JPH10112690A - Limited multi-address cipher communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a limited multi-address cipher communication method suitable in the case of making a transmitter arbitrarily multi-address transmit chargeable data, making a receiver select required data from them and performing charging for the selected data. SOLUTION: For the purpose of making key delivery data multi-address transmitted by a broadcasting station side equipment 100 small, the secret information of the receiver is prepared corresponding to the partial set of a certain finite set. After authenticating identity by proving that the secret information is possessed to a server 300 by using a receiver side equipment 200, the receiver obtains information for decoding multi-address data from the server 300 and prepares the decoding key of the multi-address data from the key delivery data in the multi-address data, the secret information of the receiver himself/ herself and the information obtained from the server 300. The receiver prevents a key from being put on the black market by performing key management by which the receiver who can not decode the multi-address data can not calculate the key for decoding the data by himself/herself as long as the secret information of himself/herself is not told to the receiver who can not decode the multi-address data.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a limited broadcast encryption communication method in which a sender encrypts transmission data and transmits it by broadcast communication, and only a limited receiver can decrypt the transmission data.

[0002]

2. Description of the Related Art To date, several methods have been proposed for a broadcast encryption communication method.

[0003] For example, the document "SJKent: Security requir
ement and protosols for a broadcast scenario, IEEE
Trans. Commun., COM-29, 6, pp. 778-786 (1981) ". This copy key method is a conventional one.
This is a simple extension of one-to-one encrypted individual communication to broadcast communication. That is, a copy of one type of key is delivered to the sender and a plurality of authorized recipients. The sender encrypts using the copy key and transmits. Then, the authorized recipient decrypts the data using the same copy key.

[0004] In addition, a document "Koyama: Encryption method of broadcast communication using master key, IEICE (D), J65-D, 9, pp. 15
51-1158 (1982) ”, a broadcast encryption communication method using the RSA master key for individual key substitution, or a literature“ Li, Tokiwa et al .: Broadcast communication using multiplexing / demultiplexing method, 1986 ” A method of multiplexing and demultiplexing information sequences using the Chinese remainder theorem described in "Cryptography and Information Security Symposium."

[0005] The following briefly describes a method of multiplexing / demultiplexing information sequences using the Chinese remainder theorem.

(1) Key generation processing: recipient i (1 ≦ i ≦ r)
, R disjoint integers g ₁ , g ₂ ,..., G _r and
Generate shared keys K ₁ , K ₂ ,..., K _r in the secret key cryptography, and use g _i , K
_i is distributed to the receiver i in advance as the secret information of the receiver i.

(2) Encryption processing: r information sequences to be multiplexed are defined as M ₁ , M ₂ ,..., M _r . The sender sends M ₁ , M ₂ ,…, M _r
Using K _i (in secret key cryptography), C _i = E (K _i : M _i ), i = 1,.

[0008]

(Equation 20)

And F is broadcast. However,
G, G _i , A _i are

[0010]

(Equation 21)

Is the smallest integer A _i .

(3) Decoding process: The receiver i receives F from g _i
Using, with C _i = F mod g _i a C _i are separated by, C _i share M _i from the key K _i (in secret key _{cryptography), M i = D (K} i: C i) To decrypt.

In these methods, a set of receivable recipients is limited in advance on the sender side, and broadcast encrypted communication data is created based on the set.

On the other hand, in recent years, as represented by pay television, the sender broadcasts paid data without paying attention to a set of receivable receivers in advance, and pays for the paid data. There is a growing need for a limited broadcast encryption communication system that can only decrypt and charge for recipients who have agreed to pay.

At present, in pay television by satellite digital broadcasting, the receiver has an IC card, stores the viewing record of the receiver in the IC card, and collects the viewing record at regular intervals using a telephone line. You are charging.

[0016]

SUMMARY OF THE INVENTION As described in the "prior art" described above, in a method of recording the viewing information of a recipient in an IC card, an unauthorized recipient cannot obtain secret information or information inside the IC card. There is a possibility that the viewing record is taken out and the confidential information is circulated to another person, or the viewing record is tampered with for convenience.

Therefore, a main object of the present invention is that the sender can arbitrarily broadcast the paid data, and the receiver can select necessary data from the data and charge the selected data. A limited broadcast encryption communication method, which (1) places security on an algorithm without placing security grounds on hardware possessed by a receiver.

(2) Even when the number of recipients is large,
Transmission data for key distribution can be reduced.

(3) The decryption of the data decryption key by an unauthorized recipient can be prevented.

(4) When the set of recipients is large and the set of recipients performing limited broadcast changes frequently,
The sender can efficiently and safely perform the broadcast without being aware of the set of recipients who perform the limited broadcast.

(5) When the broadcast transmission data is charged,
Reliable billing for recipients is possible.

The present invention provides a method characterized by the above.

[0023]

SUMMARY OF THE INVENTION In order to achieve the above object, the present invention aims to reduce the transmission data for key distribution, so that each receiver corresponds to a subset of a certain finite set. Create confidential information. Furthermore, in order to charge the broadcast data efficiently and safely, after performing authentication processing using the given secret information of the receiver, the transmission data is decrypted only once for each transmission data. Get the information to do. Here, the server cannot know the secret information of the recipient.

The receiver creates a decryption key from its own private key, information obtained from the server and broadcast data, and decrypts the transmission data. At this time, unless the receiver circulates his / her private key, the receiver who is not qualified to receive the data cannot calculate the data encryption key that is frequently changed.

An example of a concrete realizing method will be described below. As a preparatory process, a broadcasting station that distributes information by broadcasting, as the secret information of the broadcasting station,

[0026]

(Equation 22)

And as public information of the broadcasting station,

[0028]

(Equation 23)

Is made public.

Further, the broadcasting station sets different σ for each receiver i.
Choose ∈S ',

[0031]

(Equation 24)

For s _{i, σ} ,

[0033]

(Equation 25)

Is distributed as secret information. Here, the set S = {σ | one-to-one mapping σ: A = {1, 2,..., K} → B =
{1, 2,..., M}, 1 ≦ k ≦ m} and σ ₁ , σ ₂ εS
, A relationship on S is defined as σ ₁ to σ ₂ ⇔σ ₁ (A) = σ ₂ (A), and a quotient set of S is defined as S ′.

As the data encryption / decryption processing, (1) The broadcasting station randomly selects integers t, t 'satisfying 0 ≦ t, t ′ ≦ L, and sets the data encryption key K as public information (secret information). Using the key generation function f (of key encryption),

[0036]

(Equation 26)

Calculated by

[0038]

[Equation 27]

The ciphertext C = E (K: P) obtained by encrypting the data P with the key K (by secret key encryption) is broadcast.

(2) The receiver i has the set R
_The server S _i corresponding to _i is accessed and authentication is performed by proving possession of the secret information x _i, and if the authentication is established, the server S _i provides the receiver i with:

[0041]

[Equation 28]

Is transmitted.

(3) The recipient i is

[0044]

(Equation 29)

Then, the data encryption key K is calculated, and the data P is decrypted from the ciphertext C. Where gcd (x, y), lcm (x,
y) represents the least common multiple and the greatest common divisor of the integers x and y, respectively, and ord _p (g) represents the order of the integer g in the remainder field Z _{p with} respect to the prime number p. [X ₁ , ..., x _n ] represents data obtained by multiplexing integers x ₁ , ..., x _n , and [x ₁ mod L, ..., x _n mod L] is simply expressed as
[x ₁ , ..., x _n ] mod L.

[0046]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Here, an example in which the limited broadcast encryption communication method of the present invention is applied to an information distribution service system using satellite broadcasting will be described. That is,
The broadcasting station broadcasts and encrypts information such as multimedia information (including paid data) to the receiver using a satellite.
Only recipients who are eligible for viewing (or who have agreed to pay) can decrypt the transmitted data.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram showing a system configuration of an embodiment of the present invention. This system includes a broadcasting station-side device 100, a receiver-side device 200, and a server 300.

FIG. 2 is a diagram showing the internal configuration of the broadcast station apparatus 100 and the flow of processing in the embodiment. The broadcast station side device 100 includes a random number generator 101, a prime number generator 102, an arithmetic unit 10
3, a power multiplier 104, a remainder arithmetic unit 105, a key generator 106, an encryption / decryption device 107, and a communication device 108.

FIG. 3 is a diagram showing the internal configuration of the receiver apparatus 200 and the flow of processing in the embodiment. The receiver device 200 includes a memory 201, a power multiplier 202, a remainder arithmetic unit 203,
Arithmetic device 204, authentication device 205, communication device 206, key generator 20
7. An encryption / decryption device 208 and an IC card connection device 209 are provided.

FIG. 4 is a diagram showing the internal configuration of the server 300 and the flow of processing in the embodiment. The server 300 includes a communication device 301, an encryption / decryption device 302, a memory 303, and an authentication device 30.
4, a billing device 305.

FIG. 5 is a diagram showing the internal configuration of the IC card 400 possessed by the receiver in the fourth embodiment. IC card 4
00 includes a memory 401, a power multiplier 402, a remainder arithmetic unit 403, and an authentication information creation device 404.

FIG. 6 is a diagram showing an outline of an embodiment of the present invention.

FIG. 7 is a diagram showing a request calculation method according to the fourth embodiment of the present invention.

[Explanation of Symbols] Z represents a set of whole integers. gcd (a, b) and lcm (a, b) represent the greatest common divisor and the least common multiple of the integers a and b, respectively. Also, for a prime number p and a positive integer g, ord _p (g) = m indicates that the minimum integer x> 0 that satisfies g ^x ≡1 (mod p) is m. [X ₁ , ..., x _n ] is an integer
x ₁ , ..., x _n represents data multiplexed by a method such as the multiplexing by the Chinese remainder theorem described in the section of "Conventional Technology", and [x ₁ mod L, ..., x _n mod L ] Is simply [x ₁ ,…, x _n ] mod
Expressed as L.

(Embodiment 1) In Embodiment 1, a limited broadcast encryption communication method suitable for a case where the set of all receivers is relatively small will be described.

FIG. 1 shows the system configuration of this embodiment. The set of receivers R is given by R = _Λ for the subset family {R _λ } _λ ∈ _Λ .
_λ ∈ _Λ R _λ , and the server corresponding to each subset R _λ
S _λ is installed.

1. Preparation Process The broadcast station uses the random number generation device 101, the prime number generation device 102, the arithmetic device 103, and the remainder arithmetic unit 105 in the broadcast station side device 100,
Create the following information and publish only the public information.

Secret information:

[0060]

[Equation 30]

Public information:

[0062]

(Equation 31)

Further, the broadcast station uses the arithmetic unit 103, the power multiplier 104, and the remainder arithmetic unit 105 in the broadcast station side apparatus 100 for the receiver i,

[0064]

(Equation 32)

For s _i ,

[0066]

[Equation 33]

Then, x _i is distributed as secret information of the receiver i.

2. Encryption / Decryption Processing The broadcasting station randomly selects integers t and t ′ satisfying 0 ≦ t, t ′ ≦ L using a random number generation device 101 in the broadcasting station side device 100, and performs a power multiplier 104 and a remainder operation unit 105. , [Z ₁ ,... Z _m ] using the key generator 106,

[0069]

(Equation 34)

The cipher text C = E (K: P) obtained by encrypting the data P with the key K using the encryption / decryption device 107, and [z
_1, broadcasts using a ... z _m] the communication device 108. Where f
Is a public key generation function of the secret key cryptosystem.

Further, the broadcast station uses the arithmetic unit 103 and the remainder arithmetic unit 105 in the broadcast station side apparatus 100 for each λ∈Λ.

[0072]

(Equation 35)

Then, V _{λ is set} to the broadcast station and the server 300.
(S _lambda) encryption and decryption in advance shared with me key K (S _λ) between device 1
The ciphertext C _λ = E (K (S _λ ): V _λ ) encrypted using 07 is transmitted to the server 300 (S _λ ) using the communication device 108.

The recipient i accesses the server 300 in the area to which the recipient belongs to view the data P by using the communication device 205 in the recipient device 200, and the authentication device in the recipient device 200. Authentication is performed by using 204 (the server 300 uses the authentication device 304) to prove possession of the secret information xi. If authentication is successful, server 300
The u _i = t '/ s _i mod L, in 03, is transmitted to the receiver-side apparatus 200 of the receiver i using the communication device 301.

At this time, if the data P is charged, the server 300 charges the receiver i using the charging device 305.

The receiver device 200 of the receiver i has the memory 201
From x _{i in} , power multiplier 202, remainder operator 203, key generator
Using 206,

[0077]

[Equation 36]

Then, the data encryption key K is calculated, and the data P is decrypted from the ciphertext C using the encryption / decryption device 207.

In (2) of the encryption / decryption processing, the receiver i
A method of authenticating with respect to the server 300 may be based on a conventionally known authentication method as long as the authentication is not established unless the user knows x _i .

Hereinafter, a method using a signature by RSA will be described as an example of an authentication method performed by the receiver i with respect to the server.

The broadcast station sets x _i y _i ≡1 (mod lcm (p _i -1, q _i -1)), _ni = p _i q _i (p _i , q _i ) for each receiver _i. : Prime number) The server 300 in the area to which the recipient belongs (y _i , _ni )
Distribute to

The receiver i uses the authentication device 204 in the receiver-side device 200 to transmit the broadcast data [z ₁ ,..., Z _m ] to the one-way hash function Using h, a signature for h ([z ₁ ,..., z _m ]) (0 <h ([z ₁ ,..., z _m ]) <n _i ) is obtained using a secret key x _i .

[0083]

(37)

Then, the data is created and transmitted to the server 300 using the communication device 205 together with the data name desired to be viewed.

(2) The server 300 uses the authentication device 304 to

[0086]

(38)

If the test is successful, u _i becomes the memory 303.
Is transmitted to the receiver-side device 200 of the receiver i using the communication device 301. At this time, if the data that the receiver wants to view is paid, the server 300 charges the receiver i using the charging device 305. Furthermore, the recipient is in possession of mounted IC card 400 of the secret information x _i, the receiver side apparatus 200 I
Connect to C card connecting device 208, in the case of obtaining the data from the broadcasting station, the receiver is calculated using the secret information x _i performed by using the authentication information creation unit 404 in the IC card 400.

For example, in the above example, sgn _i (h ([z ₁ ,.
z _m ])) is calculated by the authentication information creation device 404 in the IC card 400.
This is performed using

(Embodiment 2) In Embodiment 2, a limited broadcast encryption communication method suitable for a case where the set of all recipients is large will be described.

FIG. 1 shows the system configuration of this embodiment. The set of receivers R is given by R = _∈Λ for the subset family {R _λ } _λ∈Λ .
_{λ ∈Λ} R _λ , and the server corresponds to each subset R _λ.
S _λ is installed.

1. Preparation Process The broadcast station uses the random number generation device 101, the prime number generation device 102, the arithmetic device 103, and the remainder arithmetic unit 105 in the broadcast station side device 100,
Create the following information and publish only the public information.

Secret information:

[0093]

[Equation 39]

Public information:

[0095]

(Equation 40)

Further, the broadcasting station sets different σ for each receiver i.
∈S ′ is selected, and using the arithmetic unit 103, the power multiplier 104, and the remainder arithmetic unit 105 in the broadcast station side apparatus 100,

[0097]

[Equation 41]

For s _{i, σ} ,

[0099]

(Equation 42)

Then, x _i is distributed as secret information of the receiver i. Where the set S = ｛σ | one-to-one mapping σ: A =
{1,2, ..., k} → B = {1,2, ..., m}, 1 ≦ k
For ≦ m｝ and σ ₁ , σ ₂ ∈S, the relation on S is defined as σ ₁ σσ ₂ ⇔σ ₁ (A) = σ ₂ (A), and the quotient set of S Is S ′.

2. Encryption / decryption processing (see FIG. 6) (1) The broadcasting station randomly selects integers t and t 'satisfying 0 ≦ t, t ′ ≦ L using a random number generator 101 in the broadcasting station side device 100,
To the multiplier 104, the remainder calculator 105, using the key generator 106, data encryption key K, _{and, [z 1, ..., z} m] a,

[0102]

[Equation 43]

[0103] calculated in the dark using the decoding apparatus 107 encrypts the data P with the key K ciphertext C = E (K: P) , _{and, [z 1, ..., z} m] a communication device It broadcasts using 108.

Further, the broadcast station uses the arithmetic unit 103 and the remainder arithmetic unit 105 in the broadcast station side apparatus 100 for each λ∈Λ to obtain V _λ = {(i, u _i ) | u _i = t ′. / s _i mod L, i∈R _λ }, and encrypts V _λ with the key K (S _λ ) shared in advance between the broadcast station and the server 300 (S _λ ) using the encryption / decryption device 107. The encrypted cipher text C _λ = E (K (S _λ ): V _λ ) is transmitted to the server 300 (S _λ ) using the communication device 108.

The receiver i accesses the server 300 located in the area to which the receiver belongs in order to see the data P by using the communication device 205 in the receiver device 200, and the authentication device in the receiver device 200. 204 using (server 300 using the authentication device 304) performs authentication by demonstrating that possession of secret information x _i. If authentication is successful, server 300
The u _i = t '/ s _i mod L, in 03, is transmitted to the receiver-side apparatus 200 of the receiver i using the communication device 301.

At this time, if the data P is charged, the server 300 charges the receiver i using the charging device 305.

The receiver device 200 of the receiver i is stored in the memory 201
Power multiplier 202, remainder operation unit 203, key generator from xi in
Using 206,

[0108]

[Equation 44]

Then, the data encryption key K is calculated, and the data P is decrypted from the ciphertext C using the encryption / decryption device 207.

In the encryption / decryption process (2), the method by which the receiver i authenticates to the server 300 is conventionally known as long as the authentication is not established unless the user knows x _i . It suffices to depend on the authentication method (a specific example is the same as in the first embodiment).

At this time, if the data that the receiver i desires to view is paid, the server 300 charges the receiver i using the charging device 305.

(Embodiment 3) In Embodiments 1 and 2, the value of t of the data encryption key K = f (g ^{tt '} mod n) is changed for each short time period, whereby the data encryption key K is changed. Update.

Further, by setting the value of t 'to a value unique to the transmission data, the transmission data to be broadcast by the broadcasting station is identified. That is, the information u _i obtained from the server 300 for the receiver i to view a certain broadcast data is unique to the broadcast data information, and the information is received from the server 300 to view another broadcast data. Need to get another u _i '. Thereby, the broadcast data to be charged is identified.

(Embodiment 4) This embodiment is different from the embodiment 2 in that the receiver holds the IC card 400 and the receiver device 200
To obtain data from a broadcasting station, the receiver i in step (3) of the encryption / decryption process of the second embodiment.

[0115]

[Equation 44]

A request calculation method for efficiently performing the above calculation will be described (see FIG. 7).

The receiver-side apparatus 200 uses the remainder arithmetic unit 203 and the arithmetic unit 204 to

[0118]

[Equation 46]

Is calculated, and ξ _i is output to the IC card 400.

The IC card 400 uses a power multiplier 402 and a remainder arithmetic unit 403 to calculate

[0121]

[Equation 47]

Is calculated, and η _i is output to the receiver device 200.

The receiver device 200 uses an exponentiation multiplier 202, a remainder operation unit 203, and an operation unit 204 to

[0124]

[Equation 48]

Is calculated.

(Embodiment 5) In Embodiment 2, w ₁ ,..., W
e ₁ so as to reduce the value of _m, ..., e _m, by selecting r, recipient i in step decryption process (3)

[0127]

[Equation 49]

The calculation processing load is reduced.

(Embodiment 6) In Embodiment 6, a key distribution method will be described.

[0130] 1. Preparation Process The broadcast station uses the random number generation device 101, the prime number generation device 102, the arithmetic device 103, and the remainder arithmetic unit 105 in the broadcast station side device 100,
Create the following information and publish only the public information.

Secret information:

[0132]

[Equation 39]

Public information:

[0134]

(Equation 40)

Further, the broadcasting station sets different σ for each receiver i.
∈S ′ is selected, and using the arithmetic unit 103, the power multiplier 104, and the remainder arithmetic unit 105 in the broadcast station side apparatus 100,

[0136]

[Equation 41]

The following x _i = s _{i, σ} is distributed as secret information of the receiver i. Where the set S = ｛σ | one-to-one mapping σ: A =
{1,2, ..., k} → B = {1,2, ..., m}, 1 ≦ k
For ≦ m｝ and σ ₁ , σ ₂ ∈S, the relation on S is defined as σ ₁ σσ ₂ ⇔σ ₁ (A) = σ ₂ (A), and the quotient set of S Is S ′.

[0138] 2. Encryption / Decryption Processing (1) The broadcast station uses a random number generator 10 in the broadcast station apparatus 100.
Using 1, an integer t satisfying 0 ≦ t ≦ L is randomly selected, and using a power multiplier 104, a remainder arithmetic unit 105, and a key generator 106,
Data encryption key ^{K = f (g t mod n} ), and, [z _1, ..., z
_m ]

[0139]

(Equation 6)

[0140] calculated in the dark using the decoding apparatus 107 encrypts the data P with the key K ciphertext C = E (K: P) , _{and, [z 1, ..., z} m] a communication device It broadcasts using 108.

The receiver device 200 of the receiver i is stored in the memory 201
Power multiplier 202, remainder operation unit 203, key generator from xi in
Using 206,

[0142]

[Equation 45]

Then, the data encryption key K is calculated, and the data P is decrypted from the cipher text C using the encryption / decryption device 207.

[0144]

According to the limited broadcast communication system according to the present invention, each receiver has different unique secret information, and even if the number of receivers is large, the transmission data for key distribution can be obtained. The amount can be reduced. Further, according to the present invention, access to the server for decrypting the broadcast cipher text needs to be performed only once for each transmission data even though the data encryption key is frequently changed. ,
Good communication efficiency. Further, at this time, the server does not know the confidential information of the receiver, and if the transmission data is paid information, it is possible to reliably charge.

Also, unless a recipient who can see transmission data teaches a recipient who does not qualify to see transmission data the private key of the recipient, frequent recipients who do not have qualification to see transmission data are frequent. It is difficult to calculate the data encryption key that is changed to itself, and if a fraudulent recipient diverts his / her private key, the divert recipient will impersonate the divert recipient Therefore, the receiver who has performed the diversion will pay a fee for the data obtained by the receiver who has diverted. For this reason, it is difficult for the recipient to circulate the key, and secure limited broadcast communication and reliable charging can be performed without assuming the physical security of the IC card or the like.

[Brief description of the drawings]

FIG. 1 is a diagram showing a system configuration according to an embodiment of the present invention.

FIG. 2 is a diagram showing an internal configuration of a sender-side device and a flow of processing in an embodiment.

FIG. 3 is a diagram illustrating an internal configuration of a receiver-side device and a processing flow in an embodiment.

FIG. 4 is a diagram showing an internal configuration of a server and a flow of processing in the embodiment.

FIG. 5 is a diagram showing an internal configuration of an IC card.

FIG. 6 is a diagram showing an outline of an embodiment.

FIG. 7 is a diagram illustrating a request calculation method according to a fourth embodiment.

[Explanation of symbols]

100: Broadcast station side device, 101: Random number generator in the broadcast station side device 100, 102: Prime number generator in the broadcast station side device 100, 103: Arithmetic device in the broadcast station side device 100, 10
4 ... Multiplier in broadcast station side apparatus 100, 105 ... Remainder arithmetic unit in broadcast station side apparatus 100, 106 ... Key generator in broadcast station side apparatus 100, 107 ... Encryption / decryption inside broadcast station side apparatus 100 , A communication device in the broadcasting station device 100, a receiver device, 201 a receiver device 20
Memory in 0, 202: Multiplier in receiver 200, 203: Remainder in receiver 200, 2
04: arithmetic device in the recipient device 200; 205: authentication device in the recipient device 200; 206: recipient device 2
00: communication device in 207: key generator in receiver-side device 200; 208: encryption / decryption device in receiver-side device 200; 208: IC card connection device in receiver-side device 200; 300: server , 301: communication device in server 300, 302: encryption / decryption device in server 300, 303 ...
Memory in server 300, 304 ... Authentication device in server 300, 305 ... Billing device in server 300, 400 ...
IC card, 401 ... Memory in IC card 400, 4
02: power multiplier in IC card 400, 403: IC
Remainder arithmetic unit in card 400, 404 ... IC card 40
Authentication information creation device within 0

Claims (9)

[Claims] A broadcast station, which is a sender, encrypts transmission data to a plurality of recipients and transmits the encrypted transmission data to a plurality of recipients by broadcast, and only a limited recipient can decrypt the transmission data. a cryptographic communication system, a set R of the entire recipient for finite subsets R _lambda, meets _R = ∪R λ the relationship, are installed in the server S _lambda for each set R _lambda , The broadcast station broadcasts an encrypted text E obtained by encrypting the transmission data P using the data encryption key K and key information W relating to the data encryption key K, where the key information W is a limited broadcast communication. This information does not depend on the set of receivers to be performed. Further, the broadcasting station changes the data encryption key K frequently, and the receiver i
Accesses the server S _lambda corresponding to the set R _lambda contained the own check for eligibility obtaining data P performs identity authentication of using the secret key B _i itself, which is distributed in advance from the broadcast station after being distributed only once information a _i required for decoding the transmission data P from the server S _lambda for each transmission data P, this case, the server S _lambda learn the secret key B _i of the receiver i It is difficult for the receiver i to decode the transmission data P from the private key B _i distributed in advance from the broadcasting station, the information A _i obtained from the server, and the broadcast data W. , And obtains the correct transmission data P from the broadcast data E. At this time, the receiver i who can see the transmission data P sends to the receiver j who is not qualified to see the transmission data P , as long as you do not tell the secret key B _i of the recipient i, recipient j is frequent Data encryption key K to change
Is a limited broadcast encryption communication system characterized in that it is difficult to calculate the data by itself. 2. A broadcasting station, which is a sender, encrypts transmission data to a plurality of recipients and transmits the encrypted transmission data by broadcast communication, and only a limited recipient can decrypt the transmission data. a cryptographic communication system, a set R of the entire recipient for finite subsets R _lambda, meets _R = ∪R λ the relationship, are installed in the server S _lambda for each set R _lambda As a preparation process, the broadcasting station uses the secret information of the broadcasting station as , And as public information of the broadcasting station, And the broadcasting station sends the following to the receiver i: For s _i , Is distributed as secret information, and as a data encryption / decryption process, (1) the broadcasting station randomly selects integers t, t 'satisfying 0 ≦ t, t ′ ≦ L, and transmits the data encryption key K to the public information. Using a key generation function f (of secret key cryptography), , And And, the cipher text C = E (K: P) obtained by encrypting the data P with the key K (by secret key encryption) is broadcast. (2) the recipient i accesses the server S _lambda corresponding to the set R _lambda contained the own performs authentication by demonstrating that possession of secret information x _i, the server S _lambda if satisfied authentication Sends u _i = t ′ / s _i mod L, to the receiver _i . (3) The recipient i is: Wherein the data encryption key K is calculated and the data P is decrypted from the ciphertext C. (However, Z is a set of whole integers, gcd (x, y), lcm (x,
y) represents the greatest common divisor and the least common multiple of the integers x and y, respectively, and ord _p (g) represents the order of the prime number p in the remainder field Z _p of the integer g. [X ₁ , ..., x _n ] represents data obtained by multiplexing integers x ₁ , ..., x _n , and [x ₁ mod L, ..., x _n mod L] is simply expressed as
[x ₁ , ..., x _n ] mod L. ) 3. A broadcasting station, which is a sender, encrypts transmission data to a plurality of recipients and transmits the encrypted transmission data by broadcast communication, and only a limited recipient can decrypt the transmission data. a cryptographic communication system, a set R of the entire recipient for finite subsets R _lambda, meets _R = ∪R λ the relationship, are installed in the server S _lambda for each set R _lambda As a preparation process, the broadcast station uses the secret information of the broadcast station as Is created, and as public information of the broadcasting station, And the broadcasting station sends a different σ∈ for each receiver i.
Choose S 'and For s _i , _σ , Is distributed as secret information (however, the set S = ｛σ |
Mapping σ: A = {1, 2,..., K} → B = {1, 2,.
For m｝, 1 ≦ k ≦ m｝ and σ ₁ , σ ₂ ∈S, a relation on S is defined as σ ₁ to σ ₂ ⇔σ ₁ (A) = σ ₂ (A), Let the quotient set of S of S be S ′. ),
As the data encryption / decryption processing, (1) the broadcasting station randomly selects integers t, t 'satisfying 0 ≦ t, t ′ ≦ L, and sends the data encryption key K as public information (of the secret key encryption). ) Using the key generation function f, Is calculated by the following equation. And, the cipher text C = E (K: P) obtained by encrypting the data P with the key K (by secret key encryption) is broadcast. (2) the recipient i accesses the server S _lambda corresponding to the set R _lambda contained the own performs authentication by demonstrating that possession of secret information x _i, the server S _lambda if satisfied authentication Sends u _i = t ′ / s _{i, σ} mod L to the receiver _i . (3) The recipient i is: Wherein the data encryption key K is calculated and the data P is decrypted from the ciphertext C. (However, gcd (x, y) and lcm (x, y) are integers x and y, respectively.
Represents the greatest common divisor and least common multiple of, and ord _p (g) is the prime p
It represents the position number in the residue field Z _p integer g respect. [X ₁ , ..., x _n ] represents data obtained by multiplexing integers x ₁ , ..., x _n , and [x ₁ mod L, ..., x _n mod L] is simply expressed as [x ₁ , ..., xn ] mod L
It expresses. ) 4. The data encryption key K according to claim 2, wherein the data encryption key K is changed by changing the value of t of the data encryption key K = f (g ^tt 'mod n). Limited broadcast encryption communication system. 5. The data encryption key according to claim 2, wherein Characterized in that the transmission data is identified by setting the value of t ′ to a value unique to the transmission data. 6. In claim 2 or claim 3, when the transmission data P of the broadcasting station is paid information, the server authenticates the receiver or the server transmits u _i to the receiver. A limited broadcast encryption communication system for charging a fee of transmission data P to a receiver. 7. The method according to claim 3, wherein the receiver i has a secret key x _i
Possessing a storage medium with a calculation function on which is mounted, and connecting the storage medium to a receiving apparatus having a higher calculation function, and using a data encryption key ## EQU17 ## wherein the receiver comprises: Is calculated, and ξ _i is output to the storage medium. Is calculated, and η _i is output to the receiving device. A limited broadcast encryption communication system characterized by calculating 8. The method of claim 3, w _1, ..., as the value of w _m is _{small, e 1, ..., e m} , only broadcast cryptographic communication system, characterized by choosing the value of r. 9. A broadcasting station, which is a sender, encrypts transmission data for a plurality of recipients and transmits the encrypted transmission data by broadcast communication, and only a limited receiver can decrypt the transmission data. a cryptographic communication system, a set R of the entire recipient for finite subsets R _lambda, meets _R = ∪R λ the relationship, are installed in the server S _lambda for each set R _lambda As a preparation process, the broadcast station uses the secret information of the broadcast station as Is created, and as public information of the broadcasting station, And the broadcasting station sends a different σ∈ for each receiver i.
Choose S 'and Comprising x _i = s _i, it distributes _sigma as secret information (where the set S = {σ | 1-one mapping σ: A = {1,2, ... , k} → B =
{1, 2,..., M}, 1 ≦ k ≦ m} and σ ₁ , σ ₂ εS
, A relation on S is defined as σ ₁ to σ ₂ ⇔σ ₁ (A) = σ ₂ (A), and a quotient set of S is defined as S ′. ),
As the data encryption / decryption processing, (1) the broadcasting station randomly selects an integer t satisfying 0 ≦ t ≦ L, and replaces the data encryption key K with a key generation function f (of secret key encryption) which is public information. used, calculated in ^{K = f (g t mod n} ), Equation 13] And, the cipher text C = E (K: P) obtained by encrypting the data P with the key K (by secret key encryption) is broadcast. (2) The recipient i is: Wherein the data encryption key K is calculated and the data P is decrypted from the ciphertext C. (However, gcd (x, y) and lcm (x, y) are integers x and y, respectively.
Represents the greatest common divisor and least common multiple of, and ord _p (g) is the prime p
It represents the position number in the residue field Z _p integer g respect. [X ₁ , ..., x _n ] represents data obtained by multiplexing integers x ₁ , ..., x _n , and [x ₁ mod L, ..., x _n mod L] is simply expressed as [x ₁ , ..., xn ] mod L
It expresses. )