JP2002300149A - Key management system for broadcast distribution - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a broadcast information providing system in which users permitted for receiving information are dynamically changed as information changes, that can efficiently update a cryptographic key for distribution. SOLUTION: A center 1 subdivides users into a plurality of sub-groups. The center distributes a user secret key in the sub-group except user's own secret key and a sub-group secret key except user's own sub-group secret key to each user. The center encrypts a broadcast distribution secret key by using a user secret key of an exclusion object user and encrypts the broadcast distribution secret key by using a sub-group secret key to which the exclusion object user belongs and distributes them. The center distributes broadcast distribution information encrypted by the broadcast distribution secret key. Each user other than the exclusion object user receives the information encrypted by the broadcast distribution secret key and decodes the information by using the broadcast distribution secret key.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a broadcast distribution key management system, and more particularly to a broadcast distribution key management system for efficiently updating a broadcast distribution encryption key in a broadcast-type information providing system.

[0002]

2. Description of the Related Art In a broadcast-type information providing system in satellite broadcasting or the Internet, when data is encrypted and distributed, each recipient needs to hold a broadcast distribution key. Recipients are newly added or removed every certain period depending on the contract status and the like. In the case of new addition, it is only necessary to distribute the used broadcast distribution key to new recipients, but if the recipient is excluded, update the broadcast distribution key to all recipients Need to be done. Several methods have been reported for the purpose of efficiently updating a key.

[0003] As a first example of a conventional method for updating a broadcast encryption key, an Internet standardization organization IET has been proposed.
“Comp” described in the standard specification document “RFC2627” issued by F.
Figure 11-Figure 13
This will be described with reference to FIG. FIG. 11 is a conceptual diagram of a change in a user within a broadcast distribution group. In FIG. 11, a center 1 is an information service organization such as a web server or a broadcasting station for broadcasting information, or a center of a limited organization. The user 2 is a user (including an organization member) that receives information. Each user holds a user individual key. The broadcast communication network 5 is, for example, the Internet or a satellite broadcast network capable of performing broadcast communication. FIG. 12 is a flowchart of the key distribution procedure. FIG. 13 is a diagram showing a key distribution state. The purpose of this method is to send all users in the group from center 1
In a broadcast-type information providing system for sending information encrypted with a broadcast distribution encryption key, when a non-authorized user occurs, the broadcast distribution encryption key is updated efficiently without the user being informed. It is.

With reference to FIG. 11, an outline of a broadcast communication system including a center 1, a plurality of users, and a broadcast network will be described. The N users (U ₁ ~U _N) Guile the whole group. The center 1 distributes broadcast distribution information using a broadcast communication network. In the period 2, _UN is excluded from the target according to the contract with the user or the like. In period 3, U ₂ , U _y
Is further excluded. A method of updating the broadcast distribution secret key K _NET will be described. Suppose U _y is excluded.

The procedure will be described with reference to FIG. In step 121, the center 1 transmits N pieces of secret information Ki (i = 1 to
Generate N) and K _NET . At step 122, each user j
And (N-1) pieces of secret information Ki (i ≠ j) and K other than j
Distribute _.NET . In step 123, the center 1 instructs all users to delete the user y. For example, “Cut y from
In step 124, each user creates a new K _NET using K _NET and Ky. User y cannot create a new K _NET because there is no Ky.

FIG. 13 shows a key distribution when there are 16 users.
Indicates the status. Center 1 uses the user secret key K₁~ K₁₆To
Generate and distribute to each user. At that time, user U₁
Contains the user secret key K_Two~ K₁₆To deliver. User U_TwoTo
Is the user secret key K₁And K_Three~ K ₁₆To deliver. The same applies hereinafter
And user U₁₆Contains the user secret key K₁~ K₁₅Distribute
I believe. As a result, as shown in FIG.
State. The amount of information held by each user is 15, and
When the number of users is N, it becomes (N-1).

As a second example of a conventional method for updating a broadcast distribution encryption key, a “Hierarchical tree approach” described in a standard specification document “RFC2627” issued by IETF is used.
(The same applies to “encryption key distribution system” in Japanese Patent Application Laid-Open No. 11-187013). As shown in FIG. 14, each user has a key hierarchy, from the user key Ki of the user itself to broadcasting key K _NET. Each user has their own user key K
If the user has only i, the broadcast distribution key K _NET must be encrypted for each user with the user key Ki and sent in order to update the broadcast distribution key K _NET for excluding the user from the distribution target. . However, if the intermediate key is provided in the structure as shown in FIG. 13, the communication amount is log ₂ N in the case of the highest efficiency. For example, the U ₁₆ becomes exclusion target. Keys with the U ₁₆ is, Key H, Key L, Key N, and a K _NET. If other users have these keys, they must change them. Key H, Key L, Ke having a U ₁₅
y N, K _NET is, to send updates to encrypt the new key using the K _16. Key Canada L with a _{U 13, U 14, Key N} , K NET
Encrypts and sends a new key using Key G and updates it. The keys of U ₉ , U ₁₀ , U ₁₁ , and U ₁₂ are updated by encrypting a new key using Key K. The same applies hereinafter. Thus, to update the key without revealing the U _16.

A "mobile communication system" disclosed in Japanese Patent Laid-Open Publication No. Hei 10-336745, which is a third example of a conventional method for updating a broadcast encryption key, is a mobile communication system that performs group privacy communication. In addition, it is possible to safely and easily change the group configuration. In this mobile communication system, mobile station individual information is encrypted by an internal master key and stored in a database used for communication control between the base station (BS1 to BSn) and the mobile station (MS1 to MSm) using an internal master key. I do. At the same time, information obtained by encrypting the group-related information with the private key ki for each mobile station is stored. Thus,
Securely store and manage the secret communication key used in the system. In the control station, when the secret key Gki for group encryption communication is delivered to each mobile station belonging to the same group,
By distributing the information encrypted with the individual secret key ki of the destination station, exclusive group privacy communication can be executed safely and easily.

[0009]

However, the above-described conventional method for updating the broadcast distribution encryption key has the following problems. Complementary variable a of "RFC2627"
Since pproach cannot return a user excluded from a distribution target to a distribution target again, it cannot be directly applied to a system in which users permitted to receive dynamically change. The following improvement can be made so that the excluded user can be returned to the distribution target. Rather than to create a new K _NET on the user side, to deliver to each user to create the center. For example, if the exception of the user U ₁ distributes the secret key for the broadcasting, the center 1, the encrypted private key for multicasting user secret key K ₁ broadcasts, the user U ₁
Other than the user, the broadcast private key is changed to the user private key K _1.
Can be decrypted. Even in the case of this improvement, the communication amount is one and the efficiency is the best, but the information amount to be held by each user is large as N. When a user is added, there is a problem that all users must additionally update the held information. In addition, "R
Also, the encryption distribution system of the Hierarchical tree appoach of FC2627 cannot be applied as it is to the use in which the users permitted to receive dynamically change. The following can be improved for application. It can be changed to change only K _NET . That is, to the U _15, new key K using the K _15
NET is encrypted and sent for update. U _13, the U ₁₄ is, Key
Use G to encrypt and send a new key K _NET for renewal.
U ₉ , U ₁₀ , U ₁₁ , and U ₁₂ are encrypted with a new key K _NET using Key K and sent to be updated. The same applies hereinafter. Even with such an improvement, a large amount of communication is required to update the broadcast distribution encryption key. The traffic is at least log ₂ N (N
= 128 for 7), and the maximum is N / 2 (64 for N = 128, when one of the two users sharing the first layer key is an excluded user).

SUMMARY OF THE INVENTION The present invention solves the above-mentioned conventional problem, and enables a user who is permitted to receive a broadcast-type information providing system, which dynamically changes with the change of information, to efficiently update a broadcast encryption key. The goal is to do well. In other words, in a broadcast-type information providing system in which the set of regular users in a group does not change, but the users who are permitted to receive the information dynamically change with the change in information, the information distribution encryption key can be efficiently transmitted from the center device as the information changes The purpose is to distribute. In such an application, the encryption key is frequently updated. For example, once a week to one month in the prior art application, but every few minutes in the application of the present invention. for that reason,
Real-time performance is required, and it is important to reduce the amount of communication between the center and the user.

[0011]

According to the present invention, there is provided a broadcast key management system having a broadcast communication system comprising a center, a plurality of users, and a broadcast communication network. Means for generating a user secret key, means for generating a subgroup secret key, means for generating a broadcast private key, means for organizing users into a plurality of subgroups, and A means for encrypting and distributing with the user secret key of the exclusion target user, a means for encrypting the broadcast distribution private key with the subgroup secret key to which the exclusion target user belongs and distributing, and encrypting with the broadcast private key Means for distributing encrypted information, means for receiving, for each user, an encrypted broadcast distribution secret key, and an encrypted broadcast distribution secret key using a user secret key or a subgroup secret key. Means to decrypt Means for receiving the information encrypted by the secret key for broadcasting, encrypted information has a structure in which a means for decrypting the secret key for broadcasting.

With this configuration, it is possible to reduce the amount of communication between the center and the user required for distributing the private key for broadcast distribution. The property is not impaired. If the amount of communication is to be reduced, the amount of information held by the user may be increased, and if the amount of information held by the user is to be reduced, the amount of communication may be increased, so that the design is flexible. In addition, when a new user is added to an existing subgroup, it is only necessary to add and change only the information owned by the users in the subgroup.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below in detail with reference to FIGS.

(First Embodiment) In a first embodiment of the present invention, users are organized into a plurality of subgroups at a center, and each user is assigned to a user in a subgroup except for his own user secret key. The user secret key and the subgroup secret key excluding its own subgroup secret key are distributed, and the broadcast distribution secret key is encrypted with the user secret key of the exclusion target user and distributed, and the exclusion target user belongs to. This is a broadcast distribution key management system for encrypting and distributing with a subgroup secret key.

FIG. 1 is a conceptual diagram of key distribution of a broadcast distribution key management system according to a first embodiment of the present invention.
In FIG. 1, a center 1 is an information service organization such as a web server or a broadcasting station for broadcasting information. User 2 is a user who receives information. Subgroup 3
Is a set of some users of the group. The broadcast communication network 5 is, for example, the Internet or a satellite broadcast network capable of performing broadcast communication. FIG. 2 is a flowchart of the preparation procedure. FIG.
9 is a flowchart of a user addition procedure. FIG. 4 is a diagram showing a user secret key distribution state. FIG. 5 is a diagram showing a subgroup secret key distribution state. FIG. 6 is a flowchart of the procedure for distributing the broadcast distribution private key. FIG. 7 is a conceptual diagram of information distribution of the broadcast distribution key management system.

An operation of the broadcast distribution key management system according to the first embodiment of the present invention configured as described above will be described. First, with reference to FIG. 1, an outline of a distribution method of a broadcast distribution private key will be described. Exclusion user to user U _1. Center 1 uses the user secret key K ₁ of user U ₁ ,
Enc (K _NET , K ₁ ) which is obtained by encrypting the broadcast distribution secret key K _NET is generated and transmitted. The center 1 further includes a user U ₁
Sub-groups of the sub-group S ₁ belonging to the secret key KS
In _1, Enc obtained by encrypting the broadcast distribution for the secret key K _NET (K _{NE T,} K
Send S ₁ ). The user other than U ₁ has the user secret key K ₁
Or by using a sub-group secret key KS _1, to decode the broadcast distribution for the secret key K _NET. However, the user U ₁ is, K ₁ also KS
_Since it does not have _1, it cannot decrypt the broadcast private key _KNET .

In general, when the broadcast distribution secret key K _NET of a group is updated, a broadcast is distributed to a subgroup having no distribution exclusion user by using all the subgroup secret keys of the subgroup having the exclusion user. the use secret key K _NET and encryption, to deliver a secret key for the broadcasting K _{N ET.} The sub-group in which the excluded user is located is provided with the broadcast distribution secret key K using the user secret keys of all the excluded users in the sub-group.
_NET encrypted and delivered. When distribution of the broadcast distribution private key K _NET is completed, use the broadcast distribution private key K _NET to
The broadcast information is encrypted and transmitted. Only the user who has successfully decrypted the broadcast distribution private key K _NET can decrypt the broadcast distribution information.

Second, the preparation procedure will be described with reference to FIG. In step 21, the center 1 divides the group into m subgroups. In Step 22, Center 1
Generates a user secret key K _i (i = 1 to N) of each user. In step 23, the center 1 generates a subgroup secret key KS _{j (j} = 1~m) of each subgroup. In step 24, the center 1 distributes the related one of the user secret key and the subgroup secret key to each user.
That is, to distribute the sub-group secret key KS _j other than the sub-group to which the user belongs, the user's private key K _i of other users in the sub-group to which the user belongs.

Third, a user adding procedure will be described with reference to FIG. In step 31, the center 1 generates user private key K _q of the user U _q Add subgroup S _g. In step 32, the center 1, the existing users of the subgroup S _g, distributes the user private key K _q encrypted with non subgroup g (m-1) subgroups private key KSj. As a result, users other than the subgroup g cannot decrypt the user secret key _Kq . In step 33,
Add user U _q subgroup S _g. When a new subgroup is added, the same method is used.
As a result, as shown in FIGS. 4 and 5, the user secret key and the subgroup secret key are held by each user.

Fourth, referring to FIG.
The key distribution procedure will be described. Excluded user is user U₁Toss
You. In step 61, the center 1 determines that the user U₁Users
Secret key K₁And the broadcast private key K_NETEnc encrypted
(K_NET, K₁) Is generated and transmitted. In step 62,
Ter 1 further includes a user U₁Belongs to subgroup S₁
Subgroup secret key KS₁And the broadcast private key K_NET
Enc (K_NET, KS ₁). Step 63
And U₁Other than the user secret key K₁Or sub-gu
Loop secret key KS₁, The broadcast private key K_NETTo
Decrypt. However, user U₁Is K₁Also KS₁Have no
So the broadcast private key K_NETCannot be decrypted.

Fifth, referring to FIG.
The distribution procedure will be described. N users (U
₁~ U_N). Center 1 is broadcast information
Is distributed using a broadcast network. Contract with user, etc.
In response, the information A _N-1To users except
You. Before sending information A to perform such distribution
User U_N-1Except for the user, the broadcast private key K
_NETSend. Information A is a broadcast distribution secret key K._NETEncrypted with
And send. Information B is for user U₁And user U_N-1Just send
You. Before sending information B, user U₁And user U_N-1Only
, A new broadcast private key K_NETSend. Information B is
Broadcast distribution private key K_NETAnd send it. Information C is
User U₁To users except for. Before sending information C,
User U₁Except for the user, the broadcast private key K_NETSend
You. Information C is a broadcast private key K_NETTo encrypt and send
You. Therefore, only the selected user will receive the broadcast secret.
Key K_NET, And then the broadcast private key K_NETEncrypted with
Broadcast information can be sent.

In this way, the amount of information held by the user is
/ M + m-2). If the least,
When m is N ^1/2 , the number is 2N ^1/2 . For example, N
In the case of = 128 and m = 8, the amount of information held by the user is 22 pieces.
The number of communications is (number of subgroups with unsubscribed users +
1) times. At most, m = 8. Complementar
In the method in which the y variable approach is changed, the number of communications is always one, but the amount of information held by the user is as large as N-1 = 127. In the method in which the Hierarchical tree approach is changed, the amount of information held by the user is log ₂ N = 7, but the number of times of communication is log ₂ N = 7 at the minimum and N / 2 = 64 at the maximum.
It is. Further, even if the number of users increases, only the user in the belonging subsystem needs to update the user secret key.

As described above, in the first embodiment of the present invention, the broadcast key management system organizes users into a plurality of subgroups at the center, and gives each user its own user secret key. Distribute the user secret keys of the users in the excluded subgroups and the subgroup secret keys excluding the subgroup secret keys of their own, and encrypt and distribute the broadcast distribution secret key with the user secret keys of the excluded users. Since the distribution is performed by encrypting with the subgroup secret key to which the exclusion target user belongs, the broadcast distribution private key can be updated efficiently.

(Second Embodiment) A second embodiment of the present invention is a broadcast distribution key management system having three or more subgroups in a hierarchical structure.

FIG. 8 is a conceptual diagram of key distribution of the broadcast distribution key management system according to the second embodiment of the present invention.
In FIG. 8, a center 1 is an information service organization such as a web server or a broadcasting station for broadcasting information. User 2 is a user who receives information. Each user holds a user individual key. Subgroup 3 is a set of some users of the group. The lower subgroup 4 is a set of some users of the subgroup. The broadcast communication network 5 is, for example, the Internet or a satellite broadcast network capable of performing broadcast communication. FIG. 9 is a flowchart of the preparation procedure. FIG. 10 is a flowchart of a distribution procedure of the broadcast private key.

The operation of the broadcast distribution key management system according to the second embodiment of the present invention configured as described above will be described. In this broadcast distribution key management system, the subgroup secret key is held in a hierarchical structure of three or more levels, and the amount of retained memory is significantly reduced by slightly increasing the amount of communication.

First, with reference to FIG.
Of the distribution method of the broadcast system private key
I do. Center 1 is a group of N users
To m ₁Divide into subgroups. Each user has their own
Subgroup secret key KS1 other than subgroup_j(J = 1
~ M₁) To (m₁-1) Have. m₁Subgroups
, And m_TwoSplit into subgroups
I do. Each user is a subgroup other than their own subgroup
Secret key KS2_j(J = 1 to m_Two) To (m_Two-1) Have. Less than
Repeat the division in the same way as below. At the final level, each user
Of other users belonging to their own subgroup at the last level
User secret key K_i(I = 1 to n, n = N / (m₁× m_Two× m
_Three× ...)).

When the group is divided into h levels,
The amount of information held by the₁-1) + (m _Two-1) + (m_Three-1)
+ ... + (m_h-1) + N / (m₁× m_Two× m_Three× ・ ・ ・ ×
m_h) -1. When the two divisions are performed h times, (h−
1 + N / 2^h)become. The traffic is the putter of the excluded user.
However, it is generally (h + 1) times at the minimum. special
In some cases, it may be less.

[0029] to the exclusion user and the user U _1. The center 1 transmits Enc (K _NET , K ₁ ) obtained by encrypting the broadcast distribution secret key K _NET with the user secret key K ₁ of the user U ₁ . Furthermore, in the sub-group private key KS1 ₁ ~KSh ₁ of the sub-group of the level to which the user belongs U _1, the broadcasting for the secret key K
Enc obtained by encrypting _{NET (K NET, KS1 1)} ~Enc (K NET, KSh 1)
Send User U ₁ cannot decrypt the broadcast private key K _NET , but other users can decrypt the broadcast private key K _NET .

Next, the preparation procedure will be described with reference to FIG. In step 91, the center 1 generates a subgroup secret key KS1 _i (i = ₁ to m ₁ ) of the first level subgroup. In step 92, the center 1 sends the subgroup secret keys KSj _i (j = 2 to h, i = 1
~ M _j ). In step 93, the center 1 generates a user secret key K _i (i = 1 to N) for each user.
In step 94, the center 1 distributes the relevant one of the secret keys at each level to the user.

Third, referring to FIG.
The key distribution procedure will be described. In step 101, center 1
Is the user U₁User private key K₁And the broadcast private key
K_NETEnc (K_NET, K₁) And send
You. In step 102, the center 1 further determines that the user U₁
Belongs to subgroup S₁~ S_hSubgroup secret key K
S ₁~ KS_hAnd the broadcast private key K_NETEnc encrypted
(K_NET, KS₁) To Enc (K_NET, KS_h). step 1
03, each user has a user secret key K₁Or sub glue
Private key KS₁~ KS_h, The broadcast private key K_NET
Is decrypted. However, user U₁Is the broadcast private key K
_NETCannot be decrypted.

As described above, by adjusting the subgroup division method, it is possible to select which of the improvement of the communication volume of the secret key update and the improvement of the memory amount is important according to the system.

As described above, in the second embodiment of the present invention, the sub-group of the broadcast
With the above-described hierarchical structure, the amount of retained memory can be significantly reduced by slightly increasing the amount of communication.

[0034]

As is apparent from the above description, according to the present invention, the user private key is stored in the center of the broadcast distribution key management system of the broadcast communication system including the center, a plurality of users, and the broadcast communication network. Means for generating a sub-group private key, means for generating a broadcast private key, means for organizing users into a plurality of sub-groups,
Means for encrypting the broadcast distribution private key with the user secret key of the exclusion target user and distributing the same; and means for encrypting the broadcast distribution private key with the subgroup secret key to which the exclusion target user belongs and distributing the same. Means for distributing the information encrypted with the distribution secret key, and means for receiving, for each user, an encrypted broadcast distribution secret key, and a means for transmitting the encrypted broadcast distribution secret key to the user. Means for decrypting with a key or subgroup secret key, means for receiving information encrypted with a broadcast private key, and means for decrypting encrypted information with a broadcast private key. With the configuration, the amount of information held by the user can be reduced, and the amount of communication between the center and the user required for distribution of the broadcast private key can be reduced, and the receiving target user changes for each information. Like a system, an encryption key Even update frequently occur, the effect of real-time is not impaired can be obtained. Furthermore, when a new user is added, only the possession information of the user in the subgroup to which the user belongs has to be changed.

[Brief description of the drawings]

FIG. 1 is a conceptual diagram of key distribution of a broadcast distribution key management system according to a first embodiment of the present invention;

FIG. 2 is a flowchart of a preparation procedure of a broadcast distribution key management system according to the first embodiment of the present invention;

FIG. 3 is a flowchart of a user addition procedure of the broadcast distribution key management system according to the first embodiment of the present invention;

FIG. 4 is a diagram showing a key distribution state of the broadcast distribution key management system according to the first embodiment of the present invention;

FIG. 5 is a diagram showing a subgroup key distribution state of the broadcast distribution key management system according to the first embodiment of the present invention;

FIG. 6 is a flowchart of a distribution procedure of a broadcast distribution private key of the broadcast distribution key management system according to the first embodiment of the present invention;

FIG. 7 is a conceptual diagram of a broadcast distribution of the broadcast distribution key management system according to the first embodiment of the present invention;

FIG. 8 is a conceptual diagram of key distribution of the broadcast distribution key management system according to the second embodiment of the present invention;

FIG. 9 is a flowchart of a preparation procedure of a broadcast distribution key management system according to the second embodiment of the present invention;

FIG. 10 is a flowchart of a distribution procedure of a broadcast distribution private key of the broadcast distribution key management system according to the second embodiment of the present invention;

FIG. 11 is a conceptual diagram of a conventional broadcast distribution key management system,

FIG. 12 is a flowchart of a key distribution procedure of a conventional broadcast distribution key management system;

FIG. 13 is a diagram showing a key distribution state of a conventional broadcast distribution key management system;

FIG. 14 is a conceptual diagram of another conventional broadcast distribution key management system.

[Explanation of symbols]

 1 center 2 user 3 subgroup 4 lower subgroup 5 broadcast network

Claims (3)

[Claims] 1. A broadcast key management system for a broadcast communication system comprising a center, a user, and a broadcast network, wherein the center generates a user secret key,
Means for generating a subgroup secret key; means for generating a broadcast private key; means for organizing the users into a plurality of subgroups; Means for encrypting and distributing, means for encrypting and distributing the broadcast distribution private key with the subgroup secret key to which the user to be excluded belongs, and distributing the broadcast distribution information encrypted with the broadcast distribution private key Means for receiving, for each user, an encrypted broadcast private key, and means for decrypting the encrypted broadcast private key with a user private key or a subgroup private key. Means for receiving broadcast distribution information encrypted with the broadcast distribution secret key, and means for decrypting the encrypted broadcast distribution information with the broadcast distribution secret key. Broadcast distribution key management system. 2. The center is provided with means for distributing a user secret key of the additional user, which has been encrypted with all subgroup secret keys other than the subgroup, to an existing user in a subgroup to which the user to be added belongs. Means for receiving, for each user, a user secret key encrypted with a subgroup secret key, means for decoding the received user secret key with a subgroup secret key, and means for storing the decrypted user secret key. 2. The broadcast distribution key management system according to claim 1, further comprising: 3. The broadcast key management system according to claim 1, wherein the subgroup is configured as a hierarchical structure having three or more layers.