "Weil Pairing", identifies the parameters of the elliptic curve on the basis of the "Tate Pairing", and the like. Here, the bilinear map e is a map represented by e (•, •) having two arguments. The basic information generating means generates (n, g, g ₁ ,..., G _m , e, G, G _T ) as public information.

The positive integer m is the predetermined maximum number of colluders of the fraudster (the maximum number that can be provided with resistance even if the fraudulent person colluds and attacks the content distribution system). ) Is k, the total number of users is N, and the safety parameter is ε, it is desirable that the number be equal to or greater than k ² log (N / ε). As a result, the content distribution system can be resistant to the maximum number of colluders.

として生成する。 Then, the encrypted information generating apparatus uses the master secret information generating unit to determine 1 ≦ x _1,0 , x _1,1 <p ₁ ,..., 1 ≦ x _{m, 0} , x _{m, 1 <p m} a is _{x 1,0, x 1,1, ...,} and _{x m, 0, x m,} 1, 1 ≦ α, a β <n α, selects and beta. Then, the encrypted information generating apparatus uses the secret information generating unit to generate the secret information (p ₁ ,..., P _m , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} ,, α , Β), and the master secret key msk (= g ^αβ ) is generated by calculating the αβ power (power) of the combined element g as master secret information, and the generator (g ₁ ,. g _m ) is exponentiated with the values of (x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} ), each of which is part of the secret information, so that the parameter param is

Generate as

により生成する。このように、公開鍵は生成元のべき乗値を有することで、コンテンツ配信システムにおいて、離散対数計算の有する困難性により暗号系の安全性を確保することができる。 Then, the encrypted information generation apparatus uses the public key generation means to set the parameter param, the generation source (g ₁ ,..., G _m ), the bilinear map e, and the secret information (p ₁ ,..., P _m , x _{, 0} , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α, β) from the public key PK,

Generate by. As described above, since the public key has the power value of the generation source, it is possible to ensure the security of the encryption system due to the difficulty of the discrete logarithm calculation in the content distribution system.

  The encrypted information generation program according to claim 2 is a content distribution system for encrypting and distributing content, wherein the master secret information for generating a user secret key distributed to the content decrypting device and the user secret In order to generate the public key corresponding to the key, the computer is configured to function as basic information generating means, master secret information generating means, and public key generating means.

In such a configuration, the encrypted information generation program, with respect to the positive integer m input by the basic information generation means, as basic information, m prime numbers (p ₁ ,..., P _m ) and m generators ( g _1, ..., and _{g m),} and generates a prime composite number _{n (n = p 1 ... p} m) and synthesized origin elements _{g (g = g 1 ... g} m), composite number n the position number, the synthesized bilinear mapping e (·, ·) of the element g from the group G to a generator to the group G _T identifies the. The basic information generating means generates (n, g, g ₁ ,..., G _m , e, G, G _T ) as public information.

として生成する。 Then, the encrypted information generating program is controlled by the master secret information generating means according to the composite number n, 1 ≦ x _1,0 , x _1,1 <p ₁ ,..., 1 ≦ x _{m, 0} , x _{m, 1 <p m} a is _{x 1,0, x 1,1, ...,} and _{x m, 0, x m,} 1, 1 ≦ α, a β <n α, selects and beta. Then, the encrypted information generation program generates the secret information (p ₁ ,..., P _m , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α by the master secret information generation unit. , Β), and the master secret key msk (= g ^αβ ) is generated by calculating the αβ power (power) of the combined element g as master secret information, and the generator (g ₁ ,. g _m ) is exponentiated with the values of (x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} ), each of which is part of the secret information, so that the parameter param is

Generate as

により生成する。 Then, the encryption information generation program uses the public key generation means to set the parameter param, the generation source (g ₁ ,..., G _m ), the bilinear map e, and the secret information (p ₁ ,..., P _m , x _{, 0} , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α, β) from the public key PK,

Generate by.

  According to a third aspect of the present invention, there is provided a secret key generation device that decrypts content based on the master secret information generated by the encrypted information generation device according to claim 1 in a content distribution system that encrypts and distributes content. A secret key generation apparatus that generates a user secret key to be distributed to the apparatus, and includes a user secret key generation unit and a user secret key output unit.

を含んだユーザ秘密鍵ｄ_ｖを生成する。なお、ユーザ秘密鍵は、ユーザ識別子ｖを付加して３要素として生成してもよい。 In such a configuration, the secret key generation apparatus includes public information generated by the encryption information generation apparatus by the user secret key generation unit, and a parameter param that is part of the master secret information generated by the encryption information generation apparatus. , The master secret key msk that is part of the master secret information, the user identifier v for identifying the user, and a random number r selected in advance from Z _n ^* (= {1, 2,..., N−1}). _{From v} , at least,

The user private key _{dv including} is generated. The user secret key may be generated as three elements by adding the user identifier v.

Then, the secret key generation device outputs the user secret key by the user secret key output means. This user secret key may be output to the content decryption apparatus via a network, or may be written to a storage medium distributed to the content decryption apparatus and output. The user secret key is used when the user decrypts the content in the content decrypting apparatus.
In this way, the secret key generation apparatus can represent the user secret key with a fixed number of elements independent of the number of users.

  According to a fourth aspect of the present invention, there is provided a secret key generation program that decrypts content based on the master secret information generated by the encrypted information generation device according to claim 1 in a content distribution system that encrypts and distributes content. In order to generate a user secret key to be distributed to the apparatus, the computer is configured to function as a user secret key generation unit and a user secret key output unit.

を含んだユーザ秘密鍵ｄ_ｖを生成する。そして、秘密鍵生成プログラムは、ユーザ秘密鍵出力手段によって、ユーザ秘密鍵を出力する。 In such a configuration, the secret key generation program includes the public parameter generated by the encryption information generation device and the parameter param which is a part of the master secret information generated by the encryption information generation device by the user secret key generation means. And the master secret key msk that is a part of the master secret information, the user identifier v for identifying the user, and Z _n ^* (= {1, 2,..., N−1}) previously selected. from a random number _{r v,} at least,

The user private key _{dv including} is generated. Then, the secret key generation program outputs the user secret key by the user secret key output means.

  Furthermore, the distribution content generation device according to claim 5 is a content distribution system that encrypts and distributes content based on the public key PK generated by the encrypted information generation device according to claim 1. Content generating apparatus for generating content for use, comprising an encryption key generating means, a content encrypting means, a header generating means, and a header synthesizing means.

  In this configuration, the distribution content generation device generates an encryption key Ks for encrypting the content by the encryption key generation unit. Then, the distribution content generation apparatus encrypts the content with the encryption key Ks generated by the encryption key generation unit by the content encryption unit, and generates the encrypted content.

により生成する。 Then, the distribution content generation device uses the header generation unit to public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation unit, the public key PK, and Z _n in advance. ^{* Based} on the random number t selected from (= {1, 2,..., N−1}) and the index j selected from 1 ≦ j ≦ m, the content distribution header C to be synthesized with the encrypted content is

Generate by.

That is, the header generation means is the product (KsG _j ^t ) of the index j selected from 1 ≦ j ≦ m and the value obtained by raising G _j corresponding to the index j included in the public key PK to the power of t and the encryption key Ks. And E _j , H _{j, 0} , H _{j, 1} corresponding to the index j included in the public key PK, respectively, to values (E _j ^t , H _{j, 0} ^t , H _{j, 1} ^t ) The content delivery header C that includes it is generated.

Then, the distribution content generation apparatus generates distribution content by combining the content distribution header C generated by the header generation unit and the encrypted content by the header combination unit. That is, the header synthesizing unit generates the distribution content as a file or a stream in which the encrypted content and the content distribution header are integrated.
As described above, the distribution content generation apparatus can represent the content distribution header C, which is a ciphertext, with a fixed number of elements independent of the number of users.

  According to a sixth aspect of the present invention, there is provided a content generation program for distribution based on the public key PK generated by the encrypted information generation device according to claim 1 in a content distribution system that encrypts and distributes content. In order to generate the content for use, the computer is configured to function as an encryption key generation unit, a content encryption unit, a header generation unit, and a header synthesis unit.

  In this configuration, the distribution content generation program generates the encryption key Ks for encrypting the content by the encryption key generation unit. Then, the distribution content generation program encrypts the content with the encryption key Ks generated by the encryption key generation unit by the content encryption unit, and generates an encrypted content.

により生成する。 Then, the distribution content generation program uses the header generation unit to public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation unit, the public key PK, and Z _n in advance. ^{* Based} on the random number t selected from (= {1, 2,..., N−1}) and the index j selected from 1 ≦ j ≦ m, the content distribution header C to be synthesized with the encrypted content is

Generate by.

  Then, the distribution content generation program generates the distribution content by combining the content distribution header C generated by the header generation unit and the encrypted content by the header synthesis unit.

The content decryption device according to claim 7 is the content distribution system for encrypting and distributing the content, and the distribution content generated by the distribution content generation device according to claim 5 is described in claim 3. a content decoding apparatus for decoding based on the user private key d _v generated by the secret key generating apparatus, and a separation unit, and an encryption key decrypting unit, a content decryption unit, configured to include a.

により復号する。
なお、ここで、Ｃ_３＋ｖｊは、ｖ_ｊの値が“０”の場合はＣ_３、ｖ_ｊの値が“１”の場合はＣ_４を表す。
そして、コンテンツ復号装置は、コンテンツ復号手段によって、暗号化鍵復号手段で復号された暗号化鍵Ｋｓで、暗号化コンテンツを復号する。 In such a configuration, the content decrypting device separates the content for distribution into the content distribution header C and the encrypted content by the separating means.
Then, the content decryption apparatus sets the content distribution header C separated by the separation means by the encryption key decryption means to (j, C ₁ , C ₂ , C ₃ , C ₄ ), and the user secret for the user identifier v When the key _dv is composed of (d _{v, 1} , d _{v, 2} ), the bilinear map e specified by the encrypted information generation device according to claim 1 and disclosed as public information is used. The encryption key Ks used for content encryption is

Decrypted by
Here, C _{3 + vj} represents C ₃ when the value of v _j is “0”, and C ₄ when the value of v _j is “1”.
Then, the content decrypting device decrypts the encrypted content by the content decrypting unit with the encryption key Ks decrypted by the encryption key decrypting unit.

The content decryption program according to claim 8 is the content distribution system for encrypting and distributing the content, and the distribution content generated by the distribution content generation device according to claim 5 is described in claim 3. to decode based on a user private key d _v generated by the secret key generating device, computer, separating means, the encryption key decrypting unit, and configured to function as a content decryption unit.

により復号する。
そして、コンテンツ復号プログラムは、コンテンツ復号手段によって、暗号化鍵復号手段で復号された暗号化鍵Ｋｓで、暗号化コンテンツを復号する。 In this configuration, the content decryption program separates the distribution content into the content distribution header C and the encrypted content by the separating unit.
The content decryption program sets the content distribution header C separated by the separation means by the encryption key decryption means to (j, C ₁ , C ₂ , C ₃ , C ₄ ), and the user secret for the user identifier v When the key _dv is composed of (d _{v, 1} , d _{v, 2} ), the bilinear map e (•, which is specified by the encrypted information generation device according to claim 1 and is made public as public information.・), The encryption key Ks used to encrypt the content is

Decrypted by
The content decryption program decrypts the encrypted content with the encryption key Ks decrypted by the encryption key decryption unit by the content decryption unit.

Further, the user identification device according to claim 9, in the content distribution system for distributing encrypted content, claim incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3 7 from the content decrypting apparatus according to, a user identification device for identifying a user corresponding to the user private key d _v, and the test data generating unit, a test data transmitting means, and decoded data receiving means, a user identifier identifying means And a user search means.

を生成する。さらに、ユーザ特定装置は、テストデータ生成手段によって、テスト用コンテンツを暗号化鍵Ｋｓで暗号化した暗号化コンテンツに合成することでユーザ識別子のｊビット目をテストするためテストデータを生成する。
これによって、テストデータは、テスト用コンテンツ配信ヘッダにおいて、ｊ番目のＨ_ｊ，０又はＨ_ｊ，１のいずれか一方が、他の要素とは異なるｔ′乗となり、ダミーデータが組み込まれることになる。 In such a configuration, the user specifying device uses the test data generating unit to generate the encryption key Ks, the public information and the public key generated by the encrypted information generating device according to claim 1, and one of the public information. Based on two different random numbers t and t ′ selected from Z _n ^* specified by a certain composite number n, as a test content delivery header,

Is generated. Further, the user specifying device generates test data for testing the j-th bit of the user identifier by combining the test content with the encrypted content encrypted with the encryption key Ks by the test data generating means.
As a result, in the test content delivery header, any _one of the j-th H _{j, 0} or H _{j, 1} becomes t ′ different from the other elements in the test content delivery header, and dummy data is incorporated. Become.

  Then, the user specifying device transmits the test data generated by the test data generating unit to the content decrypting device by the test data transmitting unit. Then, the user specifying device receives the content decrypted by the test data from the content decrypting device by the decrypted data receiving means.

Then, the user specifying device compares the content received by the decrypted data receiving unit with the test content for all j of 1 ≦ j ≦ m by the user identifier specifying unit, and whether or not the comparison results match. Based on the above, the value of the j-th bit of the user identifier is specified. In the present invention, the fact that content is not normally decrypted when decrypted using a different t'th power value from other elements is utilized. That is, when C ^* _{j, 1} is used as the test content distribution header, the user identifier specifying means sets the value of the j-th bit of the user identifier to “1” and the comparison result matches if the comparison result matches. Otherwise, the value of the jth bit of the user identifier is set to “0”. Further, when C ^* _{j, 0} is used as the test content delivery header, the user identifier specifying means sets the value of the j-th bit of the user identifier to “0” and the comparison result matches if the comparison result matches. If not, the user identifier is specified by setting the value of the j-th bit of the user identifier to “1”.

  And a user specific device searches the user information corresponding to the user identifier specified by the user identifier specific means from the database which matched the user identifier and the user information which specifies a user beforehand by a user search means.

Further, the user identification program according to claim 10, in the content distribution system for distributing encrypted content, claim 7 incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3 from the content decrypting apparatus according to, in order to identify the user corresponding to the user private key d _v, the computer, the test data generating means, the test data transmission unit, decoding the data receiving means, a user identifier identifying unit, a user searching means It was set as the structure made to function as.

を生成する。さらに、ユーザ特定プログラムは、テストデータ生成手段によって、テスト用コンテンツを暗号化鍵Ｋｓで暗号化した暗号化コンテンツに合成することでユーザ識別子のｊビット目をテストするためテストデータを生成する。 In such a configuration, the user specifying program includes the encryption key Ks, the public information and the public key generated by the encrypted information generation device according to claim 1, and one of the public information by the test data generation unit. Based on two different random numbers t and t ′ selected from Z _p ^* specified by a certain prime number p, as a test content delivery header,

Is generated. Further, the user specifying program generates test data for testing the j-th bit of the user identifier by combining the test content with the encrypted content encrypted with the encryption key Ks by the test data generating means.

  And a user specific program transmits the test data produced | generated by the test data production | generation means to the content decoding apparatus by the test data transmission means. Then, the user specifying program receives the content decrypted by the test data from the content decrypting device by the decrypted data receiving means.

  Then, the user specifying program compares the content received by the decrypted data receiving unit and the test content for all j of 1 ≦ j ≦ m by the user identifier specifying unit, and whether or not the comparison result matches. Based on the above, the value of the j-th bit of the user identifier is specified.

  And a user specific program searches the user information corresponding to the user identifier specified by the user identifier specific means from the database which matched the user identifier and the user information which specifies a user beforehand by a user search means.

The present invention has the following excellent effects.
According to the first and second aspects of the invention, the number of elements of the secret key (user secret key) that can be a fixed number and the number of elements of the content distribution header that is the ciphertext are fixed numbers. It is possible to generate a public key that can be

  According to the third and fourth aspects of the present invention, it is possible to generate a secret key (user secret key) having a fixed number of elements and a fixed length size independent of the number of users. Thereby, the data amount of the secret key held in the content decryption apparatus can be reduced.

  According to the fifth and sixth aspects of the invention, it is possible to generate distribution content to which a content distribution header having a fixed number of elements and a ciphertext having a fixed length size independent of the number of users is added. it can. As a result, even when content is distributed all at once, the number of elements in the content distribution header, which is a ciphertext, is a fixed number, so the amount of data can be suppressed and the load on the network can be reduced.

  According to the seventh and eighth aspects of the invention, the encryption key can be decrypted from the content distribution header having a fixed number of elements independent of the number of users.

  According to the ninth and tenth aspects of the present invention, the user who uses the content decrypting device can be specified from the content decrypting device. As a result, even when an unauthorized user creates an unauthorized content decryption device by copying the distributed user private key, the user who created the unauthorized content decryption device can be identified.

It is a block diagram which shows the structure of the content delivery system which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the encryption information generation server (encryption information generation apparatus) which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the secret key generation server (secret key generation apparatus) which concerns on 1st Embodiment of this invention. 1 is a block diagram showing a configuration of a content server (distribution content generation device) according to a first embodiment of the present invention. FIG. It is a block diagram which shows the structure of the content delivery server which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the user terminal (content decoding apparatus) which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the unauthorized user tracking server (user specific device) which concerns on 1st Embodiment of this invention. It is a flowchart which shows the operation | movement which produces | generates a public key and a user private key in the content delivery system which concerns on 1st Embodiment of this invention. It is a flowchart which shows the operation | movement which produces | generates the content for delivery in the content delivery system which concerns on 1st Embodiment of this invention. It is a flowchart which shows the operation | movement which distributes the content for distribution in the content distribution system which concerns on 1st Embodiment of this invention. It is a flowchart which shows the operation | movement which the user terminal which concerns on 1st Embodiment of this invention decodes the content for delivery. It is a flowchart which shows the operation | movement which tracks the user who created the said user terminal from the unauthorized user terminal which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the content delivery system which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the encryption information generation server (encryption information generation apparatus) which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the secret key generation server (secret key generation apparatus) which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the user terminal (content decoding apparatus) which concerns on 2nd Embodiment of this invention.

Embodiments of the present invention will be described below with reference to the drawings.
<First Embodiment>
[Content distribution system configuration]
First, the configuration of the content distribution system according to the first embodiment will be described with reference to FIG. The content distribution system 1 includes an encrypted information generation server 10, a secret key generation server 20, a content server 30, a content distribution server 40, and a content distributor (hereinafter referred to as a provider) connected via an intranet 3. The system includes a gateway (GW) 5 and distributes content to a user terminal 50 that is a terminal on the purchaser side (hereinafter referred to as a user) of the content via the Internet 7.
In the present embodiment, the content distribution system 1 further includes an unauthorized user tracking server 90 on the provider side.

  The encryption information generation server (encryption information generation device) 10 uses master secret information, which is secret information on the provider side used in the secret key generation server 20, and content as encryption information used when encrypting the content. A public key used in the server 30 is generated. The generated master secret information is transmitted to the secret key generation server 20, and the public key is transmitted to the content server 30.

  The secret key generation server (secret key generation device) 20 generates a user-specific secret key (user secret key) used when decrypting encrypted content. The generated user secret key is distributed (transmitted) to the user terminal 50 on the user side.

  The content server (distribution content generation device) 30 encrypts the content, encrypts the encryption key used for content encryption using the public key generated by the encryption information generation server 10, and generates header information ( Content distribution header) is generated and synthesized with the encrypted content, thereby generating content (distribution content) to be distributed to the user side. The content server 30 stores a plurality of distribution contents in a storage unit (not shown), and transmits the distribution contents requested from the content distribution server 40 to the content distribution server 40.

  The content distribution server 40 acquires the content requested by the user terminal 50 (distribution content) from the content server 30 and transmits it to the user terminal 50.

  The user terminal (content decryption apparatus) 50 requests the content distribution server 40 for content (distribution content) desired by the user, and decrypts the distribution content acquired from the content distribution server 40. The user terminal 50 obtains a user-specific user secret key from the secret key generation server 20 in advance, and decrypts the distribution content. Although only one user terminal 50 is shown here, it goes without saying that a plurality of user terminals 50 can be connected via the Internet 7.

  The gateway (GW) 5 is a device for connecting each network of the intranet 3 and the Internet 7. The gateway 5 is, for example, an IP router (IP: Internet Protocol), and has a firewall function that prevents unauthorized access to the intranet 3.

  The unauthorized user tracking server (user identification device) 90 identifies a user who uses the user terminal 50. For example, when an unauthorized user duplicates a distributed user secret key to create an unauthorized user terminal 50Z (50), the unauthorized user tracking server 90 tests the unauthorized user terminal 50Z. By inputting data and analyzing the data output from the user terminal 50Z, the user who created the user terminal 50Z is specified by the user identifier.

  Hereinafter, the respective configurations of the encryption information generation server 10, the secret key generation server 20, the content server 30, and the content distribution server 40, which are provider devices, and the configuration of the user terminal 50, which is a user device, will be sequentially described. Further, the configuration of the unauthorized user tracking server 90 will be described.

(Configuration of encrypted information generation server)
First, the configuration of the encrypted information generation server 10 will be described with reference to FIG. 2 (refer to FIG. 1 as appropriate). Here, the encrypted information generation server 10 includes basic information generation means 11, master secret information generation means 12, master secret information transmission means 13, public key generation means 14, and public key transmission means 15. ing.

The basic information generating unit 11 generates basic information used for generating the master secret information and the public key in the master secret information generating unit 12 and the public key generating unit 14.
Here, the basic information generating means 11 inputs a positive integer m from the outside by an input means (not shown), and as basic information, m prime numbers (p ₁ , p ₂ ,..., P _m ) and a prime number ( _{p 1,} ..., p _m) a group of origin to of order _(g 1, ..., to generate a _{g m).} Furthermore, the basic information generating means 11, as the basic information, the prime number _{(p 1, p 2, ...} , p m) a composite number of all the multiplied prime with _{n (n = p 1 ... p} m), origin (g ₁ ,..., G _m ) are generated, and an element g (g = g ₁ ... G _m ) is generated by combining the generation sources. In addition, the predetermined maximum number of collusions of the illegitimate person (the maximum number that can be made resistant even if the illegitimate person collusions and attacks the content distribution system 1) is k, When the total number of users is N and the safety parameter is ε, the positive integer m is a number greater than or equal to k ² log (N / ε). For example, when the number of users N = 10000, the maximum number of collusion attackers k = 10, and the security parameter ε = 0.0001, the positive integer m is m ≧ 1843.

Furthermore, the basic information generating means 11, of order a composite number n, the synthesized bilinear mapping e (·, ·) of the element g from the group G to a generator to the group G _T determined. For example, the basic information generating means _{11, e: G × G → G} T become bilinear mapping e (·, ·) as a typical "Weil Paring", "Tate Paring " elliptic curve on the basis of parameters such as Is identified.

Note that the basic information generation means 11 receives the input positive integer m and the generated basic information (combined number n, prime numbers p ₁ ,..., P _m , combined element g, generator g ₁ ,. g _m and bilinear mapping e (•, •)) are output to the master secret information generation means 12 and the public key generation means 14.

The master secret information generation unit 12 generates master secret information used when the secret key generation server 20 generates a user secret key.
Specifically, the master secret information generating unit _{12, 1 ≦ x 1,0, x 1,1} <p 1, ..., 1 ≦ x m, 0, x m, 1 <2m pieces the number of which is a _{p m} x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} and two numbers α and β satisfying 1 ≦ α and β <n are selected at random, and the secret information master = (P ₁ ,..., P _m , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α, β).

Furthermore, the master secret information generation means 12 generates the generation sources g ₁ ,..., G _m generated by the basic information generation means 11 and x _1,0 , x _1,1,. A parameter for generating a user private key or public key (hereinafter, public parameter) param is generated from _{m, 0} , x _{m, 1} by the following equation (1), and the master secret key msk is set to g ^αβ (Msk = g ^αβ ).

That is, the master secret information generation unit 12 generates the master secret key msk (= g ^αβ ) by calculating the αβ power (power) of the synthesized element g, and the generation source (g ₁ ,..., G _m ) With the values of the secret information (x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} ), respectively, to generate the public parameter param. This public parameter is information that is disclosed to the secret key generation server 20 in addition to the public information.

Then, the master secret information generation unit 12 outputs the generated master secret key msk and the public parameter param to the master secret information transmission unit 13 as master secret information.
Further, the master secret information generation unit 12 outputs the generated public parameter param and α and β that are part of the secret information to the public key generation unit 14.

  The master secret information transmission unit 13 transmits the master secret information generated by the master secret information generation unit 12 to the secret key generation server 20 via the intranet 3. That is, the master secret information transmission unit 13 transmits the master secret key msk and the public parameter param generated by the master secret information generation unit 12 to the secret key generation server 20.

  The public key generation unit 14 generates a public key (Trator Tracing public key) for generating a header (content distribution header) to be combined with distribution content in the content distribution server 40.

Here, the public key generation unit 14 includes the positive integer m input by the basic information generation unit 11, the prime numbers p ₁ , p ₂ ,..., P _m generated by the basic information generation unit 11, the generation sources g ₁ , g ₂ ,..., g _m and the bilinear map e (•, •), the public parameter param generated by the master secret information generating means 12 (see the above equation (1)), and α, which is a part of the secret information. Based on β, the public key PK = (E ₁ , E ₂ ,..., E _m , G ₁ , G ₂ ,..., G _m , H _1,0 , H _2,0 , .., H _{m, 0} , H _1,1 , H _2,1 ,..., H _{m, 1} ) are generated.

Then, the public key generation unit 14 outputs the generated public key PK to the public key transmission unit 15.
The public key transmission unit 15 transmits the public key generated by the public key generation unit 14 to the content server 30 via the intranet 3.

The encrypted information generation server 10 is used for encryption, decryption, key generation, etc. generated by the basic information generation means 11 (n, g, g ₁ ,..., G _m , e, G, G _T ). Publish as public information.
Here, the encryption information generation server 10 publishes the public information by transmitting it to the secret key generation server 20 and the content server 30 by the master secret information transmission unit 13 and the public key transmission unit 15. In addition, in order to transmit public information, you may provide a public information transmission means (not shown) separately.

  By configuring the encryption information generation server 10 in this way, the encryption information generation server 10 can generate master secret information (master secret key, public parameter) and a public key.

  The encrypted information generation server 10 can be realized by a general computer having a CPU and a memory (not shown). At this time, the encryption information generation server 10 operates by an encryption information generation program that causes the computer to function as each of the above-described means.

(Configuration of secret key generation server)
Next, the configuration of the secret key generation server 20 will be described with reference to FIG. 3 (refer to FIG. 1 as appropriate). Here, the secret key generation server 20 includes a master secret information receiving unit 21, a master secret information storage unit 22, a user secret key generation unit 23, and a user secret key output unit 24.

  The master secret information receiving means 21 receives the master secret key msk that is the master secret information generated by the encrypted information generation server 10 and the public information (including the public parameter param) via the intranet 3. . The master secret key and the public information (including the public parameter param) received by the master secret information receiving unit 21 are stored in the master secret information storage unit 22.

  The master secret information storage means 22 stores the master secret key received by the master secret information receiving means 21 and public information (including public parameters param), and is a general storage device such as a hard disk. The master secret key and public parameters (public information) stored in the master secret information storage unit 22 are read by the user secret key generation unit 23.

The user secret key generation unit 23 generates a user-specific secret key (user secret key) from a value for identifying the user (for example, user-specific user identifier [v]).
Here, the user secret key generation unit 23 includes a master secret key msk (= g ^αβ ) stored in the master secret information storage unit 22, public information (public parameter param (see the above formula (1))), a user identifier v, previously ^{_{Z n * (= {1,2,}} ..., n-1}) ( where, n is obtained as the public information composite number) from the selected random number _{r v} from the following (3 ) to generate the user's private key d _v by the formula.

In the equation (3), the user identifier v is input via an input unit (not shown). The user identifier v is data having a bit length of a positive integer m input to the basic information generation unit 11 (see FIG. 2) of the encrypted information generation server 10. Here, the bit value of the i-th bit (1 ≦ i ≦ m) when the user identifier v is represented by a bit string is expressed as v _i . That is, the user identifier v is composed of a bit string of (v ₁ , v ₂ ,..., V _m ).

Here, the user identifier v is included in the user secret key, but the user identifier v does not necessarily have to be secret information. Therefore, the user secret key generation unit 23 may generate the user secret key _{dv according} to the following equation (4).

  The user secret key generated by the user secret key generation unit 23 is output to the user secret key output unit 24.

The user secret key output unit 24 outputs the user secret key generated by the user secret key generation unit 23 to the outside. The user secret key output means 24 may be written in a general-purpose storage medium (external storage medium) such as a tamper-resistant IC card or a flexible disk, or via a network (intranet 3, Internet 7). It may be transmitted to the user terminal 50. However, when the user secret key is written in the storage medium, the storage medium is delivered to the user side by mail or the like.
By configuring the secret key generation server 20 in this way, the secret key generation server 20 can generate a user secret key to be distributed to the user terminal 50.

  The secret key generation server 20 can be realized by a general computer having a CPU and a memory (not shown). At this time, the secret key generation server 20 is operated by a secret key generation program that causes the computer to function as each of the means described above.

(Content server configuration)
Next, the configuration of the content server 30 will be described with reference to FIG. 4 (refer to FIG. 1 as appropriate). Here, the content server 30 includes an encryption key generation unit 31, a public key reception unit 32, a header generation unit 33, a content reception unit 34, a content encryption unit 35, a header synthesis unit 36, and a distribution purpose. A content storage unit 37, a content request receiving unit 38, and a distribution content transmitting unit 39 are provided.

  The encryption key generation unit 31 generates an encryption key for encrypting content. The encryption key generated here is output to the header generation unit 33 and the content encryption unit 35. This encryption key is an encryption key used in the content encryption means 35, and is randomized using a pseudo random number generation means, a hash function (not shown), etc., and the key lengths are made uniform. Is.

The public key receiving unit 32 receives the public key PK generated by the encrypted information generation server 10 (see the formula (2)) via the intranet 3. The public key received here is output to the header generation means 33.
Here, the public key receiving means 32, together with the public key PK, public information (combined number n, combined element g, generators g ₁ ,..., G _m , bilinear map e, group G and group G _T ). Receive. The public key receiving unit 32 writes the received public information in the distribution content storage unit 37 and outputs the composite number n of the public information to the header generation unit 33.
The public information may be received separately by providing public information receiving means (not shown) and independent of the public key PK.

The header generation unit 33 encrypts the encryption key Ks generated by the encryption key generation unit 31 with the public key PK received by the public key reception unit 32, thereby synthesizing the content with the content (content distribution header). Is generated.
Here, the header generation unit 33 selects a random number t in advance from Z _n ^* (= {1, 2,..., N−1}) (where n is a composite number acquired as public information) ( A random number t is generated by a pseudo-random number generator (not shown), and an index j is selected from (1 ≦ j ≦ m), and an encrypted text is obtained using an encryption key Ks and a public key PK. The content distribution header (header information) C shown in the equation (5) is generated.

That is, the header generation unit 33 calculates the product (KsG _j ^t ) of the index j selected from 1 ≦ j ≦ m, the value obtained by raising the power of G _j corresponding to the index j included in the public key PK to the power of t, and the encryption key Ks. ) And E _j , H _{j, 0} , H _{j, 1} corresponding to the index j included in the public key PK, respectively, and values (E _j ^t , H _{j, 0} ^t , H _{j, 1} ^t ) Is generated. Then, the header generation unit 33 outputs the generated content distribution header to the header synthesis unit 36.

  The content receiving unit 34 receives content for distribution. The content received here is output to the content encryption unit 35. For example, the content receiving unit 34 may read content from a recording medium (not shown), or may acquire content as communication data via a network (Internet 7 or the like). .

  The content encryption unit 35 encrypts the content for distribution received by the content reception unit 34 with the encryption key generated by the encryption key generation unit 31 to generate encrypted content. The encrypted content generated here is output to the header synthesis means 36. The content encryption unit 35 encrypts the content by using a common key encryption method using the encryption key. In addition, since the content to be encrypted is assumed to be information with a large amount of data such as video, here, the common key encryption method, which is faster than the public key encryption method, is used. I will do it. For example, a common common key encryption method such as AES (Advanced Encryption Standard) may be used.

  The header synthesizing unit 36 synthesizes the encrypted content generated by the content encrypting unit 35 and the content distribution header C generated by the header generating unit 33 (see the above formula (5)) to generate the distribution content. Is to be generated. The distribution content generated here is stored in the distribution content storage unit 37 with unique content identification information (for example, a file name).

  Note that the composition of the encrypted content and the content distribution header in the header composition means 36 does not only mean that the data is synthesized as one data (file, stream). That is, the encrypted content and the content distribution header need only be associated with each other, and can be managed as individual data. However, in order to simplify the management, it is preferable to combine the encrypted content and the content distribution header into one data.

The distribution content storage unit 37 stores the distribution content generated by the header synthesis unit 36 and is a general storage device such as a hard disk. The distribution content stored in the distribution content storage unit 37 is read by the distribution content transmission unit 39.
Here, the distribution content storage unit 37 also stores the public information received by the public key receiving unit 32.

  The content request receiving unit 38 receives a request (content request) for content including content identification information for specifying content for distribution transmitted from the content distribution server 40 via the intranet 3. The content request receiving unit 38 outputs the identification information included in the content request to the distribution content transmitting unit 39.

The distribution content transmission means 39 reads the distribution content corresponding to the content identification information output from the content request reception means 38 from the distribution content storage means 37 and transmits it to the requested content distribution server 40. It is.
If the content request receiving unit 38 receives a public information request (public information request) before the content request, the content request receiving unit 38 notifies the distribution content transmitting unit 39 to that effect. Then, the distribution content transmission unit 39 reads the public information from the distribution content storage unit 37 and transmits it to the content distribution server 40.

  By configuring the content server 30 in this way, the content server 30 encrypts the content with the encryption key, and associates the encrypted encrypted content with the content distribution header to generate the content for distribution. Can do.

  The content server 30 can be realized by a general computer having a CPU and a memory (not shown). At this time, the content server 30 operates according to the distribution content generation program that causes the computer to function as each of the above-described means.

(Content distribution server configuration)
Next, the configuration of the content distribution server 40 will be described with reference to FIG. 5 (refer to FIG. 1 as appropriate). Here, the content distribution server 40 includes a user request receiving unit 41, a content request transmitting unit 42, a distribution content receiving unit 43, and a distribution content transmitting unit 44.

  The user request receiving means 41 receives a request (content request form) transmitted from the user terminal 50 and indicating the content desired by the user via the network. This content request document includes at least content identification information for specifying the content and terminal identification information (for example, an IP address) indicating which user terminal 50 is requested. The user request receiving unit 41 outputs the content identification information to the content request transmitting unit 42 and outputs the terminal identification information to the distribution content transmitting unit 44.

  The content request transmission unit 42 transmits a content request (content request) including content identification information output from the user request reception unit 41 to the content server 30 via the intranet 3.

  The distribution content receiving unit 43 receives the distribution content corresponding to the content identification information transmitted from the content request transmission unit 42 from the content server 30 via the intranet 3. The distribution content receiving unit 43 outputs the received distribution content to the distribution content transmitting unit 44.

  The distribution content transmitting unit 44 transmits the distribution content received by the distribution content receiving unit 43 to the user terminal 50 corresponding to the terminal identification information output from the user request receiving unit 41.

By configuring the content distribution server 40 in this manner, the content distribution server 40 can acquire the distribution content requested from the user terminal 50 from the content server 30 and distribute it to the requested user terminal 50. it can.
Further, when there is a request for public information from the user terminal 50, the content distribution server 40 transmits a public information request to the content server 30, acquires the public information, and transmits it to the user terminal 50. In this case, the flow of data for the public information request and the public information is the same as that for the content request and the content for distribution.

  The content distribution server 40 can be realized by a general computer having a CPU and a memory (not shown). At this time, the content distribution server 40 operates by a content distribution program that causes the computer to function as each of the above-described means.

  The configuration of each device on the provider side in the content distribution system 1 has been described above, but the present invention is not limited to this. For example, the encrypted information generation server 10 may be incorporated in the content server 30 and newly configured as the content server 30B (not shown). Alternatively, the content server 30B (not shown) may be incorporated in the content distribution server 40 and newly configured as the content distribution server 40B (not shown).

  For example, in order to distribute the load in the content distribution system 1, a plurality of content servers 30 (content servers 30B, 30C, etc .: not shown) may be provided depending on the type of content. In this case, the content distribution server 40 transmits a content request by switching the content server that requests the content depending on the type of content.

(User terminal configuration)
Next, the configuration of the user terminal 50 will be described with reference to FIG. 6 (see FIG. 1 as appropriate). Here, the user terminal 50 includes a distribution content request unit 51, a distribution content reception unit 52, a separation unit 53, a secret key storage unit 54, an encryption key decryption unit 55, a content decryption unit 56, It has.

  The distribution content request means 51 transmits a request (content request) indicating the content desired by the user (distribution content) to the content distribution server 40 on the provider side via the Internet 7. For example, the distribution content requesting unit 51 includes content identification information by inputting content identification information (for example, a file name) specifying the content desired by the user by an input unit (not shown). A content request is generated and transmitted to the content distribution server 40.

  The distribution content receiving means 52 receives the distribution content requested by the user from the provider-side content distribution server 40 via the Internet 7. The distribution content received here is output to the separating means 53. In addition, in the distribution content received here, the content distribution header C (see the above formula (5)) is combined with the encrypted content (encrypted content).

  The separating unit 53 separates the distribution content received by the distribution content receiving unit 52 into a content distribution header and an encrypted content. The separated content distribution header is output to the encryption key decryption unit 55, and the encrypted content is output to the content decryption unit 56.

  The secret key storage means 54 is a general-purpose storage medium (external storage medium) such as an IC card or a flexible disk having tamper resistance, and the user secret key is written in advance on the provider side and distributed to the user. is there.

The encryption key decryption means 55 decrypts and extracts the encryption key from the content distribution header separated by the separation means 53 based on the user secret key stored in the secret key storage means 54. The decrypted encryption key is output to the content decrypting means 56.
In this encryption key decryption means 55, the user secret key stored in the secret key storage means 54 is d _v (= formula (3)) = (v, d _{v, 1} , d _{v, 2} ), separation When the content delivery header separated by the means 53 is C (= the above formula (5)) = (j, C ₁ , C ₂ , C ₃ , C ₄ ), the encryption key Ks is set to the following (6 ) Note that the bilinear map e used here is acquired in advance as public information through the same route as the distribution content, and is stored in a storage unit (not shown).

Here, v is user-specific information (user identifier). Further, in this equation (6), when the value of the j-th bit of v is “0”, Ks = C ₁ e (d _{v, 2} , C ₃ ) / e (d _{v, 1} , C ₂ ), v When the value of the j-th bit is “1”, Ks = C ₁ e (d _{v, 2} , C ₄ ) / e (d _{v, 1} , C ₂ ) is indicated.
The right side of the expression (6) is encrypted by the modification shown in the following expression (7) based on the expressions (2), (4) and (5), and the property of the bilinear map e. It can be proved that the key Ks is indicated.

The bilinear map e is e (g ₁ ... G _j−1 g _{j + 1} ... G _m , g _j ) = 1, that is, the subgroup G _j composed of the generator g _j is excluded from the group G. The subgroup elements g ₁ ... G _j−1 g _{j + 1} ... G _m and the bilinear mapping value for the element g _j of the subgroup G _j are “1”. Therefore, by utilizing this property, the second to fourth deformation formulas in the formula (7) are modified.
The bilinear map e has a property of e (g ₁ ^α , g ₂ ^β ) = e (g ₁ , g ₂ ) ^αβ . Therefore, by utilizing this property, the fourth modified expression in the expression (7) is modified.

  The content decrypting unit 56 decrypts the encrypted content using the encryption key decrypted by the encryption key decrypting unit 55. The content decrypting unit 56 decrypts the encrypted content after the content distribution header is separated by the separating unit 53 using the encryption key. As a result, the encrypted content is decrypted into content that can be viewed and the like.

  By configuring the user terminal 50 as described above, the user terminal 50 must use user-specific information (user ID) when decrypting the encryption key Ks. As a result, even when a certain user creates an unauthorized user terminal using a private key owned by the user, the unauthorized user terminal must include the owner's ID and secret key. Therefore, the user who created the unauthorized user terminal can be easily identified.

  The user terminal 50 can be realized by a general computer having a CPU and a memory (not shown). At this time, the user terminal 50 operates by a content decryption program that causes the computer to function as each of the means described above.

(Configuration of unauthorized user tracking server)
Next, the configuration of the unauthorized user tracking server 90 will be described with reference to FIG. 7 (refer to FIG. 1 as appropriate). Here, the unauthorized user tracking server 90 includes a public information storage unit 91, a content storage unit 92, a test data generation unit 93, a test data transmission unit 94, a decrypted data reception unit 95, and a user identifier specification unit 96. User information storage means 97 and user search means 98 are provided. Here, it is assumed that the unauthorized user tracking server 90 is connected to a user terminal 50Z (50) that is a target for specifying a user.

The public information storage unit 91 stores a public key (public information) disclosed in the encryption information generation server 10 and is a general storage device such as a hard disk. Specifically, the public information storage unit 91 includes public information (n, g, g ₁ ,..., G _m , e, G, G _T ) disclosed in the encrypted information generation server 10 and public information. Key PK = (E ₁ , E ₂ ,..., E _m , G ₁ , G ₂ ,..., G _m , H _1,0 , H _2,0 ,..., H _{m, 0} , H _1,1 , H _{2 , 1} ,..., H _{m, 1} ) are stored in advance.
The public key (public information) stored in the public information storage unit 91 is read by the test data generation unit 93.

The content storage unit 92 stores a test content to be included in the test data output to the user terminal 50Z, and is a general storage device such as a hard disk. The content stored in the content storage unit 92 may be the same type as that distributed to the regular user terminal 50. For example, if the user terminal 50Z is a terminal for viewing video / audio content, the content storage unit 92 stores the video / audio content as test data content. For example, if the user terminal 50Z is a terminal that presents character information, the content storage unit 92 stores text data as content for test data.
The content stored in the content storage unit 92 is read by the test data generation unit 93 and the user identifier specifying unit 96.

  The test data generating means 93 generates test data for testing a predetermined bit of a user identifier of a user who uses the user terminal 50Z (specifying a bit value) from the user terminal 50Z. Here, the test data generation unit 93 includes a header generation unit 931, a content encryption unit 932, and a header synthesis unit 933.

The header generation unit 931 generates a header (test content distribution header) to be combined with the test content. Here, the header generation unit 931 uses two different random numbers t and t ′ in advance as Z _p ^* (= {1, 2,..., N−1}) (where n is public information storage unit 91 as public information). (Synthetic numbers stored in the table) (random numbers t and t ′ are generated by pseudorandom number generation means not shown), and using the encryption key Ks and the public key PK, the following (8 ) To generate a test content delivery header (header information) C ^* _{j, 1} shown in the formula ( ₁ ).

The test content delivery headers C ^* _0,1 , C ^* _1,1 ,..., C ^* _{m, 1} generated in this way are sequentially output to the header synthesis means 933.
In the equation (8), j is an integer of 1 ≦ j ≦ m, and m is the bit length of the user identifier v. Further, in this equation (8) _, only H _{j, 1} is the t'th power, and the others are the tth power.
That is, the header generation means 931 sequentially adds j one by one from j = 1, and the test content distribution headers C ^* _0,1 , C ^* _1,1 ,..., C ^* _{m, 1} is generated. At this time, for each C ^* _{j, 1 ,} only H _{j, 1} has a t'th power value.
As a result, each of the test content distribution headers C ^* _{j, 1} has H _{1,1 to} H _{m, 1} specified by the value of j raised to the power of t ', and dummy data is set.

On the other hand, the user's private key _{d v} used in the user terminal 50Z, the equation (3), (4) As shown in equation _{x 1, v1} square of origin _{g, x 2, v2} square, ..., x It is generated using the _{m and vm} powers. These v ₁ , v ₂ ,..., V _m are bit values of the user identifier v.
Thus, for example, _{x 1, v1} square of g is, if the value of the first bit of the user identifier v is _"0" g _{x 1,0} square of _{(H 1, 0;} said (see 2)) is Used, if the value of the first bit is “1”, x _1,1 power (H _1,1 ) is used.

Here, it is assumed that, for example, dummy data is set to j = 1 in the test content distribution header C ^* _{j, 1} . That is, it is assumed that only H _1,1 is a power of t ′. Then, if the value of the first bit of the user identifier v is “0”, the user terminal 50Z can decrypt the content because the regular H _{1,0 to} the power of t is used. If the value of the first bit of v is “1”, the content cannot be decrypted because the dummy data H _1,1 raised to the power of t ′ is used.

In this way, each bit value of the user identifier v is specified depending on whether or not the content can be decrypted by sequentially setting H _{j, 1 to} the t ′ power from j = 1 to j = m. be able to. The identification of each bit value of the user identifier v is performed by a user identifier specifying means 96 described later.

  The content encryption unit 932 encrypts the test content. Here, the content encryption unit 932 encrypts the test content stored in the content storage unit 92 with the encryption key Ks. The encryption key Ks may be generated in the same manner as the encryption key generation unit 31 (see FIG. 4), or may be stored in the content storage unit 92 in advance. The content encryption unit 932 outputs the encrypted content to the header synthesis unit 933.

The header synthesizing unit 933 synthesizes the encrypted content generated by the content encrypting unit 932 with the test content distribution header C ^* _{j, 1} (refer to the expression (8)) sequentially generated by the header generating unit 931. To generate test data. The test data generated here is output to the test data transmission means 94.

The test data transmission unit 94 sequentially transmits the test data generated by the test data generation unit 93 to the user terminal 50Z that is a target for specifying the user. As a result, the user terminal 50Z to which the test data is input has the encrypted content included in the test data, the test content distribution header C ^* _{j, 1} also included in the test data, and the user terminal 50Z. Decrypt using the stored user private key. The decrypted data (decrypted content) decrypted by the user terminal 50Z is input to the unauthorized user tracking server 90.

The decrypted data receiving means 95 receives decrypted data (decrypted content) decrypted by the user terminal 50Z. The decoded data receiving means 95 receives the number of pieces of decoded data from the user terminal 50Z according to the test data for the number of bits of the user identifier v output from the test data transmitting means 94.
The decoded data received by the decoded data receiving unit 95 is sequentially output to the user identifier specifying unit 96.

The user identifier specifying unit 96 compares the content used when the test data is generated by the test data generation unit 93 with the decrypted data (decoded content) sequentially received by the decrypted data receiving unit 95, thereby obtaining the user identifier. Is specified.
Here, the content used when the test data is generated (more specifically, the content stored in the content storage unit 92) is M, and the decrypted data input by the decrypted data receiving unit 95 is M ′ _j ( 1 ≦ j ≦ m; m is the bit length of the user identifier).

At this time, the user identifier identifying unit 96, _'the case of _j, the value of the value _{v j} of j-th bit of the user identifier _{"0", M ≠ M'} M = M For _j, j-th bit values of the user identifier Specify v _j as the value “1”.
Then, the user identifier specifying unit 96 specifies the user identifier v = (v ₁ v ₂ ... V _m ) by concatenating the bit values of the user identifier specified for all j of 1 ≦ j ≦ m. The user identifier v specified in this way is output to the user search means 98.

  The user information storage unit 97 stores a database in which user information is associated with a user identifier, and is a general storage device such as a hard disk. Here, the user information is information for identifying the user, for example, personal information (name, address, etc.) of the user. In the user information storage unit 97, the provider stores the user information and the user identifier in advance in a database.

  The user searching means 98 searches the user information corresponding to the user identifier specified by the user identifier specifying means 96 from the database stored in the user information storage means 97 and specifies the user. The user information of the user specified by the user search means 98 is output to the outside (for example, a display device not shown) as information specifying the user of the user terminal 50Z.

The configuration of the unauthorized user tracking server 90 has been described above, but the present invention is not limited to this. Here, the header generation unit 931 sets H _{1,1 to} H _{m, 1} to the t'th power in each test content delivery header C ^* _{j, 1} , but as shown in the following equation (9), A test content delivery header C ^* _{j, 0 in} which _{H1,0 to} Hm _{, 0} is raised to the t'th power may be used.

In this case, for example, if the value of the first bit of the user identifier v is “1”, the user terminal 50Z can decrypt the content because the regular H _{1,1 to} the power of t is used. If the value of the first bit of the user identifier v is “0”, the content cannot be decrypted because the dummy data H _1,0 raised to the power of t ′ is used.
Therefore, when using the equation (9), the user identifier specifying unit 96 uses M as the content used when the test data is generated, and M ′ _j (1 ≦ j ≦) as the decoded data input by the decoded data receiving unit. m; m is the bit length of the user identifier). When M = M ′ _j , the value v _j of the j-th bit of the user identifier is the value “1”, and when M ≠ M ′ _j , the user identifier j The value v _j of the bit is specified as the value “0”.

  In this example, the unauthorized user tracking server 90 specifies user information (such as user personal information), but may simply have a function for specifying a user identifier. In this case, the unauthorized user tracking server 90 is configured by omitting the user information storage unit 97 and the user search unit 98 from the configuration described in FIG.

  Here, the unauthorized user tracking server 90 inputs the decrypted data (decrypted content) from the user terminal 50Z. However, for example, when the user terminal 50Z reproduces and outputs the content as a video signal or an audio signal, the test data generation unit 93 sequentially generates and outputs test data in accordance with an operator instruction input from the outside. Thus, the operator determines whether or not the video has been normally reproduced normally as video or audio, and specifies the user identifier. In this case, the unauthorized user tracking server 90 is configured to only transmit test data sequentially, and is configured by omitting the decrypted data receiving means 95, the user identifier specifying means 96, the user information storage means 97, and the user search means 98.

  The unauthorized user tracking server 90 can be realized by a general computer having a CPU and a memory (not shown). At this time, the unauthorized user tracking server 90 operates by an unauthorized user tracking program (user identification program) that causes the computer to function as each of the above-described means.

[Operation of content distribution system]
Next, the operation of the content distribution system according to the first embodiment will be described with reference to FIGS.

(Public key / user secret key generation operation)
First, referring to FIG. 8 (refer to FIGS. 1, 2 and 3 as appropriate), an operation of generating a public key and a user secret key in the content distribution system 1 will be described.

First, the encrypted information generation server 10 generates (selects) _m prime numbers (p ₁ ,..., P _m ) corresponding to the input positive integer m by the basic information generation unit 11 (step S10). In addition, the encrypted information generation server 10 generates (selects) the generation source (g ₁ ,..., G _m ) of the order (prime number) (p ₁ ,..., P _m ) by the basic information generation unit 11. (Step S11).

Further, the encrypted information generation server 10 uses the basic information generating section 11, the synthesis and the number n _{= p} 1 ... _{p m} of m prime numbers, and elements _{g =} g 1 ... g _m obtained by combining the m-number of origin generates, of order a composite number n, bilinear map e (·, ·) of the synthesized elements g from the group G to a generator to the group G _T identifies a (step S12).

Next, the encrypted information generation server 10 uses the master secret information generation means 12 to satisfy 1 ≦ x _1,0 , x _1,1 <p ₁ ,..., 1 ≦ x _{m, 0} , x _{m, 1} <p _m 2m numbers x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} and 2 numbers α and β satisfying 1 ≦ α and β <n are randomly selected. Then, secret information master = (p ₁ ,..., P _m , x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α, β) is generated.
Then, the encrypted information generation server 10 uses the master secret information generation means 12 to synthesize the element g and generation sources g ₁ ,..., G _m and x _1,0 , x _1, which are part of the secret information _{. 1} ,..., X _{m, 0} , x _{m, 1} , public parameter param (see equation (1) above), which is a parameter for generating a user secret key or public key, and master secret key msk (= g ^αβ ) is generated as master secret information (step S13).

Then, the encrypted information generation server 10 sends the master secret information (master secret key msk, public parameter param) generated in step S13 by the master secret information transmission unit 13 to the secret key generation server 20 via the intranet 3. Transmit (step S14).
The public information other than the public parameters is transmitted to the secret key generation server 20 after step S12 or at the timing of step S14.

Further, the encryption information generation server 10 uses the public key generation unit 14 to input the positive integer m input in step S10, the prime numbers p ₁ , p ₂ ,..., P _m generated in step S10, and in step S11. Based on the generated sources g ₁ , g ₂ ,..., G _m , the public parameters param generated in step S13, and α and β that are part of the secret information, the public key PK ((2 (See formula)) is generated (step S15).
Thereafter, the encrypted information generation server 10 transmits the public key generated in step S15 to the content server 30 via the intranet 3 by the public key transmission unit 15 (step S16).

  Also, the secret key generation server 20 receives the master secret information (master secret key msk, public parameter param) transmitted from the encrypted information generation server 10 in step S14 by the master secret information receiving means 21, and receives the master secret information. It is written and stored in the storage means 22 (step S17).

Then, the secret key generation server 20 uses the user secret key generation unit 23 to store the master secret key msk stored in the master secret information storage unit 22, the public parameter param, the user identifier v, and Z _n ^* (= {1,2, ..., n-1 } and a selected random number _{r v} from), by the equation (3), generating a user's private key _{d v} for each user (step S18).

Then, the secret key generating server 20, the user secret key output unit 24 writes the user private key d _v generated at step S18 in the storage medium. Then, the provider distributes the storage medium to the user (step S19). The user secret key output unit 24, a user private key d _v, network (intranet 3, the Internet 7) may be transmitted to the user terminal 50 via the.

  Through the above operation, the encryption information generation server 10 can generate a public key and transmit it to the content server 30. The secret key generation server 20 can generate a user secret key and distribute it to the user.

(Delivery content generation operation)
Next, with reference to FIG. 9 (refer to FIGS. 1 and 4 as appropriate), the operation of generating content for distribution in the content distribution system 1 will be described. The public information is assumed to have been acquired in advance.

First, the content server 30 generates the encryption key Ks for encrypting the content by the encryption key generation means 31 (step S20).
Then, the content server 30 receives the public key PK (see formula (2)) generated by the encryption information generation server 10 by the public key receiving unit 32 via the intranet 3 (step S21).

  Thereafter, the content server 30 encrypts the encryption key Ks generated in step S20 with the public key PK received in step S21 by the header generation unit 33, so that the header (content distribution header C; (Refer to formula (5)) (step S22).

  Further, the content server 30 receives content for distribution from the outside by the content receiving unit 34 (step S23). Then, the content server 30 encrypts the content received in step S23 by the content encryption unit 35 using a common key encryption method such as AES using the encryption key Ks generated in step S20 (step S24). ).

Thereafter, the content server 30 synthesizes the content encrypted in step S24 (encrypted content) and the content distribution header C generated in step S22 by the header synthesizing unit 36, thereby generating distribution content. (Step S25). The distribution content is stored in the distribution content storage unit 37.
With the above operation, the content server 30 can generate distribution content by combining a content distribution header that cannot be decrypted without using a user secret key with the encrypted content.

(Content distribution operation for distribution)
Next, with reference to FIG. 10 (refer to FIG. 1 and FIGS. 4 to 6 as appropriate), an operation of distributing content (content for distribution) in the content distribution system 1 will be described.

First, the user terminal 50 generates a content request including content identification information indicating the content desired by the user by using the distribution content request means 51 (step S30) and transmits it to the content distribution server 40 (step S31). .
Further, the content distribution server 40 receives the content request from the user terminal 50 by the user request receiving unit 41 (step S32), and the content identification information described in the content request by the content request transmitting unit 42. (Content identification information such as a file name) is transmitted as a content request to the content server 30 (step S33).

  Then, the content server 30 receives the content request from the content distribution server 40 by the content request receiving unit 38 (step S34), and the distribution content transmitting unit 39 stores the corresponding content (distribution content) in the distribution content storage. It reads from the means 37 (step S35), and transmits to the content distribution server 40 (step S36).

Then, the content distribution server 40 receives the distribution content from the content server 30 by the distribution content receiving means 43 (step S37), and the distribution content transmission means 44 sends the distribution content to the user who requested it. It transmits to the terminal 50 (step S38).
Then, the user terminal 50 receives the distribution content by the distribution content receiving means 52 (step S39).
With the above operation, the content distribution server 40 can transmit (distribute) distribution content to the user terminal 50 that has requested it.

(Decoding content for distribution)
Next, referring to FIG. 11 (refer to FIGS. 1 and 6 as appropriate), an operation of decrypting content (content for distribution) in the content distribution system 1 will be described. The public information is assumed to have been acquired in advance.

First, the user terminal 50 receives the distribution content from the content distribution server 40 by the distribution content receiving means 52 (step S40). Then, the user terminal 50 separates the distribution content into the content distribution header and the encrypted content by the separating unit 53 (step S41).
Then, the user terminal 50, the encryption key decrypting unit 55 reads the user private key _{d v} stored in the secret key storage unit 54 (step S42), and based on the user private key _{d v,} at step S41 The encryption key Ks is decrypted and extracted from the separated content distribution header according to the equation (6) (step S43).

Then, the user terminal 50 decrypts the encrypted content using the encryption key decrypted in step S43 by the content decrypting means 56 (step S44). At this stage, the user can view the decrypted content.
Through the above operation, the user terminal 50 can decrypt the encryption key with the user private key unique to the user and decrypt the encrypted content with the encryption key.

(User specific operation)
Next, referring to FIG. 12 (refer to FIG. 7 as appropriate), an operation for specifying the user who created the unauthorized user terminal 50Z (50) in the content distribution system 1 will be described. The public information is assumed to be stored in the public information storage unit 91 in advance.

First, the unauthorized user tracking server 90 initializes the variable j (value “1”) (step S50).
Then, the unauthorized user tracking server 90 generates test data for testing the j-th bit of the user identifier by the test data generating means 93 (step S51).
Specifically, the unauthorized user tracking server 90 uses the header generation unit 931 of the test data generation unit 93 to store two different random numbers t and t ′, the encryption key Ks, and the public information storage unit 91. Using the key PK, the test content delivery header C ^* _{j, 1} or C ^* _{j, 0} shown in the above equation (8) or (9) (1 ≦ j ≦ m; m is the bit length of the user identifier) Is generated.

In addition, the unauthorized user tracking server 90 encrypts the test content stored in the content storage unit 92 with the encryption key Ks by the content encryption unit 932 of the test data generation unit 93.
Then, the unauthorized user tracking server 90 uses the header composition unit 933 of the test data generation unit 93 to add the encrypted content to the test content distribution header C ^* _{j, 1} or C ^* _{j, 0} (1 ≦ j ≦ m). By combining, test data is generated.

Thereafter, the unauthorized user tracking server 90 transmits the test data having the test content delivery header C ^* _{j, 1} or C ^* _{j, 0} of the variable j to the user terminal 50 by the test data transmission means 94 (step S52). .
Then, the unauthorized user tracking server 90 receives the decrypted data (decrypted content) obtained by decrypting the test data by the user terminal 50 by the decrypted data receiving unit 95 (step S53).

Then, the unauthorized user tracking server 90 analyzes the decrypted data (decrypted content) received in step S53 by the user identifier identifying unit 96 and identifies the j-th bit value of the user identifier (step S54).
That is, in the case where the formula (8) (C ^* _{j, 1} ) is used in step S51, the user identifier specifying unit 96 uses the content used in step S51 and the decrypted data (decoded content) received in step S53. Are the same, the value of the j-th bit of the user identifier is specified as the value “0”, and if not the same, the value “1” is specified.

In step S51, when the equation (9) (C ^* _{j, 0} ) is used, the user identifier specifying unit 96 uses the content used in step S51 and the decrypted data (decoded content) received in step S53. Are the same, the value of the j-th bit of the user identifier is specified as the value “1”, otherwise the value “0” is specified.

Then, the unauthorized user tracking server 90 determines whether or not the variable j matches m, which is the bit length of the user identifier, that is, j = m (step S55).
If j = m is not satisfied (“No” in step S55), the unauthorized user tracking server 90 increments (+1) the variable j (step S56), and returns to step S51.
On the other hand, when j = m (“Yes” in step S55), the unauthorized user tracking server 90 specifies the user identifier by concatenating the bit values sequentially specified in step S54 by the user identifier specifying unit 96. (Step S57).

Then, the unauthorized user tracking server 90 searches the user information corresponding to the user identifier specified in step S57 from the database stored in the user information storage means 97 by the user search means 98 and specifies the user (step) S58). The user specified here is specified as the user who performed fraud.
With the above operation, the unauthorized user tracking server 90 can track (detect) which user has created the unauthorized user terminal 50.

Second Embodiment
[Content distribution system configuration]
Next, the configuration of the content distribution system according to the second embodiment will be described with reference to FIG. The content distribution system 1B includes an encrypted information generation server 10B, a secret key generation server 20B, a content server 30, a content distribution server 40, and a gateway (GW) 5 connected to the provider side via the intranet 3. This is a system for distributing content to a user terminal 50B, which is a user terminal, via the Internet 7. In the present embodiment, the content distribution system 1B further includes an unauthorized user tracking server 90 on the provider side.
This system configuration is basically the same as the content distribution system 1 (see FIG. 1) described in the first embodiment, and only the internal processing method is different. Therefore, in the following description, only parts different from the content distribution system 1 will be described, and the same components will be denoted by the same reference numerals and description thereof will be omitted.

(Configuration of encrypted information generation server)
First, the configuration of the encrypted information generation server 10B will be described with reference to FIG. 14 (see FIG. 13 as appropriate). Here, the encrypted information generation server 10B includes basic information generation means 11, master secret information generation means 12B, master secret information transmission means 13B, public key generation means 14B, and public key transmission means 15. ing. The basic information generation unit 11 and the public key transmission unit 15 have the same configuration as that of the encrypted information generation server 10 described with reference to FIG.

The master secret information generation unit 12B generates master secret information used when generating a user secret key in the secret key generation server 20B.
Specifically, the master secret information generating unit 12B _{is, 1 ≦ x 1,0, x 1,1} <p 1, ..., 1 ≦ x m, 0, x m, 1 <2m pieces the number of which is a _{p m} x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} and β satisfying 1 ≦ β <n are selected at random, and the secret information master = (p ₁ ,..., p _{m 1} , x ₁ , ₀ , x ₁ , ₁ ,..., x _{m, 0} , x _{m, 1} , β).

Further, the master secret information generation unit 12B generates the generation sources g ₁ ,..., G _m generated by the basic information generation unit 11 and x _1,0 , x _{1,1,. From m, 0} , xm _{, 1} , a parameter (public parameter) param for generating a user secret key or public key is generated by the above equation (1), and a master secret key msk is generated by g ^β ( msk = g ^β) to.

That is, the master secret information generation unit 12B generates the master secret key msk (= g ^β ) by calculating the β power (power) of the combined element g, and the generation source (g ₁ ,..., G _m ) _Are respectively exponentiated with the values of x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} which are part of the secret information, thereby generating the public parameter param. This public parameter is information that is disclosed to the secret key generation server 20B in addition to the public information.

Then, the master secret information generating unit 12B outputs the generated secret information master, master secret key msk, and public parameter param to the master secret information transmitting unit 13 as master secret information.
Further, the master secret information generating unit 12B outputs the generated public parameter param and secret information master to the public key generating unit 14.

  The master secret information transmission unit 13B transmits the master secret information generated by the master secret information generation unit 12B to the secret key generation server 20B via the intranet 3. That is, the master secret information transmission unit 13B transmits the master secret key msk, the public parameter param, and the secret information master generated by the master secret information generation unit 12B to the secret key generation server 20B.

  The public key generation unit 14B generates a public key (Trator Tracing public key) for generating a header (content distribution header) to be combined with distribution content in the content distribution server 40.

Here, the public key generation unit 14B is configured to input the positive integer m input by the basic information generation unit 11 and the prime numbers p ₁ , p ₂ ,..., P _m generated by the basic information generation unit 11 and the generation sources g ₁ , g ₂ ,..., g _m and a bilinear map e (•, •), a public parameter param generated by the master secret information generating means 12 (see the above equation (1)), and β which is a part of the secret information, the following (10) published by the formula key _{PK = (E 1, E 2} , ..., E m, G 1, G 2, on the basis of _{..., G m, H 1,0,} H 2,0, ..., H _{m, 0} , H _1,1 , H _2,1 ,..., H _{m, 1} ) are generated.

  Then, the public key generation unit 14B outputs the generated public key PK to the public key transmission unit 15.

By configuring the encryption information generation server 10B in this way, the encryption information generation server 10B transmits the master secret information (secret information, master secret key, and public parameters) to the secret key generation server 20B, and the public key is It transmits to the content server 30.
The encrypted information generation server 10B can be realized by a general computer having a CPU and a memory (not shown). At this time, the encryption information generation server 10B operates by an encryption information generation program that causes the computer to function as each of the above-described means.

(Configuration of secret key generation server)
Next, the configuration of the secret key generation server 20B will be described with reference to FIG. 15 (see FIG. 13 as appropriate). Here, the secret key generation server 20B includes a master secret information reception unit 21B, a master secret information storage unit 22B, a user secret key generation unit 23B, and a user secret key output unit 24. The user secret key output unit 24 has the same configuration as the secret key generation server 20 described with reference to FIG.

  The master secret information receiving unit 21B receives the master secret key msk, which is the master secret information generated by the encrypted information generation server 10B, the public information (including the public parameter param), and the secret information master via the intranet 3. To do. The master secret key, the public information (including the public parameter param), and the secret information received by the master secret information receiving unit 21B are stored in the master secret information storage unit 22B.

  The master secret information storage unit 22B stores the master secret key, public information (including the public parameter param) received by the master secret information reception unit 21B, and secret information, and is a general storage device such as a hard disk. . The master secret key, the public parameter (public information), and the secret information stored in the master secret information storage unit 22 are read by the user secret key generation unit 23B.

The user secret key generation unit 23B generates a user-specific secret key (user secret key) from a value for identifying the user (for example, user-specific user identifier [v]).
Here, the user secret key generation unit 23B is configured to include β, which is a part of the secret information master stored in the master secret information storage unit 22, the master secret key msk (= g ^β ), and public information (public parameter param ( (See formula (1))), user identifier v, and Z _n ^* (= {1, 2,..., N−1}) (where n is the number of composites acquired as public information). and a random number _{r v,} generates a user private key _{d v} by the following equation (11).

In this equation (11), the user identifier v is input via input means not shown. The user identifier v is data having a bit length of a positive integer m input to the basic information generation unit 11 (see FIG. 14) of the encrypted information generation server 10B. Further, v _i represents the bit value of the i-th bit (1 ≦ i ≦ m) when the user identifier v is represented by a bit string.

Here, the user identifier v is included in the user secret key, but the user identifier v does not necessarily have to be secret information. Therefore, the user secret key generation unit 23B may generate the user secret key _{dv according} to the following equation (12).

The user secret key generated by the user secret key generation unit 23B is output to the user secret key output unit 24.
By configuring the secret key generation server 20B in this way, the secret key generation server 20B can generate a user secret key distributed to the user terminal 50B.

  The secret key generation server 20B can be realized by a general computer equipped with a CPU and a memory (not shown). At this time, the secret key generation server 20B is operated by a secret key generation program that causes the computer to function as each of the means described above.

(User terminal configuration)
Next, the configuration of the user terminal 50B will be described with reference to FIG. 16 (see FIG. 13 as appropriate). Here, the user terminal 50B includes a distribution content request unit 51, a distribution content reception unit 52, a separation unit 53, a secret key storage unit 54, an encryption key decryption unit 55B, a content decryption unit 56, It has. The configuration other than the encryption key decryption unit 55B is the same as that of the user terminal 50 described with reference to FIG.

The encryption key decryption unit 55B decrypts and extracts the encryption key from the content distribution header separated by the separation unit 53 based on the user secret key stored in the secret key storage unit 54. The decrypted encryption key is output to the content decrypting means 56.
In this encryption key decryption means 55B, the user secret key stored in the secret key storage means 54 is d _v (= formula (11)) = (v, d _{v, 1} , d _{v, 2} ), separation When the content distribution header separated by the means 53 is C (= the above formula (5)) = (j, C ₁ , C ₂ , C ₃ , C ₄ ), the encryption key Ks is expressed as (13 ) Note that the bilinear map e used here is acquired in advance as public information through the same route as the distribution content, and is stored in a storage unit (not shown).

Here, v is user-specific information (user identifier). Further, in this equation (6), when the value of the j-th bit of v is “0”, Ks = C ₁ e (d _{v, 2} , C ₃ ) / e (d _{v, 1} , C ₂ ), v When the value of the j-th bit is “1”, Ks = C ₁ e (d _{v, 2} , C ₄ ) / e (d _{v, 1} , C ₂ ) is indicated.
The right side of the equation (13) is encrypted by the modification shown in the following equation (14) based on the equations (5), (10) and (11), and the property of the bilinear map e. It can be proved that the key Ks is indicated.

It should be noted that the transformation of the second to fourth modified expressions in the expression (14) is made by utilizing the property of e (g ₁ ... G _j−1 g _{j + 1} ... G _m , g _j ) = 1 possessed by the bilinear map e. It is carried out.
Further, using the property that e (g ₁ ^α , g ₂ ^β ) = e (g ₁ , g ₂ ) ^αβ possessed by the bilinear map e, the fourth modified expression in the expression (14) is modified. ing.

  By configuring the user terminal 50B as described above, the user terminal 50B must use user-specific information (user ID) when decrypting the encryption key Ks. As a result, even when a certain user creates an unauthorized user terminal using a private key owned by the user, the unauthorized user terminal must include the owner's ID and secret key. Therefore, the user who created the unauthorized user terminal can be easily identified.

  The user terminal 50B can be realized by a general computer having a CPU and a memory (not shown). At this time, the user terminal 50 operates by a content decryption program that causes the computer to function as each of the means described above.

[Operation of content distribution system]
The basic operation of the content distribution system 1B according to the second embodiment is the same as the operation described with reference to FIGS. However, the generated master secret key, public key, and user secret key are different. Therefore, only the part (public key / user secret key generation operation) different from the operation of the first embodiment will be described here.

(Public key / user secret key generation operation)
In contrast to the public key / user secret key generation operation of the content distribution system 1 of the first embodiment shown in FIG. 8, the public key / user secret key generation operation of the content distribution system 1B of the second embodiment includes steps S13 and S13. Only S15 and step S18 are different.

That is, in step S13, the encrypted information generation server 10B described with reference to FIG. 14 includes the element g and the generation sources g ₁ ,..., G _m synthesized by the master secret information generation unit 12B and a part of the secret information. A public parameter param that is a parameter for generating a user secret key and a public key from a certain x _1,0 , x _1,1 ,..., X _{m, 0} , x _{m, 1} (see the above formula (1)) and, a master secret key msk (= g ^β), is generated as the master secret information.

Also, the encrypted information generation server 10B, in step S15, the positive integer m input in step S10 by the public key generation means 14, and the prime numbers p ₁ , p ₂ ,..., P _m generated in step S10. , origin _g 1 generated in step _S11, g 2, ..., and _{g m,} and the public parameter param generated in step S13, on the basis of the β is a part of the secret information, the public key PK (the (See equation (10)).

Further, in step S18, the secret key generation server 20B described with reference to FIG. 15 performs the master secret key msk, the public parameter param, and the secret information stored in the master secret information storage unit 22B by the user secret key generation unit 23B. a master, a user identifier v, previously ^{_{Z n * (= {1,2,}} ..., n-1}) and a selected random number _{r v} from, by the equation (11), user private key for each user _{d v} Is generated.

As described above, the content distribution systems 1 and 1B set the number of elements of the user secret key that can be a fixed number and the number of elements of the content distribution header that becomes ciphertext as a fixed number. It is possible to generate a public key that can be used.
Thereby, the content distribution systems 1 and 1B can reduce the data amount of the secret key held in the user terminals (content decryption devices) 50 and 50B. In addition, even when content is distributed all at once, since the number of elements of the content distribution header that is the ciphertext is a fixed number, the amount of data can be suppressed and the load on the network can be reduced.

1 Content Distribution System 10 Encrypted Information Generation Server (Encrypted Information Generation Device)
DESCRIPTION OF SYMBOLS 11 Basic information generation means 12 Master secret information generation means 13 Master secret information transmission means 14 Public key generation means 15 Public key transmission means 20 Secret key generation server (secret key generation apparatus)
21 Master Secret Information Receiving Unit 22 Master Secret Information Storage Unit 23 User Secret Key Generation Unit 24 User Secret Key Output Unit 30 Content Server (Distribution Content Generation Device)
Reference Signs List 31 Encryption key generation means 32 Public key reception means 33 Header generation means 34 Content reception means 35 Content encryption means 36 Header composition means 37 Distribution content storage means 38 Content request reception means 39 Distribution content transmission means 40 Content distribution server 41 User request reception means 42 Content request transmission means 43 Distribution content reception means 44 Distribution content transmission means 50 User terminal (content decryption apparatus)
51 Distribution Content Requesting Unit 52 Distribution Content Receiving Unit 53 Separation Unit 54 Secret Key Storage Unit 55 Encryption Key Decryption Unit 56 Content Decryption Unit 90 Unauthorized User Tracking Server (User Identification Device)
91 public information storage means 92 content storage means 93 test data generation means 94 test data transmission means 95 decrypted data reception means 96 user identifier specification means 97 user information storage means (database)
98 User search means

Claims (10)

Encrypted information generating device for generating master secret information for generating a user secret key distributed to a content decrypting device and a public key corresponding to the user secret key in a content distribution system for encrypting and distributing content Because
For the input positive integer m, as basic information, m prime numbers (p ₁ ,..., P _m ), m generators (g ₁ ,..., G _m ), and a composite number n ( n = p ₁ ... p _m ) and the element g (g = g ₁ ... g _m ) obtained by combining the generation sources, the order of the combination number n, and the combined element g as the generation source. identify the bilinear mapping e to the group _{G T} from the group G to the public information _{(n, g, g 1,} ..., g m, e, G, G T) and the basic information generating means for generating,
1 ≦ x _1,0 , x _1,1 <p ₁ ,..., 1 ≦ x _{m, 0} , x _{m, 1} <p _m according to the composite number n generated by the basic information generating means _{, 0} , x _1,1 ,..., X _{m, 0} , x _{m, 1} and α, β where 1 ≦ α, β <n are selected, and secret information (p _{1 ,.} x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} , α, β), and g ^αβ is calculated as the master secret information to generate a master secret key msk. Along with the parameter param

Master secret information generating means generated by
The parameter param generated by the master secret information generating means, the generation source (g ₁ ,..., G _m ), the bilinear map e, and the secret information (p ₁ ,..., P _m , x _{1, 0} , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α, β) and the public key PK

Public key generation means generated by
An encrypted information generating apparatus comprising: In a content distribution system that encrypts and distributes content, a computer is generated to generate master secret information for generating a user secret key distributed to the content decryption apparatus and a public key corresponding to the user secret key. ,
For the input positive integer m, as basic information, m prime numbers (p ₁ ,..., P _m ), m generators (g ₁ ,..., G _m ), and a composite number n ( n = p ₁ ... p _m ) and the element g (g = g ₁ ... g _m ) obtained by combining the generation sources, the order of the combination number n, and the combined element g as the generation source. identify the bilinear mapping e to the group _{G T} from the group G to the public information _{(n, g, g 1,} ..., g m, e, G, G T) basic information generating means for generating,
1 ≦ x _1,0 , x _1,1 <p ₁ ,..., 1 ≦ x _{m, 0} , x _{m, 1} <p _m according to the composite number n generated by the basic information generating means _{, 0} , x _1,1 ,..., X _{m, 0} , x _{m, 1} and α, β where 1 ≦ α, β <n are selected, and secret information (p ₁ ,..., P _m , x _1,0 , x _1,1 ,..., x _{m, 0} , x _{m, 1} , α, β), and g ^αβ is calculated as the master secret information to generate a master secret key msk. Along with the parameter param

Master secret information generating means generated by
The parameter param generated by the master secret information generating means, the generation source (g ₁ ,..., G _m ), the bilinear map e, and the secret information (p ₁ ,..., P _m , x _{1, 0} , x _1,1 ,..., X _{m, 0} , x _{m, 1} , α, β) and the public key PK

Public key generation means generated by
An encryption information generation program characterized by causing it to function as: A secret key generation device for generating a user secret key to be distributed to a content decryption device based on the master secret information generated by the encryption information generation device according to claim 1 in a content distribution system for encrypting and distributing content Because
The public information generated by the encrypted information generating device, the parameter param that is a part of the master secret information generated by the encrypted information generating device, and the master secret key that is a part of the master secret information From at least msk, a user identifier v for identifying the user, and a random number r _v selected in advance from Z _n ^* ,

And the user secret key generation means for generating a user secret key d _v that includes,
User secret key output means for outputting the user secret key _dv generated by the user secret key generation means;
A secret key generation device comprising: In a content distribution system for encrypting and distributing content, a computer for generating a user secret key to be distributed to the content decryption device based on the master secret information generated by the encrypted information generation device according to claim 1 The
The public information generated by the encrypted information generating device, the parameter param that is a part of the master secret information generated by the encrypted information generating device, and the master secret key that is a part of the master secret information From at least msk, a user identifier v for identifying the user, and a random number r _v selected in advance from Z _n ^* ,

User secret key generation means for generating a user secret key d _v that includes,
User secret key output means for outputting the user secret key _dv generated by the user secret key generation means;
A secret key generation program characterized by functioning as In a content distribution system for encrypting and distributing content, a distribution content generation device for generating distribution content based on the public key PK generated by the encrypted information generation device according to claim 1,
Encryption key generation means for generating an encryption key Ks for encrypting the content;
A content encryption unit that encrypts the content with the encryption key Ks generated by the encryption key generation unit and generates an encrypted content;
The public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation means, the public key PK, and a random number t selected in advance from Z _n ^* and 1 ≦ j ≦ a content delivery header C to be synthesized with the encrypted content based on the index j selected from m,

Header generating means generated by
A header synthesizing unit that generates the distribution content by synthesizing the content distribution header C generated by the header generation unit and the encrypted content;
A content generating apparatus for distribution, comprising: In a content distribution system for encrypting and distributing content, in order to generate content for distribution based on the public key PK generated by the encrypted information generation device according to claim 1, a computer is provided.
An encryption key generating means for generating an encryption key Ks for encrypting the content;
A content encryption unit that encrypts the content with the encryption key Ks generated by the encryption key generation unit and generates an encrypted content;
The public information generated by the encryption information generation device, the encryption key Ks generated by the encryption key generation means, the public key PK, and a random number t selected in advance from Z _n ^* and 1 ≦ j ≦ a content delivery header C to be synthesized with the encrypted content based on the index j selected from m,

Header generating means generated by
Header synthesizing means for generating the distribution content by synthesizing the content distribution header C generated by the header generation means and the encrypted content;
A content generation program for distribution, characterized in that it is made to function as: In the content distribution system for encrypting and distributing content, the distribution content generated by the distribution content generation device according to claim 5 is the user secret key d generated by the secret key generation device according to claim 3. A content decrypting device for decrypting based on _v ,
Separating means for separating the content for distribution into the content distribution header C and the encrypted content;
The content distribution header C separated by this separation means is (j, C ₁ , C ₂ , C ₃ , C ₄ ), and the user secret key d _v is (d _{v, 1} , d) for the user identifier v. _{v, 2} ), the cipher used for encrypting the content using the bilinear map e specified by the encryption information generating device according to claim 1 and published as public information S key Ks

Encryption key decryption means for decrypting by
Content decrypting means for decrypting the encrypted content with the encryption key Ks decrypted by the encryption key decrypting means;
A content decryption apparatus comprising: In the content distribution system for encrypting and distributing content, the distribution content generated by the distribution content generation device according to claim 5 is the user secret key d generated by the secret key generation device according to claim 3. to decrypt based on _v ,
Separating means for separating the content for distribution into the content distribution header C and the encrypted content;
The content distribution header C separated by this separation means is (j, C ₁ , C ₂ , C ₃ , C ₄ ), and the user secret key d _v is (d _{v, 1} , d) for the user identifier v. _{v, 2} ), the cipher used for encrypting the content using the bilinear map e specified by the encryption information generating device according to claim 1 and published as public information S key Ks

Encryption key decryption means for decryption by
Content decrypting means for decrypting the encrypted content with the encryption key Ks decrypted by the encryption key decrypting means;
A content decryption program that is allowed to function as: In the content distribution system for distributing encrypted content from the content decrypting apparatus of claim 7 incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3, the user's private key A user identification device for identifying a corresponding user,
2 selected from the encryption key Ks, the public information and the public key generated by the encrypted information generation apparatus according to claim 1, and Z _n ^* specified by the composite number n, which is one of the public information. Based on two different random numbers t and t ′, as a test content delivery header,

Generating test data for testing the j-th bit of the user identifier by synthesizing the test content with the encrypted content encrypted with the encryption key Ks;
Test data transmission means for transmitting the test data generated by the test data generation means to the content decryption device;
Decrypted data receiving means for receiving the content decrypted by the test data from the content decrypting device;
The content received by the decoded data receiving means and the test content are compared for all j of 1 ≦ j ≦ m, and based on whether the comparison result matches, j bits of the user identifier A user identifier specifying means for specifying an eye value;
User search means for searching for user information corresponding to the user identifier specified by the user identifier specifying means from a database in which the user identifier and user information for specifying the user are associated in advance;
A user specifying device comprising: In the content distribution system for distributing encrypted content from the content decrypting apparatus of claim 7 incorporating a user private key d _v generated by the secret key generating apparatus according to claim 3, the user's private key In order to identify the corresponding user,
2 selected from the encryption key Ks, the public information and the public key generated by the encrypted information generation apparatus according to claim 1, and Z _n ^* specified by the composite number n, which is one of the public information. Based on two different random numbers t and t ′, as a test content delivery header,

Generating test data for testing the j-th bit of the user identifier by synthesizing the test content with the encrypted content encrypted with the encryption key Ks,
Test data transmitting means for transmitting the test data generated by the test data generating means to the content decrypting device;
Decrypted data receiving means for receiving the content decrypted by the test data from the content decrypting device;
The content received by the decoded data receiving means and the test content are compared for all j of 1 ≦ j ≦ m, and based on whether the comparison result matches, j bits of the user identifier A user identifier specifying means for specifying an eye value;
User search means for searching for user information corresponding to the user identifier specified by the user identifier specifying means from a database in which the user identifier and user information for specifying the user are associated in advance;
A user-specific program that functions as:

Images