JP2005260852A - Information processing method, decoding processing method, information processing apparatus and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a configuration which enables it to reduce the amount of information which should be stored in a device which performs encrypted message decoding in an encrypted message provisioning configuration which applies a tree structure based on an SD system. <P>SOLUTION: The value of corresponding label to partial special subset among corresponding label to subsets of each established based on SD system or LSD system is set as a calculable value by one which applies monodirectivity function F to other label value. In a receiver, a label corresponding to un-subset specially, and the minimum label corresponding to a special subset except the label computable with the application of monodirectivity function F to the provisioning label to the receiver as the label corresponding to the subset specially are provided. With this configuration, the reduction of the number of labels which the receiver should be provided can be performed. About the reduction label, in the receiver side, monodirectivity function F is applied to the held label, and it can be calculated. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an information processing method, a decoding processing method, an information processing apparatus, and a computer program. Further, in detail, in the Subscriber Difference (SD) method currently known in the broadcast encryption method to which the hierarchical tree structure is applied, and in the Layered Subset Difference (LSD) method, a label that the receiver needs to hold safely The present invention relates to an information processing method, a decryption processing method, an information processing apparatus, and a computer program that reduce the amount of secret information and realize efficient and secure information distribution.

  Recently, various software data (hereinafter referred to as content) such as audio data such as music, image data such as movies, game programs, various application programs, etc. are transmitted via a network such as the Internet or It is distributed through information recording media (media) such as CD (Compact Disc), DVD (Digital Versatile Disk), MD (Mini Disk). These distributed contents are reproduced and used in various information processing apparatuses such as PCs (Personal Computers), players, and game machines owned by users.

  Many contents, such as music data and image data, generally have distribution rights or the like held by the creator or seller. Therefore, when distributing these contents, it is common to adopt a configuration that restricts the use of the contents, that is, permits the use of the contents only to authorized users and prevents unauthorized copying or the like. It is the target.

  In particular, in recent years, recording devices and storage media for digitally recording information are becoming widespread. According to such a digital recording apparatus and storage medium, for example, recording and reproduction can be repeated without degrading images and sound, distribution of illegally copied content via the Internet, recording of CD-R, etc. There is a problem of unauthorized copying of media.

  As one method for preventing such unauthorized use of content, a key for decrypting content or encrypted content is encrypted and distributed, and only a specific authorized user or authorized device can decrypt the distribution data. There is a system. For example, a configuration using a hierarchical tree structure, which is an aspect of the broadcast encryption method, is known.

  A process for providing encrypted data such as an encryption key to which a hierarchical tree structure is applied will be described with reference to the drawings.

  The hierarchical tree structure shown in FIG. 1 uses a binary tree, the lowest layer of which is called a leaf (leaf), and a portion including a vertex, each branching portion, and a leaf is called a node. The vertex is called a root or a root node. In the binary tree hierarchical tree structure shown in FIG. 1, the leaves are 8 to 15, the nodes are 1 to 15, and the root is 1.

  Information processing devices such as a playback device and a receiver as content use devices are assigned to the leaves 8 to 15 in the binary tree hierarchical tree structure one by one.

  One node key is assigned to each node (including leaves) 1 to 15 of the tree. Node keys assigned to the leaves 8 to 15 may be called leaf keys.

  Each information processing apparatus corresponding to a leaf is given a node key assigned to a node on the path from the corresponding leaf to the root. In the configuration of FIG. 1, there are eight information processing devices assigned to the leaves 8 to 15, and node keys are assigned to the nodes 1 to 15, respectively. Four node keys assigned to the nodes 1, 2, 4 and 8 are given. The information processing apparatus 102 corresponding to the leaf 12 is given four node keys assigned to the nodes 1, 3, 6, and 12. Each information processing apparatus securely stores these node keys.

  A method of transmitting information that can be acquired only by the selected information processing apparatus using the setting accompanying the node key distribution process will be described with reference to FIG. For example, in order to decrypt encrypted content obtained by encrypting content such as specific music and image data by broadcast distribution or storing it in a recording medium such as a DVD so that anyone can obtain it, and decrypting the encrypted content Is assumed to provide the key (content key Kc) only to a specific user, that is, a user having an authorized content use right or an information processing apparatus.

  It is assumed that the information processing apparatus assigned to the leaf 14 shown in FIG. 2 is excluded (revoked) as an unauthorized device, and other information processing apparatuses are legitimate information processing apparatuses. In this case, the information processing device assigned to the leaf 14 cannot acquire the content key Kc, but other information processing devices generate a ciphertext that can acquire the content key Kc and record the ciphertext via the network or Store and distribute on media.

  In this case, among the node keys other than the node key (represented by x in FIG. 2) of the information processing device to be revoked (excluded), the key shared by as many information processing devices as possible, that is, the one located above the tree It is only necessary to encrypt the content key and transmit it using

In the example shown in FIG. 2, a set of ciphertexts in which the content key Kc is encrypted is generated and provided using the node keys of the nodes 2, 6, and 15. That is,
E (NK ₂ , Kc), E (NK ₆ , Kc), E (NK ₁₅ , Kc)
Is generated and stored in a network distribution or recording medium. E (A, B) means data obtained by encrypting data B with the key A. NKn means the n-th node key shown in the figure. Therefore, the above formula is
The encrypted data E (NK ₂ , Kc) obtained by encrypting the content key Kc with the node key NK ₂ , the encrypted data E (NK ₆ , Kc) obtained by encrypting the content key Kc with the node key NK ₆ , and the content key Kc This means that it is a set of three ciphertexts including encrypted data E (NK ₁₅ , Kc) encrypted with the node key NK ₁₅ .

If the above three ciphertexts are created and transmitted to all information processing devices using, for example, a broadcast channel, any information processing device that is not a revoke target (information processing device corresponding to leaves 8 to 13 and 15 shown in FIG. 2) Such a ciphertext can be decrypted with the node key that it has, and the content key Kc can be obtained. However, the information processing apparatus corresponding to the revoked leaf 14 does not have any of the three node keys NK ₂ , NK ₆ , and NK ₁₅ applied to the above three ciphertexts. Even if the sentence is received, the decryption process cannot be performed and the content key Kc cannot be obtained.

  The above-described broadcast encryption method is called a complete subtree method. When information distribution is performed using such a tree structure, the number of messages to be broadcast increases as the number of information processing devices (user devices) corresponding to leaves increases, and each information processing device (user device) can safely There is a problem that key information such as node keys to be stored also increases.

  As a method for solving such a problem, there are a subset difference (SD) method and a layered subset difference (LSD) method, which is an improved version, as a method proposed so far. The SD method is described in Non-Patent Document 1, for example, and the LSD method is described in Non-Patent Document 2, for example.

  In any system, the total number of receivers (recipients) in the broadcast encryption system is N, and the number of receivers that are excluded (revoked), that is, cannot receive confidential information that is broadcast, is r. In this case, the number of messages (ciphertext) to be broadcast is O (r), which is smaller and better than other methods such as the above-mentioned Complete Subtree method.

However, the number of keys (labels) that each receiver should hold in a secure memory is O (log ² N) in the SD method and O (log ^{1 + εN} ) in the LSD method. Here, ε is an arbitrary positive number. The number of keys is larger than that of other systems such as the Complete Subtree system, and it is an issue to reduce this number. In the present specification, the bottom of the log is 2 unless otherwise specified.
Advances in Cryptography-Crypto 2001, Lecture Notes in Computer Science 2139, Springer, 2001 pp. 41-62 “D. Naor, M. Naor and J. Lotspiech,“ Revocation and Tracing Schemes for Stateless Receivers ”” Advances in Cryptography-Crypto 2002, Lecture Notes in Computer Science 2442, Springer, 2002, pp 47-60 "D. Halevy and A. Shamir" The The LSD

  The present invention has been made in view of such circumstances, and is a relatively efficient configuration in an information distribution configuration to which a hierarchical tree structure, which is an aspect of a broadcast encryption method, is applied. Secret information such as a label that the receiver needs to hold securely by applying a one-way tree described below to the Subscriber Difference (SD) method and the Layered Subset Difference (LSD) method It is an object to provide an information processing method, a decryption processing method, an information processing apparatus, and a computer program that reduce the amount of data and realize efficient and secure information distribution.

The first aspect of the present invention is:
An information processing method for applying a broadcast encryption method based on a hierarchical tree configuration and generating a hierarchical tree that is applied to a ciphertext providing process that can be decrypted only to a specific selected device except for an exclusion (revoke) device,
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method to which a hierarchical tree is applied, the label values corresponding to some selected special subsets are displayed as labels corresponding to other special subsets. Generating a label set as a value that can be calculated by applying the one-way function F to the value of
Determining a provided label for a receiver corresponding to an end node of the hierarchical tree;
A special subset incompatible label that does not correspond to the special subset;
A label corresponding to the special subset, excluding the label that can be calculated by applying the one-way function F to the label provided to the receiver, and a label corresponding to the minimum special subset;
A provided label determining step for determining as a provided label for the receiver;
There is an information processing method characterized by comprising:

  Furthermore, in an embodiment of the information processing method of the present invention, the information processing method further includes an encryption process by selectively applying a subset key derived from each label corresponding to the subset generated in the label generation step. To generate a ciphertext and provide the receiver with the ciphertext generation step.

Furthermore, in an embodiment of the information processing method of the present invention, the special subset selected in the label generation step is a portion of a hierarchical tree having a node j at a node lower than the node i as a vertex from a partial tree having the node i as a vertex. Among the subsets S _{i, j} defined as a set excluding the tree, the first special subset in which the node i and the node j are directly connected in the hierarchical tree and the root including all the leaves of the hierarchical tree are set as vertices. It is at least one of the second special subset which is the subset S1 _{, φ} defined as a set of whole trees.

  Furthermore, in an embodiment of the information processing method of the present invention, the label generation step includes a special subset selected in a label (LABEL) corresponding to each subset set based on a SD (Subset Difference) method in the hierarchical tree. This is a step of generating a label that can be calculated by applying the one-way function F to the value of another special subset set immediately below the special subset.

Furthermore, in one embodiment of the information processing method of the present invention, the label generation step determines _N values: x _{N to} x _2N−1 in a hierarchical tree having a binary tree structure with N terminal nodes. And i = (2N−1) to 1 when i = (2N−1) to 1, and when i = even, the unidirectional function F is applied and F (x _i ) is calculated. X _{i / 2,} and by the processing of each of the above steps, in the binary tree configuration with the number of end nodes N, label values corresponding to 2N−1 special subsets: x _{1 to} x _{And 2N-1} is determined.

Furthermore, in an embodiment of the information processing method of the present invention, the provided label determination step starts from an internal node i on a path m (path-m) from a leaf to which the receiver um is allocated to a root. And a whole tree including the label LABEL _{i, j} of the subset S _{i, j} corresponding to the node j directly branched from the path from the leaf to i and all receivers used when there is no revoke receiver The label LABEL _{1, φ} corresponding to the subset SS _{1, φ} corresponding to is used as a temporary selection label, and (a) a first special in which node i and node j are in a parent-child relationship in the following conditions: subset SS i _{such, j,} and, second special subset SS 1 corresponding to the entire tree including all receivers to be used when the receiver is to be revoked is no _{single, phi} Neu From the label LABEL _{i, j} corresponding to the subset which is not shifted, and (b) from the temporarily selected label, any one of the first special subset SS _{i, j} and the second special subset SS _{1, φ} a corresponding label, (b1) is a node node y is included in PathNodes-m, and the value _{x y} which corresponds to the value y is a node that is not included in the (b2) node 2y is PathNodes-m In this step, a label that satisfies the corresponding label LABEL _{i, j} and the condition (a) or (b) is determined as a final provided label for the receiver um.

Furthermore, in an embodiment of the information processing method of the present invention, the provided label determination step includes a label [X _y ] corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver. x _y = LABEL _{P (y), S (y)} ] in addition to j labels (where j is 0 or more and log N, N is the number of terminal nodes in the hierarchical tree = the number of receivers) In this step, the number of provided labels corresponding to the special subset is set.

  Furthermore, in one embodiment of the information processing method of the present invention, the one-way function F is MD4, MD5, or SHA-1.

  Furthermore, in an embodiment of the information processing method of the present invention, the label determining step includes a basic LSD (Basic Layered Subset Difference) system having a subset management configuration for each layer separated by one special level set in a hierarchical tree. Among the labels (LABEL) corresponding to each of the subsets set according to the above, the values of the labels corresponding to the selected special subsets are calculated by applying the one-way function F to the labels (LABEL) corresponding to different special subsets. It is a step of setting as a possible value.

  Furthermore, in an embodiment of the information processing method according to the present invention, the label determination step includes a general layered subset difference (LSD) having a subset management configuration for each layer separated by a plurality of special levels set in a hierarchical tree. Among the labels (LABEL) corresponding to each subset set according to the method, the label values corresponding to some selected special subsets are calculated by applying the one-way function F to the labels (LABEL) values corresponding to different special subsets. It is a step of setting as a possible value.

Furthermore, the second aspect of the present invention provides
A decryption processing method for performing decryption processing of ciphertext encrypted by a subset key corresponding to each subset set based on a SD (Subset Difference) scheme that is a broadcast encryption scheme based on a hierarchical tree configuration,
A ciphertext selection step of selecting a ciphertext generated by applying a subset key derivable by a pseudo-random number generation process based on a label held by the ciphertext or a label that can be calculated from the label held by the ciphertext; ,
Label calculation for applying a one-way function F to a retained label and calculating a label different from the retained label when the applied subset key of the ciphertext is not a subset key that can be derived by a pseudo-random number generation process based on the retained label Steps,
Generating a subset key by a pseudo-random number generation process based on a retained label or a calculated label;
A decryption step of performing decryption processing of the ciphertext by applying the generated subset key;
A decoding processing method characterized by comprising:

Furthermore, in one embodiment of the decryption processing method of the present invention, the label calculating step includes applying the ciphertext subset key to a node j below the node i from the subtree having the node i as a vertex in the hierarchical tree. Among the subsets S _{i, j} defined as a set excluding the subtree to be processed, the first special subset in which the node i and the node j are directly connected in the hierarchical tree, or the root including all the leaves of the hierarchical tree. A subset key that can be calculated by a pseudorandom number generation process based on a label corresponding to any special subset of the second special subset that is the subset S1 _{, φ} defined as a set of whole trees as vertices, and the special subset When the corresponding label is not held, the special function F is applied to the other held labels to apply the special feature F. It is a step of calculating a label corresponding to another subset.

  Furthermore, in an embodiment of the decoding processing method of the present invention, the label calculating step corresponds to a special subset including a node on a path from a setting node of a receiver that performs decoding processing to a root in the hierarchical tree. It is a step of executing the calculation of the label to be applied by applying a one-way function.

  Furthermore, in one embodiment of the decoding processing method of the present invention, the one-way function F is MD4, MD5, or SHA-1.

Furthermore, the third aspect of the present invention provides
An information processing apparatus that applies a broadcast encryption method based on a hierarchical tree configuration and generates a hierarchical tree that is applied to a ciphertext providing process that can be decrypted only by a specific selected device other than an exclusion (revocation) device,
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method to which a hierarchical tree is applied, the label values corresponding to some selected special subsets are displayed as labels corresponding to other special subsets. Label generating means for generating a label set as a value that can be calculated by applying the one-way function F to the value of
Provided label determining means for determining a provided label for a receiver corresponding to a terminal node of the hierarchical tree;
A special subset incompatible label that does not correspond to the special subset;
Providing a label corresponding to the special subset, the minimum special subset-corresponding label excluding the label that can be calculated by applying the one-way function F to the provided label to the receiver, as the provided label for the receiver Label determining means;
There is an information processing apparatus characterized by having.

  Furthermore, in an embodiment of the information processing apparatus of the present invention, the information processing apparatus further performs an encryption process by selectively applying a subset key derived from each label corresponding to the subset generated by the label generation means. And ciphertext generating means for generating a ciphertext and ciphertext providing means for providing the ciphertext to the receiver.

Furthermore, in an embodiment of the information processing apparatus according to the present invention, the special subset selected by the label generating means is a portion of a hierarchical tree having a node j as a vertex below a node j lower than the node i from a partial tree having the node i as a vertex. Among the subsets S _{i, j} defined as a set excluding the tree, the first special subset in which the node i and the node j are directly connected in the hierarchical tree and the root including all the leaves of the hierarchical tree are set as vertices. It is at least one of the second special subset which is the subset S1 _{, φ} defined as a set of whole trees.

  Furthermore, in an embodiment of the information processing apparatus of the present invention, the label generation means includes a special subset selected from labels (LABELs) corresponding to each of the subsets set based on the SD (Subset Difference) scheme in the hierarchical tree. Is generated by applying the one-way function F to the value of the other special subset set immediately below the special subset.

Furthermore, in one embodiment of the information processing apparatus of the present invention, the label generating means determines _N values: x _{N to} x _2N−1 in a hierarchical tree having a binary tree structure with N terminal nodes. Perform an initial setting of i = 2N−1, and if i = (2N−1) to 1, i = even, apply a one-way function F to calculate F (x _i ), x _{i / 2} is set, and by the above processes, 2N-1 label values corresponding to special subsets: x _{1 to} x _2N-1 are determined in a binary tree configuration with N terminal nodes. It is the structure which carries out.

Furthermore, in one embodiment of the information processing apparatus of the present invention, the provided label determination means starts the internal node i on the path m (path-m) from the leaf to which the receiver um is assigned to the root. And a whole tree including the label LABEL _{i, j} of the subset S _{i, j} corresponding to the node j directly branched from the path from the leaf to i and all receivers used when there is no revoke receiver The labels LABEL _{1 and φ} corresponding to the subset SS _{1 and φ} corresponding to
(A) The first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship in the temporarily selected label, and all receivers used when there is no receiver to be revoked A label LABEL _{i, j} corresponding to a subset that is not _one of the second special subset SS _{1, φ} corresponding to the whole tree;
(B) a label corresponding to one of the first special subset SS _{i, j} and the second special subset SS _{1, φ} from a provisionally selected label;
(B1) The node y is a node included in PathNodes-m, and
(B2) node 2y corresponds to the value _{x y} which corresponds to the value y is a node that is not included in PathNodes-m label LABEL _i, and _j,
A label that satisfies the above condition (a) or (b) is determined as a final provided label for the receiver um.

Furthermore, in an embodiment of the information processing apparatus of the present invention, the provided label determination means includes a label [X _y ] corresponding to a corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver. x _y = LABEL _{P (y), S (y)} ] in addition to j labels (where j is 0 or more and log N, N is the number of terminal nodes in the hierarchical tree = the number of receivers) The number of provided labels corresponding to the special subset is set as a feature.

  Furthermore, in one embodiment of the information processing apparatus of the present invention, the one-way function F is MD4, MD5, or SHA-1.

  Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label determination means includes a basic LSD (Basic Layered Subset Difference) system having a layer-by-layer subset management configuration separated by one special level set in a hierarchical tree. Among the labels (LABEL) corresponding to each of the subsets set according to the above, the values of the labels corresponding to the selected special subsets are calculated by applying the one-way function F to the labels (LABEL) corresponding to different special subsets. It is the structure set as a possible value, It is characterized by the above-mentioned.

  Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label determination unit includes a general layered subset difference (LSD) having a subset management configuration for each layer separated by a plurality of special levels set in a hierarchical tree. Among the labels (LABEL) corresponding to each subset set according to the method, the label values corresponding to some selected special subsets are calculated by applying the one-way function F to the labels (LABEL) values corresponding to different special subsets. It is the structure set as a possible value, It is characterized by the above-mentioned.

Furthermore, the fourth aspect of the present invention provides
An information processing apparatus that executes decryption processing of ciphertext encrypted by a subset key corresponding to each subset set based on a SD (Subset Difference) scheme that is a broadcast encryption scheme based on a hierarchical tree configuration,
A ciphertext selection means for selecting a ciphertext generated by applying a subset key derivable by a pseudorandom number generation process based on a label held by the ciphertext or a label that can be calculated from the label held by the ciphertext; ,
Label calculation for applying a one-way function F to a retained label and calculating a label different from the retained label when the applied subset key of the ciphertext is not a subset key that can be derived by a pseudo-random number generation process based on the retained label Means,
Subset key generation means for generating a subset key by a pseudo-random number generation process based on a retained label or a calculated label;
Decryption means for performing decryption processing of the ciphertext by applying the generated subset key;
There is an information processing apparatus characterized by having.

Furthermore, in one embodiment of the information processing apparatus of the present invention, the label calculation means uses the ciphertext applied subset key as a vertex from a subtree having the node i as a vertex in the hierarchical tree and a node j lower than the node i. Among the subsets S _{i, j} defined as a set excluding the subtree to be processed, the first special subset in which the node i and the node j are directly connected in the hierarchical tree, or the root including all the leaves of the hierarchical tree. A subset key that can be calculated by a pseudorandom number generation process based on a label corresponding to any special subset of the second special subset that is the subset S1 _{, φ} defined as a set of whole trees as vertices, and the special subset When the corresponding label is not held, the special support is applied by applying the one-way function F to other held labels. It is the structure which calculates the label corresponding to busset.

  Furthermore, in an embodiment of the information processing apparatus according to the present invention, the label calculation means corresponds to a special subset including a node on a path from a setting node of a receiver that performs decoding processing to a root in the hierarchical tree. This is characterized in that the calculation of the label to be performed is executed by applying a one-way function.

  Furthermore, in one embodiment of the information processing apparatus of the present invention, the one-way function F is MD4, MD5, or SHA-1.

Furthermore, the fifth aspect of the present invention provides
A computer program that generates a hierarchical tree that is applied to a ciphertext providing process that can be decrypted only by a specific selected device other than an exclusion (revoke) device by applying a broadcast encryption method based on a hierarchical tree configuration,
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method to which a hierarchical tree is applied, the label values corresponding to some selected special subsets are displayed as labels corresponding to other special subsets. Generating a label set as a value that can be calculated by applying the one-way function F to the value of
Determining a provided label for a receiver corresponding to an end node of the hierarchical tree;
A special subset incompatible label that does not correspond to the special subset;
A label corresponding to the special subset, excluding a label that can be calculated by applying a one-way function F to the label provided to the receiver;
A provided label determining step for determining as a provided label for the receiver;
There is a computer program characterized by comprising:

  Furthermore, in an embodiment of the computer program of the present invention, the computer program further applies an encryption process by selectively applying a subset key derived from each label corresponding to the subset generated in the label generation step. To generate a ciphertext and provide the receiver with the ciphertext generation step.

Furthermore, the sixth aspect of the present invention provides
A computer program for executing decryption processing of ciphertext encrypted by a subset key corresponding to each subset set based on a SD (Subset Difference) scheme that is a broadcast encryption scheme based on a hierarchical tree configuration,
A ciphertext selection step of selecting a ciphertext generated by applying a subset key derivable by a pseudo-random number generation process based on a label held by the ciphertext or a label that can be calculated from the label held by the ciphertext; ,
Label calculation for applying a one-way function F to a retained label and calculating a label different from the retained label when the applied subset key of the ciphertext is not a subset key that can be derived by a pseudo-random number generation process based on the retained label Steps,
Generating a subset key by a pseudo-random number generation process based on a retained label or a calculated label;
A decryption step of performing decryption processing of the ciphertext by applying the generated subset key;
There is a computer program characterized by comprising:

  The computer program of the present invention is, for example, a storage medium or communication medium provided in a computer-readable format to a computer system capable of executing various program codes, such as a CD, FD, or MO. It is a computer program that can be provided by a recording medium or a communication medium such as a network. By providing such a program in a computer-readable format, processing corresponding to the program is realized on the computer system.

  Other objects, features, and advantages of the present invention will become apparent from a more detailed description based on embodiments of the present invention described later and the accompanying drawings. In this specification, the system is a logical set configuration of a plurality of devices, and is not limited to one in which the devices of each configuration are in the same casing.

  According to the configuration of the present invention, Subset Difference (SD), which is considered to be a relatively efficient configuration in an information distribution configuration to which a hierarchical tree structure that is an aspect of a broadcast encryption scheme is applied. By applying a one-way tree to the system and the Layered Subset Difference (LSD) system, it is possible to reduce the amount of information that each receiver (information processing apparatus) should safely hold.

  Furthermore, according to the configuration of the present invention, among the labels (LABEL) corresponding to the respective subsets (LABEL) set based on the SD method or LSD method, the values of the labels corresponding to some selected special subsets are set to other special values. Set as a value that can be calculated by applying the one-way function F to the value of the label corresponding to the subset, and the label corresponding to the special subset not corresponding to the special subset and the label corresponding to the special subset provided to the receiver Since the label corresponding to the minimum special subset excluding the label that can be calculated by applying the one-way function F to the label is used as the provided label for the receiver, the number of labels provided to the receiver in the conventional SD method or LSD method Can be reduced. The reduced label can be calculated by applying the one-way function F to the label held on the receiver side, and processing corresponding to all subsets that can be set based on the conventional SD method or LSD method is possible. . By applying the configuration of the present invention in this way, it is possible to reduce the amount of information (label) that each receiver should hold safely.

  Hereinafter, details of an information processing method, a decoding processing method, an information processing apparatus, and a computer program according to the present invention will be described with reference to the drawings.

The description will be made according to the following items.
1. 1. Outline of Complete Subtree (CS) system 2. Overview of the Subset Difference (SD) method 3. SD label reduction configuration using unidirectional tree 4. Example of unidirectional tree construction method 5. Information distribution processing example using one-way tree 6. Overview of Basic Layered Subset Difference (Basic LSD) method 7. Basic LSD system label number reduction configuration using unidirectional tree Overview of General Layered Subset Difference (Generalized LSD) System 9. Configuration for reducing the number of labels in the generalized LSD method using unidirectional trees

[1. Overview of Complete Subtree (CS) System]
First, an outline of the Complete Subtree (CS) method known as a broadcast encryption method using an existing hierarchical tree structure will be described.

  In the following description, for the sake of simplicity, it is assumed that the total number N of information processing apparatuses (receivers) set corresponding to the leaves of the hierarchical tree structure is a power of 2. In the following description, the base of the function log is all 2. Note that a device corresponding to a leaf of a hierarchical tree structure can set various information processing apparatuses such as a PC and a portable terminal as long as the secret information decryption process described below can be performed. It is. Here, these are collectively referred to as a receiver. Further, the ciphertext distribution process in the present invention includes not only a provision process by communication via a communication network but also a provision process of ciphertext stored in a recording medium.

In the following explanation, the following symbols are used for explanation.
P (i): a parent node of node i S (i): a node that is a sibling of node i (ie, a node different from i and having the same parent as i)
LC (i): Child node on the left side of the node i RC (i): Child node on the right side of the node i

(1) Complete Subtree (CS) System The Complete Subtree (CS) system basically corresponds to the configuration described in the background art section, and as shown in FIG. 3, each node has two layers as a hierarchical tree structure. Use a binary tree with a branching shape. FIG. 3 shows an example in which the number of receivers N = 16. Each receiver is assigned to each leaf of this binary tree (u1 to u16 in FIG. 3). Further, each node (node) of the tree is used to represent “a set of receivers assigned to the leaves of the sub-tree having the node as a vertex”. Node i201 in FIG. 3 represents a set of receivers u5 and u6.

  Then, a key (node key) is defined for each constituent node of the binary tree shown in FIG. Each receiver is given a node key assigned to a node on the path from the leaf to which each receiver is assigned to the root (vertex) of the tree, and the receiver stores these node keys in a secure memory. Hold on. A trusted management center called a Trusted Center (TC) performs tree definition, node key definition, receiver assignment, node key distribution, and the like.

  As shown in FIG. 4, 16 receivers u1 to u16 are assigned to the hierarchical tree, and 31 nodes 31 to 31 exist. The receiver u4 is given five node keys assigned to the nodes 1, 2, 4, 9, and 19. That is, when the total number of receivers is N, each receiver holds logN + 1 node keys.

  With reference to FIG. 5, it will be described how secret information (for example, a content key for decrypting encrypted content) is transmitted to an unrevoked receiver using this setting. Here, it is assumed that the management center (TC) is a sender of secret information. Now, it is assumed that the receivers u2, u11, u12 are revoked receivers. In other words, the receivers u2, u11, u12 can be excluded (revoked) as unauthorized devices, and information can be safely received only by other receivers, that is, decryption based on ciphertext that is broadcast can be performed. To do.

  When the management center (TC) transmits secret information, the node key assigned to the node on the path from the leaf to which the revoke receiver u2, u11, u12 is assigned to the root of the tree is used as the encryption key. Generate and send a set of ciphertext without using it.

  When the node keys assigned to the leaves or nodes on the path from the leaf (leave) to which the revoked receivers u2, u11, u12 are assigned to the root of the tree are used, these are the keys of the receiver to be revoked. As a result, confidential information can be obtained in the revoke device. Therefore, a ciphertext set is generated and broadcasted without using these keys.

  If nodes and paths on the path from the leaf to which the revoke receiver u2, u11, u12 is assigned to the root of the tree are excluded from the tree, one or more subtrees remain. For example, a partial tree having the node 5 as a vertex or a partial tree having the node 12 as a vertex.

The sender of the secret information encrypts the secret information by using the node keys assigned to the nodes closest to the vertices of the respective subtrees, that is, the nodes 5, 7, 9, 12, and 16 in the example shown in FIG. Send a set of encrypted ciphertexts. For example, if the transmission secret information is a content key Kc applied to decryption of encrypted content, and the node keys assigned to the nodes 5, 7, 9, 12, 16 are NK5, NK7, NK9, NK12, NK16, the secret information The sender of
E (NK5, Kc), E (NK7, Kc), E (NK9, Kc), E (NK12, Kc), E (NK16, Kc)
The ciphertext set is generated and stored in a network distribution or recording medium. E (A, B) means data obtained by encrypting data B with the key A.

  The ciphertext set cannot be decrypted only by the revoke receivers u2, u11, u12, and can be decrypted by other receivers. By generating and transmitting such a ciphertext set, it is possible to transmit secret information efficiently and safely.

  The receiver is encrypted using the node key corresponding to the node on the path from the leaf (leaf) to which the receiver is assigned, that is, the encrypted ciphertext that can be decrypted by the receiver. Secret information can be obtained by decrypting things. In the above example, since the receiver u4 holds the node key of the node 9, the encrypted text E (NK9, Kc) can be decrypted using this. In this way, there is always one ciphertext that can be decrypted by a non-revoked receiver in the received ciphertext set.

[2. Subset Difference (SD) method]
As described above, in the Complete Subtree (CS) method, each node (node) of the hierarchical tree is used to “set of receivers assigned to the leaves (leaves) of the subtree having the node as a vertex”. Was represented. On the other hand, in the Subset Difference (SD) system, two nodes i and j (where i is a node that is an ancestor of j) of a hierarchical tree are used, and “(leaf of a subtree having node i as a vertex ( (Set consisting of leaves) minus (set consisting of leaves (leaves) of a subtree having node j as a vertex) ”.

For example, the set S _{i, j} defined by the node _i 231 and the node j 232 in FIG. 6 is obtained by removing u 5 and u 6 from the set of the receivers u 1 to u 8, that is, S _{i, j} = {u 1, u 2 , U3, u4, u7, u8}. Define such a set for all node pairs where node i is an ancestor of node j (ie, node j is not identical to node i and node i exists on the path from node j to the root) .

A subset key SK _{i, j} is set as a key corresponding to the subset S _{i, j} . The subset key SK _{i, j} is set as a key commonly held by the subset S _{i, j} = {u1, u2, u3, u4, u7, u8} obtained by removing u5 and u6 from the set of u1 to u8. By transmitting information obtained by encrypting secret information using the key SK _{i, j} as an encryption key, decryption is possible only in the subset S _{i, j} = {u1, u2, u3, u4, u7, u8}, and u5, u6 Can be revoked.

In such a setting, the number of sets to which one receiver belongs is the number O (N) represented by the following equation.

  Therefore, if a key (subset key) is independently assigned to each set (subset), each receiver needs to securely hold O (N) subset keys. However, this dramatically increases with the increase in the total number N of receivers, and it is practically difficult to safely store such a large amount of information in each device.

  For this reason, the device described below is used in the Subset Difference (SD) method. Similar to the above-described Complete Subtree (CS) method, the management center (TC) performs definition of a hierarchical tree, definition of a subset, definition of a key, distribution, and the like.

  First, as shown in FIG. 7A, the management center (TC) pays attention to a certain internal node (that is, a node that is not a leaf), and uses a label S of the node i as LABELi and a C bit value S Select at random.

Next, as shown in FIG. 7B, LABELi = S is input to the C-bit input and 3C-bit output pseudo-random number generator G. This output is divided into C bits from the left (from the most significant bit side), and are designated as G _L (S), G _M (S), and G _R (S), respectively. G _L (S) is the label of the left child node k of node i shown in FIG. 7A, and G _R (S) is the label of the right child node of node i.

Now, with this process, for node k, which is the left child of node i in FIG. 7, the label LABEL _{i, k} of node k when node i is the starting point is LABEL _{i, k} = _GL (S) became. Let this be T. Next, the label LABEL _{i, k} = G _L (S) = T of the node k is input to the pseudo random number generator G shown in FIG. 7B, and the output is divided into C bits from the left. , G _L (T), G _M (T), and G _R (T) are set as follows.
G _L (T) = label LABEL _{i, LC (k)} of child node LC (k) on the left side of node k when node i is the starting point
G _M (T) = the key of the node k when the node i is the starting point (this is the subset key SK _{i, k} corresponding to the set S _{i, k} )
G _R (T) = Label _{i, RC (k)} of child node RC (k) on the right side of node i when node i is the starting point

By repeating this process, labels corresponding to all the descendants when the node i is the starting point are created. According to the above definition, the set S _{i, i} is an empty set, and when the node i is the starting point, the key of the node i is unnecessary, so the LABEL _i is input to the pseudorandom number generator G. Note that G _M (S), the central part of the output, is not used.

When shown in the example of FIG. 7 (A), defined label S of the node i is the starting point, become a label i right child node when G R _(S) is starting from the node i, further it G _L (G _R (S)) obtained by inputting to the pseudo-random number generator G becomes the label LABEL _{i, j} of the node j when the node i is the starting point. When the node i is the starting point, processing for creating labels corresponding to all the descendent nodes is performed for all the internal nodes i.

These processes are performed by the management center (TC) at the time of system setup. The pseudo-random number generator (or pseudo-random number generation function) G is defined and published by the management center (TC). Thus, the receiver given LABEL _{i, j} calculates the labels LABEL _{i, n} of all the nodes n that are descendants of the node j when the node i is the starting point, and the node i is the starting point. In this case, the subset key SK _{i, n} of the node j and its descendant node n can be calculated.

  With such a setting, as shown in FIG. 8A, a receiver u assigns a node i to each internal node i on the path from the leaf to which it is assigned to the vertex of the tree. As a starting point, only the labels of nodes a, b, and c, which are nodes directly branched from the path from leaf u to i, need only be held.

  It becomes possible to create a subset key of these nodes a, b, c and their descendants starting from node i. In FIG. 8A, when attention is paid to the node i, there are three nodes a, b, and c that are directly branched from the path from u to i, and the receiver u assigns these three labels to the system. Is given from the management center (TC) at the time of setup.

The leaf u can obtain the subset key SK _{i, a} corresponding to the subset S _{i, a} by the processing of the pseudo random number generator G based on the label LABEL _{i, a} of the node a. That is,
G _M (LABEL _{i, a} ) = SK _{i, a} .
As shown in FIG. 8A _{, the} subset S _{i, a} is a subset in which a leaf of a partial tree having the node a as a vertex is set as a revoke device. In this subset, only the leaves other than the leaves of the partial tree having a as a vertex are set as information distribution targets.

Further, the leaf u can obtain a subset key SK _{i, b} corresponding to the subset S _{i, b} by processing of the pseudo random number generator G based on the label LABEL _{i, b} of the node b. That is,
G _M (LABEL _{i, b} ) = SK _{i, b}
As shown in FIG. _{8B, the} subset S _{i, b} is a subset in which a leaf of a partial tree having the node b as a vertex is set as a revoke device. In this subset, only the leaves other than the leaves of the partial tree having b as a vertex are set as information distribution targets.

Further, the leaf u can obtain the subset key SK _{i, c} corresponding to the subset S _{i, c} by the processing of the pseudo random number generator G based on the label LABEL _{i, c} of the node c. That is,
G _M (LABEL _{i, c} ) = SK _{i, c} .
As shown in FIG. 8C _{, the} subset S _{i, c} is a subset in which the node c (leaf c) is set as a revoke device, and leaves other than the leaf c among the leaves of the subtree having the node i as a vertex. Is a subset that is set as an information distribution target.

In the hierarchical tree starting from i, the configuration for revoking leaves other than the leaf u can be variously set in addition to these three. For example, when only the leaf d251 shown in FIG. 8 (a) and revoked sets the subset _{S i,} the _d, it is necessary to apply the subset key _{SK i,} the _d. However, a key corresponding to each node and leaf, that is, a subset key can be generated by a pseudo-random number generation process based on a higher-order label. Therefore, the leaf u can generate the subset key SK _{i, d} corresponding to the revoke of the leaf d251 based on the label LABEL _{i, a} of the node a held by the leaf u.

  The same applies to the other subset configurations, and as shown in FIG. 8A, a certain receiver u makes a change with respect to each internal node i on the path from the leaf to which it is assigned to the vertex of the tree. Thus, only the labels of the nodes a, b, and c, which are nodes directly branching from the path from the leaf u to i starting from the node i, need only be held.

FIG. 9 is a diagram showing labels to be held by each receiver when the total number of receivers N = 16. Considering the receiver u4, the internal nodes 1, 2, 4, and 9 on the path from the node 19 that is the leaf to which the receiver u4 is assigned to the vertex 1 are the starting points (node i). Since node 1 is the starting point, there are four nodes 3, 5, 8, and 18 directly branching from the path from node 19 to node 1, and therefore receiver u 4 has four labels, that is,
LABEL _1,3 ,
LABEL _1,5 ,
LABEL _1,8 ,
LABEL _1,18 ,
Hold.

Similarly, if node 2 is the starting point,
LABEL _2,5 ,
LABEL _2,8 ,
LABEL _2,18 ,
3 labels are held.

If node 4 is the starting point,
LABEL _4,8 ,
LABEL _4,18 ,
Hold two labels.

If node 9 is the starting point,
LABEL _9,18 ,
Hold one label.

Also, labels LABEL _{1, φ} , corresponding to a set including all receivers used in a special case where there are no receivers to be revoked (denoted as subset S _{1, φ} ).
Is held.

That is, when LABEL which u4 has in the structure of FIG. 9 is put together, as described also in FIG.
Four labels with j = 3, 5, 8, 18 for i = 1 Three labels with j = 5, 8, 18 for i = 2 Two labels with j = 8, 18 for i = 4 One label with j = 18 for label i = 9 and LABEL for the case without revoke is a total of 11 labels.

However, in order to unify the description here, labels corresponding to the subsets S _{1 and φ} are used. However, instead of the labels, the subset keys corresponding to the subsets S _{1 and φ} may be directly held.

As mentioned above, each receiver needs to keep a label for the height of the internal node and a special label for each internal node on the leaf-to-root path. When the number of transceivers is N, the number of labels held by each receiver is a number calculated by the following equation.

  Each receiver holds the number of labels indicated by the above equation, and can create a necessary subset key by using a publicly-known pseudorandom number generation function G. The receiver needs to keep these labels securely.

[3. Configuration for reducing the number of labels in the SD method using a unidirectional tree]
Next, a configuration for reducing the number of labels in the Subset Difference (SD) method using a unidirectional tree according to the present invention will be described. Observation of the above-described Subset Difference (SD) method reveals the following.

That is, the label LABEL _{i, j} is
(A) When given directly from the management center (TC) to the receiver;
(B) when the receiver derives from other labels using the pseudorandom number generator G;
There are
As for the label in which the node i and the node j have a parent-child relationship (distance 1, ie, in a continuous hierarchy), the case (B) does not exist, and all the labels (A) directly to the receiver It can only be given from (TC).

This is because, in order for a receiver to generate LABEL _{i, j} using the pseudo-random number generator G, it is necessary to know LABEL _{i, k} using the node k that is an ancestor of the node j. This is because there is no node k that is an ancestor of the node j and a descendant of the node i because j is a parent-child relationship, and LABEL _i is not given to any receiver.

This will be described with reference to the configuration example of FIG. LABELs _{2 and 8} are given directly to the receiver u4 from the management center (TC), but not directly to the receiver u5, and the receiver u5 receives the LABEL ₂ given from the management center (TC). _{, 4} by calculating G _L (LABEL _2,4 ) using a pseudorandom number generator G, LABEL _2,8 is derived.

In contrast, as shown in FIG. 11, _{LABEL 2, 5} to node 2 and node 5 is a parent-child relationship, the subset _{S 2, 5} to belong to that receiver u1, u2, u3, u4 given directly Since other receivers do not belong to the set, they cannot be derived by calculation. That is, such a label is only given directly from the management center (TS) to the receiver, and is not derived using the pseudo-random number generator G.

In the SD scheme, when a node i is a parent node of two different nodes j and k, and the node j is a parent node of a node n different from them, the receivers belonging to the subset S _{j, n} are It can be seen that it also belongs to the subset S _{i, k} .

For example, as shown in FIG. 12, the receiver U4 belonging to the subset S _9,18 belongs to any of the subset S _4,8 , the subset S _2,5 , and the subset S _1,3 . That is,
S _9,18 = {u4}
S _4,8 = {u3, u4}
S _2,5 = {u1, u2, u3, u4}
S _1,3 = {u1, u2, u3, u4, u5, u6, u7, u8}
It is.

Also a receiver u4 other receiver belonging to the subset _{S 4, 8} receiver u3 also subset _{S 2, 5,} belonging to any of the subset _{S 1, 3.}

In the present invention, the label LABEL _{i, j in} which the node i and the node j are in a parent-child relationship and the subset S _{1, φ} that is a set including all receivers used in a special case where there is no receiver to be revoked The number of labels held by the receiver is reduced by applying a key tree structure to which a one-way function is applied, that is, a one-way tree, to LABEL _{1 and φ} that are labels to be received.

In the above-described Subset Difference (SD) method, each receiver uses a label LABEL _{i, j in} which the node i and the node j are in a parent-child relationship on the path from the leaf (leaf) to which the receiver is assigned to the top of the tree. One by one for each of the internal nodes of the receiver, a total of logN is held, and by making the above settings some of which can be derived from one value by applying a one-way function or the like, the receiver Reduce the number of labels that should be retained.

In the original SD method, as described with reference to FIG. 9, the receiver u4 has a total of 11 labels, that is,
Four labels LABEL _1,3 , j = 3, 5, 8, 18 for i = 1
LABEL _1,5 ,
LABEL _1,8 ,
LABEL _1,18 ,
Three labels LABEL _2,5 , j = ₅ , 8, 18 for i = 2
LABEL _2,8 ,
LABEL _2,18 ,
Two labels LABEL _4,8 , j = 8,18 for i = 4
LABEL _4,18 ,
one label with j = 18 for i = 9 LABEL _9,18 ,
One LABEL for the case without revoke LABEL _{1, φ} ,
Although it was necessary to hold a total of 11 labels safely, by applying the configuration of the present invention, the labels in which the nodes i and j are in a parent-child relationship, that is,
LABEL _1,3 ,
LABEL _2,5 ,
LABEL _4,8 ,
LABEL _9,18 ,
Furthermore, LABEL _{1, φ} , which is a LABEL for the case without revoke
Although it is necessary for the receiver to hold these labels, the number of labels to be held by the receiver can be reduced by applying a one-way tree described below.

[4. Example of unidirectional tree configuration]
Hereinafter, an information distribution configuration based on a hierarchical tree configuration using a unidirectional tree according to the present invention will be described. The “one-way tree” used in the description of the present specification is not a general term but a term used for the description of the present invention, and is a term defining a tree structure having a certain characteristic.

The definition of “one-way tree” will be described.
A complete binary tree having N leaves is a one-way tree, as shown in FIG. 13, the route that is the highest node is 1 and the subsequent nodes are 2, 3, in order from the upper left. .., 2N-1 and breadth first order and each node is assigned a node number, a value corresponding to node i, that is, a value x _{i of} C bits (for example, 128 bits) as a node corresponding value (I = 1, 2,..., 2N−1) and a tree structure in which x _i = F (x _2i ) holds for i = 1, 2 _,. To do.

  Here, the function F is a one-way function that outputs a C-bit output with respect to a C-bit input.

  Examples of such functions include MD4 and MD5 that output 128 bits for an input of an arbitrary length, and SHA-1 that outputs 160 bits. These functions can be applied. For these functions, for example, A.I. J. et al. Menezes, P.M. C. van Oorschot and S.V. A. Introduced by Vanstone, "Handbook of Applied Cryptography", CRC Pres, 1996. These functions are called one-way functions or hash functions.

The relationship between the function F set corresponding to each node i constituting the unidirectional tree and the node corresponding value x _i is shown in FIG. The tree structure constituting the one-way tree is a tree structure in which x _i = F (x _2i ) holds for the node correspondence values x _i of the upper node and the lower node.
For example,
x ₈ = F (x ₁₆ )
x ₄ = F (x ₈ )
x ₂ = F (x ₄ )
x ₁ = F (x ₂ )
As described above, the node correspondence value x _i set corresponding to the node i constituting the binary tree is set so that x _i = F (x _2i ) holds.

An example of an algorithm constituting a one-way tree in a binary tree having N leaves is shown below. In this algorithm, the input and output are set as follows.
[input]
The number N of leaves that make up the binary tree,
C-bit output unidirectional function F,
[output]
Number of all nodes (including leaves) constituting the binary tree: number of 2N−1 C bits corresponding to 2N−1 x ₁ , x ₂ ,..., X _2N−1
It is.

Based on the above [input], the algorithm for obtaining the above [output] is as follows.
1. N C-bit numbers x _N , x _{N + 1} ,..., X _2N−1 are selected independently.
2. The following processing is performed while i is decremented by 1 from 2N-1 to 1 using a counter.
(2-1) If i is an even number, the function F is applied to calculate F (x _i ), and this is set to x _{i / 2} .
3. Output _2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 and end. The value x _i is a value corresponding to the node i of the unidirectional tree, that is, a node corresponding value. Note that the total number of nodes in the complete binary tree with N leaves is 2N-1.

  FIG. 14 shows the flow of the above algorithm. Each step of the flow will be described. In step S101, the number N of leaves constituting the binary tree and a C-bit output one-way function F are input.

In step S102, N C bit numbers x _N , x _{N + 1} ,..., X _2N−1 are independently selected. In step S103, i = 2N-1 is set as an initial setting of the value: i.

  In step S104, it is determined whether i is an even number. If i is an even number, the process proceeds to step S105. If i is an odd number, the process proceeds to step S106.

If i is an even number, in step S105, the function F is applied to calculate F (x _i ), which is set to x _{i / 2} .

  In step S106, it is determined whether or not i = 1. If i = 1 is not satisfied, the process proceeds to step S107, an update process is performed to set the value i to i = i-1, and the processes in and after step S104 are performed. Run repeatedly.

If it is determined in step S106 that i = 1, the process proceeds to step S108, and 2N-1 C-bit numbers x ₁ , x ₂ ,..., X _2N−1 are _assigned to node i corresponding to each node i. Output as x _i .

This number of 2N-1 C bits x ₁ , x ₂ ,..., X _2N−1 is the node i of 2N−1 nodes (including leaves) (i = 1 to 2N−1). It is set as a value corresponding to each.

By this process, the node correspondence value x _i corresponding to each node i constituting the one-way tree is determined, and the one-way tree structure is completed.

  In the above example of the one-way tree setting process, as shown in FIG. 13, the higher-order node that rises from the lower-level node can be calculated by applying the one-way function F. It is also possible to employ a configuration in which the higher-order upper node can be calculated by applying the one-way function F.

[5. Example of information distribution processing using unidirectional tree]
Next, an example of information distribution processing to which the above-described unidirectional tree is applied will be described. Less than,
(5-1) Setup processing (5-2) Information distribution processing (5-3) Reception and decoding processing Each processing will be described in order.

(5-1) Setup process The setup process is performed only once at system startup. The subsequent information distribution and reception and decoding processes are executed each time information to be transmitted is generated. For example, a content storage recording medium such as a DVD disk storing new content is created and distributed every time it is distributed to the user or encrypted content is distributed via the Internet.

  The setup process is executed by the following steps 1 to 4. Each step will be described.

a. Step 1
First, the management center (TC) defines a hierarchical tree that is a binary tree and has N leaves. This hierarchical tree is different from the one-way tree described above. K (k = 1, 2,..., 2N−1) is set as an identifier corresponding to each node in the hierarchical tree. However, the root is set to 1, and the identifiers (numbers) are assigned to the lower nodes in order of breadth first (breadth first order). That is, the node number (y) as shown in FIG. 15 is set. With this process, node numbers y = 1 to 2N−1 are set to the respective nodes in the binary tree.

  A receiver um (m = 1, 2,..., N) is assigned to each leaf of the tree. In the example of FIG. 15, 16 receivers u1 to u16 are assigned to node numbers y = 16 to 31.

  Furthermore, the management center (TC) selects and discloses a one-way function F of C-bit output. C is an arbitrary number, and as the one-way function, for example, an existing one-way function (hash function) such as MD4, MD5, and SHA-1 can be applied.

Next, for each internal node i (i = 1, 2,..., N−1), a subset S _{i, j} corresponding to a node j that is a descendant of the node _i is defined. Further, among all the subsets S _{i, j} defined above, the node i and the node j that are in a parent-child relationship are designated as a first special subset (Special Subset) SS _{i, j} I will represent it. Here, since each node except the root of the tree has only one parent node _{, j} of SS _{i, j} has j j, 2, 3,..., 2N−1 only once. Note that it is used. Furthermore, a second special subset SS _{1, φ} including all receivers to be used when no receiver is revoked is defined.

b. Step 2
The management center (TC) calculates the corresponding value x _i of each node i in the binary tree having N leaves according to the algorithm described above with reference to the flow of FIG. That is,
(A) The number N of leaves constituting the binary tree,
(B) C-bit output unidirectional function F;
, The number of all nodes (including leaves) constituting the binary tree: the number of 2N−1 C bits corresponding to 2N−1 x ₁ , x ₂ ,..., X _{2N− 1}
To decide.

The management center (TC) uses the algorithm described with reference to FIG.
[input]
The number N of leaves that make up the binary tree,
C-bit output unidirectional function F,
[output]
Number of all nodes (including leaves) constituting the binary tree: number of 2N−1 C bits corresponding to 2N−1 x ₁ , x ₂ ,..., X _2N−1
, 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 are determined.

Management center (TC), the 2N-1 pieces of C number of bits _x 1, _{x 2, ...,} the value _{x 1} in _{x 2N-1,} used when the receiver is to be revoked is no one _Let the label of the second special subset SS _{1, φ} including all receivers. That is,
LABEL _{1, φ} = x ₁
And

Also, among all the subsets S _{i, j} , the first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship (where j = 2, 3,... .., 2N-1), the label LABEL _{i, j} is defined as follows. That, _x y (y = 2,3, except route corresponding value _{x 1} in _{x 2N-1} from _{x 1} set as a value corresponding to 2N-1 from node 1 by the processing described above, · · ·, 2N _Let -1) be the labels LABEL _{P (y) and S (y)} corresponding to the first special subset SSP _{(y) and S (y)} specified by the sibling node and the parent node of the node y. That is,
x _y = LABEL _{P (y), S (y)}
And
Note that P (i) is a parent node of the node i, and S (i) is a sibling node of the node i.

FIG. 16 shows a specific example. In FIG. 16, _xy as a node corresponding value is assigned to the node y301. Note that all node-corresponding values including _xy are values calculated according to the algorithm described with reference to the flow of FIG.
F (x _i ) = x _{i / 2}
Satisfied.

The parent node of the node y301 is P (y) 302, and the sibling node is S (y) 303. The first special subset designated by the sibling node S (y) 303 and the parent node P (y) 302 of the node y301, that is, the first special subset SSP _{(y), S (y)} is the subset SSP _{(y), S (y)} 310 shown in FIG.

At this time, the labels corresponding to the subsets SS _{P (y), S (y)} 310 are LABEL _{P (y), S (y)} ,
_Let LABEL _{P (y), S (y) be xy} as a node corresponding value corresponding to the node y301. That is,
x _y = LABEL _{P (y), S (y)}
And

To summarize the above processing, one value x ₁ in _2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 calculated by the algorithm described with reference to FIG. second special subset SS 1 including all receivers to be used when the receiver is to be revoked is no _single, a label of _phi, other x _2, ..., ,, node values of x _2N-1 Label LABEL _i corresponding to the first special subset SS _{i, j} in which i and node j are in a parent-child relationship (where j = 2, 3,..., 2N−1 as described above) _{, J.} That is,
LABEL _{1, φ} = x ₁
And set
Furthermore, for y = 1, 2,..., N−1,
LABEL _{y, 2y} = x _{2y + 1}
LABEL _{y, 2y + 1} = x _2y
And

In FIG. 17 (1),
(A) a second special subset SS _{1, φ} label LABEL _{1, φ} corresponding to the whole tree including all receivers used when no receiver is revoked;
(B) Corresponds to the first special subset SS _{i, j} in which node i and node j are in a parent-child relationship (where j = 2, 3,..., 2N−1 as described above) And a label corresponding to a special subset of the label LABEL _{i, j} and the number of 2N-1 C bits x ₁ , x ₂ ,..., X _2N− calculated by the algorithm described with reference to FIG. Correspondence with ₁ is shown.

As shown in FIG. 17 (2), each of 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 is set as a value of each label as follows. .
x ₁ = LABEL _{1, Φ}
x ₂ = LABEL _1,3
x ₃ = LABEL _1,2
x ₄ = LABEL _2,5
x ₅ = LABEL _2,4
::
x ₃₀ = LABEL _15,31
x ₃₁ = LABEL _15,30

As described above, the management center in step 2,
(A) a second special subset SS _{1, φ} label LABEL _{1, φ} corresponding to the whole tree including all receivers used when no receiver is revoked;
(B) Corresponds to the first special subset SS _{i, j} in which node i and node j are in a parent-child relationship (where j = 2, 3,..., 2N−1 as described above) Label LABEL _{i, j} to
Are determined in association with _2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 calculated by the algorithm described with reference to FIG.

c. Step 3
Next, the management center (TC) inputs the label LABEL _{i, j} of the first special subset SS _{i, j in which} the node i and the node j are in a parent-child relationship to the pseudo random number generator G, and the node i The labels LABEL _{i, LC (j)} and LABEL _{i, RC (j)} of the child node of node j are obtained.

That is, G _L (LABEL _{i, j} ) _, which is the upper C bit of the 3C-bit pseudorandom number obtained by inputting LABEL _{i, j} having the number of bits C to the pseudorandom number generator G, starts from the node i, Set as a label LABEL _{i, LC (j)} of a subset S _{i, LC (j)} corresponding to the left child node LC (j) of node _j, and LABEL _{i, j} of bit number C G _R (LABEL _{i, j} ) _, which is the lower C bit of the 3C-bit pseudo-random number obtained by inputting to the pseudo-random number generator G, is the child node RC (j) to the right of the node j starting from the node i. Is set as a label LABEL _{i, RC (j)} of a subset S _{i, RC (j)} corresponding to (not special). That is,
LABEL _{i, LC (j)} = _GL (LABEL _{i, j} )
_{LABEL i, RC (j) =} G R (LABEL i, j)
Each label is set as

Further, by repeatedly inputting these outputs (labels) to the pseudo-random number generator G, labels corresponding to all nodes that are descendants of the node j starting from the node i are obtained. This is done for the labels of all special subsets SS _{i, j} to determine the labels of all the subsets S _{i, j} defined in step 1.

d. Step 4
Next, the management center (TC) determines a label to be provided to the receiver um, that is, a label to be stored by the receiver um.

First, a label given to the receiver um in the original SD method is selected as a temporary selection label. This is the node j that branches directly from the path from the leaf (leaf) to i starting from the internal node i on the path m (path-m) from the leaf (leaf) to which the receiver um is allocated to the root. and the subset _{S i, j} of the label lABEL _{i, j} corresponding to the special subset SS ₁ of the second of the _above, the label lABEL ₁ corresponding to _phi, is _phi.

A process for determining a label to be provided to the receiver will be described with reference to FIG. For example, as a temporary selection label for the receiver u4 corresponding to the node number 19 in FIG.
_{LABEL 1,3, LABEL 1,5, LABEL 1,8} , LABEL 1,18, LABEL 2,5, LABEL 2,8, LABEL 2,18, LABEL 4,8, LABEL 4,18, LABEL 9,18, Eleven labels LABEL _{1 and φ} are selected.

  The management center (TC) reselects the label to be provided to the receiver um from among these temporarily selected labels.

Among these 11 provisionally selected labels, the labels of the first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship are LABEL _1,3 , LABEL _2,5 , LABEL _4,8 LABEL _9,18 .

  The management center (TC) uses the following rules for the receivers um (m = 1, 2,..., N) set corresponding to the leaves as the end nodes of the hierarchical tree. , Determine the provided label.

  For example, in the hierarchical tree as shown in FIG. 19, 16 receivers are assigned to node numbers y = 16 to 31 from u1 to u16, respectively.

  A path from the leaf to the root to which the receiver um is assigned is represented as a path m [path-m]. A set of nodes y on the path m [path-m] is represented as a path node m [PathNodes-m].

In the example of FIG.
PathNodes-1 = {1, 2, 4, 8, 16}
PathNodes-4 = {1, 2, 4, 9, 19}
PathNodes-11 = {1, 3, 6, 13, 26}
It becomes.

  A solid line 321 illustrated in FIG. 19 is a path 1 [path-1] 321 of the receiver u1, and is configured by PathNodes-1 = {1, 2, 4, 8, 16}. A dotted line 322 is the path 4 [path-4] 322 of the receiver u4, and is configured by PathNodes-4 = {1, 2, 4, 9, 19}. A broken line 323 is the path 11 [path-11] 323 of the receiver u11 and is configured by PathNodes-11 = {1, 3, 6, 13, 26}.

  The management center (TC) selects a label satisfying the following condition (a) and a label satisfying the following condition (b) from among the temporarily selected labels described with reference to FIG. Determine the final provided label for machine um.

(A) Among the temporarily selected labels, those that do not correspond to any special subset, that is, the first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship, and the receiver to be revoked A label LABEL _{i, j} corresponding to a subset that is not _one of the second special subset SS _{1, φ} corresponding to the entire tree including all receivers to be used when there is no one.
(B) In the temporary selection label, any special subset, that is, the first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship, and no receiver to be revoked A label corresponding to _one of the second special subset SS _{1, φ} corresponding to the whole tree including all receivers used in the case;
(B1) The node y is a node included in PathNodes-m, and
(B2) node 2y label _{LABEL i} corresponding to the corresponding values _{x y} the value y is a node that is not included in _PathNodes-m, j.
A label satisfying the condition (a) and a label satisfying the condition (b) are provided to the receiver um.

A specific example will be described with reference to FIG. As a temporary selection label for the receiver u4 corresponding to the node number 19 in the hierarchical tree shown in FIG.
_{LABEL 1,3, LABEL 1,5, LABEL 1,8} , LABEL 1,18, LABEL 2,5, LABEL 2,8, LABEL 2,18, LABEL 4,8, LABEL 4,18, LABEL 9,18, Eleven labels LABEL _{1 and φ} are selected.

From among these, first, a label satisfying the condition (a), that is, a label that does not correspond to any of the first and second special subsets is selected. This is because any one of the first special subset SS _{i, j} and the second special subset SS _{1, φ} corresponding to the whole tree including all receivers to be used when there is no receiver to be revoked. It is a label corresponding to a subset that does not correspond to. That is,
_{LABEL 1,5, LABEL 1,8, LABEL 1,18} , LABEL 2,8, LABEL 2,18, 6 pieces of label _{LABEL 4,18} given is selected to the receiver u4.

Furthermore, a label satisfying the condition (b) is selected from the temporarily selected labels. That is, a label corresponding to either the first or second special subset;
(B1) The node y is a node included in PathNodes-m, and
(B2) A label LABEL _{i, j} corresponding to a value _xy set corresponding to a node number y selected as a node whose node 2y is not included in PathNodes-m.

Each of the node number y and the 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 has a relationship as described above with reference to FIG. Further, each of 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 is set as a value of each label as shown in FIG. That is,
x ₁ = LABEL _{1, Φ}
x ₂ = LABEL _1,3
x ₃ = LABEL _1,2
x ₄ = LABEL _2,5
x ₅ = LABEL _2,4
::
x ₃₀ = LABEL _15,31
x ₃₁ = LABEL _15,30
It is.

In the hierarchical tree shown in FIG. 20, the path-m of the receiver u4 corresponding to the node number 19 is the path 4 [path-4] 322 shown in FIG. 19, and the nodes included in the path 4 [path-4] 322 The path node 4 as follows is PathNodes-4 = {1, 2, 4, 9, 19}.
here,
(B1) The node y is a node included in PathNodes-m, and
(B2) The node number y that satisfies the node 2y not included in the PathNodes-m is selected.

In the receiver u4,
(B1) Node y is included in PathNodes-m,
Nodes satisfying the condition are PathNodes-4 = {1, 2, 4, 9, 19}.
In this,
(B2) The nodes that do not include the node 2y are nodes 4, 9, and 19. For nodes 1 and 2,
Node 1 includes node 2 corresponding to node 2 × 1 in PathNodes-4 = {1, 2, 4, 9, 19}.
The node 2 includes the node 4 corresponding to the node 2 × 2 in PathNodes-4 = {1, 2, 4, 9, 19}.

Therefore, in the receiver u4,
(B1) Node y is included in PathNodes-m, and
(B2) Node not including node 2y Nodes satisfying these conditions (b1) and (b2) have node numbers y = 4, 9, and 19.

As a result, the labels corresponding to the node corresponding values x ₄ , x ₉ , x ₁₉ corresponding to y = ₄ , ₉ , ₁₉ ;
x ₄ = LABEL _2,5
x ₉ = LABEL _4,8
x ₁₉ = LABEL _9,18
Is selected as a label satisfying the condition (b), and determined as a provided label for the receiver u4.

As a result, the receiver u4 has
As a label satisfying the condition (a),
_{LABEL 1,5, LABEL 1,8, LABEL 1,18} , LABEL 2,8, LABEL 2,18, 6 pieces of label _{LABEL 4,18,}
As a label satisfying the condition (b),
3 labels x ₄ = LABEL _2,5 , x ₉ = LABEL _4,8 , x ₁₉ = LABEL _9,18 ,
A total of nine labels are provided.

The label given to the receiver um in the conventional original SD method starts from the internal node i on the path m (path-m) from the leaf to which the receiver um is allocated to the root. The label LABEL _{i, j} of the subset S _{i, j} corresponding to the node j directly branched from the path from leaf to i _, and the label LABEL _1, corresponding to the second special subset SS _{1, φ} described above _φ , which corresponds to the provisionally selected label for the receiver u4 described with reference to FIG.
_{LABEL 1,3, LABEL 1,5, LABEL 1,8} , LABEL 1,18, LABEL 2,5, LABEL 2,8, LABEL 2,18, LABEL 4,8, LABEL 4,18, LABEL 9,18, 11 labels of LABEL _{1 and φ} will be provided. In the system of the present invention, as described above, the receiver u4 has 9 labels, that is,
As a label satisfying the condition (a),
_{LABEL 1,5, LABEL 1,8, LABEL 1,18} , LABEL 2,8, LABEL 2,18, 6 pieces of label _{LABEL 4,18,}
As a label satisfying the condition (b),
3 labels x ₄ = LABEL _2,5 , x ₉ = LABEL _4,8 , x ₁₉ = LABEL _9,18 ,
Only will be provided.

In the system of the present invention, two labels that are not given to the receiver u4 are:
LABEL _1,3 ,
LABEL _{1, φ} ,
Are two labels,
For these labels, the receiver u4 calculates from the provided labels. That is,
LABEL _1,3 = x ₂
LABEL _{1, φ} = x ₁
And
The receiver u4 has x ₄ = LABEL _2,5 ,
Each of the 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 as the node-corresponding values is calculated according to the algorithm described with reference to the flow of FIG. Value
F (x _i ) = x _{i / 2}
Satisfied.

Therefore, the receiver u4 is based on the label x ₄ = LABEL _2,5 that it owns,
F (x ₄ ) = x ₂ = LABEL _1,3
F (x ₂ ) = x ₁ = LABEL _{1, φ}
Can be calculated.
Details of these processes will be described later.

Similarly, the provided labels for the receiver u1 corresponding to the node number 16 in the hierarchical tree shown in FIG. 20 are as follows.
First, as a temporary selection label,
_{LABEL 1,3, LABEL 1,5, LABEL 1,9} , LABEL 1,17, LABEL 2,5, LABEL 2,9, LABEL 2,17, LABEL 4,9, LABEL 4,17, LABEL 8,17, Eleven labels LABEL _{1 and φ} are selected.

From among these, first, a label satisfying the condition (a), that is, a label that does not correspond to any of the first and second special subsets is selected. This is because any one of the first special subset SS _{i, j} and the second special subset SS _{1, φ} corresponding to the whole tree including all receivers to be used when there is no receiver to be revoked. It is a label corresponding to a subset that does not correspond to. That is,
_{LABEL 1,5, LABEL 1,9, LABEL 1,17} , LABEL 2,9, LABEL 2,17, 6 pieces of label _{LABEL 4, 17} is selected.

Furthermore, a label satisfying the condition (b) is selected from the temporarily selected labels. That is, a label corresponding to either the first or second special subset;
(B1) The node y is a node included in PathNodes-m, and
(B2) The label LABEL _{i, j} corresponding to the value _xy set corresponding to the node number y selected as the node 2y not included in the PathNodes-m.

The path-m of the receiver u1 corresponding to the node number 16 is the path 1 [path-4] 321 shown in FIG. 19, and the path node 4 as a node included in the path 1 [path-1] 321 is PathNodes- 1 = {1, 2, 4, 8, 16}.
here,
(B1) The node y is a node included in PathNodes-m, and
(B2) The node number y that satisfies the node 2y not included in PathNodes-m is only y = 16.

Therefore, the label corresponding to the node corresponding value x ₁₆ corresponding to y = 16, that is,
x ₁₆ = LABEL _8,17
Is selected as a label satisfying the condition (b), and determined as a provided label for the receiver u1.

As a result, the receiver u1
As a label satisfying the condition (a),
_{LABEL 1,5, LABEL 1,9, LABEL 1,17} , LABEL 2,9, LABEL 2,17, 6 pieces of label _{LABEL 4,17,}
As a label satisfying the condition (b),
one of the label of x ₁₆ = _{LABEL 8,17,}
A total of seven labels are provided.

The label given to the receiver um in the conventional original SD method starts from the internal node i on the path m (path-m) from the leaf to which the receiver um is allocated to the root. The label LABEL _{i, j} of the subset S _{i, j} corresponding to the node j directly branched from the path from leaf to i _, and the label LABEL _1, corresponding to the second special subset SS _{1, φ} described above _φ , which corresponds to the provisionally selected label for the receiver u1 described with reference to FIG.
_{LABEL 1,3, LABEL 1,5, LABEL 1,9} , LABEL 1,17, LABEL 2,5, LABEL 2,9, LABEL 2,17, LABEL 4,9, LABEL 4,17, LABEL 8,17, LABEL _{1 and} 11 labels are provided, but in the method of the present invention, as described above, only seven labels are provided to the receiver u1.

In the method of the present invention, the four labels not given to the receiver u1 are:
LABEL _4,9 ,
LABEL _2,5 ,
LABEL _1,3 ,
LABEL _{1, φ} ,
The four labels of
For these labels, the receiver u1 calculates from the provided labels. That is,
LABEL _4,9 = x ₈ ,
LABEL _2,5 = x ₄ ,
LABEL _1,3 = x ₂
LABEL _{1, φ} = x ₁
And
The receiver u1 has x ₁₆ = LABEL _8,17
Each of the 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 as the node corresponding value is calculated according to the algorithm described with reference to the flow of FIG. Value
F (x _i ) = x _{i / 2}
Satisfied.

Therefore, the receiver u1 is based on the label x ₁₆ = LABEL ₈ , ₁₇ owned by
F (x ₁₆ ) = x ₈ = LABEL _4,9
F (x ₈ ) = x ₄ = LABEL _2,5
F (x ₄ ) = x ₂ = LABEL _1,3
F (x ₂ ) = x ₁ = LABEL _{1, φ}
Can be calculated.

  For any receiver um, the number of provisionally selected labels and the number of labels that do not correspond to a special subset are the same. In the case of a hierarchical tree having 16 receivers corresponding to 16 leaves shown in FIG. 20, the number of temporarily selected labels is 11 for any receiver um, and the label does not correspond to a special subset. Number = 6.

As described above, the label providing processing according to the method of the present invention, among the labels corresponding to the special subset, labels corresponding to the value x _y leaves y to receiver um is assigned in one direction trees always When the path from the leaf to the root is expressed as going up to the left or right by one step, a label corresponding to the value of the previous node going up to the left is given to um.

As described above, the number of labels corresponding to the special subset given to the receiver um varies depending on how many upward-sending paths are included in the path m (path-m) corresponding to each receiver um. Since this one-way tree is a complete binary tree with N leaves, considering the path m (path-m) of all receivers, the left-up path is 1 and the right-up path is 0. The number of log N digits (bits) appears one by one from 00 ... 0 to 11 ... 1. That is, the bit representation of the path m (path-m) is
{0,1} ^logN
It can be expressed as

  As an example, FIG. 21 shows a bit representation of a path m (path-m) corresponding to the 16 receivers u1 to u16 shown in FIG.

  For example, the path 1 (path-1) from the receiver u1 to the route is [0000]. Referring to FIG. 19, the path 1 (path-1) from the receiver u1 to the route is all four right-upward paths (16 → 8, 8 → 4, 4 → 2, 2 → 1). Since it is set, the path 1 (path-1) from the receiver u1 to the route is [0000] in the setting in which the upward path is represented as 0.

  The path 2 (path-2) from the receiver u2 to the route is [1000]. Referring to FIG. 19, in the path 2 (path-2) from the receiver u2 to the root, only the first is a left-up path (17 → 8), and the rest are all the up-path 3 Since it is set by (8 → 4, 4 → 2, 2 → 1), the path 2 (path-2) from the receiver u2 to the route is [1000].

  Similarly, the bit representation of the path m (path-m) corresponding to the 16 receivers u1 to u16 shown in FIG. 19 is determined.

  FIG. 21 is a diagram illustrating a bit representation of a path m (path-m) corresponding to the 16 receivers u1 to u16 illustrated in FIG. As shown in FIG. 21, the bit representation of the path m (path-m) corresponding to the receivers u1 to u16 is 16 types of bit representations of [0000] to [1111] that are different for each receiver.

  The number of bit values [1] in the bit representation of path m (path-m) is defined as [weight] of path m (path-m).

  In the configuration of the present invention, the label provided to the receiver um is a label that does not correspond to the special subset and a label that is further reselected from the label that corresponds to the special subset, and corresponds to the special subset and is reselected. The labels to be used are as follows.

The label corresponding to the value _xy corresponding to the node number y of the leaf (leaf node), ie,
x _y = LABEL _{P (y), S (y)}
Is always given to the receiver. Note that P (i) is a parent node of the node i, and S (i) is a sibling node of the node i.

  Further, the label of the number of weights (number of 1s) in the bit representation of the path m (path-m) corresponding to the upper receiver um is given to the receiver. Note that the label corresponding to the value assigned to the leaf must be given directly to the receiver, since it is not derived from other values.

For example, in the binary tree configuration shown in FIG. 19A, in the configuration in which the bit representation of the path m (path-m) corresponding to each receiver um as shown in FIG. 21 is set, the path m (path− Only the label x ₁₆ = LABEL _{8, 17} corresponding to the node corresponding value x ₁₆ corresponding to the leaf (node number = 16) corresponding to the receiver u 1 is received by the receiver u 1 whose bit representation of m) is all 0. Given, no other labels.

The logN receivers (u2, u3, u5, u9) including only one 1 included in the bit representation correspond to the node number (y) corresponding to the node number (y) of the self node (leaf) set by the receiver um ( In addition to the label [x _y = LABEL _{P (y), S (y)} ] corresponding to X _y ), one label is given. However, the leaf to which the receiver is assigned here is called a “self node”.

で表される。
なお、上記式は、ｌｏｇＮ個からｊ個を選択する場合の数を示す式である。 The same applies to the following, in addition to the label [ _xy = LABEL _{P (y), S (y)} ] corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver. The number of receivers to which j labels (j = 0, 1,..., Log N) are given is

It is represented by
Note that the above expression is an expression indicating the number when j is selected from logN.

Specifically, in the binary tree configuration (N = 16) shown in FIG.
log16 = 4.
In the case of j = 1, that is, the label [x _y = LABEL _{P (y), S (y)} corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver ], There are four receivers (u2, u3, u5, u9) that are given one more label.
In the case of j = 2, that is, a label [x _y = LABEL _{P (y), S (y)} corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver ], There are six receivers (u4, u6, u7, u10, u11, u13) that can be given two more labels.
In the case of j = 3, that is, the label [x _y = LABEL _{P (y), S (y)} corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver ], There are four receivers (u8, u12, u14, u15) that are given three labels.
In the case of j = 4, that is, the label [x _y = LABEL _{P (y), S (y)} corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver ], A receiver that can be given four more labels is one of (u16).
Note that the node u1 only needs to have a label corresponding to the node corresponding value corresponding to the self node.

As described above, in the configuration in which the node key setting process of the present invention is performed, the receiver associated with each leaf (leaf) is the self-node (leaf) in which the receiver is set for the label corresponding to the special subset. In addition to the label [x _y = LABEL _{P (y), S (y)} ] corresponding to the corresponding value (X _y ) of the node number (y) of j, it is sufficient to hold j labels, that is, j + 1 labels in total. . However, j is the number of nodes i other than leaves that satisfy both of the above conditions (b1) and (b2), and the number of nodes other than leaves included in the path m (path-m) is logN. The number is 0 or more and log N or less.

In the conventional subset difference (SD) method, the label corresponding to the special subset given to each receiver is N receivers.
logN + 1.

The number of labels corresponding to a special subset given to the receiver in the SD scheme is calculated as follows. A first special subset S _{i, j} to which a receiver belongs and nodes i and j are in a parent-child relationship is the number of internal nodes on the path from the leaf to the root to which the receiver is assigned. Exists. This is because the internal node is i, and the node that is not on the above path among the child nodes is j.

Therefore, the number of labels corresponding to the first special subset possessed by a certain receiver is logN. The second special subset S1 _{, φ} is used when there is no receiver to be revoked, and all receivers belong to it. That is, all receivers have LABEL _{1, φ} . From the above, the number of labels corresponding to the special subset given to the receiver in the SD method is logN + 1.

On the other hand, in this system, when the number of receivers is N, the number of labels corresponding to the special subset given to each receiver is as described above.
j + 1.

Therefore, by applying this method, the number of labels held by each receiver can be reduced by the following number. That is,
(LogN + 1)-(j + 1)
= LogN−j reductions are possible.

  This reduced amount of labels can be obtained by applying the one-way function F to the labels held by each receiver.

である点に注意されたい。すなわち、受信機数Ｎの２分木構成において、ラベル数をｊ個削減することのできる受信機の数も、

によって示されることになる。 By the way, the following formula

Please note that. That is, in the binary tree configuration with N receivers, the number of receivers that can reduce the number of labels by j is

Will be indicated.

  FIG. 22 shows the flow of the setup process described above. Each step of the flow of FIG. 22 will be described.

  First, in step S201, the management center (TC) defines a binary tree having N leaves. The root, which is the highest node in the binary tree, is set to 1, and the subsequent numbers are set with breadth priority (breadth first order). That is, a node correspondence number is set for each node of the hierarchical tree as shown in FIGS.

  Further, the receiver um (m = 1, 2,..., N) is assigned to each leaf of the tree. In addition, a one-way function F of C-bit output is selected and disclosed. C is an arbitrary number, and as the one-way function, for example, an existing one-way function (hash function) such as MD4, MD5, and SHA-1 can be applied.

  Furthermore, a subset is defined in a binary tree with N leaves. As described above with reference to FIG. 6, two nodes i and j (where i is a node that is an ancestor of j) are used as a subtree having node i as a vertex. A set representing “a set obtained by subtracting a leaf (leaf) of a sub-tree having a node j as a vertex” from a set of leaves (leaves) is defined.

Next, in step S203, the management center (TC) sets the corresponding value x _i of each node i in the binary tree having N leaves according to the algorithm described above with reference to the flow of FIG. Construct a directional tree. That is,
(A) The number N of leaves constituting the binary tree,
(B) C-bit output unidirectional function F;
, The number of all nodes (including leaves) constituting the binary tree: the number of 2N−1 C bits corresponding to 2N−1 x ₁ , x ₂ ,..., X _{2N− 1}
To decide.

The management center (TC) uses the determined 2N−1 C-bit numbers x ₁ , x ₂ ,..., X _2N−1 as labels corresponding to the special subset in the subset defined in step S201. decide.

That is, the number _x 1 of 2N-1 pieces of C bits calculated by the algorithm described with reference to FIG. 14, _{x 2, ...,} one value _{x 1} in _{x 2N-1,} the receiver is to be revoked _Are the labels of the second special subset SS _{1, φ} including all receivers to be used in the absence of any and the other values of x ₂ ,..., X _2N−1 are the node i and node j Is set as a label LABEL _{i, j} corresponding to the first special subset SS _{i, j} (where j = 2, 3,..., 2N−1 as described above) having a parent-child relationship. To do. That is,
LABEL _{1, φ} = x ₁
And set
Furthermore, for y = 1, 2,..., N−1,
LABEL _{y, 2y} = x _{2y + 1}
LABEL _{y, 2y + 1} = x _2y
And

Next, in step S203, a label that does not correspond to a special subset is derived. The management center (TC) inputs the label LABEL _{i, j} of the first special subset SS _{i, j in which} the node i and the node j are in a parent-child relationship to the pseudorandom number generator G, and sets the node i as the starting point. The labels LABEL _{i, LC (j)} and LABEL _{i, RC (j)} of the child node of the node j are obtained.

That is, G _L (LABEL _{i, j} ) _, which is the upper C bit of the 3C-bit pseudorandom number obtained by inputting LABEL _{i, j} having the number of bits C to the pseudorandom number generator G, starts from the node i, Set as a label LABEL _{i, LC (j)} of a subset S _{i, LC (j)} corresponding to the left child node LC (j) of node _j, and LABEL _{i, j} of bit number C G _R (LABEL _{i, j} ) _, which is the lower C bit of the 3C-bit pseudo-random number obtained by inputting to the pseudo-random number generator G, is the child node RC (j) to the right of the node j starting from the node i. Is set as a label LABEL _{i, RC (j)} of a subset S _{i, RC (j)} corresponding to (not special). That is,
LABEL _{i, LC (j)} = _GL (LABEL _{i, j} )
_{LABEL i, RC (j) =} G R (LABEL i, j)
Each label is set as

Further, by repeatedly inputting these outputs (labels) to the pseudo-random number generator G, labels corresponding to all nodes that are descendants of the node j starting from the node i are obtained. This is done for the labels of all special subsets SS _{i, j} to determine the labels of all the subsets S _{i, j} defined in step 1.

Next, in step S204, the management center (TC) determines a label to be provided to the receiver um, that is, a label to be stored by the receiver um. As described above, first, a label given to the receiver um in the original SD method is selected as a temporary selection label. This is the node j that branches directly from the path from the leaf (leaf) to i starting from the internal node i on the path m (path-m) from the leaf (leaf) to which the receiver um is allocated to the root. and the subset _{S i, j} of the label lABEL _{i, j} corresponding to the special subset SS ₁ of the second of the _above, the label lABEL ₁ corresponding to _phi, is _phi.

  Next, the management center (TC) reselects a label to be provided to the receiver um from among these temporarily selected labels. The management center (TC) selects a label satisfying the following condition (a) and a label satisfying the following condition (b) from among the temporarily selected labels, and finally provides the label to each receiver um. Determine as.

(A) Among the temporarily selected labels, those that do not correspond to any special subset, that is, the first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship, and the receiver to be revoked A label LABEL _{i, j} corresponding to a subset that is not _one of the second special subset SS _{1, φ} corresponding to the entire tree including all receivers to be used when there is no one.
(B) In the temporary selection label, any special subset, that is, the first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship, and no receiver to be revoked A label corresponding to _one of the second special subset SS _{1, φ} corresponding to the whole tree including all receivers used in the case;
(B1) The node y is a node included in PathNodes-m, and
(B2) node 2y label _{LABEL i} corresponding to the corresponding values _{x y} the value y is a node that is not included in _PathNodes-m, j.
The label satisfying the condition (a) and the label satisfying the condition (b) are determined as final provided labels for the receiver um and provided to the receiver.

(5-2) Information Distribution Processing Next, details of the secret information transmission processing executed after the above-described setup processing will be described. Information distribution, that is, transmission of secret information, is performed by broadcast transmission of one or more ciphertexts by the management center (TC). Each ciphertext is obtained by encrypting secret information using one of the subset keys. For example, the secret information transmitted by the management center is configured as a set of a plurality of ciphertexts obtained by encrypting the same transmission secret information using different subset keys.

For example, when the secret information is a key applied to the composite of encrypted content: the content key Kc, a set of ciphertexts in which the content key Kc is encrypted with a plurality of subset keys is generated and provided. For example,
E (SK _{a, b} , Kc), E (SK _{c, d} , Kc), E (SK _{e, f} , Kc)
Is generated and stored in a network distribution or recording medium. E (A, B) means data obtained by encrypting data B with the key A. The above example is a ciphertext set composed of three ciphertexts encrypted by applying three different subset keys.

Each of the subset key SK _{a, b} , subset key SK _{c, d} , subset key SK _{e, f} corresponds to the subset key corresponding to the subset selected in the management center (TC) to set a specific device as a revoke device. It is.

Non-revoked receivers can generate any of the subset keys applied to ciphertext encryption based on the labels (labels and intermediate labels) held by the receiver, Only the selected receiver
E (SK _{a, b} , Kc), E (SK _{c, d} , Kc), E (SK _{e, f} , Kc)
The content key Kc can be obtained by decrypting one of the ciphertexts included in the.

FIG. 23 shows a subset used when the receivers u5, u11, and u12 are revoked in the hierarchical tree configuration in which the total number of receivers N = 16. Subset to be used for revoked receivers u5, u11, u12 are two subsets _{S 2,20} and _{S 3, 13} shown in FIG. 23.

Not revoked receivers are included in one of the two subsets _{S 2,20} and _{S 3, 13,} the receiver being revoked u5, u11, u12 is because it is not included in any thereof, corresponding to these subsets if transmission by encrypting the secret information using the subset keys SK _2,20 and SK _{3, 13,} it is possible to obtain the secret information only receiver does not revoke by decrypting the ciphertext.

  The processing procedure of the information distribution process will be described with reference to the flow shown in FIG. Each step in the flow shown in FIG. 24 will be described.

  First, in step S301, the management center (TC) selects a revoke receiver, that is, an excluded device that is not to be provided with transmission secret information. Note that all receivers are set in correspondence with leaves in a hierarchical tree structure.

Next, in step S302, based on the leaf position of the hierarchical tree corresponding to the determined revoke receiver, a subset to be applied for the distribution name of the secret information is determined. For example, in the example of FIG. 23, the receiver u5 as revoked receivers, u11, u12 has selected subset of applying becomes two subsets _{S 2,20} and _{S 3, 13.}

In step S303, a subset key corresponding to the determined subset is selected. The management center (TC) holds a subset key corresponding to the subset in advance. For example, in the example of FIG. 23, two subset keys _SK corresponding to the two subsets _{S 2,20} and _{S 3, 13 2,20} and the SK _{3, 13} are selected.

Next, in step S304, the secret information is encrypted using the subset key selected in step S303 to generate a ciphertext set. For example, in the example of FIG. 23, a ciphertext set is generated by encrypting the secret information by using the two subset keys _{SK 2,20} and SK _{3, 13.} For example, in the example of FIG. 23, the secret information (e.g., content key Kc) to encrypt the following ciphertext set by using the two subset keys _{SK 2,20} and SK _{3, 13,
E (SK 2,20, Kc),} E (SK 3,13, Kc)
Is generated.

  In step S305, the ciphertext set generated in step S304 is transmitted to the receiver (broadcast transmission). The transmitted ciphertext set is composed only of ciphertext that can be decrypted only by a receiver other than the revoke device. The ciphertext set cannot be decrypted by the revoke device, and secure information distribution is possible.

  In transmitting the ciphertext set, subset designation information as sequence information of ciphertext corresponding to each subset included in the ciphertext may be transmitted together. Based on the designation information, the receiver can easily extract the ciphertext to which the subset key that can be generated by the receiver is applied. As this specific method, for example, a configuration using a key designation code disclosed in Japanese Patent Laid-Open No. 2001-352322 is applicable.

Note that the subset key used for encryption may be the one created and stored in the setup phase by the management center (TC), or created and stored in the setup phase. You may derive | lead-out using the pseudorandom number generator G from the label for every subset. If there is no receiver to be revoked, it is used for encryption of secret information using the subset key SK _{1, φ} of the second special subset SS _{1, φ} described above.

(5-3) Reception and Decryption Processing A receiver that is not revoked belongs to only one of the above subsets. Therefore, if a ciphertext created using a subset key corresponding to the subset is decrypted, it is a secret. Information can be obtained. In order to find the ciphertext to be decrypted by the receiver, the above-described subset designation information may be used. After identifying the ciphertext, the receiver derives a subset key from the label or intermediate label it owns and uses it to decrypt the ciphertext. A method for deriving the subset key is described below.

First, the receiver um determines whether the node j of the subset S _{i, j} corresponding to the subset key SK _{i, j} to be applied to the ciphertext decryption process is one of the following (A) and (B): To do.
(A) Whether the receiver is a descendant of node k with direct label LABEL _{i, k} (including the case where j = k),
(B) Among the child nodes of node i, the node not on the path from the leaf (leaf) n to which the receiver is assigned to the root (that is, the node that is a sibling of the child node of node i on the path) ) That matches or is a descendant of k, but the receiver does not directly hold the label LABEL _{i, k} (ie, node j is the first of the subsets to which the receiver um is labeled in the SD scheme) Of a particular subset SS _{i, k} of the node k but whose receiver does not directly hold the label LABEL _{i, k} )
It is judged whether it is either.

If there is no receiver to be revoked and the subset key SK _{1, φ of} the second special subset SS _{1, φ} is used for encryption of secret information, the receiver holds the label LABEL _{i, φ} . If it is, it is assumed that it is (A), otherwise it is assumed that it is (B). In this case, in the case of (B), the receiver can calculate the label LABEL _{i, φ} by applying the one-way function F to the label corresponding to the special subset held by itself.

In the case of (B), the label LABEL _{i, k} for deriving the subset key applied to the ciphertext is calculated based on the label given to the receiver as described below.

に対応するラベルを保持している。なお、ここで、ｎ＝０ならば、受信機ｕｍは、値ｘ_ｙに対応するラベルを直接保持しているので、上記（Ａ），（Ｂ）の条件の（Ａ）に対応することになる。よってここではｎ＞０となる。 First, the receiver um finds LABEL _i, node y unidirectional tree corresponding to _k (i.e. _{LABEL i,} k = y). 2 ⁿ y is included in the path node m (PathNodes-m) corresponding to the receiver um, but 2 ^{n + 1} y detects the minimum n that is not included in the path node m (PathNodes-m). In this case, the receiver um, the corresponding value of the node ^{2 n} y,

The label corresponding to is held. Here, if n = 0, the receiver um directly holds the label corresponding to the value _xy, and therefore corresponds to (A) in the conditions (A) and (B). Become. Therefore, here, n> 0.

に等しい値を持つラベルに対して一方向性関数Ｆをｎ回適用することで、ノードｙの値ｘｙに対応するＬＡＢＥＬ_ｉ，ｋを算出する。 The receiver uses the corresponding value of the node 2 ^ny detected by the above processing,

LABEL _{i, k} corresponding to the value xy of the node y is calculated by applying the one-way function F n times to a label having a value equal to.

When the LABEL _{i, k} corresponding to the subset S _{i, k} is derived in this way, the label of the necessary subset S _{i, j} using the pseudo random number generator G as described above with reference to FIG. LABEL _i, seek _j, further subset key _{SK i} of that _{subset, j} the _{SK i, j = G M (} LABEL i, j)
And the ciphertext is decrypted using the subset key SK _{i, j} .

A specific subset key derivation processing example will be described with reference to FIG. As shown in FIG. 25, it is assumed that the receivers u5, u11, u12 are revoked, and the ciphertext encrypted with the subset keys corresponding to the subsets S2, ₂₀ and the subsets _{S3, 13} is broadcast.

First, a processing example in the receiver u4 (node number = 19) will be described. The receiver u4 includes three labels: LABEL _2,5 , LABEL _4,8 and LABEL _9,18 corresponding to the special subset, and labels not corresponding to the special subset: LABEL _1,5 , LABEL _1,8 , _{lABEL 1,18, lABEL 2,8, lABEL 2,18} , holds a total of nine labels and six labels _{lABEL 4,18,.}

The receiver u4 is the above (A). That is, since the receiver _u4 directly holds the label LABEL _2,5 using the node 5 that is the ancestor of the node 20 with _respect to the subset S _2,20 , the pseudo random number generator G is provided to the subset S _2,20 as many times as necessary ( In this case, the subset key SK _2,20 can be obtained by applying only three times.

As described above, in the conventional SD system, for the receiver u4,
_{LABEL 1,3, LABEL 1,5, LABEL 1,8} , LABEL 1,18, LABEL 2,5, LABEL 2,8, LABEL 2,18, LABEL 4,8, LABEL 4,18, LABEL 9,18, 11 labels of LABEL _{1 and φ} will be provided. In the system of the present invention, as described above, the receiver u4 has 9 labels, that is,
As a special non-subset label,
_{LABEL 1,5, LABEL 1,8, LABEL 1,18} , LABEL 2,8, LABEL 2,18, 6 pieces of label _{LABEL 4,18,}
As a special subset support label,
three labels x ₄ = LABEL _2,5 , x ₉ = LABEL _4,8 , x ₁₆ = LABEL _9,18 ,
Only will be provided.

In the system of the present invention, two labels that are not given to the receiver u4 are:
LABEL _1,3 ,
LABEL _{1, φ} ,
Are two labels,
For these labels, the receiver u4 calculates from the provided labels. That is,
LABEL _1,3 = x ₂
LABEL _{1, φ} = x ₁
And
The receiver u4 has x ₄ = LABEL _2,5 ,
Each of the 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 as the node-corresponding values is calculated according to the algorithm described with reference to the flow of FIG. Value
F (x _i ) = x _{i / 2}
Satisfied.

Therefore, the receiver u4 is based on the label x ₄ = LABEL _2,5 that it owns,
F (x ₄ ) = x ₂ = LABEL _1,3
F (x ₂ ) = x ₁ = LABEL _{1, φ}
Can be calculated.

  Therefore, the receiver u4 has fewer labels than the conventional SD system, but the number of usable labels is the same as that of the conventional SD system.

Next, a processing example in the receiver u1 (node number = 16) will be described. As shown in FIG. 26, the receiver u1 has one label: LABEL ₈ , ₁₇ corresponding to the special subset and a label not corresponding to the special subset: LABEL _1,5 , LABEL _1,9 , LABEL _1, A total of seven labels are held, including six labels ₁₇ , LABEL ₂ , ₉ , LABEL ₂ , ₁₇ , and LABEL ₄ , ₁₇ .

In this case, the receiver u1 corresponds to the above (B). (B) Among the child nodes of node i, the node not on the path from the leaf (leaf) n to which the receiver is assigned to the root (that is, the sibling of the child node of node i on the path) A node) that matches or is a descendant of k, but the receiver does not directly hold the label LABEL _{i, k} (ie, among the subsets in which node j is given a label to receiver um in the SD scheme) A descendant of node k constituting the first special subset SS _{i, k} but the receiver does not directly hold the label LABEL _{i, k} ).

Specifically, the receiver u1 does not directly hold the label LABEL _{2, k} using the node k that is an ancestor of the node 20 with respect to the subset S _2,20 . For this reason, _{LABELs 2} and ₅ are derived from the labels _{LABELs 8} and ₁₇ held.

The label given to the receiver u1 in the conventional original SD method is
_{LABEL 1,3, LABEL 1,5, LABEL 1,9} , LABEL 1,17, LABEL 2,5, LABEL 2,9, LABEL 2,17, LABEL 4,9, LABEL 4,17, LABEL 8,17, LABEL _{1 and} 11 labels are provided, but in the method of the present invention, as described above, only seven labels are provided to the receiver u1.

In the method of the present invention, the four labels not given to the receiver u1 are:
LABEL _4,9 ,
LABEL _2,5 ,
LABEL _1,3 ,
LABEL _{1, φ} ,
The four labels of
For these labels, the receiver u1 calculates from the provided labels. That is,
LABEL _4,9 = x ₈ ,
LABEL _2,5 = x ₄ ,
LABEL _1,3 = x ₂
LABEL _{1, φ} = x ₁
And
The receiver u1 has x ₁₆ = LABEL _8,17
Each of the 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 as the node-corresponding values is calculated according to the algorithm described with reference to the flow of FIG. Value
F (x _i ) = x _{i / 2}
Satisfied.

Therefore, the receiver u1 is based on the label x ₁₆ = LABEL ₈ , ₁₇ owned by
F (x ₁₆ ) = x ₈ = LABEL _4,9
F (x ₈ ) = x ₄ = LABEL _2,5
F (x ₄ ) = x ₂ = LABEL _1,3
F (x ₂ ) = x ₁ = LABEL _{1, φ}
Can be calculated.

In the example of FIG. 26, since LABELs ₂ , ₅ are required to be derived, the receiver u1 performs the one-way function F with respect to the special subset corresponding label x ₁₆ = LABEL ₈ , ₁₇ held by the receiver u1. _Is applied twice to derive LABELs _2,5 .

By applying the pseudo random number generator G to the derived labels LABEL ₂ and ₅ as many times as necessary (three times), the subset keys SK ₂ and ₂₀ applied to the ciphertext can be calculated.

This process is the same when there is no receiver to be revoked and the second special subset SS1 _{, φ} is used as a subset. That is, the receiver holds LABEL _{1, φ} directly or holds a label from which LABEL _{1, φ} can be derived by applying the one-way function F as many times as necessary. LABEL _{1, φ} is obtained using the function F. Then, a subset key is obtained by SK _{1, φ} = G _M (LABEL _{1, φ} ). Since no other labels are derived from LABEL _{1, φ,} there is no receiver to revoke if SK _{1, φ} = LABEL _{1, φ} is specially set only for subset key SK _{1, φ.} In this case, the number of times the pseudo random number generator G is applied can be reduced by one, leading to a reduction in load.

  A procedure for acquiring and decrypting a subset key from ciphertext receipt executed by the receiver will be described with reference to a flowchart of FIG.

  In step S401, the receiver first determines a ciphertext set composed of a plurality of ciphertexts to be decrypted by itself. This is a process of extracting the ciphertext encrypted with the subset key that can be generated by itself. Here, the fact that the receiver cannot determine the cipher to be decrypted means that the receiver has been revoked. This ciphertext selection process is executed based on, for example, subset designation information sent together with the ciphertext.

  When the ciphertext is determined, in step S402, the receiver derives the subset key used for encrypting the ciphertext by the above method.

In the subset key derivation process, the receiver executes the following process.
(1) When the applied subset key of the ciphertext is not a subset key that can be calculated from the label corresponding to the special subset by the pseudorandom number generation process, the receiver generates a pseudorandom number generator for the label that does not support the special subset Applying G as many times as necessary to calculate an applied subset key of ciphertext.
(2) When the applied subset key of the ciphertext is a subset key that can be calculated from the label corresponding to the special subset by the pseudorandom number generation process, the receiver uses the pseudorandom number generator G from the label corresponding to the special subset held by the receiver. To determine whether the applicable subset key of ciphertext can be calculated
(2-1) If possible, apply the pseudo random number generator as many times as necessary to the label corresponding to the special subset, and calculate the applied subset key of the ciphertext.
(2-2) If impossible, apply one-way function F to the label corresponding to the special subset held by itself as many times as necessary to calculate a label corresponding to the new special subset, The pseudo-random number generator is applied as many times as necessary to the label corresponding to the special subset, and the applied subset key of the ciphertext is calculated.

  The label calculation process in (2-2) is performed as a label calculation process corresponding to a special subset including a node on a path from the setting node of the receiver um to the root in the hierarchical tree. A label corresponding to a higher special subset is calculated by applying a one-way function from a label corresponding to a lower special subset of the hierarchical tree of the receiver um.

  In step S404, the receiver that has derived the subset key by the above process decrypts the ciphertext selected from the ciphertext set in step S402, and obtains the transmitted secret information. The secret information is, for example, a content key for decrypting encrypted content of a television broadcasting system. In this case, the receiver receives the encrypted content, decrypts it using the content key, and outputs it.

  Next, with reference to FIG. 28 and FIG. 29, the functional configuration of the information processing apparatus that executes label setting processing, ciphertext generation processing, and the information processing apparatus as a receiver that executes ciphertext decryption processing will be described. To do.

  First, the configuration of an information processing apparatus that executes label setting processing and ciphertext generation processing will be described with reference to FIG. The information processing apparatus 410 includes a label generation unit 411, a provided label determination unit 412, a ciphertext generation unit 413, and a ciphertext provision unit 414.

  Information processing apparatus 410 applies a broadcast encryption method based on a hierarchical tree configuration to generate a hierarchical tree that is applied to ciphertext provision processing that can be decrypted only by a specific selected device other than an exclusion (revocation) device. The label generation unit 411 is a processing device, and a label corresponding to a special subset selected in a subset (LABEL) corresponding to each subset set based on an SD (Subset Difference) scheme to which a hierarchical tree is applied Is generated as a value that can be calculated by applying the one-way function F to the values of the labels corresponding to other special subsets. For example, MD4, MD5, or SHA-1 is applicable as the one-way function F.

The special subset selected by the label generating means 411 is
In the hierarchical tree, node i and node j are directly connected in the hierarchical tree among subsets S _{i, j} defined as a set excluding a partial tree having node j as a vertex from a partial tree having node i as a vertex. A first special subset in a parent-child relationship,
A second special subset which is a subset S1 _{, φ} defined as a set of whole trees with the root containing all leaves of the hierarchical tree as vertices;
At least one of them.

  The label generation means 411 is a label corresponding to each subset set based on the SD (Subset Difference) method (LABEL), and the label value corresponding to the selected special subset is set immediately below the special subset. A label that can be calculated by applying the one-way function F to the values of the special subset of is generated.

Specifically, according to the algorithm described above with reference to the flow of FIG. 14, N values: x _{N to} x _2N−1 are determined in a hierarchical tree having a binary tree structure with N terminal nodes, Perform an initial setting of i = 2N−1, and if i = (2N−1) to 1, i = even, apply a one-way function F to calculate F (x _i ), x _{i / 2} is set, and by these processes, 2N-1 label values corresponding to special subsets: x _{1 to} x _2N-1 are determined in a binary tree configuration with N terminal nodes.

  The provided label determination unit 412 executes a process of determining a provided label for a receiver corresponding to the end node of the hierarchical tree. The provided label determining means 412 is a special subset non-corresponding label that does not correspond to the special subset, and a label that corresponds to the special subset and can be calculated by applying the one-way function F to the label provided to the receiver. The minimum special subset-compatible label is excluded as a provision label for the receiver.

Specific processing of the provided label determination means 412 is as follows. First, the internal node i on the path m (path-m) from the leaf (leaf) to which the receiver um is assigned to the root is set as the starting point, and the node j directly branched from the path from the leaf (leaf) to i provisional corresponding subset _{S i, j} of the label lABEL _i, and _j, the subset SS ₁ corresponding to the entire tree including all receivers to be used when no revoked _receivers, the label lABEL ₁ corresponding to _phi, and _phi As a selection label, the following conditions,
(A) The first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship in the temporarily selected label, and all receivers used when there is no receiver to be revoked A label LABEL _{i, j} corresponding to a subset that is not _one of the second special subset SS _{1, φ} corresponding to the whole tree;
(B) a label corresponding to one of the first special subset SS _{i, j} and the second special subset SS _{1, φ} from a provisionally selected label;
(B1) The node y is a node included in PathNodes-m, and
(B2) node 2y corresponds to the value _{x y} which corresponds to the value y is a node that is not included in PathNodes-m label LABEL _i, and _j,
The label that satisfies the above condition (a) or (b) is determined as the final provided label for the receiver um.

The provided label determination means 412 is a label [x _y = LABEL _{P (y), S (y)} ] corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver. In addition, j labels (where j is 0 or more and log N, N is the number of terminal nodes in the hierarchical tree = the number of receivers) are determined as the number of provided labels corresponding to the special subset for the receiver.

  The ciphertext generation unit 413 selectively applies a subset key that can be derived from the label generated by the label generation unit 411 and executes an encryption process to generate a ciphertext. The ciphertext providing unit 414 provides the ciphertext generated in this manner by storing it in a network or a medium.

  Next, a functional configuration of an information processing apparatus as a receiver that executes ciphertext decryption processing will be described with reference to FIG.

  The information processing apparatus 420 as a receiver that executes ciphertext decryption processing includes ciphertext selection means 421, label calculation means 422, subset key generation means 423, decryption means 424, and label memory 425.

  The information processing apparatus 420 as a receiver that executes the decryption process of the ciphertext is encrypted by a subset key corresponding to each subset set based on a SD (Subset Difference) method that is a broadcast encryption method based on a hierarchical tree configuration. Information processing apparatus 420 that executes the decryption process of the ciphertext, and the ciphertext selection unit 421 can calculate from the ciphertext to be processed from the label held in its own label memory 425 or the label held by itself A ciphertext generated by applying a subset key derivable by pseudorandom number generation processing based on a simple label is selected.

  The label calculation unit 422 applies a one-way function F to the retained label when the applied subset key of the ciphertext is not a subset key that can be derived by the pseudorandom number generation process based on the retained label, and is different from the retained label. Calculate the label.

The label calculating means 422 uses the subset S _i, in which the ciphertext applied subset key is defined as a set excluding a subtree having a node j as a vertex from a subtree having the node i as a vertex in the hierarchical tree _{. j} is a first special subset in which a node i and a node j are directly connected in a hierarchical tree, or a subset S ₁ defined as a set of whole trees whose vertices are roots including all leaves of the hierarchical tree. _{, Φ} is a subset key that can be calculated by a pseudo-random number generation process based on a label corresponding to any special subset of the second special subset, and is held when the label corresponding to this special subset is not held By applying the one-way function F to other labels, a label corresponding to this special subset is calculated.

  The label calculation unit 422 calculates a label corresponding to a special subset including a node on a path from the setting node of the receiver that performs decoding processing to the root in the hierarchical tree by performing an operation using a one-way function. . The directional function F to be applied is MD4, MD5, SHA-1, or the like.

  The subset key generation unit 423 applies a pseudo random number generator G based on the label stored in the label memory 425 or the label LABEL calculated from the other label in the label calculation unit 422 to obtain a necessary subset key. Ask.

  The decryption means 424 executes the ciphertext decryption process based on the subset key calculated by the subset key generation means 423.

  FIG. 30 illustrates a hardware configuration example of an information processing apparatus 500 that performs label setting processing, ciphertext generation processing, and an information processing apparatus 500 as a receiver that executes ciphertext decryption processing. The blocks surrounded by dotted lines in the figure are not necessarily provided. For example, the media interface 507 is provided when the receiver 500 is an optical disc player or the like. The input / output interface 503 is provided when the receiver 500 exchanges information with other devices or receives a signal from an antenna. What is important is the secure storage unit 504, and the label given from the management center (TC) is securely stored in the setup phase.

  As illustrated in FIG. 30, the information processing apparatus 500 includes a controller 501, an arithmetic unit 502, an input / output interface 503, a secure storage unit 504, a main storage unit 505, a display device 506, and a media interface 507.

  The controller 501 is configured by a CPU having a function as a control unit that executes data processing according to a computer program, for example. The arithmetic unit 502 functions as a dedicated arithmetic unit and cryptographic processing unit for generating cryptographic keys, generating random numbers, and cryptographic processing, for example. A label calculation process and a subset key calculation process based on the label are executed. Further, when the information processing apparatus 500 is an information processing apparatus as a receiver, a ciphertext decryption process based on the subset key is executed.

  The input / output interface 503 is an interface corresponding to data input from an input unit such as a keyboard and a mouse, data output to an external output device, and data transmission / reception processing via a network.

  When the information processing apparatus 500 is an information processing apparatus as a receiver, the secure storage unit 504 should hold the label, various IDs, and the like given from the management center (TC) safely or secretly in the setup phase, for example. Data is saved.

  The secure storage unit 504 stores a label corresponding to the special subset (LABEL) selected from the subset and a label not corresponding to the special subset (LABEL).

When the information processing apparatus 500 is an information processing apparatus as a receiver, the label corresponding to the special subset (LABEL) stored in the secure storage unit 504 is
In the hierarchical tree, node i and node j are directly connected in the hierarchical tree among subsets S _{i, j} defined as a set excluding a partial tree having node j as a vertex from a partial tree having node i as a vertex. A first special subset in a parent-child relationship,
A second special subset which is a subset S1 _{, φ} defined as a set of whole trees with the root containing all leaves of the hierarchical tree as vertices;
Is a label corresponding to a subset selected from the special subset, and is the minimum number of labels that cannot be calculated from the labels held by itself.

That is, as described above, the receiver sets the label [x _y = LABEL _{P (y), S} corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver. _{(Y) In} addition to], j labels (j = 0, 1,..., LogN) are stored.

  The main storage unit 505 is a memory area used for, for example, a data processing program executed in the controller 501, other temporary storage processing parameters, a work area for program execution, and the like. The secure storage unit 504 and the main storage unit 505 are memories configured by, for example, a RAM, a ROM, or the like. The display device 506 is used for outputting decrypted content. The media interface 507 provides a read / write function for media such as a CD, a DVD, and an MD.

[6. Overview of Basic Layered Subset Difference (Basic LSD) Method]
Next, an outline of the Basic Layered Subset Difference (Basic LSD) method will be described.

  [Non-Patent Document 2: Advances in Cryptography-Crypto 2002, Lecture Notes in Computer Science 2442, Springer, 2002, pp 47-60, “D. Halevi and A. ShamTham E. In “Scheme” ”], a Layered Subset Difference method, which is an improvement of the SD method, has been proposed. The LSD system includes a basic (basic) system and a general (generalized) system that is an extension of the basic system. Here, the basic method will be described.

  The LSD system is an extension of the SD system and incorporates a new concept of layers. In the tree structure in the SD system, a specific height is defined as a special level (special level). In the basic LSD system, there is only one special level, but in the generalized LSD system, a plurality of special levels having different importance levels are used.

For simplicity, it is assumed that log ^1/2 N is an integer. In the basic LSD system, as shown in FIG. 31, of each level (floor) from the root of a tree to a leaf (leaf), each log ^1/2 N including the level of the root and leaf (leaf) is included. Decide that the level is a special level. A hierarchy (including special levels at both ends) sandwiched between two adjacent special levels is called a layer. In the example of FIG. 31, the level of the root, the level including the node k, and the level of the leaf (leaf) are special levels, and the level of the root, the level including the node i, and the level including the node k constitute one layer. . Further, the level including the node k, the level including the node j, and the level including the leaf constitute different layers.

In the basic LSD scheme, among the subsets S _{i, j} defined in the SD scheme, (1) node i and node j are in the same layer, or (2) node i is at a special level, at least one of them Define only those that satisfy the conditions. In this way, some of the subsets used in the SD method will not be defined in the basic LSD method, but this subset may be represented by at most two unions of the subsets defined in the basic LSD method. it can. For example, in the example of FIG. 31, the subset S _{i, j} is not defined in the basic LSD scheme, but the node on the special level closest to node i (node k) on the path from node i to node j is used. ,
S _{i, j} = S _{i, k} ∪S _{k, j}
It can be expressed as.

That is, in the SD method, instead of one ciphertext encrypted using the subset key SK _{i, k} corresponding to the subset S _{i, k} , in the basic LSD method, the subsets S _{i, k} and S _{k, j} Two ciphertexts encrypted using the corresponding subset keys SK _{i, k} and SK _{k, j} are transmitted.

  With this contrivance, the number of ciphertexts to be transmitted only increases at most twice that of the SD system, while the number of labels held by each receiver can be reduced as compared with the SD system described above.

The number of labels held by each receiver in the SD method has been described with reference to FIG. 9. The number of labels held by each receiver in the basic LSD method in the case of the same setting is shown in FIG. Will be described with reference to FIG. The receiver u4 in FIG. 32 may hold only the label LABEL _{i, j} where i and j are in the same layer or i is at a special level. That is, the labels held by the receiver u4 are LABEL _1,3 , LABEL _1,5 , LABEL _1,8 , LABEL _1,18 , LABEL _2,5 , LABEL _4,8 , LABEL _4,18 , LABEL _9,18 It becomes. Furthermore, like the SD method, it is necessary to hold a special label used when there is no receiver to be revoked.

となる。 When the total number of receivers is N, the total number of labels held by each receiver is obtained as follows. First, the number of labels per layer is the number calculated by the following equation because node j exists for the height of i in the label when node i is determined.

It becomes.

である。 Since there are log ^1/2 N layers in the hierarchical tree, the number of labels in the layers of the entire hierarchical tree is the number calculated by the following equation.

It is.

である。 Next, considering that node i is at a special level, there are nodes j corresponding to the height of i in the entire hierarchical tree. Therefore, the number of labels in the entire hierarchical tree including that in which node i is at the special level is expressed by the following equation. Is the number calculated by

It is.

である。 Now, since the node i is in the special level and the node j is in the same layer is counted redundantly, it is necessary to subtract that amount. Since there are log ^1/2 N per layer, this combination is log N in total. If these and a special one for the case where there is no receiver to be revoked are added, the total number of labels held by each receiver in the basic LSD system is the number given by the following equation.

It is.

[7. Basic LSD system with a reduced number of labels using a unidirectional tree]
Next, a configuration for reducing the number of labels in the basic LSD method using a unidirectional tree will be described. In the present invention based on the SD method described above, the label LABEL _{i, j} of the subset S _{i, j} when the node i is the parent of the node j can be derived from another label by applying the one-way function F. By doing so, the number of labels each receiver has was reduced. This method can be similarly applied to the basic LSD method.

A specific configuration method is almost the same as the above-described embodiment of the present invention. However, at the time of setup, when the management center (TC) uses the pseudo random number generator G to create labels LABEL _{i, j} one after another, if the node i is not at the special level, the management center (TC) starts from the special level immediately below i. Since the label whose j is the lower node is not used, label generation can be stopped up to that special level. Also, when distributing the produced labels to the respective receivers, only the labels satisfying the above-described conditions are created, and it is only necessary to distribute only the labels to the receivers.

As a setting similar to that described with reference to FIG. 32, a specific example of a configuration for reducing the number of labels in the basic LSD method using a one-way tree will be described with reference to FIG. In the basic LSD system, the labels held by the receiver u4 are LABEL _1,3 , LABEL _1,5 , LABEL _1,8 , LABEL _1,18 , LABEL _2,5 , as described with reference to FIG. LABEL _4,8 , LABEL _4,18 , LABEL _9,18 and the same label as LABEL _{1, φ} used for a special subset when there is no receiver to be revoked _, a total of 9 labels It was necessary to keep it.

On the other hand, in the present invention, among the nine labels, four labels LABEL _1,5 , LABEL _1,8 , LABEL _1,18 , LABEL _4,18 that do not correspond to the special subset, and labels corresponding to the special subset And
(B1) The node y is a node included in PathNodes-m, and
(B2) node 2y label _{LABEL i} corresponding to the corresponding values _{x y} the value y is a node that is not included in _PathNodes-m, j.
Only hold.

In the receiver u4 in the example of FIG.
(B1) Node y is included in PathNodes-m,
Nodes satisfying the condition are PathNodes-4 = {1, 2, 4, 9, 19}.
In this,
(B2) The nodes that do not include the node 2y are nodes 4, 9, and 19. For nodes 1 and 2,
Node 1 includes node 2 corresponding to node 2 × 1 in PathNodes-4 = {1, 2, 4, 9, 19}.
The node 2 includes the node 4 corresponding to the node 2 × 2 in PathNodes-4 = {1, 2, 4, 9, 19}.

Therefore, in the receiver u4,
(B1) Node y is included in PathNodes-m, and
(B2) Node not including node 2y Nodes satisfying these conditions (b1) and (b2) have node numbers y = 4, 9, and 19.

As a result, the labels corresponding to the node corresponding values x ₄ , x ₉ , x ₁₉ corresponding to y = ₄ , ₉ , ₁₉ ;
x ₄ = LABEL _2,5
x ₉ = LABEL _4,8
x ₁₉ = LABEL _9,18
Are selected as the labels satisfying the condition (b), and these three labels are determined as the provided labels for the receiver u4.

As a result, the receiver u4 has
As a label that does not support special subsets,
LABEL _1,5 , LABEL _1,8 , LABEL _1,18 , 4 labels of LABEL _4,18 ,
As a label for the special subset,
3 labels x ₄ = LABEL _2,5 , x ₉ = LABEL _4,8 , x ₁₉ = LABEL _9,18 ,
A total of seven labels are provided.

In the system of the present invention, two labels that are not given to the receiver u4 are:
LABEL _1,3 ,
LABEL _{1, φ} ,
Are two labels,
For these labels, the receiver u4 calculates from the provided labels. That is,
LABEL _1,3 = x ₂
LABEL _{1, φ} = x ₁
And
The receiver u4 has x ₄ = LABEL _2,5 ,
Each of the 2N−1 C bit numbers x ₁ , x ₂ ,..., X _2N−1 as the node-corresponding values is calculated according to the algorithm described with reference to the flow of FIG. Value
F (x _i ) = x _{i / 2}
Satisfied.

Therefore, the receiver u4 is based on the label x ₄ = LABEL _2,5 that it owns,
F (x ₄ ) = x ₂ = LABEL _1,3
F (x ₂ ) = x ₁ = LABEL _{1, φ}
Can be calculated.

  As described above, even in the basic LSD system, the number of labels retained in the receiver can be reduced by the configuration to which the unidirectional tree of the present invention is applied.

Consider the number of labels that can be reduced by the present invention when the total number of receivers is N. Consider how many labels LABEL _{i, j} should be held by each receiver so that nodes i, j have a parent-child relationship in the basic LSD system to which the present invention is not applied.

When nodes i and j are in a parent-child relationship, the following three cases can be considered.
(A) Node i is at a special level.
(B) Node j is at a special level.
(C) Nodes i and j are not at a special level.
In any of these cases, when the nodes i and j are in a parent-child relationship (that is, adjacent to each other), i and j exist in the same layer. That is, the subset S _{i, j} satisfies the condition for being defined by the basic LSD method. That is, since such a subset is defined and used in the basic LSD system, the receiver needs to hold the corresponding LEVEL _{i, j} .

  For a given receiver, such a node i, j has a length of i (ie, a leaf on the path from the leaf to which the receiver is assigned to the root). There are all nodes except), and if i is determined, only one j is determined (a node that is a child of i and not on the above path), so there are log N pieces, that is, logN.

That is, in the basic LSD system, the number of labels can be reduced as in the SD system described above. Specifically, even in the basic LSD system, a label [ _xy = LABEL _{P (y), S} corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver. _{(Y) In} addition to], j labels (j = 0, 1,..., LogN) are given, and when the number of receivers is N, the number of labels corresponding to the special subset given to each receiver Is
j + 1.

の個数の受信機においてラベル数をｊ個削減することが可能となる。 By applying the method of the present invention, among N receivers,

The number of labels can be reduced by j in the number of receivers.

  This reduced amount of labels can be obtained by applying the one-way function F to the labels held by each receiver.

[8. Overview of General Layered Subset Difference (Generalized LSD) Method]
Next, an outline of the general layered subset difference (generalized LSD) method will be described.

  In the basic LSD method, one type of special level is used, but in the general layered subset difference (generalized LSD) method, a plurality of special levels having different importance levels are used.

Similar to the paper that proposed the LSD method, a path from the root to node j through node i is considered as one graph in the hierarchical tree. A tree root and a node j are end points, a tree node is a graph node, and one of the nodes other than the end points is a node i. In this graph, each node is represented by a distance from the route. This distance is represented by a d-digit b-base number (where b = (log ^{1 / d} N)). For example, the root is expressed as 0 ... 00, and the adjacent node (a node that is a child node of the root in the hierarchical tree structure) is expressed as 0 ... 01.

すなわち、ＳＤ方式におけるサブセットＳ_ｉ，ｊは一般化ＬＳＤ方式においては、高々ｄ個のサブセットの和集合で表される。 The subset S _{i, j} is considered to be the final transition from node i to node j, combining the defined transformations (node-to-node transition). The defined transformation represents the defined subset, and the individual transitions required for the final transition indicate the defined subset required to divide and represent the subset S _{i, j} . As in the original paper, when nodes i, k ₁ , k ₂ ,..., K _d−1 , j exist on the tree path in this order, the subset S _{i, j} in the SD scheme is In the generalized LSD system, it is expressed by the following formula.

That is, the subset S _{i, j} in the SD scheme is represented by a union of at most d subsets in the generalized LSD scheme.

In the generalized LSD scheme, node i is [x] (→) a [0] (→) in the above graph (where a is the rightmost number among non-zero numbers, and [x] (→) is [X + 1] (→) 0 [0] (→) or [x] (→) a ′ [y] when expressed as an arbitrary numeric string [0] (→) is a sequence of zero) ] (→) (where a ′> a, and [y] (→) is an arbitrary number string of the same length as [0] (→)). Define. That is, all the subsets S _{i, j} represented by such i, j pairs are defined.

In this way, in the basic LSD system, it is considered that the level represented by a 2-digit number in which d = 2 and the last digit (rightmost) is 0 in the generalized LSD system is a special level. Can do. In the generalized LSD scheme, the number of digits in the rightmost zero column in the number representing the node i represents the level of importance, and the node j can be any number from i + 1 to the first node that is more important than i. Node (including nodes at both ends). With such a setting, for example, if i = 8255917 and j = 864563, the transition from i to j, that is, the subset S _{i, j} in the SD scheme is
825917 → 825920 → 826000 → 830000 → 864563
It can be expressed by four transitions defined by the generalized LSD method.

となる。 That is, if k ₁ = 825920, k ₂ = 826000, k ₃ = 830000, the subset S _{i, j} is expressed by the following equation. That is,

It becomes.

に対応するサブセットキーで暗号化した４つの暗号文を送信する。 In order to transmit secret information to receivers belonging to the above-described subset S _{i, j} of the SD scheme, in the generalized LSD scheme, a subset represented by the following equation:

The four ciphertexts encrypted with the subset key corresponding to are transmitted.

The number of labels that each receiver should hold in the generalized LSD method decreases as the parameter d is increased, and finally,
O (log ^{1 + ε} N)
Get. However, ε = 1 / d. At this time, the upper limit of the number of ciphertexts to be sent is
d (2r-1)
It becomes. Please refer to the above paper for details.

[9. Generalized LSD Label Reduction Configuration Using One-way Tree]
Next, a configuration for reducing the number of labels in the generalized LSD method using a unidirectional tree will be described. The above-described method of reducing the number of labels that the receiver should hold by using a one-way tree in the basic LSD method can also be applied to the generalized LSD method. Specifically, the basic LSD method and the generalized LSD method differ only in the conditions to be satisfied by the defined subset, and there is no difference in the part using the one-way tree.

Also in the generalized LSD scheme, the receiver um is a label LABEL _i, corresponding to the subset S _{i, j} in which the nodes i and j are in a parent-child relationship among the labels defined in the SD scheme and given to the receiver um _. It is necessary to keep all _j . This is because no matter what value is taken as the node i, the transition to the child node j (i.e., i + 1) satisfies the transition condition defined above. That is, similar to the basic LSD system, there are logN labels corresponding to a special subset in which nodes i and j have a parent-child relationship among labels to be held for a certain receiver. By making it possible to calculate at least a part of these labels by applying the one-way function F to the labels corresponding to other special subsets, it is possible to reduce the number of labels to be held by the receiver.

That is, also in the generalized LSD system, the number of labels can be reduced as in the SD system described above. Specifically, even in the generalized LSD scheme, a label [ _xy = LABEL _{P (y),} which corresponds to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver _{. In} addition to _{S (y)} ], j labels (j = 0, 1,..., LogN) are given, and when the number of receivers is N, the label corresponding to the special subset given to each receiver The number is
j + 1.

の個数の受信機においてラベル数をｊ個削減することが可能となる。 By applying the method of the present invention, among N receivers,

The number of labels can be reduced by j in the number of receivers.

  This reduced amount of labels can be obtained by applying the one-way function F to the labels held by each receiver.

The number of labels that each receiver should originally hold in the generalized LSD method is
O (log ^{1 + ε} N)
(Where ε is an arbitrary positive number), which is a small setting compared to the SD method or the basic LSD method. In this sense, the number of labels can be reduced by the same number as the SD method or the basic LSD method. The effect of reduction becomes even more remarkable.

  The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiments without departing from the gist of the present invention. In other words, the present invention has been disclosed in the form of exemplification, and should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims section described at the beginning should be considered.

  The series of processes described in the specification can be executed by hardware, software, or a combined configuration of both. When executing processing by software, the program recording the processing sequence is installed in a memory in a computer incorporated in dedicated hardware and executed, or the program is executed on a general-purpose computer capable of executing various processing. It can be installed and run.

  For example, the program can be recorded in advance on a hard disk or ROM (Read Only Memory) as a recording medium. Alternatively, the program is temporarily or permanently stored on a removable recording medium such as a flexible disk, a CD-ROM (Compact Disc Read Only Memory), an MO (Magneto optical) disk, a DVD (Digital Versatile Disc), a magnetic disk, or a semiconductor memory. It can be stored (recorded). Such a removable recording medium can be provided as so-called package software.

  The program is installed on the computer from the removable recording medium as described above, or is wirelessly transferred from the download site to the computer, or is wired to the computer via a network such as a LAN (Local Area Network) or the Internet. The computer can receive the program transferred in this manner and install it on a recording medium such as a built-in hard disk.

  Note that the various processes described in the specification are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Further, in this specification, the system is a logical set configuration of a plurality of devices, and the devices of each configuration are not limited to being in the same casing.

  As described above, according to the configuration of the present invention, it is said that the configuration is relatively efficient in the information distribution configuration to which the hierarchical tree structure that is one aspect of the broadcast encryption scheme is applied. The amount of information that each receiver (information processing device) should hold safely is reduced by applying a unidirectional tree to the existing Subset Difference (SD) and Layered Subset Difference (LSD) methods. It becomes possible.

  Furthermore, according to the configuration of the present invention, among the labels (LABEL) corresponding to the respective subsets (LABEL) set based on the SD method or LSD method, the values of the labels corresponding to some selected special subsets are set to other special values. Set as a value that can be calculated by applying the one-way function F to the value of the label corresponding to the subset, and the label corresponding to the special subset not corresponding to the special subset and the label corresponding to the special subset provided to the receiver Since the label corresponding to the minimum special subset excluding the label that can be calculated by applying the one-way function F to the label is used as the provided label for the receiver, the number of labels provided to the receiver in the conventional SD method or LSD method Can be reduced. The reduced label can be calculated by applying the one-way function F to the label held on the receiver side, and processing corresponding to all subsets that can be set based on the conventional SD method or LSD method is possible. . By applying the configuration of the present invention in this way, it is possible to reduce the amount of information (label) that each receiver should hold safely.

It is a figure explaining a binary tree hierarchical tree structure. It is a figure explaining the method of transmitting the information which only the selected information processing apparatus can acquire in a binary tree hierarchical tree structure. It is a figure explaining the hierarchical tree structure where the node applied in a Complete Subtree (CS) system branches in two. It is a figure explaining the node key which the receiver corresponding to a leaf has in the Complete Subtree (CS) system. It is a figure explaining whether secret information is selectively provided only to the receiver which is not revoked in CS system. It is a figure explaining the definition of the subset in a Subset Difference (SD) system. It is a figure explaining the setting and structure of a label in Subset Difference (SD) system. It is a figure explaining the setting of the subset in a Subset Difference (SD) system. FIG. 11 is a diagram showing labels that each receiver should hold in the SD system when the total number of receivers N = 16. It is a figure explaining the detail of the label which each receiver should hold | maintain in SD system. It is a figure explaining the detail of the label which each receiver should hold | maintain in SD system. In the SD scheme, it is a diagram for explaining the details of a subset to which a specific receiver u4 belongs. It is a figure explaining the structure of a unidirectional tree. It is a flowchart explaining the algorithm which sets the 2N-1 node corresponding value corresponding to the node of a one way tree. It is a figure explaining the example of a node number setting which set the route | root as 1 and attached | subjected the identifier (number) by the breadth priority (breadth first order) sequentially about a lower layer node below. It is a figure explaining the structural example of 1st special subset SSP _{(y) and S (y)} in which a node has a parent-child relationship. FIG. 15 is a diagram illustrating a correspondence between a label corresponding to a special subset and 2N−1 C-bit values x ₁ , x ₂ ,..., X _2N−1 calculated by the algorithm described with reference to FIG. is there. It is a figure explaining the determination process of the label provided to a receiver. It is a figure explaining the path m and path node m corresponding to each receiver um. It is a figure explaining the determination process of the label provided to a receiver. FIG. 20 is a diagram illustrating a bit representation of a path m (path-m) corresponding to the 16 receivers u1 to u16 illustrated in FIG. It is a figure which shows the flow of a setup process. It is a figure which shows the subset used when receiver u5, u11, u12 is revoked in the hierarchical tree structure set to the total number of receivers N = 16. It is a figure which shows the flow explaining the process sequence of an information delivery process. It is a figure explaining the example of a derivation | leading-out process of a specific subset key. It is a figure explaining the example of a derivation | leading-out process of a specific subset key. It is a flowchart explaining the decryption processing procedure of the ciphertext in a receiver. It is a figure explaining the structure of the information processing apparatus which performs the determination process of a label, and the production | generation process of a ciphertext. It is a figure explaining the function structure of the information processing apparatus as a receiver which performs the decoding process of a ciphertext. It is a figure which shows the block diagram as a hardware structural example of information processing apparatus. It is a figure explaining a basic LSD system. It is a figure explaining the number of labels which each receiver in a basic LSD system holds. It is a figure explaining the label number reduction structure of the basic LSD system using a unidirectional tree.

Explanation of symbols

101 Information processing apparatus 201 Node 231, 232 Node 251 Leaf 301 Node 302 Parent node P (i)
303 Sibling node S (i)
310 Subset SS _{P (y), S (y)}
321, 322, 323 Path m corresponding to each receiver um
410 Information processing apparatus 411 Label generation means 412 Provided label determination means 413 Ciphertext generation means 414 Ciphertext provision means 420 Information processing apparatus 421 Ciphertext selection means 422 Label calculation means 423 Subset key generation means 424 Decryption means 425 Label memory 500 Information processing Device 501 Controller 502 Arithmetic unit 503 Input / output interface 504 Secure storage unit 505 Main storage unit 506 Display device 507 Media interface

Claims (31)

An information processing method for applying a broadcast encryption method based on a hierarchical tree configuration and generating a hierarchical tree that is applied to a ciphertext providing process that can be decrypted only to a specific selected device except for an exclusion (revoke) device,
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method to which a hierarchical tree is applied, the label values corresponding to some selected special subsets are displayed as labels corresponding to other special subsets. Generating a label set as a value that can be calculated by applying the one-way function F to the value of
Determining a provided label for a receiver corresponding to an end node of the hierarchical tree;
A special subset incompatible label that does not correspond to the special subset;
A label corresponding to the special subset, excluding the label that can be calculated by applying the one-way function F to the label provided to the receiver, and a label corresponding to the minimum special subset;
A provided label determining step for determining as a provided label for the receiver;
An information processing method characterized by comprising: The information processing method further includes:
A ciphertext generation step of generating a ciphertext by selectively applying a subset key derived from each label corresponding to the subset generated in the label generation step to generate a ciphertext and providing the ciphertext to the receiver; The information processing method according to claim 1. The special subset selected in the label generation step is
In the hierarchical tree, node i and node j are directly connected in the hierarchical tree among subsets S _{i, j} defined as a set excluding a partial tree having node j as a vertex from a partial tree having node i as a vertex. A first special subset in a parent-child relationship,
A second special subset which is a subset S1 _{, φ} defined as a set of whole trees with the root containing all leaves of the hierarchical tree as vertices;
The information processing method according to claim 1, wherein the information processing method is at least one of the following. The label generation step includes
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method in the hierarchical tree, the value of the label corresponding to the selected special subset is set to other special values set immediately below the special subset. The information processing method according to claim 1, wherein the label is a step of generating a label that can be calculated by applying the one-way function F to the subset value. The label generation step includes
Determining _N values: x _{N to} x _2N−1 in a hierarchical tree having a binary tree structure with N terminal nodes;
an initial setting step of i = 2N−1;
For i = (2N−1) −1, if i = even, apply a one-way function F to calculate F (x _i ) and set it to x _{i / 2} ;
And, in the binary tree structure with the number of end nodes N, determining the value of labels corresponding to 2N−1 special subsets: x _{1 to} x _2N−1 by the processing of each of the above steps. The information processing method according to claim 1. The provided label determination step includes:
Corresponds to the node j directly branched from the path from the leaf (leaf) to i starting from the internal node i on the path m (path-m) from the leaf (leaf) to which the receiver um is assigned to the root. subset _{S i, j} of the label lABEL _{i, j} and the subset SS _1, the label lABEL ₁ corresponding to _phi corresponding to the entire tree including all receivers to be used when no revoked _{receivers, phi} and the tentatively selected labels And the following conditions:
(A) The first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship in the temporarily selected label, and all receivers used when there is no receiver to be revoked A label LABEL _{i, j} corresponding to a subset that is not _one of the second special subset SS _{1, φ} corresponding to the whole tree;
(B) a label corresponding to one of the first special subset SS _{i, j} and the second special subset SS _{1, φ} from a provisionally selected label;
(B1) The node y is a node included in PathNodes-m, and
(B2) node 2y corresponds to the value _{x y} which corresponds to the value y is a node that is not included in PathNodes-m label LABEL _i, and _j,
The information processing method according to claim 1, wherein a label satisfying the condition (a) or (b) is determined as a final provided label for the receiver um. The provided label determination step includes:
In addition to the label [x _y = LABEL _{P (y), S (y)} ] corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver, j labels (Where j is 0 or more logN, N is the number of terminal nodes in the hierarchical tree = the number of receivers),
2. The information processing method according to claim 1, wherein the number of provided labels corresponds to a special subset for the receiver. The one-way function F is
The information processing method according to claim 1, wherein the information processing method is MD4, MD5, or SHA-1. The label determination step includes
In a label (LABEL) corresponding to each subset set according to a basic LSD (Basic Layered Subset Difference) method having a subset management configuration for each layer separated by one special level set in the hierarchical tree, a part of the selected label 9. The step of setting a value of a label corresponding to a special subset as a value that can be calculated by applying the one-way function F to a label (LABEL) value corresponding to a different special subset. Information processing method according to crab. The label determination step includes
A part selected in a label (LABEL) corresponding to each subset set according to a general LSD (General Layered Subset Difference) method having a subset management configuration for each layer separated by a plurality of special levels set in a hierarchical tree 9. A step of setting a label value corresponding to a special subset of the two as a value that can be calculated by applying the one-way function F to a label (LABEL) value corresponding to a different special subset. Information processing method according to crab. A decryption processing method for performing decryption processing of ciphertext encrypted by a subset key corresponding to each subset set based on a SD (Subset Difference) scheme that is a broadcast encryption scheme based on a hierarchical tree configuration,
A ciphertext selection step of selecting a ciphertext generated by applying a subset key derivable by a pseudo-random number generation process based on a label held by the ciphertext or a label that can be calculated from the label held by the ciphertext; ,
Label calculation for applying a one-way function F to a retained label and calculating a label different from the retained label when the applied subset key of the ciphertext is not a subset key that can be derived by a pseudo-random number generation process based on the retained label Steps,
Generating a subset key by a pseudo-random number generation process based on a retained label or a calculated label;
A decryption step of performing decryption processing of the ciphertext by applying the generated subset key;
A decoding processing method characterized by comprising: The label calculating step includes:
The applied subset key of the ciphertext is
In the subset S _{i, j} defined as a set excluding a subtree having a node j as a vertex below a node i from a subtree having the node i as a vertex in the hierarchical tree, the node i and the node j are directly connected in the hierarchical tree. A first special subset in a parent-child relationship, or a second special subset that is a subset S1 _{, φ} defined as a set of whole trees with vertices at the root including all leaves of the hierarchical tree,
Is a subset key that can be calculated by a pseudo-random number generation process based on a label corresponding to one of the special subsets, and when the label corresponding to the special subset is not retained, the one-way function for the other label retained 12. The decoding processing method according to claim 11, wherein the decoding is a step of calculating a label corresponding to the special subset by applying F. The label calculating step includes:
In the hierarchical tree, a step of applying a one-way function to calculate a label corresponding to a special subset including a node on a path from a setting node of a receiver that performs decoding processing to a route. The decoding processing method according to claim 12, wherein: The one-way function F is
It is MD4 or MD5 or SHA-1, The decoding processing method of Claim 11 characterized by the above-mentioned. An information processing apparatus that applies a broadcast encryption method based on a hierarchical tree configuration and generates a hierarchical tree that is applied to a ciphertext providing process that can be decrypted only by a specific selected device other than an exclusion (revocation) device,
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method to which a hierarchical tree is applied, the label values corresponding to some selected special subsets are displayed as labels corresponding to other special subsets. Label generating means for generating a label set as a value that can be calculated by applying the one-way function F to the value of
Provided label determining means for determining a provided label for a receiver corresponding to a terminal node of the hierarchical tree;
A special subset incompatible label that does not correspond to the special subset;
Providing a label corresponding to the special subset, the minimum special subset-corresponding label excluding the label that can be calculated by applying the one-way function F to the provided label to the receiver, as the provided label for the receiver Label determining means;
An information processing apparatus comprising: The information processing apparatus further includes:
A ciphertext generating unit that selectively applies a subset key derived from each label corresponding to the subset generated by the label generating unit and executes an encryption process to generate a ciphertext;
Ciphertext providing means for providing the ciphertext to the receiver;
The information processing apparatus according to claim 15, further comprising: The special subset selected by the label generating means is
In the hierarchical tree, node i and node j are directly connected in the hierarchical tree among subsets S _{i, j} defined as a set excluding a partial tree having node j as a vertex from a partial tree having node i as a vertex. A first special subset in a parent-child relationship,
A second special subset which is a subset S1 _{, φ} defined as a set of whole trees with the root containing all leaves of the hierarchical tree as vertices;
The information processing apparatus according to claim 15, wherein the information processing apparatus is at least one of the following. The label generating means includes
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method in the hierarchical tree, the value of the label corresponding to the selected special subset is set to other special values set immediately below the special subset. 16. The information processing apparatus according to claim 15, wherein a label that can be calculated by applying the one-way function F to the value of the subset is generated. The label generating means includes
N values: x _{N to} x _2N−1 are determined in a hierarchical tree having a binary tree structure with the number of end nodes N, and initial setting is performed with i = 2N−1, and i = (2N−1) 1 to i, when i = even, apply a one-way function F, calculate F (x _i ), and set this to x _{i / 2.} The information processing apparatus according to claim 15, wherein in the N binary tree configuration, the label values corresponding to 2N−1 special subsets: x _{1 to} x _2N−1 are determined. The provided label determining means includes
Corresponds to the node j directly branched from the path from the leaf (leaf) to i starting from the internal node i on the path m (path-m) from the leaf (leaf) to which the receiver um is assigned to the root. subset _{S i, j} of the label lABEL _{i, j} and the subset SS _1, the label lABEL ₁ corresponding to _phi corresponding to the entire tree including all receivers to be used when no revoked _{receivers, phi} and the tentatively selected labels And the following conditions:
(A) The first special subset SS _{i, j} in which the node i and the node j are in a parent-child relationship in the temporarily selected label, and all receivers used when there is no receiver to be revoked A label LABEL _{i, j} corresponding to a subset that is not _one of the second special subset SS _{1, φ} corresponding to the whole tree;
(B) a label corresponding to one of the first special subset SS _{i, j} and the second special subset SS _{1, φ} from a provisionally selected label;
(B1) The node y is a node included in PathNodes-m, and
(B2) node 2y corresponds to the value _{x y} which corresponds to the value y is a node that is not included in PathNodes-m label LABEL _i, and _j,
The information processing apparatus according to claim 15, wherein a label that satisfies the condition (a) or (b) is determined as a final provided label for the receiver um. The provided label determining means includes
In addition to the label [x _y = LABEL _{P (y), S (y)} ] corresponding to the corresponding value (X _y ) of the node number (y) of the self node (leaf) set by the receiver, j labels (Where j is 0 or more logN, N is the number of terminal nodes in the hierarchical tree = the number of receivers),
The information processing apparatus according to claim 15, wherein the number of provided labels corresponds to a special subset for the receiver. The one-way function F is
The information processing apparatus according to claim 15, wherein the information processing apparatus is MD4, MD5, or SHA-1. The label determining means includes
In a label (LABEL) corresponding to each subset set according to a basic LSD (Basic Layered Subset Difference) method having a subset management configuration for each layer separated by one special level set in the hierarchical tree, a part of the selected label 23. The configuration according to claim 15, wherein the label value corresponding to the special subset is set as a value that can be calculated by applying the one-way function F to a label (LABEL) value corresponding to a different special subset. An information processing apparatus according to claim 1. The label determining means includes
A part selected in a label (LABEL) corresponding to each subset set according to a general LSD (General Layered Subset Difference) method having a subset management configuration for each layer separated by a plurality of special levels set in a hierarchical tree 23. The configuration according to claim 15, wherein a label value corresponding to a special subset is set as a value that can be calculated by applying the one-way function F to a label (LABEL) value corresponding to a different special subset. An information processing apparatus according to claim 1. An information processing apparatus that executes decryption processing of ciphertext encrypted by a subset key corresponding to each subset set based on a SD (Subset Difference) scheme that is a broadcast encryption scheme based on a hierarchical tree configuration,
A ciphertext selection means for selecting a ciphertext generated by applying a subset key derivable by a pseudorandom number generation process based on a label held by the ciphertext or a label that can be calculated from the label held by the ciphertext; ,
Label calculation for applying a one-way function F to a retained label and calculating a label different from the retained label when the applied subset key of the ciphertext is not a subset key that can be derived by a pseudo-random number generation process based on the retained label Means,
Subset key generation means for generating a subset key by a pseudo-random number generation process based on a retained label or a calculated label;
Decryption means for performing decryption processing of the ciphertext by applying the generated subset key;
An information processing apparatus comprising: The label calculating means includes
The applied subset key of the ciphertext is
In the subset S _{i, j} defined as a set excluding a subtree having a node j as a vertex below a node i from a subtree having the node i as a vertex in the hierarchical tree, the node i and the node j are directly connected in the hierarchical tree. A first special subset in a parent-child relationship, or a second special subset that is a subset S1 _{, φ} defined as a set of whole trees with vertices at the root including all leaves of the hierarchical tree,
Is a subset key that can be calculated by a pseudo-random number generation process based on a label corresponding to one of the special subsets, and when the label corresponding to the special subset is not retained, the one-way function for the other label retained 26. The information processing apparatus according to claim 25, wherein a label corresponding to the special subset is calculated by applying F. The label calculating means includes
In the hierarchical tree, the configuration is such that a one-way function is applied to calculate a label corresponding to a special subset including a node on a path from a setting node of a receiver that performs decoding processing to a route. 27. The information processing apparatus according to claim 26, characterized in that: The one-way function F is
The information processing apparatus according to claim 25, wherein the information processing apparatus is MD4, MD5, or SHA-1. A computer program that generates a hierarchical tree that is applied to a ciphertext providing process that can be decrypted only by a specific selected device other than an exclusion (revoke) device by applying a broadcast encryption method based on a hierarchical tree configuration,
Among the labels (LABEL) corresponding to each subset set based on the SD (Subset Difference) method to which a hierarchical tree is applied, the label values corresponding to some selected special subsets are displayed as labels corresponding to other special subsets. Generating a label set as a value that can be calculated by applying the one-way function F to the value of
Determining a provided label for a receiver corresponding to an end node of the hierarchical tree;
A special subset incompatible label that does not correspond to the special subset;
A label corresponding to the special subset, excluding a label that can be calculated by applying a one-way function F to the label provided to the receiver;
A provided label determining step for determining as a provided label for the receiver;
A computer program characterized by comprising: The computer program further includes:
A ciphertext generation step of generating a ciphertext by selectively applying a subset key derived from each label corresponding to the subset generated in the label generation step to generate a ciphertext and providing the ciphertext to the receiver; 30. A computer program according to claim 29. A computer program for executing decryption processing of ciphertext encrypted by a subset key corresponding to each subset set based on a SD (Subset Difference) scheme that is a broadcast encryption scheme based on a hierarchical tree configuration,
A ciphertext selection step of selecting a ciphertext generated by applying a subset key derivable by a pseudo-random number generation process based on a label held by the ciphertext or a label that can be calculated from the label held by the ciphertext; ,
Label calculation for applying a one-way function F to a retained label and calculating a label different from the retained label when the applied subset key of the ciphertext is not a subset key that can be derived by a pseudo-random number generation process based on the retained label Steps,
Generating a subset key by a pseudo-random number generation process based on a retained label or a calculated label;
A decryption step of performing decryption processing of the ciphertext by applying the generated subset key;
A computer program characterized by comprising:

Images