JP2004166154A - Key control system for multicast distribution - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize easy control of keys (encryption/decryption keys) in a network system wherein encrypted data are distributed by multicast. <P>SOLUTION: A key control server 31 holds a set of encryption and decryption keys and an key ID for uniquely identifying the keys for key control. Each of contents servers 11-1n receives a set of the encryption key and its key ID from the key control server 31 and sends a multicast packet having data encrypted with the encryption key and the key ID to clients 21-2m. Each of clients 21-2m receives the multicast packet from the contents servers 11-1n, acquires the decryption key corresponding to the key ID contained in the multicast packet from the key control server 31, and decrypts the encrypted data contained in the multicast packet with the decryption key. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a key management method for multicast distribution that manages a key (encryption key / decryption key) used in encryption / decryption in a network system in which multicast distribution of encrypted data is performed.
[0002]
[Prior art]
As a protocol for communication of encrypted data in unicast communication, there is IPsec or the like, but these cannot be applied to multicast communication (distribution) as they are. This is because the unicast communication is performed on a one-to-one basis, and therefore, the key may be shared between the two parties. However, the multicast communication is a one-to-many communication, so that the key cannot be shared by the same method as the unicast communication. For this reason, encryption in multicast communication requires a different mechanism from that in unicast communication.
[0003]
In general, when a plurality of multicast distributions are performed, in order to distinguish each of them, the distinction is made by a combination of a source address, a multicast address, and a transmission / reception port number.
[0004]
Therefore, according to the conventional technology, when there are a plurality of content servers, each of which distributes a multicast packet including data encrypted using a different key, the client side needs a decryption key corresponding to each multicast packet. In order to obtain this, it was necessary to distinguish multicast packets based on a combination of a source address, a multicast address, and a transmission / reception port number.
[0005]
When the key (encryption key / decryption key) is changed during multicast distribution of the encrypted data (encrypted data), the key is used between the content server and the client by using some method. It is necessary to synchronize the encryption key and the decryption key.
[0006]
Here, in the related art, as a method of synchronizing keys, there is a system that realizes the synchronization using a key management server that performs the following processing (for example, see Patent Document 1).
[0007]
That is, the key management server described in Patent Document 1 receives a new key when the sender (content server) starts transmission or changes the key, and notifies the receiver (client) of the new key. The key corresponding to the transmission data (data to be distributed) is distributed to the receiver.
[0008]
[Patent Document 1]
JP-A-2002-111649 (page 4-5, FIG. 1)
[0009]
[Problems to be solved by the invention]
In the above-described conventional key management method for multicast distribution, when a key is changed, the key management server needs to distribute a new key to the client. In addition, there is a problem that key management becomes complicated, for example, the key management server needs to know the client currently receiving the multicast packet.
[0010]
SUMMARY OF THE INVENTION In view of the above, an object of the present invention is to provide a key ID (sender (content) for uniquely identifying a plurality of keys (encryption key / decryption key) in advance in a network system that performs encryption processing during multicast distribution. An ID (Identification) for distinguishing a key shared between a server) and a large number of receivers (clients) is assigned to each key, and a key used for encrypting data to be distributed at the time of multicast distribution A key for multicast distribution that allows key management to be performed easily by including a key ID corresponding to the key ID in a multicast packet and realizing key management using such a key ID. To provide a management method.
[0011]
In other words, according to the present invention, when the content server changes the encryption key, the content server only changes the key ID attached to the encrypted data, and the client checks the key ID in the received multicast packet. Since it is possible to know that the key used for encryption / decryption has changed and to request a new key from the client side to the key management server side, it is not necessary for the key management server side to manage information about the client.
[0012]
Note that an ID is also used in a protocol such as IPsec (protocol for unicast communication) to distinguish a plurality of keys, but it is only to distinguish a key shared between two parties.
[0013]
Further, in IPsec communication using PKI (Public Key Infrastructure), a public key is stored in a server called a CA (Certification Authority) station, and a client obtains the public key from the server prior to communication. However, this public key is used for exchanging a shared key for communication, and encrypted communication is not performed using the public key (in the present invention, the decryption key and its key ID are used for key management). Passed from server to client).
[0014]
[Means for Solving the Problems]
The key management method for multicast distribution according to the present invention uses an encryption key / decryption key (a paired encryption key and decryption key, which may be the same key) in a network system where multicast distribution of encrypted data is performed. Upon receiving a key creation request from the content server and a key management table in the key management server holding a set of a key ID for uniquely distinguishing the key, an encryption key / decryption key is generated and the key is assigned to the key. An ID is assigned, a set of the generated encryption key / decryption key and the key ID is stored in the key management table, and a key information response message having the pair of the encryption key and the key ID is returned to the content server. Upon receiving a key information request from the key generation means in the key management server and the client, a key corresponding to the key ID in the key information request is searched from the key management table, and the search is performed. A decryption key sending means in the key management server for returning a key information message having a pair of the resulting decryption key and key ID to the client, and an encryption key in the content server holding the pair of the encryption key and the key ID Issue a key creation request to the key management server in order to obtain an encryption key at the time of multicast distribution, and send a set of the encryption key and the key ID in the received key information response message to the encryption key. Encrypting the data to be distributed using an encryption key acquisition unit in the content server to be stored in the table and an encryption key acquired by the encryption key acquisition unit and held in the encryption key table; Encrypting and transmitting means in a content server for transmitting a multicast packet having a key ID corresponding to the encryption key, a decryption key and its key ID, When a multicast packet is received, a decryption key corresponding to the key ID in the multicast packet is searched from the decryption key table, and if there is a corresponding decryption key, the decryption key is searched. The key is acquired, and if there is no corresponding decryption key, a key information request using the key ID as a key is transmitted to the key management server, and the key information transmitted from the key management server as a reply to the key information request A decryption key acquiring unit in the client for acquiring a decryption key in the message and storing a set of the decryption key and its key ID in the decryption key table; and receiving a multicast packet and acquiring the multicast packet. Receiving / decrypting means in the client for decrypting the encrypted data in the multicast packet using the decryption key.
[0015]
Here, the key management method for multicast distribution of the present invention is a key management server key management program for causing the key management server to function as the key management table, the key generation unit, and the decryption key transmission unit. A content server key management program for causing the content server to function as the encryption key table, the encryption key acquisition unit, and the encryption / transmission unit; The present invention can also be realized in a mode having a key acquisition unit and a client key management program for functioning as a reception / decryption unit.
[0016]
Further, the key management method for multicast distribution of the present invention holds a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key in a network system where multicast distribution of encrypted data is performed. Upon receiving a key generation request from the key management table in the key management master server and the key management slave server, and a key creation request from the content server, an encryption key / decryption key is generated, a key ID is assigned to the key, and the generated encryption key / decryption is performed. The set of the key and the key ID is stored in the key management table in the key management master server, and a key information response message having the set of the encryption key and the key ID is returned to the content server. Key generation and distribution in the key management master server that distributes a key information distribution message having a pair of a decryption key and the key ID to all key management slave servers Key management means for storing a set of an encryption key / decryption key and a key ID in a key information distribution message distributed by the key generation / distribution means in the key management table in a key management slave server in which the key generation / distribution means is located Upon receiving a key information request from the client and the key storage means in the slave server, a key corresponding to the key ID in the key information request is searched from the key management table in the key management slave server in which the key exists, and the search is performed. A decryption key sending means in the key management slave server for returning a key information message having a pair of the resulting decryption key and key ID to the client, and a cipher in the content server holding the pair of the encryption key and the key ID. A key creation request is issued to the key management master server to obtain an encryption key during multicast distribution, and the key information received as a response An encryption key acquisition unit in the content server for storing a pair of an encryption key and a key ID in a response message in the encryption key table; and an encryption key acquired by the encryption key acquisition unit and held in the encryption key table. Encrypting and transmitting means in the content server for encrypting data to be distributed using the encryption server and transmitting a multicast packet having the encrypted data and a key ID corresponding to the encryption key; a decryption key and the key; When a multicast packet is received, a decryption key corresponding to a key ID in the multicast packet is searched from the decryption key table. Acquires the decryption key, and if there is no corresponding decryption key, assigns the key ID to one of all the key management slave servers. The key information request, and obtains the decryption key in the key information message transmitted from the key management slave server as a reply to the key information request, and decrypts the set of the decryption key and its key ID. A decryption key acquisition unit in the client that stores the key table, and a client that receives the multicast packet and decrypts the encrypted data in the multicast packet using the decryption key acquired by the decryption key acquisition unit. It is also possible to configure so as to have a receiving / decoding means.
[0017]
Here, the key management method for multicast distribution of the present invention is a key management program for a key management master server for causing the key management master server to function as the key management table and the key generation / distribution means, A key management program for a key management slave server for causing the key management slave server to function as the key management table, the key storage unit, and the decryption key sending unit; and the content server, A content server key management program for functioning as an encryption key acquisition unit and an encryption / transmission unit, and a function for causing the client to function as the decryption key table, the decryption key acquisition unit, and the reception / decryption unit. It is also possible to realize the above-mentioned embodiment having the client key management program.
[0018]
Further, the key management method for multicast distribution of the present invention holds a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key in a network system where multicast distribution of encrypted data is performed. Upon receiving a key creation request from the content server and a key management table in the key management server to perform encryption and decryption keys, a key ID is assigned to the key, and the generated encryption key and decryption key and the key ID Is stored in the key management table, key generation means in the key management server for returning a key information response message having the pair of the encryption key and the key ID to the content server, and a key information request from the client. Upon receipt, a key corresponding to the key ID in the key information request is searched from the key management table, and a key information message having a pair of a decryption key and a key ID of the search result is retrieved. A decryption key sending means in the key management server for returning the page to the client, an encryption key table in the content server holding a set of the encryption key and its key ID, and a key change preparation time. Issues a key creation request to the key management server in order to obtain an encryption key to be used in advance, and stores a pair of the encryption key and the key ID in the received key information response message in the encryption key table as a response. Encrypting the data to be distributed using an encryption key acquisition unit in the content server to be stored and an encryption key acquired by the encryption key acquisition unit and held in the encryption key table; An encryption / transmission unit in a content server for transmitting a multicast packet having a key ID corresponding to the encryption key, and an encryption key to be used next by the encryption key acquisition unit When the acquisition is performed, a key change notice means in the content server that performs multicast distribution of the key change notice message having the key ID of the encryption key, and a key change notice means in the client that holds a set of the decryption key and the key ID When receiving the decryption key table and the key change notice message, the decryption key table corresponding to the key ID in the key change notice message is searched from the decryption key table. A key information request using the key ID as a key is transmitted, a decryption key in a key information message transmitted from the key management server as a reply to the key information request is obtained, and a pair of the decryption key and the key ID is obtained. A decryption key acquisition unit in the client to be stored in the decryption key table; and a multicast packet received by the decryption key acquisition unit. A receiving / decoding means in the client for decrypting encrypted data in the multicast packet using a decryption key held in a table and corresponding to a key ID in the multicast packet; Is also possible.
[0019]
Here, the key management method for multicast distribution of the present invention is a key management server key management program for causing the key management server to function as the key management table, the key generation unit, and the decryption key transmission unit. A content server key management program for causing the content server to function as the encryption key table, the encryption key acquisition means, the encryption / transmission means, and the key change notification means, and the client The present invention can also be realized in a mode having a decryption key table, a decryption key acquisition unit, and a client key management program for functioning as a reception / decryption unit.
[0020]
The key management method for multicast distribution according to the present invention is more generally arranged in a network system in which encrypted data is multicast distributed so as to be accessible from a content server group and a client group. A key management server that manages a key by holding a set of an encryption key / decryption key and a key ID for uniquely identifying the key; and a key management server that manages the encryption key and its key ID from the key management server. A content server for receiving a set and transmitting a multicast packet having the data encrypted with the encryption key and the key ID to a group of clients; and a key ID included in the multicast packet, receiving the multicast packet from the content server. From the key management server, and obtains the decryption key corresponding to It can be expressed as having a client decrypts the encrypted data included in the multicast packet.
[0021]
Here, with regard to the key management method for the multicast distribution, load distribution can be enabled by dividing the key management server into a key management master server and a plurality of key management slave servers. Also, when the content server changes the key to be used, it performs multicast distribution of a key change notice in advance and prompts the client to obtain a new decryption key from the key management server, so that there is no delay when changing the key. It may also be possible to perform the decoding.
[0022]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, the present invention will be described in detail with reference to the drawings.
[0023]
(1) First embodiment
[0024]
FIG. 1 is a block diagram showing a configuration of a key management method for multicast distribution according to the first embodiment of the present invention.
[0025]
Referring to FIG. 1, a key management method for multicast distribution according to the present embodiment includes a content server 11, 12,..., 1n (n is a positive integer) for transmitting a multicast packet, and a client for receiving the multicast packet. , 2m (m is a positive integer), a key management server 31 for managing keys (encryption key / decryption key), a content server 1i (i is a positive integer of 1 to n), and a client 2j ( j is a positive integer from 1 to m), and a network 100 for connecting the key management server 31.
[0026]
The content server 1i has an encryption key table 1i0 for storing a set of a key (encryption key) used for encrypting data distributed in a multicast packet and a key ID for identifying the key.
[0027]
Each content server 1i includes an encryption key acquisition unit 1i1 and an encryption / transmission unit 1i2.
[0028]
The client 2j has a decryption key table 2j0 that stores a set of a key (decryption key) used for decrypting the encrypted data distributed by the multicast packet and a key ID for identifying the key.
[0029]
Each client 2j includes a decryption key acquisition unit 2j1 and a reception / decryption unit 2j2.
[0030]
The key management server 31 has a key management table 310 for managing a set of a key (encryption key / decryption key) and a corresponding key ID. Note that the encryption key and the decryption key used in the pair of encryption / decryption processes may be the same or different depending on the encryption method, but in any case, they are identified by the same key ID.
[0031]
Further, the key management server 31 is configured to include a key generation unit 311 and a decryption key sending unit 312.
[0032]
FIG. 2 is a block diagram for explaining the operation of the key management method for multicast distribution according to the present embodiment. As shown in FIG. 2, a key creation request 51 is transmitted from the content server 1i to the key management server 31, and a key information response message 52 is transmitted from the key management server 31 to the content server 1i as a response thereto. Further, a key information request 61 is transmitted from the client 2j to the key management server 31, and a key information message 62 is transmitted from the key management server 31 to the client 2j in response to the key information request 61.
[0033]
FIG. 3 is a flowchart showing an encryption / transmission process in the key management method for multicast distribution according to the present embodiment. This processing includes an encryption key presence / absence determination step A1, a key creation request issuing step A2, a key generation step A3, a key ID assignment step A4, a key information key management table storage step A5, and a key information response message transmission step A6. , A key information encryption key table storage step A7, a data encryption step A8, a key ID holding multicast packet generation step A9, and a multicast packet transmission step A10.
[0034]
FIG. 4 is a flowchart showing reception / decryption processing in the key management method for multicast distribution according to the present embodiment. This processing includes a multicast packet receiving step B1, a decryption key presence / absence determining step B2, a key information request issuing step B3, a key management table searching step B4, a key information message transmitting step B5, and a key information decrypting key table saving step. B6 and an encrypted data decryption step B7.
[0035]
Next, the overall operation of the key management system for multicast distribution according to the present embodiment configured as described above will be described in detail with reference to FIGS.
[0036]
First, the operation at the time of encryption / transmission processing on the content server side will be described (see FIG. 3).
[0037]
When encrypting the data to be distributed and transmitting a multicast packet having the encrypted data, the encryption / transmission unit 1i2 in the content server 1i uses a key (encryption key) for the encryption in the content server 1i. It is determined whether or not it is stored in the encryption key table 2i0 (own table) of 1i (step A1).
[0038]
If the encryption / transmission means 1i2 determines in step A1 that the encryption key is held in its own table, the encryption / transmission means 1i2 encrypts the data to be distributed using the encryption key (step A8). Then, a multicast packet having the encrypted data and a key ID corresponding to the encryption key is generated (step A9), and the multicast packet is transmitted (multicast distribution) onto the network 100 (step A10).
[0039]
On the other hand, if the encryption / transmission unit 1i2 determines in step A1 that the encryption key is not stored in its own table, it passes control to the encryption key acquisition unit 1i1. The encryption key acquisition unit 1i1 issues a key creation request 51 (see FIG. 2) to the key management server 31 (step A2).
[0040]
The key generation means 311 in the key management server 31 that has received the key creation request 51 generates the requested key (encryption key / decryption key) (step A3), and sends the key to the key management table 310 in the key management table 310. A key ID for unique management is assigned (step A4).
[0041]
Further, the key generation unit 311 stores the pair of the key generated in step A3 and the key ID allocated in step A4 in the key management table 310 (step A5), and transmits the key generation request 51 to the content server 1i that has issued the key generation request 51. A key information response message 52 (see FIG. 2) having a pair of the key ID and the key (encryption key) is transmitted (step A6).
[0042]
Upon receiving the key information response message 52, the encryption key obtaining means 1i1 in the content server 1i stores the set of the received key and key ID in its own encryption key table 1i0 (step A7).
[0043]
Further, the encryption / transmission means 1i2 in the content server 1i encrypts the data to be distributed using the encryption key received from the key management server 31 (step A8), and the encrypted data and the encryption key Is generated (step A9), and the multicast packet is transmitted to the network 100 (multicast distribution) (step A10).
[0044]
When a plurality of keys are held in an encryption key table (the encryption key table 120 in FIG. 2) as in the content server 12 shown in FIG. 2, the content and time of data to be multicast-distributed are stored. It is also possible to use the plurality of keys properly. In other words, the present invention is not limited to this embodiment, and in the present invention, a plurality of pairs of encryption keys and key IDs can be simultaneously held on the content server side, and the encryption key used for multicast distribution can be changed as needed. It is.
[0045]
Second, the operation of the client at the time of reception / decoding processing will be described (see FIG. 4).
[0046]
When receiving / decoding means 2j2 in the client 2j receives the multicast packet distributed from the content server 1i (step B1), the receiving / decoding means 2j2 refers to the key ID included in the multicast packet and determines the key (decryption) corresponding to the key ID. It is determined (searched) whether the key is in its own decryption key table 8j (own table) (step B2).
[0047]
If the receiving / decrypting means 2j2 determines in the search in step B2 that "there is a decryption key corresponding to the key ID", it decrypts the encrypted data in the multicast packet using the decryption key. (Step B7).
[0048]
On the other hand, when the receiving / decrypting means 2j2 determines that "there is no decryption key corresponding to the key ID" in the search in step B2, it passes control to the decryption key obtaining means 2j1. The decryption key acquisition unit 2j1 issues a key information request 61 (see FIG. 2) to the key management server 31 using the key ID included in the multicast packet (using the key ID as a key) (step B3). That is, the key management server 31 requests key information (a set of a key ID and a decryption key) relating to the decryption key corresponding to the key ID.
[0049]
The decryption key sending unit 312 in the key management server 31 that has received the key information request 61 searches the key management table 310 using the key ID in the key information request 61 and obtains a key corresponding to the key ID. (Step B4).
[0050]
Then, the decryption key sending unit 312 sends a key information message 62 (see FIG. 2) having a pair of the key (decryption key) obtained from the key management table 310 and the key ID as a reply to the key information request 61. Is transmitted to the client 2j that has issued the key information request 61 (step B5).
[0051]
Upon receiving the key information message 62 from the key management server 31, the decryption key acquisition unit 2j1 in the client 2j receives the key information message 62 from the key management server 31, and uses the key information message 62 The set of the decryption key and the key ID is stored in its own decryption key table 2j0 (step B6).
[0052]
Further, the reception / decryption means 2j2 in the client 2j decrypts the encrypted data in the multicast packet received in step B1 using the decryption key (step B7).
[0053]
The decryption key table 2j0 of the client 2j does not have one piece of key information (a pair of a key ID and a key) in an initial state. In addition, a set of a key and its key ID in the decryption key table 2j0 is deleted from the decryption key table 2j0 if it is not used for a certain period of time.
[0054]
(2) Second embodiment
[0055]
FIG. 5 is a block diagram showing a configuration of a key management method for multicast distribution according to the second embodiment of the present invention.
[0056]
Referring to FIG. 5, a key management method for multicast distribution according to the present embodiment includes a content server 11, 12,..., 1n (n is a positive integer) that transmits a multicast packet, and a client that receives the multicast packet. , 2m (m is a positive integer) and a key management master (MASTER) server 40 and a key management slave (SLAVE) server 41,..., 4p (p) for managing keys (encryption key / decryption key). Are positive integers), the content server 1i (i is a positive integer of 1 to n), the client 2j (j is a positive integer of 1 to m), the key management master server 40, and the key management slave server 4k (k is 1 to n). (a positive integer of p).
[0057]
Comparing this embodiment (second embodiment) and the first embodiment, it is assumed that this embodiment corresponds to the key management server 31 in the first embodiment (see FIG. 1). Is different in that a key management master server 40 and a plurality of key management slave servers 4k exist separately.
[0058]
That is, the configuration of the present embodiment shown in FIG. 5 divides the key management server into a key management master server 40 and a key management slave server 4k, and prepares a plurality of key management slave servers 4k. Enables load distribution.
[0059]
The key management master server 40 has a key management table 400 and includes a key generation / distribution unit 401.
[0060]
The key management slave server 4k has a key management table 4k0, and is configured to include a key storage unit 4k1 and a decryption key sending unit 4k2.
[0061]
FIG. 6 is a block diagram for explaining the operation of the key management method for multicast distribution according to the present embodiment. As shown in FIG. 6, a key creation request 51 is transmitted from the content server 1i (in FIG. 6, only the content server 11 is shown for simplicity) to the key management master server 40, and the key management request The key information response message 52 is transmitted from the master server 40 to the content server 1i. At this time, key information distribution messages 71 to 7p are transmitted from key management master server 40 to key management slave servers 41 to 4p. Further, a key information request 61 is transmitted from the client 2j to any of the key management slave servers 41 to 4p, and in response, a key information message 62 is transmitted from the key management slave server 4k to the client 2j.
[0062]
Next, with reference to FIG. 5 and FIG. 6 (refer also to FIG. 1 to FIG. 4 as appropriate), the operation of the key management method for multicast distribution according to the present embodiment configured as described above will be described. The following description focuses on the differences from the first embodiment.
[0063]
First, the operation at the time of encryption / transmission processing will be described.
[0064]
In the first embodiment, if the content server 1i determines in step A1 in FIG. 3 that "the encryption key is not stored in the own table", the content server 1i issues a key creation request to the key management server 31 in step A2. 51 (see FIG. 2).
[0065]
On the other hand, in the present embodiment, the content server 1i (the encryption key obtaining means 1i1 in the content server i1) issues a key creation request 51 (see FIG. 6) to the key management master server 40.
[0066]
Then, the key generation / distribution unit 401 in the key management master server 40 that has received the key creation request 51 generates a key (encryption key / decryption key), and uniquely generates the key in the key management table 400. Assign a key ID for management.
[0067]
Further, the key generation / distribution unit 401 stores the set of the generated key and the key ID assigned to the key in the key management table 400, and sends the key to the content server 1i as a response to the key generation request 51. A key information response message 52 (see FIG. 6) having a set of the ID and the key (encryption key) is transmitted.
[0068]
Further, the key generation / distribution means 401 in the key management master server 40 transmits the key information distribution messages 71 to 7p (see FIG. 6) having the pair of the key and the key ID to all the key management slave servers 41 to 4p. Also sent to.
[0069]
The key storage unit 4k1 in each key management slave server 4k stores a set of the key and the key ID in its own key management table 4k0.
[0070]
Second, the operation at the time of reception / decoding processing will be described.
[0071]
In the first embodiment, when the client 2j determines that “the decryption key corresponding to the key ID in the multicast packet is not in the own table” in the search (determination) in step B2 in FIG. At B3, the key information request 61 (see FIG. 2) is issued to the key management server 31 using the key ID included in the multicast packet received from the content server 1i.
[0072]
On the other hand, in the present embodiment, when issuing the key information request 61 (see FIG. 6), the client 2j sends the key information request 61 to any of the plurality of key management slave servers 41 to 4p. At this time, as a method of determining which key management slave server 4k to send to, there are, for example, the following two methods a and b.
[0073]
a. A method of determining in advance to which key management slave server 4k the key information request 61 is to be sent for each client 2j
[0074]
b. A method of changing the destination key management slave server 4k every time the client 2j sends the key information request 61 (round robin method)
[0075]
The decryption key sending means 4k2 in the key management slave server 4k that has received the key information request 61 searches its own key management table 4k0 using the key ID in the key information request 61 and corresponds to the key ID. A key is obtained, and a key information message 62 (see FIG. 6) having a pair of the obtained key (decryption key) and its key ID is returned to the client 2j which has issued the key information request 61 as a reply to the key information request 61. Send.
[0076]
Regarding operations other than those described above, the key management method for multicast distribution according to the present embodiment performs the same operation (process) as in the first embodiment (see FIGS. 3 and 4).
[0077]
As described above, in the present embodiment, since a plurality of key management slave servers 4k that receive the key information request 61 from the client 2j are prepared, the load of the key management server is smaller than that of the first embodiment. Can be dispersed.
[0078]
(3) Third embodiment
[0079]
FIG. 7 is a block diagram showing a configuration of a key management method for multicast distribution according to the third embodiment of the present invention.
[0080]
Referring to FIG. 7, the key management method for multicast distribution according to the present embodiment is similar to that of the first embodiment shown in FIG. 1, in that content servers 11, 12,. (N is a positive integer), clients 21, 22,..., 2m (m is a positive integer) for receiving the multicast packet, a key management server 31 for managing keys (encryption key / decryption key), and a content server 1i. (I is a positive integer of 1 to n), a client 2j (j is a positive integer of 1 to m), and a network 100 connecting the key management server 31. However, the content server 1i according to the present embodiment has a key change notice unit 1i3 as a component unique to the present embodiment.
[0081]
Comparing this embodiment (third embodiment) and the first embodiment, the basic configuration of this embodiment is the same as that of the first embodiment (see FIG. 1). Before the content server 1i changes the key used for encryption, the client 2j is notified of the key ID of the key to be newly used as a key change notice to the client 2j in advance, and new key information ( The difference is that a pair of a decryption key and a key ID) is obtained in advance from the key management server 31.
[0082]
Such a specific configuration / operation has a specific effect that when the encryption key is changed on the content server 1i side, the client 2j can decrypt the encrypted data with the changed key without delay on the client 2j side.
[0083]
FIG. 8 is a sequence diagram for explaining a specific operation of the key management method for multicast distribution according to the present embodiment.
[0084]
FIG. 9 is a flowchart showing key change notice related processing in the key management method for multicast distribution according to the present embodiment. This processing includes a key change preparation time arrival recognition step C1, a key creation request issuing step C2, a key generation step C3, a key ID assignment step C4, a key information key management table storage step C5, and a key information response message transmission. Step C6, key information encryption key table storage step C7, key change notice message multicast distribution step C8, decryption key presence / absence determination step C9, key information request issuing step C10, key management table search step C11, key information It comprises a message transmission step C12 and a key information decryption key table storage step C13.
[0085]
Next, with reference to FIGS. 7 to 9 (and FIGS. 1 to 4 as appropriate), the operation of the key management method for multicast distribution according to the present embodiment configured as described above will be described. The following description focuses on the differences from the first embodiment.
[0086]
As shown in FIG. 8, the client 2j (FIG. 8 shows the client 21 as a representative) receives a key ID and an encryption from the content server 1i (FIG. 8 shows the content server 11 as a representative). A multicast packet having data is received, and the encrypted data is decrypted with a key (decryption key) corresponding to the key ID. Such an operation is the same as the operation in the above-described first embodiment.
[0087]
Here, in the operation sequence shown in FIG. 8, in the period A, the multicast packet 91 having the key ID1 (the multicast packet having the data encrypted with the encryption key identified by the key ID1) is transmitted and received. In B, it is assumed that a multicast packet 92 having a key ID 2 (a multicast packet having data encrypted with an encryption key identified by the key ID 2) is transmitted and received.
[0088]
In the present embodiment, the following key change notice-related processing is performed on the assumption that the multicast packet is distributed as described above (see FIG. 9).
[0089]
The encryption key obtaining means 1i1 in the content server 1i recognizes that a certain point (arbitrary point in time before the point at which a new key is actually used, which is called a "key change preparation point") has been reached. Then (step C1), a key creation request 51 is sent to the key management server 31 to obtain a new key (step C2).
[0090]
In the example of FIG. 8, the content server 11 transmits a key creation request 51 to the key management server 31 at the key change preparation time point a.
[0091]
The key generation means 311 in the key management server 31 generates a key (encryption key and decryption key) requested by the key creation request 51 (step C3), assigns a key ID to the key (step C4), and The set of the ID and the key is stored in the key management table 310 (step C5), and the key information response message 52 having the set of the key ID and the key (encryption key) is transmitted to the content of the issuer of the key creation request 51. The data is transmitted to the server 1i (step C6).
[0092]
In the example of FIG. 8, the key management server 31 generates a key 2, assigns a key ID 2 to the key 2, and transmits a key information response message 52 having a pair of the key ID 2 and the key 2 to the content server 11.
[0093]
Upon receiving the key information response message 52, the encryption key obtaining means 1i1 in the content server 1i stores the key information of the new key (the pair of the received key and the key ID) in its own encryption key table 1i0 (step C7). ).
[0094]
Further, the key change notice means 1i3 in the content server 1i performs multicast distribution of the key change notice message 81 having the changed key ID and the key change notice at the stage of acquiring the new key ID and key pair. Perform (Step C8).
[0095]
In the example of FIG. 8, the content server 11 performs multicast distribution of the key change notice message 81 having the key change notice and the key ID2.
[0096]
The decryption key acquisition unit 2j1 in each client 2j that has received the key change notice message 81 searches its own decryption key table 2j0 using the key ID included in the key change notice message 81, and corresponds to the key ID. It is determined whether or not the key to be executed (decryption key) is in its own decryption key table 2j0 (own table) (step C9).
[0097]
If the decryption key obtaining means 2j1 determines in the search in step C9 that "there is no decryption key corresponding to the key ID", it uses the key ID included in the key change notice message 81 to request a key information request 61 Is issued to the key management server 31 (step C10). That is, the key management server 31 requests key information about the decryption key corresponding to the key ID. If it is determined in the search in step C9 that “there is a decryption key corresponding to the key ID”, the processing after step C10 becomes unnecessary, and the processing ends.
[0098]
In the example of FIG. 8, the client 21 issues a key information request having the key ID 2 to the key management server 31 in order to obtain a key (decryption key) corresponding to the key ID 2 included in the key change notice message 81. I do.
[0099]
The decryption key sending unit 312 in the key management server 31 that has received the key information request 61 searches the key management table 310 using the key ID in the key information request 61 and obtains a key corresponding to the key ID. (Step C11).
[0100]
Then, the decryption key sending unit 312 sends the key information message 62 having a pair of the key (decryption key) obtained from the key management table 310 and the key ID as a reply to the key information request 61, Is transmitted to the client 2j that has issued (step C12).
[0101]
Upon receiving the key information message 62 from the key management server 31, the decryption key acquisition unit 2j1 in the client 2j decrypts the multicast packet during the next period (for example, period B with respect to period A in FIG. 8). The pair of the decryption key and the key ID in the key information message 62 is stored in its own decryption key table 2j0 for use in the processing (step C13).
[0102]
In the example of FIG. 8, the key management server 31 returns a key information message 62 having a pair of a key ID 2 and a key 2 to the client 21, and the client 21 transmits the key (decryption key) 2 and a pair of the key ID 2. Is stored in its own decryption key table 210.
[0103]
Thereafter (in period B), the content server 11 uses the key (encryption key) 2 to encrypt the data to be distributed, and transmits a multicast packet 92 having the data encrypted with the key 2 and the key ID 2.
[0104]
The client 21 that has received the multicast packet 92 can immediately decrypt the encrypted data using the key (decryption key) 2 corresponding to the key ID 2 stored in the key management table 210. Become.
[0105]
Regarding operations other than those described above, operations (processes) similar to those of the first embodiment are performed in the present embodiment. However, in the series of processes shown in FIGS. 3 and 4, since the encryption key and the decryption key are obtained in advance, as long as the above-described change notice-related process is performed normally, the step A2 in FIG. The processing of A7 and the processing of steps B3 to B6 in FIG. 4 are not performed.
[0106]
In the first embodiment, the client 2j knows that the key has changed only by looking at the key ID included in the received multicast packet when the key has changed. Therefore, in many cases, the client 2j requests the key management server 31 to send a new key at that time, and acquires a new key in response to the request. In such a case, the client 2j cannot decrypt the encrypted data in the multicast packet having the new key ID until receiving the response.
[0107]
On the other hand, in the present embodiment (third embodiment), before actually changing the key, the content server 1i issues a key change notice to the client 2j, and newly uses the key 2j for the client 2j in advance. By obtaining the key, it is possible to decrypt the encrypted data with the new key without delay when changing the key.
[0108]
(4) Fourth embodiment
[0109]
FIG. 10 is a block diagram showing a configuration of a key management method for multicast distribution according to the fourth embodiment of the present invention.
[0110]
Referring to FIG. 10, the key management scheme for multicast distribution according to the fourth embodiment of the present invention is different from the key management scheme for multicast distribution according to the first embodiment shown in FIG. A key management program for content server 1001, a key management program for client 1002, and a key management server key management program 1003 are different.
[0111]
The content server key management program 1001 is read by the content server 1i, and controls the operation of the content server 1i as an encryption key table 1i0, an encryption key acquisition unit 1i1, and an encryption / transmission unit 1i2. The operation of the content server 1i under the control of the content server key management program 1001 (operation relating to the encryption key table 1i0, the encryption key acquisition unit 1i1, and the encryption / transmission unit 1i2) is the same as that of the content server 1i in the first embodiment. Since the operation is completely the same, a detailed description thereof will be omitted.
[0112]
The client key management program 1002 is read by the client 2j, and controls the operation of the client 2j as the decryption key table 2j0, the decryption key acquisition unit 2j1, and the reception / decryption unit 2j2. The operation of the client 2j under control of the client key management program 1002 (the operation relating to the decryption key table 2j0, the decryption key acquisition means 2j1, and the reception / decryption means 2j2) is exactly the same as the operation of the client 2j in the first embodiment. Since it becomes the same, detailed explanation is omitted.
[0113]
Further, the key management server key management program 1003 is read by the key management server 31, and controls the operation of the key management server 31 as the key management table 310, the key generation unit 311, and the decryption key sending unit 312. The operation of the key management server 31 under the control of the key management server key management program 1003 (operation relating to the key management table 310, the key generation unit 311, and the decryption key sending unit 312) is the same as that of the key management server 31 in the first embodiment. Since the operation is exactly the same as that described above, a detailed description thereof will be omitted.
[0114]
(5) Fifth embodiment
[0115]
FIG. 11 is a block diagram showing a configuration of a key management method for multicast distribution according to the fifth embodiment of the present invention.
[0116]
Referring to FIG. 11, the key management method for multicast distribution according to the fifth embodiment of the present invention is different from the key management method for multicast distribution according to the second embodiment shown in FIG. A key management program 1101, a client key management program 1102, a key management master server key management program 1103, and a key management slave server key management program 1104 are different.
[0117]
The content server key management program 1101 is read by the content server 1i and controls the operation of the content server 1i as an encryption key table 1i0, an encryption key acquisition unit 1i1, and an encryption / transmission unit 1i2. The operation of the content server 1i under the control of the content server key management program 1101 (operation relating to the encryption key table 1i0, the encryption key acquisition unit 1i1, and the encryption / transmission unit 1i2) is the same as that of the content server 1i in the second embodiment. Since the operation is completely the same, a detailed description thereof will be omitted.
[0118]
The client key management program 1102 is read by the client 2j, and controls the operation of the client 2j as the decryption key table 2j0, the decryption key acquisition unit 2j1, and the reception / decryption unit 2j2. The operation of the client 2j under the control of the client key management program 1102 (the operation relating to the decryption key table 2j0, the decryption key acquisition means 2j1, and the reception / decryption means 2j2) is exactly the same as the operation of the client 2j in the second embodiment. Since it becomes the same, detailed explanation is omitted.
[0119]
Further, the key management master server key management program 1103 is read by the key management master server 40 and controls the operation of the key management master server 40 as the key management table 400 and the key generation / distribution unit 401. The operation of the key management master server 40 under the control of the key management master server key management program 1103 (the operation relating to the key management table 400 and the key generation / distribution means 401) is the same as the operation of the key management master server 40 in the second embodiment. Since it is completely the same as above, its detailed explanation is omitted.
[0120]
In addition, the key management slave server key management program 1104 is read by the key management slave server 4k, and controls the operation of the key management slave server 4k as a key management table 4k0, a key storage unit 4k1, and a decryption key sending unit 4k2. I do. The operations of the key management slave server 4k (operations related to the key management table 4k0, the key storage unit 4k1, and the decryption key sending unit 4k2) under the control of the key management slave server key management program 1104 are the same as those in the second embodiment. Since the operation is completely the same as that of the slave server 4k, a detailed description thereof will be omitted.
[0121]
(6) Sixth embodiment
[0122]
FIG. 12 is a block diagram showing a configuration of a key management method for multicast distribution according to the sixth embodiment of the present invention.
[0123]
Referring to FIG. 12, the key management method for multicast distribution according to the sixth embodiment of the present invention is different from the key management method for multicast distribution according to the third embodiment shown in FIG. 3 in that a key management program for content server 1201, a key management program for client 1202, and a key management program for key management server 1203 are provided.
[0124]
The content server key management program 1201 is read by the content server 1i and controls the operation of the content server 1i as the encryption key table 1i0, the encryption key acquisition unit 1i1, the encryption / transmission unit 1i2, and the key change notice unit 1i3. . The operation of the content server 1i under the control of the content server key management program 1201 (the operation related to the encryption key table 1i0, the encryption key acquisition unit 1i1, the encryption / transmission unit 1i2, and the key change notice unit 1i3) is the third embodiment. Since the operation is exactly the same as the operation of the content server 1i in the embodiment, detailed description thereof will be omitted.
[0125]
The client key management program 1202 is read by the client 2j, and controls the operation of the client 2j as the decryption key table 2j0, the decryption key acquisition unit 2j1, and the reception / decryption unit 2j2. The operation of the client 2j under the control of the client key management program 1202 (the operation relating to the decryption key table 2j0, the decryption key acquisition means 2j1, and the reception / decryption means 2j2) is exactly the same as the operation of the client 2j in the third embodiment. Since it becomes the same, detailed explanation is omitted.
[0126]
Further, the key management server key management program 1203 is read by the key management server 31 and controls the operation of the key management server 31 as a key management table 310, a key generation unit 311, and a decryption key sending unit 312. The operation of the key management server 31 under the control of the key management server key management program 1203 (operation relating to the key management table 310, the key generation unit 311, and the decryption key sending unit 312) is the same as that of the key management server 31 in the third embodiment. Since the operation is exactly the same as that described above, a detailed description thereof will be omitted.
[0127]
【The invention's effect】
As described above, according to the present invention, in a network system in which multicast distribution of encrypted data is performed, when each distribution target data of a plurality of multicast distributions is encrypted by a different key, a different key is used. There is an effect that management of (encryption key / decryption key) can be easily realized.
[0128]
The reason for this effect is that a key ID for identifying the key used by the content server in the encryption process is included in a multicast packet having encrypted data and sent to the client. It is possible to know that the key used for encryption has changed, so even if the key used for encryption changes, the client side sends a new decryption key to the key management server side as necessary. This is because the request can be made, so that it is not necessary to manage information about the client on the key management server side or the content server side.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a key management method for multicast distribution according to a first embodiment of the present invention.
FIG. 2 is a block diagram for explaining the operation of the key management system for multicast distribution shown in FIG.
FIG. 3 is a flowchart showing encryption / transmission processing of a key management method for multicast distribution shown in FIG. 1;
FIG. 4 is a flowchart showing reception / decryption processing of the key management system for multicast distribution shown in FIG. 1;
FIG. 5 is a block diagram showing a configuration of a key management method for multicast distribution according to a second embodiment of the present invention.
FIG. 6 is a block diagram for explaining the operation of the key management method for multicast distribution shown in FIG.
FIG. 7 is a block diagram showing a configuration of a key management method for multicast distribution according to a third embodiment of the present invention.
8 is a flowchart showing a key change notice related process of the key management system for multicast distribution shown in FIG. 7;
FIG. 9 is a sequence diagram for explaining a specific operation of the key management system for multicast distribution shown in FIG. 7;
FIG. 10 is a block diagram showing a configuration of a key management method for multicast distribution according to a fourth embodiment of the present invention.
FIG. 11 is a block diagram showing a configuration of a key management method for multicast distribution according to a fifth embodiment of the present invention.
FIG. 12 is a block diagram showing a configuration of a key management system for multicast distribution according to a sixth embodiment of the present invention.
[Explanation of symbols]
11,12, ..., 1n Content server
21, 22, ..., 2m Client
31 Key Management Server
40 Key Management Master Server
41, ..., 4p key management slave server
51 Key creation request
52 Key information response message
61 Key information request
62 Key information message
71, ..., 7p Key information distribution message
81 Key change notice message
91,92 Multicast packet
100 networks
110, 120, ..., 1n0 encryption key table
111, 121,..., 1n1 Encryption key acquisition means
112, 122, ..., 1n2 encryption / transmission means
113, 123, ..., 1n3 Key change notice means
210, 220, ..., 2m0 decryption key table
211,221, ..., 2m1 decryption key acquisition means
212, 222, ..., 2m2 receiving / decoding means
310, 400, 410, ..., 4p0 key management table
311 Key generation means
312, 412, ..., 4p2 decryption key sending means
401 Key generation / distribution means
411, ..., 4p1 key storage means
1001,1101,1201 Content server key management program
1002, 1102, 1202 Client key management program
1003, 1203 Key management server key management program
1103 Key Management Master Server Key Management Program
1104 Key management program for key management slave server

Claims (10)

In a network system where multicast distribution of encrypted data is performed,
Key management that is arranged so as to be accessible from the content server group and the client group, and manages keys by holding a set of an encryption key / decryption key and a key ID for uniquely identifying the key. Server and
A content server that receives a set of an encryption key and its key ID from the key management server and transmits a multicast packet having data encrypted with the encryption key and the key ID to a group of clients;
A multicast packet is received from the content server, a decryption key corresponding to a key ID included in the multicast packet is obtained from the key management server, and the decryption key is used to decrypt encrypted data included in the multicast packet. A key management method for multicast distribution, comprising: a client; 2. The key management system for multicast distribution according to claim 1, wherein load distribution is enabled by dividing the key management server into a key management master server and a plurality of key management slave servers. When the content server changes the key to be used, it performs multicast distribution of the key change notice in advance and prompts the client to obtain a new decryption key from the key management server, so that the key can be decrypted without delay even when the key is changed 3. The key management method for multicast distribution according to claim 1, wherein the key management method is capable of performing the following. In a network system where multicast distribution of encrypted data is performed,
A key management table in a key management server that holds a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key;
Upon receiving the key creation request from the content server, an encryption key / decryption key is generated, a key ID is assigned to the key, and a set of the generated encryption key / decryption key and the key ID is stored in the key management table. Key generation means in the key management server for returning a key information response message having a pair of the encryption key and the key ID to the content server;
When a key information request is received from the client, a key corresponding to the key ID in the key information request is searched from the key management table, and a key information message having a pair of a decryption key and a key ID of the search result is sent to the client. A decryption key sending means in the key management server to be returned,
A key creation request is issued to the key management server to obtain the encryption key during the multicast distribution and the encryption key table in the content server holding the pair of the encryption key and the key ID, and the key generation request is received as a response. An encryption key acquisition unit in the content server that stores a set of an encryption key and a key ID in the key information response message in the encryption key table;
A data packet to be distributed is encrypted using an encryption key acquired by the encryption key acquisition means and held in the encryption key table, and a multicast packet having the encrypted data and a key ID corresponding to the encryption key Encryption / transmission means in the content server for transmitting the
A decryption key table in the client holding a pair of a decryption key and its key ID;
When a multicast packet is received, a decryption key corresponding to the key ID in the multicast packet is searched from the decryption key table, and if there is a corresponding decryption key, the decryption key is obtained. Transmits a key information request using the key ID as a key to the key management server, obtains a decryption key in a key information message transmitted from the key management server as a reply to the key information request, and Decryption key acquisition means in the client for storing a set of
Receiving and decoding means in the client for receiving the multicast packet and decoding the encrypted data in the multicast packet using the decoding key acquired by the decoding key acquiring means. Key management method for distribution. In a network system where multicast distribution of encrypted data is performed,
A key management table in a key management master server and a key management slave server that holds a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key;
When a key creation request is received from the content server, an encryption key / decryption key is generated, a key ID is assigned to the key, and a set of the generated encryption key / decryption key and the key ID is stored in the key management master server. The key information response message having the set of the encryption key and the key ID is returned to the content server, and the key information distribution message having the set of the encryption key / decryption key and the key ID is stored in the management table. Key generation / distribution means in the key management master server to be distributed to all key management slave servers;
In the key management slave server storing the set of the encryption key / decryption key and the key ID in the key information distribution message distributed by the key generation / distribution means in the key management table in the key management slave server in which the self exists. Key storage means,
When a key information request is received from the client, a key corresponding to the key ID in the key information request is searched for from the key management table in the key management slave server in which the key exists, and the decryption key and the key ID of the search result are searched for. Decryption key sending means in a key management slave server for returning a key information message having a pair to the client;
Issue a key creation request to the key management master server to obtain the encryption key during the multicast distribution and the encryption key table in the content server that holds the pair of the encryption key and its key ID, and receive it as a response Encryption key obtaining means in the content server for storing a set of an encryption key and a key ID in the key information response message thus obtained in the encryption key table;
A data packet to be distributed is encrypted using an encryption key acquired by the encryption key acquisition means and held in the encryption key table, and a multicast packet having the encrypted data and a key ID corresponding to the encryption key Encryption / transmission means in the content server for transmitting the
A decryption key table in the client holding a pair of a decryption key and its key ID;
When a multicast packet is received, a decryption key corresponding to the key ID in the multicast packet is searched from the decryption key table, and if there is a corresponding decryption key, the decryption key is obtained. Transmits a key information request using the key ID as a key to any of the key management slave servers, and decrypts the key information message transmitted from the key management slave server as a reply to the key information request. A decryption key acquisition unit in the client that acquires a key and stores a set of the decryption key and its key ID in the decryption key table;
Receiving and decoding means in the client for receiving the multicast packet and decoding the encrypted data in the multicast packet using the decoding key acquired by the decoding key acquiring means. Key management method for distribution. In a network system where multicast distribution of encrypted data is performed,
A key management table in a key management server that holds a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key;
Upon receiving the key creation request from the content server, an encryption key / decryption key is generated, a key ID is assigned to the key, and a set of the generated encryption key / decryption key and the key ID is stored in the key management table. Key generation means in the key management server for returning a key information response message having a pair of the encryption key and the key ID to the content server;
When a key information request is received from the client, a key corresponding to the key ID in the key information request is searched from the key management table, and a key information message having a pair of a decryption key and a key ID of the search result is sent to the client. A decryption key sending means in the key management server to be returned,
An encryption key table in a content server that holds a set of an encryption key and its key ID, and a key management server for obtaining an encryption key to be used next in advance when a key change preparation time is reached. An encryption key acquisition unit in the content server that issues a creation request and stores a set of an encryption key and a key ID in a key information response message received as a response in the encryption key table;
A data packet to be distributed is encrypted using an encryption key acquired by the encryption key acquisition means and held in the encryption key table, and a multicast packet having the encrypted data and a key ID corresponding to the encryption key Encryption / transmission means in the content server for transmitting the
A key change notification unit in the content server that performs multicast distribution of a key change notification message having a key ID of the encryption key when the encryption key to be used next is obtained by the encryption key obtaining unit;
A decryption key table in the client holding a pair of a decryption key and its key ID;
Upon receiving the key change notice message, the decryption key corresponding to the key ID in the key change notice message is searched from the decryption key table, and if there is no corresponding decryption key, the key ID is sent to the key management server. The key information request, and obtains the decryption key in the key information message transmitted from the key management server as a reply to the key information request, and stores the set of the decryption key and its key ID in the decryption key table. Decryption key acquisition means in the client to be stored;
A multicast packet is received, and the decryption key of the encrypted data in the multicast packet is acquired by using the decryption key acquired in advance by the decryption key acquisition means and held in the decryption key management table and corresponding to the key ID in the multicast packet. A key management system for multicast distribution, comprising a receiving / decoding means in a client for performing decoding. 3. The content server according to claim 1, wherein a plurality of pairs of encryption keys and key IDs are held at the same time, and an encryption key used in multicast distribution can be changed as needed. A key management method for multicast distribution according to claim 3, claim 4, claim 5, claim 5, or claim 6. In a network system where multicast distribution of encrypted data is performed,
When the key management server receives a key creation request from the content server, a key management table holding a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key, the key management server generates an encryption key / decryption key. A key ID is assigned to the key, and a set of the generated encryption key / decryption key and the key ID is stored in the key management table, and a key information response message having the pair of the encryption key and the key ID is transmitted to the key management table. Upon receiving the key information request from the key generation means and the client, the key corresponding to the key ID in the key information request is searched from the key management table, and the key of the decryption key and the key ID of the search result are searched. A key management server key management program for functioning as a decryption key sending means for returning a key information message having a set to the client;
The content server issues a key creation request to the key management server to obtain the encryption key during the multicast distribution, an encryption key table holding a pair of the encryption key and its key ID, and the key received as a response An encryption key acquiring unit for storing a pair of an encryption key and a key ID in the information response message in the encryption key table, and distributing using the encryption key acquired by the encryption key acquisition unit and held in the encryption key table; A content server key management program for encrypting the target data and functioning as an encryption / transmission unit for transmitting a multicast packet having the encrypted data and a key ID corresponding to the encryption key;
When a client receives a multicast packet from a decryption key table holding a pair of a decryption key and its key ID, the client searches the decryption key table for a decryption key corresponding to the key ID in the multicast packet. If there is, obtain the decryption key, and if there is no corresponding decryption key, send a key information request using the key ID as a key to the key management server. A decryption key acquiring means for acquiring a decryption key in a key information message transmitted from a server, storing a set of the decryption key and its key ID in the decryption key table, and receiving a multicast packet; Means for functioning as a receiving / decrypting means for decrypting the encrypted data in the multicast packet using the decryption key obtained by the means. Key Management Scheme for multicast distribution characterized by having a Ianto key management program. In a network system where multicast distribution of encrypted data is performed,
When the key management master server receives a key creation request from the content server and a key management table holding a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key, the key management master server sends the encryption key / decryption key to the key management master server. Generates and assigns a key ID to the key, stores a set of the generated encryption key / decryption key and the key ID in the key management table in the key management master server, and sets the set of the encryption key and the key ID. Functioning as key generation / distribution means for returning a key information response message having a key information distribution message having the set of the encryption key / decryption key and the key ID to all key management slave servers. A key management program for a key management master server for causing
The key management slave server uses a key management table for holding a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key, and a key in the key information distribution message distributed by the key generation / distribution unit. A key storage unit for storing a set of a key / decryption key and a key ID in the key management table in the key management slave server in which the key / decryption key exists, and a key information request from the client when receiving the key information request from the client. As a decryption key sending means for searching the key management table in the key management slave server in which the self exists for the key corresponding to, and returning a key information message having a pair of the decryption key and the key ID of the search result to the client. A key management program for a key management slave server to function;
The content server issues a key creation request to the key management master server to obtain the encryption key during the multicast distribution, the encryption key table holding the pair of the encryption key and the key ID, and receives the response in response to the key creation request. An encryption key acquisition unit for storing a pair of an encryption key and a key ID in the key information response message in the encryption key table, and an encryption key acquired by the encryption key acquisition unit and held in the encryption key table. A content server key management program for encrypting data to be distributed, and for functioning as an encryption / transmission unit for transmitting a multicast packet having the encrypted data and a key ID corresponding to the encryption key;
When a client receives a multicast packet from a decryption key table holding a pair of a decryption key and its key ID, the client searches the decryption key table for a decryption key corresponding to the key ID in the multicast packet. If there is, obtain the decryption key, and if there is no corresponding decryption key, send a key information request with the key ID as a key to any of the key management slave servers, and obtain the key information Decryption key acquisition means for acquiring a decryption key in a key information message transmitted from the key management slave server as a reply to the request, storing a set of the decryption key and its key ID in the decryption key table, and a multicast packet And decrypting the encrypted data in the multicast packet using the decryption key obtained by the decryption key obtaining means. Key Management Scheme for multicast distribution characterized by having a client key management program for functioning as a decoding means. In a network system where multicast distribution of encrypted data is performed,
When the key management server receives a key creation request from the content server, a key management table holding a set of an encryption key / decryption key and a key ID for uniquely distinguishing the key, the key management server generates an encryption key / decryption key. A key ID is assigned to the key, and a set of the generated encryption key / decryption key and the key ID is stored in the key management table, and a key information response message having the pair of the encryption key and the key ID is transmitted to the key management table. Upon receiving the key information request from the key generation means and the client, the key corresponding to the key ID in the key information request is searched from the key management table, and the key of the decryption key and the key ID of the search result are searched. A key management server key management program for functioning as a decryption key sending means for returning a key information message having a set to the client;
An encryption key table holding a pair of an encryption key and its key ID, and when a key change preparation time is reached, the content server creates a key for the key management server in order to obtain an encryption key to be used next in advance. A request for issuing a request and storing a set of an encryption key and a key ID in the key information response message received as a response to the request in the encryption key table; Encrypting / transmitting means for encrypting data to be distributed using the held encryption key and transmitting a multicast packet having the encrypted data and a key ID corresponding to the encryption key; When a key acquisition unit acquires a next encryption key to be used next, a key change notice person who performs multicast distribution of a key change notice message having a key ID of the encryption key. And key management program for the content server to function as,
When the client receives a key change notice message, a decryption key table holding a set of a decryption key and its key ID, the client searches the decryption key table for a decryption key corresponding to the key ID in the key change notice message, If there is no corresponding decryption key, a key information request using the key ID as a key is transmitted to the key management server, and the decryption key in the key information message transmitted from the key management server as a reply to the key information request is transmitted. A decryption key acquisition unit that acquires and stores a set of the decryption key and its key ID in the decryption key table; and receives a multicast packet and acquires in advance by the decryption key acquisition unit and stores in the decryption key management table. Receiving and decrypting the encrypted data in the multicast packet using the decryption key corresponding to the key ID in the multicast packet. Key Management Scheme for multicast distribution characterized by having a client key management program for functioning as Goka means.

Images